Neiman: Why Canada must extend privacy laws to political parties
Federal parties have pushed back against regulation for decades. They argue that their needs for personal information are distinct. That's partly true, but better privacy protection can co-exist with a healthy democracy.
The 2019 federal election is just over 100 days away. In the lead-up to election day, there will be no shortage of issues vying for voters’ attention. One issue that will directly affect each of Canada’s 27 million voters is politicians’ failure to safeguard the electorate’s personal privacy.
To many Canadians’ surprise, political parties collect vast troves of personal information on voters. Much of the information collected is obtained from “voting lists” compiled by Elections Canada. Parties combine this data, which provides basic facts about each voter, with personal information acquired through their own efforts to create highly refined voter profiles. These profiles help parties understand voters and more precisely target their political messages in order to “nudge” the electorate.
Political parties’ handling of voters’ sensitive personal information has historically been unregulated. While the Canada Elections Act limits what parties can do with voter lists, the protections found under Canada’s privacy laws dealing with the public and private sector – the Privacy Act and Personal Information Protection and Electronic Documents Act (PIPEDA) – have no application to political parties.
Party officials argue that the imposition of privacy rules may undermine the vitality of democratic institutions by restricting candidates’ ability to interact with electors.
Political parties have pushed back against privacy regulation for decades. They argue that their needs for personal information are distinct. Since parties play a unique role in formulating policy, defining democratic choice, and educating and mobilizing the electorate, party officials argue that the imposition of privacy rules may undermine the vitality of democratic institutions by restricting candidates’ ability to interact with electors.
These arguments have some merit. With political engagement steadily declining in this country, political parties more than ever need voters’ personal information in order to engage Canadians and rally the electorate on election day.
However, the relative absence of regulation has led to a number of abuses over the years. While most incidents have been minor, several have been serious. Particularly troubling was the “robocalls scandal” during the 2011 federal election. Voters’ personal information was all too easily exploited by a rogue political staffer in order to launch a misleading robocalls campaign, which directed unsympathetic voters to the wrong polling stations in order to suppress the vote.
Parties’ misuse of voters’ personal information has costs. Cases such as the robocalls scandal shake voters’ confidence in democratic institutions and may have an enduring impact on democratic participation in Canada.
In response to the growing misuse of personal information at home and abroad, Canada has begun to take voters’ privacy more seriously. Canada recently enacted the Elections Modernization Act, which seeks to protect voters’ personal information by requiring that political parties have a privacy policy meeting mandatory minimum requirements and that it be published online. Parties that fail to comply with the Act may lose their “registered party” status and the benefits this status affords.
This initiative should be applauded. The legislation creates an effective mechanism to inform voters about how political parties collect, use and disclose electors’ personal information.
However, the Act leaves much to be desired. Transparency is only one component of a proper privacy regime, not the entire regime itself. The Act’s principal flaw is that it does not establish an objective standard against which the adequacy of each party’s privacy policy can be measured.
Also important is proper enforcement. While the Act provides the Chief Electoral Officer with a mechanism to discipline parties, deregistration is a draconian remedy, meaning that it will likely be applied rarely. Similarly troubling is the fact that the Act does not provide for independent oversight. Without a mechanism allowing for the independent investigation of voter complaints, it is impossible to know if parties will apply their policies in an objective and consistent manner.
The Act’s shortcomings require Parliament’s attention. What is needed is a privacy regime that balances political parties’ needs with voters’ rights to privacy. Fortunately, the privacy principles found in PIPEDA already strike this balance.
What is needed is a privacy regime that balances political parties’ needs with voters’ rights to privacy.
Lawmakers should amend the Act…
Leading with a security-first mentality
As technology rapidly develops, the number of security and privacy concerns will only continue …
