What's in your file? Federal political parties don't have to tell you

Federal political parties are collecting and compiling reams of personal information about Canadians, but unlike businesses and governments, there is no oversight, no requirement they seek consent and no limits on what they can do with it.

Federal parties are exempt from privacy laws in Canada, something privacy advocates, as well as federal, provincial and territorial privacy commissioners, have unsuccessfully urged the government to change.

"I can go to my bank, I can go to my telco, I can go to all sorts of businesses and say, 'Please give me a copy of all the information you have about me,'" said Halifax privacy lawyer David Fraser. "I can do that with government, as well, but I can't do that with a political party, and so they remain operating in the shadows."

Fraser said over the past decade there's been a rise in the use of social media outreach by political parties in order to connect with voters, interactions that generate a lot of data about those people.

Phone calls from political parties are also valuable, he said, and "whatever you say on those calls is noted and goes into your personal file related to your voting preferences and things like that."

Sharon Polsky, president of the non-profit and non-partisan Privacy and Access Council of Canada, calls it "an insidious problem."

She noted the politicians who put restrictions and limits on corporations to safeguard personal information are the same ones "who exempt themselves from any responsibility and grant themselves full authority to collect whatever information they wish about whomever they wish and do whatever they wish with it."

Polsky said even when canvassers come to your door they're collecting information, such as whether you have a dog or a cat, wear a religious symbol, how you dress, the vehicle you have, the area of town in which you live.

"That information, combined with information from so-called publicly available sites such as your Facebook page or social media comments, is then used by political parties to make decisions about your preferences, but you don't know what is being decided about you," Polsky said.

Under last year's Elections Modernization Act, all political parties were required, as of July 1, to post privacy statements on their website and provide them to Elections Canada.

As of July 25, the Alliance of the North has not, according to Elections Canada spokesperson Natasha Gauthier. The Bloc Québécois and the Stop Climate Change Party have submitted incomplete ones.

Even when those policies are posted, there are no rules requiring the parties to comply with international privacy standards, leaving Canada as the "exception" to most regions of the world, according to the country's privacy commissioner, Daniel Therrien.

In June 2018, Therrien appealed to a parliamentary committee that was studying Bill-76, the Elections Modernization Act.

He asked that the bill include standards such as consent to the collection of personal information, limiting the information to what is required, limiting disclosure to others, providing individuals access to their personal information and independent privacy oversight of the parties.

He noted European political parties have been subject to privacy laws for over 20 years, and said "the integrity of our democratic processes is clearly facing significant risks."

In September 2018, Therrien and all provincial and territorial privacy commissioners passed a resolution calling for those changes, saying "Canadians have overwhelmingly stated they wish to see political parties made subject to privacy laws."

Again, in April of this year, the federal privacy commissioner urged federal parties to protect voters' personal information.

'Further study'

Meg Jaques, the press secretary for Democratic Institutions Minister Karina Gould, said in an email the government takes the protection of Canadians' personal information very seriously.

Jaques said the Elections Modernization Act is the first time the federal government has included political parties in any kind of privacy regime.

"There is further study and discussion to be had regarding privacy standards for political parties, as it is important that the parties continue to be able to engage with Canadians while protecting the integrity of our democratic institutions," Jaques said.

A check of the privacy policies of registered federal parties shows similarities, but also some major differences.

Some say they will never sell or give away the personal information they have collected. Others don't. Some allow voters to access the personal information that has been collected about them. Others don't.

Some say they "collect other information from publicly available data," places like Facebook, Twitter and other social media sites. Some say even signing a petition or commenting on their policies will result in your personal data being collected.

Some talk about their proper disposal of documents and other items that contain personal information. Others don't reference that at all.

No baseline

Fraser said the government did make some changes, but he calls it a "complete half measure" because parties remain unaccountable for the information they collect, use and disclose.

"So you can have a privacy policy that says, 'Yes, we're going to violate your privacy left, right and centre,' but there's no baseline of reasonableness that says, 'This is OK and this is not,"' he said.

He maintains it's essential that guidelines be in place, especially given how targeted advertising and information about the preferences and fears of individuals were used in the last U.S. presidential election and in the Brexit vote in the U.K.

"We should have protection to make sure that political parties aren't able to profile individuals and target them with advertising or use other means to contact them or to influence their vote."

Both Fraser and Polsky both wonder whether most Canadians understand the scope of the issue.

'Like a science fiction movie'

Polsky points to the $5-billion Facebook fine after allegations the company inappropriately shared information belonging to 87 million users with the now-defunct British political consulting firm Cambridge Analytica.

She said the increasing use of artificial intelligence means federal party computers are holding a wealth of information about voters.

"We don't know who is running these computers, where in the world they're located and who has access to the information in them," she said. "It's like a science fiction movie of the far distant future that we're now living in."

She said it is urgent that Canadians start "speaking up very loudly and clearly" to their elected officials in an effort to ensure the federal government changes legislation to protect personal information collected by federal parties.