David Young is a privacy and regulatory lawyer based in Toronto.
By asking questions about an e-mail, two British Columbians may have broken new ground on how Canadian political parties can gather information on us.
After two residents of the riding of Courtenay-Alberni flagged their concerns about how their local NDP riding association had obtained their personal e-mail addresses, the B.C. Information and Privacy Commissioner made a major decision last month that the province’s private-sector privacy law applies to riding associations of federal political parties. Commissioner Michael McEvoy’s reasoning is based in part on a determination that Ottawa’s rules requiring parties to provide some protections for voters’ personal information are so limited that there is no conflict with B.C. applying its own comprehensive privacy rules.
The ruling will have implications beyond the province’s borders. It means that internationally-accepted privacy rights, as found in the federal Personal Information Protection and Electronic Documents Act (PIPEDA), which currently does not expressly apply to political parties, may be available to voters across the country.
PIPEDA and its parallel B.C. law, the Personal Information Protection Act (PIPA), provide a sophisticated privacy code and enforcement mechanism. This code includes the right of individuals to be informed of all their information held by an organization – including its third party marketing providers – and how that information was collected. As well, organizations must disclose through appropriate communications a fulsome description of their practices relating to the use and sharing of the information. An individual’s consent to collection of their information is required unless the law provides otherwise.
By contrast, the recent amendments to the Canada Elections Act contained in the Elections Modernization Act impose only limited privacy obligations on parties. The CEA simply obliges parties to have a policy disclosing, in general, the types of information collected, how it is collected and the uses of that information. The parties must provide a description of their practices relating to online information collection. There is no enforcement mechanism for failure to comply.
The parties’ published policies do not even comply with these minimal requirements and clearly do not comply with the more extensive code dictated by PIPEDA or PIPA. For example, they make no mention of personal information collected through social media monitoring or online voter tracking, profiling, and targeting. Furthermore, there is no mention of any right by individuals to access their information.
The B.C. Commissioner determined that the provincial law was constitutional and applies to the riding association notwithstanding the NDP’s arguments to the contrary. The Commissioner’s ruling was preliminary, but that office will now turn to the riding association and see if it complies substantively with PIPA’s comprehensive privacy code. By implication, this scrutiny will take into account the party generally, and so the ruling has potential application to the federal party in all its aspects, including its centralized databases and its own privacy practices.
Under PIPA, they must publish detailed privacy policies, provide access rights, and seek consent to track and target voters online and through social media, among other departures from their current practices.
Assuming that this ruling causes federal parties to take steps to bring their practices into line with the PIPA requirements, can we expect them to apply only to their activities in B.C.? They now will be subject to such rules, technically only with respect to B.C. residents. But will each party have separate privacy policies for B.C. and the rest of Canada? While this may be the result in the short term, we can assume that the parties must now align their across-Canada practices to comply with the B.C. law – which is to say, to comply with PIPEDA. That’s what should have happened in place of the Elections Modernization Act’s tepid privacy rules, anyway.
How can the B.C. ruling impact the parties’ privacy practices in this federal election? While it is unrealistic to expect all of their practices to be revised within this time frame, a commitment to certain key precepts is possible. This should include a forthright statement of voters’ privacy rights – in particular, that the parties will provide full disclosure of their online tracking and targeting practices, obtain consent for collection and use of personal information obtained through such practices and enable a voter’s access to all their personal information in a party’s database.
Recognizing that their data collection practices now will be subject to rigorous scrutiny may give the parties pause in how they exploit voter information in the current election campaign.
Keep your Opinions sharp and informed. Get the Opinion newsletter. Sign up today.