Privacy commish flags ‘flaw’ in new elections bill

OTTAWA — Proposed legislation that will require federal political parties to have and make public privacy policies covering the collection and use of electoral information is a “small” step in the right direction, but a lack of enforcement is a major concern in the bill, privacy commissioner Daniel Therrien told The Wire Report Tuesday. There is nothing in the Elections Modernization Act, Bill C-76, unveiled Monday afternoon, that suggests there will be active enforcement should political parties not abide by the new rules — only that there will be a looming risk of de-registration if they don’t make their privacy policies clear. “Based on our readings so far, there’s no one who has the authority to oversee whether the promises made in the privacy policies are actually being complied with or respected,” Therrien told The Wire Report following an appearance at a House committee Tuesday morning. “So from that perspective, yes, it appears to be a flaw in the bill that there is no independent authority — authority independent of political parties — who can review whether the promises made in the policies are respected.” Those policies would include information about how various types of personal information were collected, protected, used and sold, as well as the parties’ use of online information, including how it uses browser cookies. The policies would need to be clearly stated on the party website. The parties will also need to name a contact who will be able to handle those policy concerns. The only oversight rests in the role of the Chief Electoral Officer, who will be able to certify or reject certification of political parties based on whether or not they submit their policies and fulfill the content requirements of the policy. Therrien called this “minimalist oversight.” The parties must provide the electoral officer their policies within three months that the legislation comes into force. “It’s not very different from the status quo because currently, most federal parties are not required to have privacy policies, but they do,” Therrien said. He noted during an ethics committee appearance studying Facebook data use last month that those voluntary political privacy policies could still be improved. While the bill touches on privacy issues, it will not be guided by the Privacy Act or the The Personal Information Protection and Electronic Documents Act (PIPEDA), which governs personal information collected and used by the private sector, a government official said on background during a technical briefing Monday. In addressing the issue of enforcement, acting Minister of Democratic Institutions Scott Brison told media Monday that PIPEDA still covers companies that may be involved in the electoral process. Otherwise, he said making the policies transparent and part of the registration process is a “significant step forward” and that “no political party would want to be found” in violation of it. During his ethics committee appearance, Therrien said he wished to see Canada’s privacy laws cover political parties and an independent third-party authority be delegated the power to oversee and ensure that those privacy rules were respected. When asked how far in the right direction he would describe progress in the proposed bill on addressing concerns related to Facebook's data controversy, he said “it’s an extremely small step.” He also said Tuesday that he isn’t too concerned about what legislation the rules fall under, just that at a minimum, there should be an assurance that there are substantive privacy safeguards in the Elections Act with authority by a third party to ensure those policies are respected. The latter element is missing, he reiterated. The proposed legislation also doesn’t give citizens the right to access information the party has on them, which Therrien told the ethics committee was a “huge flaw.” On Monday, the government’s policy advisors hinted at the bill’s reliance on the threat of action, rather than action itself, to drive it. “There is no recourse if there’s any offence — that’s correct,” a government official said on background, according to simultaneous translation, during a technical briefing. “The party must produce its policy on privacy and publish it.” “It’s the provision of transparency that’s being provided here,” the official added. The bill did not go uncriticized. Tamir Israel, a lawyer for the Samuelson-Glushko Canadian Internet Policy and Public Interest Clinic (CIPPIC), said on Twitter Inc.’s platform that the parties can “basically do whatever they want as long as they have a privacy policy somewhere.” Israel added in an email that the bill is a positive step, “but hardly a meaningful one.” He said it builds only one of three core pillars of data protection, which is transparency, and even then it does so poorly. He listed several reasons for this inadequacy, including that the legislation relies on an outdated definition of personal information, which doesn’t apply to real-time data, and it doesn’t give individuals access or the ability to correct misleading information about themselves, as PIPEDA and the Privacy Act have. “If a political party were to hire a consultation firm such as Cambridge Analytica and provide them with Canadian citizen personal information as part of that consultation agreement, they would not be obligated to detail it under this law because the information isn't being 'sold' to the consultation firm, it's being shared to facilitate the consultation,” Israel said. On that note, Israel said the bill doesn’t address the Facebook case at all. Parties wouldn’t know how Cambridge Analytica got its data nor would they be obligated to ask, the bill won’t stop this kind of data collection or direct data harvesting by political parties from social media websites, and parties don’t need to list the specific companies they are collecting info from, he said. Israel said there are other missing pieces to basic data protection, including a lack of an obligation to get consent from individuals before their information is collected, used or disclosed, no obligation to minimize the amount of data that is collected or kept and for how long it's retained and, most importantly, there’s no capacity for a third party, such as Therrien’s office or Elections Canada, to provide input into the practices. “The parties have full autonomy,” he said. Likewise, advocacy group OpenMedia said in a blog post Monday that the proposed legislation will allow political parties to do “whatever they like with people’s private information so long as they’ve disclosed it somewhere in the fine print.” “In the wake of the recent Cambridge Analytica revelations, privacy and security are top of mind for Canadians,” OpenMedia’s Laura Tribe wrote in the post. Tribe’s suggestions include giving Therrien’s office the power to enforce compliance and issue fines, powers that Therrien has called for in the past. Brison told media Monday that he will be asking the House of Commons Committee on Procedure and House Affairs to “conduct a longer-term study about political parties’ privacy responsibilities.” The bill also features other matters related to foreign influence and online disruption. That includes a prohibition of the “unauthorized use of computers” to “obstruct, interrupt, or interfere with the lawful use of computer data during an election period.” Brison said Canada will work with other governments on a multilateral, ongoing basis against cyber threats and foreign interference. The legislation will also eliminate the up-to $500 that foreign third-parties can spend on Canada’s elections and prohibits social media companies like Facebook from knowingly running election advertising paid for with foreign money. When asked how the latter would be enforced, a government official said the “prospect of an investigation should reduce the likelihood of the situation.” — With reporting by Ahmad Hathout at ahathout@thewirereport.ca and editing by Anja Karadeglija at akarad@thewirereport.ca

Privacy commish flags ‘flaw’ in new elections bill

News | May 1, 2018

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Privacy commish flags ‘flaw’ in new elections bill

News | May 1, 2018

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Watchdogs find deceptive privacy practices across majority of websites, apps studied

Meta considers blocking Facebook news in Australia

Rizwan Jamal leaves Xplore to become CEO of Beanfield

Internet service quality bill becomes law

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us