Fresh off burying lawful access provisions that grant access to internet subscriber information without a warrant in the border bill, the government has now quietly inserted provisions that exempt political parties from the application of privacy protections in Bill C-4, an “affordability measures” bill.
The provisions, which come toward the end of the bill, are deemed to be in force as of May 31, 2000, retroactively exempting the parties from any privacy violations that may date back decades. The provisions mean the parties will be exempted from the privacy standards faced by private sector organizations across the country, with no real consequences for privacy violations and no effective oversight over the use of Canadians’ personal information.
The ostensible reason for the provisions is a British Columbia case that applied provincial privacy law to federal political parties. The government is now seeking to render that case moot and provide all political parties with an effective exemption from any privacy laws other than measures found in the Elections Act. An appeal of the B.C. case is scheduled to be heard later this month.
This is not the first time the government has tried to exempt political parties from standard privacy laws. Bill C-65, which failed in the last Parliament, contained similar provisions. However, the provisions were in a bill in the Elections Act, not buried among tax measures. Moreover, the previous approach was stronger. It included measures to address data breaches and the requirement to notify affected individuals, as well as certain restrictions, including the sale of personal information. This iteration removes the data breach notification requirements, drops the sale restrictions, and renders the entire exemption retroactive to the year 2000.
The Bill C-4 removal of privacy rules starts by stating that political parties may carry out any activities in relation to personal information. There are literally no limits, including the collection, use, disclosure, retention and disposal of personal information in accordance with the party’s policy for the protection of personal information.”
Having granted full rights to collect, use and disclose personal information—and knowing that federal private sector privacy law, the Personal Information Protection and Electronic Documents Act, does not generally apply to these activities—Bill C-4 then exempts the parties from any provincial privacy laws. The bill states that parties, candidates, electoral district associations, officers, agents, employees, volunteers and representatives cannot be required to comply with any provincial regulation in relation to personal information.
In case there was any doubt, the bill for greater certainty states that parties cannot be required to disclose or correct personal information under their control. In other words, Canadians cannot even force the parties to provide access to their information or to correct errors in the data.
So, what privacy safeguards are there with respect to political parties and personal information? The bill merely requires the parties to have and abide by a privacy policy. That policy must be in both official languages, written in plain language, and only include the following:
(a) designate a privacy officer who is responsible for overseeing the party’s compliance with the policy;
(b) include the name and contact information of the privacy officer;
(c) state the types of personal information in relation to which the party carries out its activities;
(d) explain, using illustrative examples, how the party carries out its activities in relation to personal information, such as by indicating whether it does so online or through the use of cookies; and
(e) describe the training related to the protection of personal information that is offered to the party’s employees and volunteers who may have access to the personal information that is under its control.
This is the barest of obligations, something that would be viewed as wholly inadequate if applied to the private sector. It is simply disclosing what the parties intend to do with personal information, with no actual requirement, limitations, or obligations on the collection, use, and disclosure of information. Privacy commissioners do not have the power to address violations that might arise, and—to top it off—the government wants to backdate these rules by 25 years.
The combination of Bill C-2 and C-4 represents a stunning assault on the privacy of Canadians. Bill C-4 significantly undermines the privacy of Canadians with respect to political parties, which have become addicted to acquiring as much data as possible. These provisions should be removed from the bill, and the B.C. case permitted to proceed. The privacy rights of millions of Canadians are at stake.
