The case for making political parties follow the same privacy rules as corporations
Parties collect your data through their apps, but it's not always clear what happens to it after that
Though it's a topic the major parties don't seem too interested in discussing, the use of mobile apps as a key part of campaigning raises some important questions: What data is being collected? How is it being analyzed? And where is it being shared?
Given how voter data has been misused and manipulated in recent elections around the world, some experts wonder why there isn't more scrutiny of how Canada's political parties use the information they collect.
Whether a party's app is a tool for canvassers to catalogue information about voters, or a social network to engage and inform supporters, the collection and exchange of information is the core function.
So far, the conversation around technology and the internet during this election campaign has been dominated by promises about price and access.
By now, most of the parties have also touched on issues such as regulation, privacy, data sovereignty, and the effort to keep tech giants such as Google and Facebook in check.
However, while some of the parties are pushing for greater transparency among tech firms, there is a "real concern about [political parties] not practising what they preach," said Prof. Colin Bennett of the University of Victoria, who studies privacy and politics.
Parties exempt from law
Many Canadians might be surprised to learn, for example, that political parties are not subject to the same privacy rules as other organizations, such as governments and corporations, both of which must adhere to the Personal Information Protection and Electronic Documents Act (PIPEDA).
"Corporations and government need to obtain an individual's consent before collecting or using their data, but campaigning parties are not prevented from using people's personal information, which can be collected without opt-in, to pitch their politics," said Ann Cavoukian, the former privacy commissioner of Ontario and founder of the Privacy by Design framework, which encourages organizations to create technologies that are private by default and let users opt-in to data-sharing features.
This means, for example, a party could text you without you ever having provided the party with your phone number. Or that the aggregate of your personal information could be used to create a detailed profile so the party could target you with customized campaign messaging.
Bennett points out that political parties use similar strategies as many private companies, including applying data analytics, purchasing ad space on websites such as Facebook and hiring telemarketing firms.
"The techniques of consumer marketing entered the political world a long time ago, so there's no clear reason why they should be exempt from the rules others have to follow."
The Conservatives' app, called the CPC App, is basically a social networking service for the party's supporters that provides updates and news about the campaign.
Conservative Leader Andrew Scheer introduced a policy platform titled "Cyber Security Measures to Protect Your Personal Data," detailing measures his party would take to safeguard Canadians' data, including requiring that companies collecting electronic data receive informed consent from Canadians.
CBC reached out to the Conservative Party to ask about this clause, and about what, if any, access the app's U.S.-based developer has to user data, as well as the Conservative position on whether political parties should be subject to privacy laws.
The Liberals' app, called MiniVAN, allows canvassers to input data into their smartphone as they're going door to door meeting voters.
While the policy includes a list of what kinds of information the app collects (name, contact information and donation information) and how the party might use the data (to communicate with you), Cavoukian points out the list isn't required to be exhaustive.
"They can essentially do whatever they want."
Group challenges status quo
In light of this, the Centre for Digital Rights, an advocacy group founded by Jim Balsillie, former co-CEO of BlackBerry-maker Research in Motion, filed a complaint to the Competition Bureau of Canada and a handful of other watchdog organizations, arguing that some parties deliberately mislead Canadians with inaccurate privacy policies.
The complaint alleges parties compile data from sources such as social media posts and door-to-door campaigning to amass detailed databases that ultimately assess the political leanings of individuals.
The centre's core argument is that political parties should no longer be exempt from PIPEDA.
Cavoukian says parties should have to obtain consent before collecting voter data, and specify why they're collecting the information and precisely how they will use it.
The irony is, while some candidates are advocating for greater transparency from big tech, they may be benefiting from the very same tools on the campaign trail, and in so doing, missing out on an opportunity to differentiate themselves.
With files from Andrea Bellemare