Lawyer’s Daily, July 3 2019 – Privacy compliance for political parties – focus on digital media
(July 3, 2019, 9:02 AM EDT) The efforts of our federal government to protect democracy in the upcoming election have a manifest incongruity.
On one hand, pro-active initiatives have been announced: recent amendments to the Canada Elections Act, contained in the Elections Modernization Act (Bill C-76), rigorous efforts by national security agencies to identify threats from foreign actors, increasing citizen awareness to guard against malicious actions, and most recently, the Canada Declaration on Electoral Integrity Online.
However, these efforts continue to avoid a critical enforcement lever – a legal obligation by political parties to protect and not misuse the personal information of voters. Commentary discussing the extension of our privacy laws to political parties is replete and almost unanimously supportive of such a step.
Despite an all-party recommendation by the House of Commons Standing Committee on Access to Information, Privacy and Ethics to adopt formal privacy protection legislation in time for this fall’s election, Parliament failed to do so.
The Bill C-76 amendments have been criticized as an inadequate response to the anticipated challenges to electoral integrity in today’s digital universe. However, it is instructive to consider how these new rules will apply and may be expected to be complied with by the parties, in particular with respect to digital media.
The new rules require that, by June 30, 2019, each party must have published privacy policy containing the following specific information:
- the types of personal information collected and the means used to collect that information;
- the party’s uses of personal information;
- the party’s security safeguards for personal information;
- training given to employees who have access to personal information;
- the party’s practices for online information collection, including through cookies; and
- contact information for a person who can answer questions regarding the privacy policy.
These required disclosures go beyond what any of the parties previously had in their privacy policies.
How they may be expected to comply with this new requirement can be gleaned from a guidance document published this April by the federal Office of the Privacy Commissioner (OPC ) in conjunction with the Chief Electoral Officer (CEO), Guidance for federal political parties on protecting personal information, setting out examples of the information that should be included in the parties’ policies.
Of particular interest will be how the parties respond to the requirement to disclose their practices for collecting personal information online. In the typical private sector privacy policy, this heading addresses collection of information through the use of cookies on the organization’s own web site and, to a certain extent, collection by data tracking through behavioral advertising techniques. Typically, private sector policies do not address collection through social media monitoring, mobile apps and other similar data tracking sources. However, the OPC/CEO’s guidance makes clear that disclosure of such collection practices is expected, together with cookie collection. Furthermore, the legislation should be interpreted broadly to apply not only to a party’s own data collection methodologies but also to include disclosure of its practices regarding the collection of information from any online source.
Targeting potential voters through any digital medium involves “tracking” personal information about such voters. A targeted message communicated through social media requires not only information about the identity of an individual, but also ancillary information such as socio-economic status, likes and dislikes, and prior political inclinations.
This past February, BC’s Information and Privacy Commissioner also issued a report, Full Disclosure: Political parties, campaign data, and voter consent, on the subject of privacy for political parties. This report contains a modern, digitally-informed understanding of how personal information can be – and is – used by parties outside of the traditional confines of “Elections Act” supervision, particularly in the social media space.
The BC Commissioner’s report should be required reading for the privacy officers of political parties as well as the media, social activists and voters interested in holding parties to account for privacy compliance in the upcoming federal election.
Read the full article: David Young, – Lawyers Daily, July 3, 2019 – Privacy compliance for political parties – focus on digital media
David Young Law
Suite 3500, 2 Bloor Street East, Hudson’s Bay Centre,
Toronto ON M4W 1A8
Tel. 416-968-6286
Mob. 416-318-5521
Email: David@DavidYoungLaw.ca