Gap in privacy law leaves elections open to 'misuse' of personal information: privacy commissioner

The next federal election will face "important risks" unless Parliament makes political parties subject to privacy law, Privacy Commissioner Daniel Therrien warned Thursday.

"Canadian political parties' lack of oversight is unfortunately becoming an exception compared to other countries, and it leaves Canadian elections open to the misuse of personal information and manipulation," Therrien told members of a parliamentary committee studying the Facebook-Cambridge Analytica scandal.

"The bottom line is that without proper data regulation, there are important risks to a fair electoral process and this applies to the next federal election in Canada."

Therrien said the time for allowing businesses and political parties to self-regulate is over.

"The government can delay no longer."

Therrien said he recently returned from a privacy conference in Europe, where Apple CEO Tim Cook warned that the personal information of individuals was being "weaponized" against them.

"Individual privacy is not a right we simply trade off for innovation, efficiency or commercial gain," he said. "No one has freely consented to having their personal information weaponized against them.

"Similarly, we cannot allow Canadian democracy to be disrupted, nor can we permit our institutions to be undermined in a race to digitize everything and everyone, simply because technology makes this possible."​

Therrien's testimony came as the Access to Information, Privacy and Ethics Committee continued its probe into a massive breach of personal information involving Cambridge Analytica and Facebook.

In the wake of the Cambridge Analytica scandal — which saw the personal data of millions of Facebook users used to help microtarget potential voters in the U.S. and the U.K — the ethics committee has been digging into what Canadian political parties have been doing with the personal information they gather.

Therrien said his office has been working with the office of British Columbia's information and privacy commissioner to investigate allegations made about Facebook and Aggregate IQ, a B.C.-based company.

Aggregate IQ has been accused of creating a data mining platform for Cambridge Analytica used by a campaign to promote British independence from the European Union, and for the presidential campaigns of Ted Cruz and then Donald Trump. AIQ has denied working for Cambridge Analytica.

Therrien said he is planning to release the first phase of their findings by the end of this year, with a follow-up report scheduled for the spring.

With less than a year to go before the next election, political parties still are not subject to any rules governing the personal information they gather on Canadians. Over the years, the Liberals, Conservatives and New Democrats have amassed databases crammed with details about Canadian voters — everything from names and addresses to political opinions.

The Privacy Act governs information held by government bodies. The Personal Information Protection and Electronic Documents Act (PIPEDA) applies to companies. Political parties have been exempt from both laws.

On Tuesday, the New Democratic Party became the only one of Canada's three largest parties to support making political parties subject to a privacy law like PIPEDA — something the Green Party had already endorsed.

The Conservative Party said it would comply with whatever laws are adopted by Parliament, while the Liberal Party argued that subjecting political parties to privacy laws would hamper their ability to attract volunteers and engage Canadians.

Therrien questioned the Liberal Party's assertion, pointing out that political parties in B.C and the European Union are subject to privacy laws and nobody has complained that it stops them from campaigning.

"It is absolutely imperative for privacy laws to be applied to Canadian political parties."

Elizabeth Thompson can be reached at elizabeth.thompson@cbc.ca