B.C. privacy commissioner finds political parties aren’t doing enough to explain info they collect

British Columbia’s privacy commissioner has found political parties are collecting too much information from potential voters, without getting proper consent.

Commissioner Michael McEvoy has found that parties are not doing enough to explain to individuals how much personal information they collect and why they are doing it.

“My investigators examine what personal information B.C.’s three main political parties collect from the province’s 3.3 million registered voters, and what they do with it,” McEvoy writes in the report. “Some may be surprised by how much information they collect and how they use it.”

The report looks into the BC NDP, the BC Green Party and the BC Liberals and how they manage the personal information of British Columbians. The major parties were they only ones the report looked at because they requested the entire voters lists from Elections BC in the most-recent provincial election.

“Some of this collection of information arises from observations made and recorded about a person by a canvasser going door to door, while other examples included ‘scraping’ personal information from social media platforms and disclosing donor lists, birth dates and other data to Facebook,” McEvoy said. “To be absolutely clear, political parties may be allowed to collect and use this kind of information. However, in most circumstances, the political party would need to get that individual’s consent.”

WATCH NOW: Watchdogs release plan for accountability in wake of legislature spending scandal

1:58 Watchdogs release plan for accountability in wake of legislature spending scandal

The province’s Personal Information Protection Act (PIPA) permits organizations, including political parties, to collect, use, or disclose information about an individual if the individual has given consent.

The report also found deficiencies in the way the major parties keep the data as well as audit practices that prevent full compliance with the act.

“In addition to over collection, we also found all of the political parties had inadequate privacy training and indefinite retention of the information,” McEvoy said.

“This, combined with the vast amount of sensitive personal information collected, leaves political parties, and by default voters, vulnerable. Political parties must ensure the same effort goes into protecting personal information as is put into collecting it.”

The report puts forward 17 recommendations. They include parties being required to provide a simple explanation of the purposes for gathering personal information at the point of collection and ensuring parties collect only personal information from social media with the consent of the individual.

The recent controversies around Cambridge Analytica’s manipulation of Facebook data to psychologically profile U.S. voters is one example of the way political parties can use data.

McEvoy is also suggesting in the report that B.C. parties be transparent about how they profile voters and only disclose email addresses to social media providers with express consent of the individual.

The BC Liberal Party says it was an active participant during the privacy commissioner’s investigation and is still working through the report.

“We will review the Commissioner’s findings and recommendations in detail, and determine the appropriate steps to further improve how we protect privacy and personal information, beginning with updates to our Privacy Policy,” reads a statement from the party.

The BC Green Party also contributed to the report. The party says it has already implemented some changes, and is putting together a road map for additional changes that need to take place.

“Over the last year, we have been making improvements to the security, privacy and integrity of the personal information entrusted to the BC Green Party by voters and supporters,” Green Party Director of Communications Stefan Jonsson said.

“We are grateful for the Privacy Commissioner’s report and how it identifies additional ways to improve the protection and privacy of personal information.”