U.K. data watchdog blasts Canadian political parties' data handling

Canada's political parties have a privacy problem — and with less than a year to go until the next federal election, it's more critical than ever that Canadians start asking hard questions about how they're handling personal data, says the United Kingdom's information commissioner.

"The way political parties acquire information on individuals should be transparent," said Elizabeth Denham in an interview this week with CBC Radio's The House. "Whatever's going to happen in the future, these micro-targeting techniques are only going to get stronger."

Denham knows what she's talking about. The U.K. data watchdog — a Canadian who spent six years as British Columbia's privacy commissioner — just wrapped up an 18-month investigation into political advertising following the political consulting firm Cambridge Analytica's alleged improper use of data harvested from tens of millions of Facebook users.

Denham told host Chris Hall that after her team of 40 investigators combed through 700 terabytes of seized data — the equivalent of 52 billion pages — they came to some sobering conclusions.

"We examined the practices of political parties and campaigns and we were astounded by the amount of personal information they had available, and also the lack of transparency and disregard for voters' privacy," she said.

Why Canadians should care about data protection

Now, Denham is calling on the international community to start policing the data policies of political parties, campaigns and social media companies like Facebook.

"It's a global issue and it needs a global solution. The laws have to allow for extraterritorial reach and we can't do it alone," she said.

In Canada, Denham said, she'd like to see stricter privacy laws on the protection of citizens' data, similar to laws already in place in the European Union.

"In the EU, we had a once-in-a-generation reboot in improvement of our data protection laws," she said. "To look behind the curtain to examine algorithms, to issue sanctions and fines when companies get it wrong. These are tools that are not available to the Canadian privacy commissioner."

Canadian political parties still aren't subject to any rules governing the personal information they gather on citizens — everything from names and addresses to political opinions.

The Privacy Act governs information held by government bodies. The Personal Information Protection and Electronic Documents Act (PIPEDA) applies to private companies. Political parties are exempt from both laws.

"In the U.K., people just take for granted that the privacy law covers all of the players in the ecosystem and that the regulator has real tools to act," said Denham.

'The parties are marking their own homework'

Although Canada's political parties say they have internal policies on data protection, Denham said that's not good enough.

"You need independent oversight of the policies that are struck by political parties, even if all the parties agree to a certain standard of practice for data and privacy," she said.

"If you don't have independent oversight, how can the public trust what's going on? Because then the parties are marking their own homework."

In the U.K., Denham has advocated for a statutory and enforceable code of conduct for political campaigning. She'd like to see something similar in Canada.

"I think that's the way to get it right, if all the players know what the rules are and they're singing from the same song sheet."

Until that happens, Canadians should keep asking questions of their political parties and social media companies, she said.

"Then people can challenge what's being fed into their newsfeed. The societal risk is that we all start to live in filter bubbles and echo chambers, and we don't know what the public debate is about. That's a harm to society, not just to individuals."