10 privacy violations in the federal government’s proposed changes to the Canada Elections Act

Bill C-65, currently before Parliament, would make changes to the Canada Elections Act. According to the Liberal government, it aims “to engage more people and increase the confidence” of Canadians in elections.

But by weakening the privacy laws that apply to political parties, it could undermine both engagement and confidence in elections.

Since C-65’s introduction, debate has focused on a provision that would move the fixed election date from Oct. 20 to Oct. 27, 2025. The stated purpose of this move is to avoid conflicts with other elections, and Diwali. It would also enable 80 MPs to reach the six years of service needed to qualify for House of Commons pensions, although the government has denied this is a factor in the proposed changes.

Opposition MPs claim that C-65 is really a “pension bill.” But even more so, C-65 is a privacy-busting bill.

Raising awareness

When my team of researchers at McMaster University, Brock University and the University of Ottawa surveyed Canadians, we found that few respondents were aware that parties may be collecting information about whether they have voted, their email addresses, political views, ethnicity, income, online activities, occupation, social media identities or religion.

Few may be aware that a canvasser’s knock on the door is also — and in some cases primarily — an opportunity for data collection.

The Cambridge Analytica scandal revealed how personal and social media information can be used for political purposes.

Many Canadians may now be correctly concerned about hackers stealing their information from a party’s database. Worse, Cambridge Analytica opened eyes to the potential to statistically infer highly sensitive personal information such as income bracket, gender or personality type from more innocuous data.

Canadian-born whistle-blower Christopher Wylie raised concerns about how data can be used to target political ads in divisive or manipulative ways. Generative AI raises this potential even higher.

That’s why privacy laws are important not only to protect Canadians’ personal information, but also to provide transparency about how democracy works.

C-65 purports to provide a “complete [personal information] regime” for political parties, but it is far from complete.

It also fails to subject political parties to the 10 privacy principles understood as core to privacy regimes. In fact, it seems designed to undermine existing British Columbia privacy law.

The B.C. Supreme Court recently ruled that the province’s Personal Information Protection Act applies to federal political parties. The federal Liberals, Conservatives, NDP and Green Party seek to appeal the ruling, and Bill C-65 could undermine the decision.

Disregarded privacy principles

My team’s research suggests that failing to incorporate these 10 basic privacy principles could threaten the government’s objectives to increase the confidence of voters and engage more people.

In its current form, C-65 undermines existing privacy rights for Canadians. It fails to meet the following fundamental privacy principles:

Principle 1: Organizations must make someone accountable for compliance with fundamental privacy principles. With no enforcement and no fundamental principles, C-65’s requirement to designate a privacy officer will provide little accountability.

Principle 2: The purposes of collection should be identified. Instead, C-65 requires parties to give “illustrative examples” but not the complete set of purposes of collection.

Principle 3: Knowledge and consent should be given. Instead, C-65 gives near blanket permission to collect and use any type of personal information.

Most Canadians surveyed by my team felt that sensitive information such as ethnicity, religion and social media information should “never” be collected and retained, or only with an individual’s “explicit consent.”

C-65 would allow data brokers and tech companies working with a party to collect and use potentially any type of personal information.

Principle 4: Data collection should be limited. Instead, C-65 places no limits on the types of personal information parties and “entities” can collect. My team’s work suggests placing the most sensitive types out of bounds.

Principle 5: Limiting use of personal information. While C-65 incorporates two new limits, it does not prevent:

• Giving personal information to third parties (such as social media companies or others);

• Using personal information to profile Canadians;

• Making statistical inferences about personality types, interests, opinions, religion, sexual orientation — or anything else; or

• Uses involving AI.

Principle 6 and 7: Ensuring accuracy and safeguarding personal information. Instead, C-65 allows tech companies or any other entity working with political parties potentially unbridled access and use with little protection or oversight. In light of the large number of companies that, as anti-surveillance organization OpenMedia recently revealed, are used by political parties to leverage Canadians’ data in campaigns, this is especially worrying.

Principle 8: Requires making detailed information available about policies and practices regarding personal information. While publication of a privacy policy is required under C-65, it does not require fully detailed information.

Principle 9: Gives individuals a right to access their own personal information held by parties; C-65 does not do this.

Principle 10: Provides the right to make a complaint or challenge a party’s compliance with these principles. C-65 provides no complaint or outside oversight system.

Distrust about political data collection

Our study found that awareness of political parties’ data collection may reduce Canadians’ willingness to interact with parties online, potentially undermining engagement.

We also found that increasing awareness of data collection may fuel concern about that collection, potentially undermining confidence.

Very few respondents saw data collection as important to the democratic process. If collection is in fact crucial to democracy, our respondents were not convinced.

C-65 would, however, help political parties exploit Canadians’ data without real limits, transparency or consent. This poses threats to privacy, engagement and confidence in political parties.

All federal parties currently benefit from the ability to gather and use Canadians’ personal information without applying full privacy law to themselves. Rather than critiquing its weak privacy provisions, critics are foolishly focusing on the bill’s implications for parliamentary pensions.