Current Rules Protecting Electors' Personal Information – Discussion Paper 3: The Protection of Electors' Personal Information in the Federal Electoral Context
The Canada Elections Act (CEA) touches on the issue of electors' personal information by establishing rules related to the lists of electors, the statements of electors who voted and a requirement that parties state how they handle personal information. Otherwise, the personal information that federal political entities collect, use and disclose is left unregulated.
At the federal level, personal information is mainly protected by two other laws: the Privacy Act (PA), which applies to the federal public sector, and the Personal Information Protection and Electronic Documents Act (PIPEDA), which applies to organizations that engage in commercial activities.Footnote 9 Neither applies to federal political parties. However, in British Columbia, political parties are subject to the Personal Information Protection Act (PIPA) because that law applies to "organizations" in broad terms. Recently, the BC Privacy Commissioner ruled that federal electoral district associations operating in British Columbia would be subject to PIPA.Footnote 10
The Lists of Electors
The lists of electors are based on data from the National Register of Electors, which is updated regularly from multiple sources, including information held by federal, provincial and territorial governments and by provincial electoral management bodies, and information provided by electors themselves.Footnote 11 The personal information that Elections Canada (EC) collects to develop the lists is regulated by the CEA and the PA.Footnote 12
The CEA provides for the distribution of the lists of electors to political parties, candidates and/or members of Parliament during the electoral period and annually. These contain the elector's name, address and unique identifier.Footnote 13
Authorized uses of the lists of electors include electoral purposes, communicating with electors, soliciting contributions and recruiting party members. It is prohibited to use personal information contained in the lists of electors for other purposes than those authorized by the CEA; offenders are liable to pay a fine up to $10,000 or spend up to one year in prison, or both.
A number of provincial and territorial (PT) election laws require or permit security measures to assist in ensuring that lists of electors distributed at the provincial and territory level are protected: for example, authorizing PT Chief Electoral Officers (CEOs) to include fictitious information in the list to trace unauthorized use;Footnote 14 instructions for the destruction, return or disposal of the list;Footnote 15 and direction to immediately inform the PT CEO of the loss of the list or information contained in it.Footnote 16 Some jurisdictions also require recipients to take "reasonable steps" to protect lists from loss or unauthorized use;Footnote 17 in Quebec, recipients must undertake in writing to take appropriate measures to protect the list and restrict its use.Footnote 18
Similar security measures are not enshrined in the CEA at the federal level. Nonetheless, best practices, including administrative, technical and physical measures, for safeguarding the lists of electors are included in EC guidelines. The guidelines provide templates so that recipients of the lists may declare their commitment to protect the information received, use it only for specified purposes and return it once it is no longer needed.Footnote 19 The guidelines also encourage list recipients to report any breaches so that EC may better understand where and when they occur and provide reassurances that they are being contained as much as possible and that potential privacy risks posed are being addressed.
Statements of Electors Who Voted
Political parties and candidates are also entitled to receive statements of electors who voted (sometimes referred to as "bingo sheets"). These documents contain numbers that, when matched with the lists of electors, allow parties to identify whether an elector assigned to a particular polling division has voted. With this information, parties and candidates can encourage registered electors who have not yet voted to do so.
For a number of years, the Act has provided that candidates' representatives who request them can get these statements after each day at the close of advance polling stations, as well as at intervals of no less than 30 minutes on polling day. The CEA was further changed to require the CEO to provide, to each candidate and each registered party that endorsed a candidate in an electoral district, the statements of the electors who voted on polling day in that electoral district; and more recently to require that the statements be provided in electronic form 180 days after the return of the writs.Footnote 20 In the lead-up to the next general election, the statements will assist parties in communicating with those electors who did or did not vote in the last election.
Unlike the lists of electors, there are no limits on the parties' uses on the statements of the electors who voted.
Privacy Policy Requirements
Under the CEA, political parties are required to adopt a policy with respect to the treatment of any personal information they collect, use or disclose. They must publish their policy online and provide it to the CEO in order to obtain and maintain their registration.Footnote 21
The CEA also requires parties to list specific information that must appear in their policies,Footnote 22 including
- the type of information collected and how it is protected and used
- under what circumstances information may be sold
- details about employee training on the collection and use of personal information
- how the party collects and uses personal information created from online activity, and whether it uses cookies
- the name and contact information of a person to whom privacy concerns may be communicated
In British Columbia and Ontario, parties must provide their policies to the CEO in order to receive their lists of electors. Elections BC provides a template that parties are encouraged to use in creating their policies.Footnote 23 In Ontario, the legislation provides that every party must develop a policy to ensure that its candidates, elected members and employees comply with the authorized use of the lists of electors, and that the policy must follow guidelines set out by Elections Ontario.Footnote 24
While the requirement to publish policies increases transparency into the personal information handling practices of political parties, some federal political parties already had substantive privacy policies on their websites before it was a requirement to do so. The new requirements have been broadly criticized as falling short of the fair information principles and for lacking any oversight mechanism to monitor whether parties actually abide by the contents of their policies.Footnote 25
In response to proposed privacy policy requirements included in Bill C-76, the Elections Modernization Act, both the CEO and the Privacy Commissioner of Canada recommended that political parties be subject to privacy regulations. In addition, in response to the privacy-related provisions in the Bill, they also recommended that the new privacy policy requirements be amended to require policies to be consistent with the fair information principles set out in Schedule 1 of PIPEDA, and that there be some form of oversight to ensure parties are complying with their policies.Footnote 26 The Standing Committee on Access to Information, Privacy and Ethics also recommended subjecting parties to privacy laws,Footnote 27 to which the government responded that it "continues to reflect on the extension of Canada's privacy protection frameworks to political parties."Footnote 28
Footnotes
Return to source of Footnote 9 Personal information is defined in the Personal Information Protection and Electronic Documents Act and the Privacy Act as "information about an identifiable individual." Personal Information Protection and Electronic Documents Act, c. 5, s. 2(1) (S.C. 2000). https://laws-lois.justice.gc.ca/eng/acts/P-8.6/; Privacy Act, c. P-21, s. 3 (R.S.C. 1985). https://laws-lois.justice.gc.ca/eng/acts/p-21/. Office of the Privacy Commissioner of Canada, Summary of Privacy Laws in Canada, January 2018. https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/02_05_d_15/. Note that there is one exception to PIPEDA's coverage to organizations engaged in commercial activities listed in Schedule 4: the World Anti-Doping Agency.
Return to source of Footnote 10 For an overview of the reasoning in the case, see Teresa Scassa, Decision Paves the Way for Federal Riding Associations in BC to Be Subject to BC's Data Protection Laws. August 30, 2019. http://www.teresascassa.ca/index.php?option=com_k2&view=item&id=313:decision-paves-the-way-for-federal-riding-associations-in-bc-to-be-subject-to-bcs-data-protection-laws&Itemid=80/
Return to source of Footnote 11 Elections Canada. "Description of the National Register of Electors." July 17, 2019. https://www.elections.ca/content.aspx?section=vot&dir=reg/des&document=index&lang=e#optout/
Return to source of Footnote 12 See an overview of privacy at Elections Canada for further details: https://www.elections.ca/content.aspx?section=abo&dir=pri&document=index&lang=e/
Return to source of Footnote 13 Canada Elections Act, c. 9, s. 44(2) (S.C. 2000). https://laws-lois.justice.gc.ca/eng/acts/E-2.01/; for an overview of provincial and territorial lists of electors, see Élections Québec. Partis politiques et protection des renseignements personnels: Exposé de la situation québécoise, perspectives comparées et recommandations. Report. 2019. 33. https://www.electionsquebec.qc.ca/english/news-detail.php?id=6299/
Return to source of Footnote 14 For example, see Nova Scotia, Elections Act, c. 50, s. 62(1) (S.N.S.). https://nslegislature.ca/sites/default/files/legc/statutes/elections.pdf; Manitoba, The Elections Act, c. E30, s. 63.9(5) (C.C.S.M. 2006). https://web2.gov.mb.ca/laws/statutes/ccsm/e030e.php#63.1/; Alberta, Election Act, c. E-1, s. 18(7) (R.S.A.). http://www.qp.alberta.ca/documents/Acts/E01.pdf; British Columbia, Election Act, c. 106, s. 51(3) (R.S.B.C. 1996). http://www.bclaws.ca/civix/document/id/complete/statreg/96106_04#division_d2e4406/
Return to source of Footnote 15 For example, see Nova Scotia, Elections Act, c. 50, s. 62(2) (S.N.S.). https://nslegislature.ca/sites/default/files/legc/statutes/elections.pdf; Northwest Territories; Elections and Plebiscite Act, c. 15, s. 75(3) (S.N.W.T. 2006). https://www.electionsnwt.ca/sites/electionsnwt/files/2018-11-20_elections_and_plebiscites_act.pdf
Return to source of Footnote 16 For example, see Manitoba, The Elections Act, c. E30, s. 63.9(2) (C.C.S.M. 2006). https://web2.gov.mb.ca/laws/statutes/ccsm/e030e.php#63.1/; Alberta, Election Act, c. E-1, s. 19.1(2) (R.S.A.). http://www.qp.alberta.ca/documents/Acts/E01.pdf
Return to source of Footnote 17 For example, see Manitoba, The Elections Act, c. E30, s. 63.9(1) (C.C.S.M. 2006). https://web2.gov.mb.ca/laws/statutes/ccsm/e030e.php#63.1/; Alberta, Election Act, c. E-1, s. 19.1(1) (R.S.A.). http://www.qp.alberta.ca/documents/Acts/E01.pdf; Yukon, Elections Act, c. 63, s. 49.13(1) (R.S.Y. 2002). http://www.gov.yk.ca/legislation/acts/elections_c.pdf
Return to source of Footnote 18 Election Act, c. E-3.3, s. 40.38.3 (C.Q.L.R.). http://legisquebec.gouv.qc.ca/en/showdoc/cs/E-3.3?langCont=en#ga:l_ii_1-h1/
Return to source of Footnote 19 Elections Canada. "Guidelines for Use of the Lists of Electors." August 1, 2019. https://www.elections.ca/content.aspx?section=pol&document=page4&dir=ann/loe_2019&lang=e/
Return to source of Footnote 20 See Canada Elections Act, s. 541.1 and s. 162 (i.1).
Return to source of Footnote 21 Party registration includes such benefits as the ability to issue tax receipts for contributions, have the party name appear on an election ballot, reimbursement of election expenses, allocation of broadcasting time, ability to provide the returning officer with the names of suitable persons to act as election officers, and receipt of the annual lists of electors for electoral districts where they ran confirmed candidates in the previous election.
Elections Canada. "Registration of Federal Political Parties." (No date). https://www.elections.ca/content.aspx?section=pol&dir=pol/bck&document=index&lang=e/
Return to source of Footnote 22 Canada Elections Act, c. 9, s. 385(2) (S.C. 2000). https://laws-lois.justice.gc.ca/eng/acts/E-2.01/
Return to source of Footnote 23 BC's legislation defines a privacy policy as a policy that sets out "reasonable security arrangements" in respect of personal information. The template includes the scope of the policy (to whom and to what it applies); restrictions on use of personal information; responsibilities of the recipients of the personal information; security (including precautions taken to ensure the security and confidentiality of personal information); disposition of personal information; tracking of distribution; loss, theft or unauthorized access; and compliance audits.
Election Act, c. 106, s. 275(4.3) (R.S.B.C. 1996). http://www.bclaws.ca/civix/document/id/complete/statreg/96106_04#division_d2e4406/; Elections BC. "Privacy Policy Template for Political Parties." 2015. https://elections.bc.ca/docs/privacy/00157.pdf; Elections BC. "Privacy Policy Acceptance Criteria." 2016. https://elections.bc.ca/docs/privacy/00158.pdf
Return to source of Footnote 24 Guidelines provide for minimum criteria to be included in parties' privacy policies. These include the scope and application of the policy; restrictions on use of the lists of electors, including the relevant provisions of the Ontario Election Act and measures implemented to track the distribution of lists and administer written acknowledgement forms (which must be signed by each person authorized to receive the list and state that the person understands how the list is to be used and protected); privacy requirements (including the measures implemented to ensure compliance with the privacy requirements); and roles and responsibilities of the Chief Privacy Officer and all political entity representatives.
Election Act, c. E.6, s. 17.6 (R.S.O. 1990). https://www.ontario.ca/laws/statute/90e06/; Elections Ontario. "Guidelines for the Use of Electoral Products." 2019. https://www.elections.on.ca/content/dam/NGW/sitecontent/2017/resources/policies/Guidelines%20For%20the%20Use%20of%20Electoral%20Products.pdf
Return to source of Footnote 25 See, for example, comments made by the Privacy Commissioner of Canada, stating before the House of Commons Standing Committee on Procedure and House Affairs that the new requirements in C-76 "fall short" of globally accepted fair information principles and that Bill C-76 "adds nothing of substance." June 5, 2018. https://www.priv.gc.ca/en/opc-actions-and-decisions/advice-to-parliament/2018/parl_20180605/
Return to source of Footnote 26 Elections Canada, Proposed Amendments to Bill C-76 Presented by the Acting Chief Electoral Officer to the Standing Committee on Procedure and House Affairs. May 28, 2018. https://www.elections.ca/content.aspx?section=med&dir=spe&document=c76&lang=e/; Office of the Privacy Commissioner of Canada, Appearance before the Standing Committee on Procedure and House Affairs on the study about Bill C-76, Elections Modernization Act. June 5, 2018. https://www.priv.gc.ca/en/opc-actions-and-decisions/advice-to-parliament/2018/parl_20180605/
Return to source of Footnote 27 Standing Committee on Access to Information, Privacy and Ethics. "Democracy under Threat: Risks and Solutions in the Era of Disinformation and Data Monopoly. December 2018. https://www.ourcommons.ca/DocumentViewer/en/42-1/ETHI/report-17/
Return to source of Footnote 28 Gould, Hon. Karina, and Hon. Navdeep Bains. "Government Response." (No date). https://www.ourcommons.ca/DocumentViewer/en/42-1/ETHI/report-17/response-8512-421-502/