The Liberals are open to adding sharper teeth to new rules proposed last week that privacy advocates describe as “a joke” because of their lack of enforcement powers.
A proposal in new legislation to overhaul Canadian election rules will force political parties to publish their privacy policies around how they use information collected about Canadian voters — or face deregistration.
However, the requirement as it stands now does nothing to allow any independent oversight of whether the parties actually follow the rules they set for themselves.
READ MORE: Political parties should not police themselves on voter data: privacy commissioner
“It’s a joke. They can do whatever they want,” said Ann Cavoukian, the longest-serving Ontario privacy commissioner and now a distinguished expert-in-residence leading the Privacy by Design Centre of Excellence at Ryerson University.
“If you don’t have some way of overseeing these activities that they’re doing, how do you know if they’re in fact following the policy properly, if they’re doing the right things?”
When asked why the legislation did not allow for any independent oversight of the privacy policies, a spokesperson for Acting Democratic Institutions Minister Scott Brison did not explain but said the government was open to considering amendments to the bill.
“The Procedure and House Affairs Committee has already studied this issue and while they did not make any recommendations, we feel this is an important issue for them to revisit,” wrote Nicky Cayer, press secretary to the acting minister, in an email.
“We are open to amendments creating an enforcement regime should PROC decide to study this issue and make recommendations.”
WATCH BELOW: What are political parties doing with our data?
On April 30, Brison introduced Bill C-76, also known as the Elections Modernization Act.
A behemoth at nearly 300 pages, the legislation proposes what the government describes as a “generational overhaul” of the rules governing Canadian elections.
Provisions in the bill include measures to tighten up rules on campaign spending, limiting the length of elections to no more than 50 days, making it easier for people with disabilities to vote, and making it illegal for organizations to accept foreign advertising aimed at “unduly influencing” elections in Canada.
It also includes a section requiring parties to publish policies detailing how they collect, use, protect and sell any personal information they have on voters.
Any party that does not publish a policy can be de-registered.
But nowhere in the bill is there a way for any third party to make sure the parties follow their own policies, and experts say that is a major red flag.
“This is clearly not good enough. It is not what Canadians need or deserve,” wrote Teresa Scassa, a professor who holds the Canada Research Chair in Information Law at the University of Ottawa’s Faculty of Law, in an assessment published this week.
In the assessment, Scassa — who is also a member of the federal Advisory Panel on Open Government and formerly a member of the External Advisory Committee of the federal privacy commissioner — offered strong words criticizing the privacy policy requirement for falling short.
She also described the proposal as “an almost contemptuous and entirely cosmetic quick fix designed to deflect attention from the very serious privacy issues raised by the use of personal information by political parties.”
WATCH BELOW: Canada’s privacy laws must cover political parties, former privacy commissioner says
At the heart of the issue is what responsibilities political parties should have when it comes to protecting the vast amounts of personal information they collect, store and analyze — and potentially, sell — on Canadians.
All parties receive a list of registered voters from Elections Canada, none of the information from which can legally be sold.
READ MORE: What political parties know about you
What can technically be sold, however, is the other information parties collect to flesh out their voter databases: for example, data submitted when an individual makes a donation, preferences or concerns collected during door-knocking activities, and information submitted when someone signs up for a party newsletter.
The Liberals, Conservatives and NDP already have privacy policies published on their websites.
Of those, only the NDP’s policy does not explicitly mention a promise not to sell personal information, though spokesperson Guillaume Francoeur said the party is in the process of updating its privacy policy and does not sell the information it collects on voters.
WATCH BELOW: Facebook’s Mark Zuckerberg testifies to U.S. lawmakers in wake of privacy scandal
In Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) sets out rules for the collection and use of personal information by private sector organizations.
But those regulations do not apply to political parties, which experts say essentially operate in a Wild West-style landscape when it comes to what they can do with personal information.
Privacy Commissioner Daniel Therrien and others have repeatedly urged the federal government to modernize PIPEDA and make its rules apply to political parties.
“No one independent from the parties examines whether they are actually living up to the promises they made,” Therrien told the House of Commons privacy committee last month.
However, successive governments have repeatedly rejected those calls.
Why?
“I’m assuming it’s that political parties want to continue engaging in the manner they have in the past, which is they can do whatever they want,” said Cavoukian.
Current proposal ‘almost like a waste of time’: Cavoukian
Reports earlier this year revealed the now-defunct Cambridge Analytica used data harvested from 87 million Facebook users to support the campaign of U.S. President Donald Trump and the “Leave” camp in the Brexit vote.
WATCH BELOW: Canada’s privacy commissioner investigating Facebook data breach
Since then, Facebook CEO Mark Zuckerberg was forced to testify before Congress on whether his company is doing enough to protect the personal privacy of its users.
Senior heads from the company have also appeared before a Canadian parliamentary committee studying the scandal and witnesses have stressed the need for stronger protections around personal information, particularly in elections.
While experts say the renewed attention to privacy concerns is encouraging, they also stress that without oversight, the current proposal to require privacy policies is essentially useless.
“Not only are these proposed amendments insufficient to meet the privacy needs of Canadians, they are shockingly cynical in their attempt to derail the calls for serious action on this issue,” Scassa wrote.
Cavoukian expressed similar concerns.
“It’s almost like a waste of time if there’s no ability to ensure accountability and transparency.”