Privacy laws should apply to political parties

A click on an online ad. A tweet about the issue of the day. A response to an online quiz. A signature on an online petition. Even signing up for an account with the app du jour—all are among the many ways personal information gets voluntarily shared online today; information that’s available for collection and use by corporations and political parties alike. Since news of the Cambridge Analytica-Facebook data breach, which impacted 87-million users worldwide—including 622,000 Canadians—first made headlines, concerns over privacy and the protection and potential misuse of personal information have been top-of-mind for legislators from around the world. This data breach has shed a light on the insidious ways personal information can be collected, shared, and used to micro-target individuals and to attempt to influence behaviour—whether consumer-based or electoral. The internet and platforms like Facebook and Twitter have been monetized as part of a “surveillance capitalism,” University of British Columbia assistant professor Taylor Owen recently told a House Committee. Facebook, for example, makes big bucks running targeted ads using personal information available from its users, raking in a reported $40-billion in ad revenue last year. But corporations like these aren’t the only ones leveraging the wealth of personal data open for the taking online—political parties around the world do it too. Federally in Canada, privacy commissioners have for years called for political parties to be covered by federal privacy laws—like the Privacy Act or the Personal Information and Protection of Electronic Documents Act (PIPEDA); and the chief electoral officer has also joined that call. Aside from rules regarding parties’ use of the list of electors shared by Elections Canada set out under the Canada Elections Act, there are currently are no laws or independent oversight for how parties collect, store, protect, and use the personal information of Canadians. Party databases and micro-targeting efforts have become something of a secret-sauce in modern elections—and are filled with information from a wide swathe of sources, far beyond what’s provided by Elections Canada. Parties have argued the democratic need for information on voters' interests, priorities, and backgrounds to enable more effective outreach, engagement, and representation. Moreover, opponents to the idea of making political parties subject to privacy laws argue it’s not in any party’s self-interest to protect the personal information it collects, as information can be as valuable as actual fundraising in elections today, and a data breach would be politically damning. But just because good intentions can be assumed doesn’t eliminate the potential for negative consequences, from misuse, to data breaches, to inappropriate data collection. Terms of engagement need to be set when it comes to how political parties can gather and leverage the personal information of Canadians. It’s the way the world is headed. The European Union’s General Data Protection Regulation (GDPR), for example, which came into force in May, are considered world-leading and, among others, regulate political party activities. In British Columbia, parties have been subject to a provincial privacy law since 2004—and it doesn’t seem to have done much of anything to hamper political activities there. Extending existing laws to govern how parties interact with personal data, or creating new ones, doesn’t mean putting a stop to these practices. But it does mean having a real conversation about how Canadians actually want their information to be collected, stored, and used by political parties. A single change in the government’s electoral reform bill, C-76, to require parties to post privacy policies online has been called superficial and insufficient by experts. Democratic Institutions Minister Karina Gould has said she will not introduce legislation to have parties be covered by federal privacy laws in this Parliament. With only nine months left, at maximum, before this Parliament dissolves for the next federal election, it’s unlikely there’s time for this government to institute such legislative change even if it wanted to. But it’s a gaping hole in law that can’t continue to be overlooked. The government should act swiftly to do what it can now. Ideas include increasing transparency around political advertising and drafting a code of conduct for political parties when it comes to personal information.