Watchdog expects ‘outdated’ Canadian privacy laws to be key election issue

Canada’s privacy commissioner says the Trudeau government’s changes to how elections are run won’t lessen current risks to democratic processes or voter privacy — likely election issues in 2019.

A parliamentary committee sided this week with the commissioner’s recommendation that political parties should be brought under federal privacy laws. That was far too late, however, to make it into the government’s elections reform bill, C-76, the Elections Modernization Act, which received royal assent on Thursday.

Even so, Democratic Institutions Minister Karina Gould told National Observer she was open to further study by parliamentarians to assess how to bring political parties under a privacy regime.

And a spokesperson for Privacy Commissioner Daniel Therrien said fixes are still possible before the next election: “where there is political will, change is certainly possible.”

Bill C-76 will be in force for the 2019 federal election campaign. It is aimed at blocking foreign interference and boosting transparency in political funding. The law responds to criticism of some measures in the former Harper government’s Fair Elections Act, by restoring voter information cards as a valid form of identification, for example. And the law anticipates concerns of foreign meddling in next year’s federal election, following vague reports of Russian interference in Canada’s 2015 campaign.

The bill creates a "pre-writ period" beginning June 30 of an ction year, during which spending by political parties and advocacy groups is limited. It also bans spending by foreign entities to influence elections, and makes it easier for voters to cast their ballots with such measures as extending hours of advance polls.

But the bill maintains the current state of play around privacy, which largely exempts political parties, which all hold large amounts of Canadians’ personal details, from any federal privacy legislation.

It adds a requirement that parties create and publish privacy policies. But it does not prescribe any standards for those policies, or subject them to independent oversight. Parties are also not required to fit with laws like the Personal Information Protection and Electronic Documents Act (PIPEDA), which governs how personal information is collected and used in the private sector.

Change possible 'where there is political will'

Ensuring the privacy policies of political parties conform to privacy law was a key recommendation from the privacy commissioner at the Commons committee on procedure and house affairs in June. He said at the time that each party’s policy fell “way short of globally accepted fair information principles.”

On Tuesday, the Commons committee on access to information, privacy and ethics released its final report on the misuse of social media data that it first encountered with the Facebook—Cambridge Analytica scandal, which affected 622,161 Canadians and millions more around the world.

In the wake of global concern over the harvesting of vast amounts of personal information by online platforms like Facebook and Google, the committee said political parties and outside political groups should be subjected to the Personal Information Protection and Electronic Documents Act.

To implement that, the committee recommended beefing up the privacy commissioner’s office with more resources to address “modern privacy concerns” and with new powers to conduct proactive audits, issue orders and levy fines.

The commissioner’s office, which confirmed its own investigation into Facebook and the Cambridge Analytica scandal is still active, said it was pleased the committee had agreed with its assessment.

“The Facebook/ Cambridge Analytica matter and its impact on democracy has certainly highlighted the importance of this issue,” said senior communications advisor Tobi Cohen.

“We also welcome the recommendation that either our office or Elections Canada be granted the mandate and authority to conduct proactive audits on political parties and political third parties regarding their privacy practices and to issue orders and levy fines. We stand ready to play an auditing role as soon as the necessary legislation is adopted.”

Cohen said despite C-76 becoming law, “we maintain that the integrity of our democratic processes is clearly facing significant risks.” She said the appropriate fixes were still possible before the next election: “where there is political will, change is certainly possible.”

“We will continue to press for reform of Canada’s outdated privacy laws and expect this will be an important election issue,” said Cohen.

At a time when “new and intrusive targeting techniques are already influencing democratic processes, and data analytics, automated decision-making technologies, and artificial intelligence are raising important ethical questions that have yet to be answered, Canadians need stronger privacy laws, not more permissive ones,” Therrien wrote in a Nov. 23 letter to Innovation, Science and Economic Development Minister Navdeep Bains.

Gould’s director of communications Amy Butcher said the minister thanked the committee for its work and is reviewing the recommendations. She said C-76’s inclusion of privacy policies was an “important first step.”

“In order to register for party status under Bill C-76, parties will need to have a publicly available and easy to understand policy outlining how they will use, collect, and secure Canadians’ personal information,” said Butcher.

“Failure to submit their privacy policy and to make it publicly available would result in their removal from the list of registered parties, significantly hindering their ability to participate in elections.”

She said Canadians are right to be concerned about their privacy and deserve to have their personal information protected. “The minister has indicated that further study by parliamentarians would be beneficial to assess how political parties can be brought under a privacy regime.”

'A very large and dark and bizarre world'

The ethics commitee investigation became a sprawling hunt across borders and oceans.

It brought unexpected drama to parliamentary hearings in April, when a Liberal MP pressed two co-founders of Canadian political consultancy AggregateIQ who were under investigation by the United Kingdom information commissioner into whether the firm broke privacy laws.

The MP, vice-chair Nathaniel Erskine-Smith, stunned the room by saying that the chair of a U.K. committee which had been investigating Brexit campaign spending had been watching the proceedings online and had just texted him to reject what one of the witnesses had said.

The co-founders, Zackary Massingham and Jeff Silvester, denied they were connected to Cambridge Analytica and said they were just hired to place ads. But Facebook suspended AggregateIQ from its platform as the controversy continued to swirl.

Months later, Erskine-Smith and two of his colleagues on the committee, Conservative MP and chair Bob Zimmer and NDP MP and vice-chair Charlie Angus, joined a historic “grand committee” meeting in the U.K. involving representatives from nine countries — all investigating fake news and disinformation on the social network.

As its final act before releasing its report, the committee asked right-wing group Ontario Proud to hand over more information about its telemarketing activity and the funding it gets from outside the province.

On Tuesday’s release of the committee report, Angus said the group had started the study to find out if Canadians’ data had been taken in the Cambridge Analytica scandal, “and it dropped us into a very large and dark and bizarre world.”

In addition to the privacy recommendations, the committee called for new legislation to regulate social media platforms, requiring them to label content that’s produced by bots, require rapid responses to reports of hate speech and other threats or harassment, identify and remove malicious and fraudulent accounts, and ban defamatory or fraudulent content.

The Elections Modernization Act requires online platforms to create a registry of political ads during the “pre-writ” period and the campaign, and keep the ads publicly visible for two years.

Meanwhile the committee suggested an existing or new regulatory body should be given the mandate and authority to audit algorithms.

Separately it called for legislation to force social media platforms to quickly remove hate speech, disinformation and other “manifestly illegal content” or else face a financial penalty corresponding to the platform’s “dominance and significance.”

It called on the federal government to “invest in research regarding the impacts of online disinformation and misinformation” and to “study the long-term cognitive impacts of digital products offered by social platforms which create dependence.”

And it suggested PIPEDA itself be amended to add principles of “data portability” or the right of users to download and use their own data from platforms, and to allow for more collaboration between the competition bureau and the privacy commissioner.

The right to data portability is part of the European Union’s General Data Protection Regulation, which the committee referenced as part of several recommendations. It suggested the government adopt some similar measures.