Privacy Commissioner provides feedback on proposed Canada Elections Act changes

Privacy Commissioner Philippe Dufresne has provided his feedback on proposed changes to the Canada Elections Act that were laid out in Bill C-65 (Electoral Participation Act).

In a submission addressed to Standing Committee on Procedure and House Affairs Chair Ben Carr, Dufresne explained that the bill could be improved to better secure electors’ personal information.

“Political parties collect and use considerable amounts of sensitive personal information in the course of their activities,” he wrote. “In this context, the regulation of political parties should ensure that voter participation can be maximized while at the same time protecting Canadians’ fundamental right to privacy.”

Dufresne presented the following three recommendations in his submission:

• The bill should require political parties to seek consent (subject to express authority in the legislation), limit collection, use and disclosure and provide a mechanism for access and correction in connection with their handling of personal information
• The privacy breach notification provisions detailed under subsections 444.4 (1) to (3) of the bill should be expanded to include reporting to a relevant, independent body such as the Privacy Commissioner of Canada, Elections Canada and/or the Commissioner of Canada Elections
• The bill should open up opportunities for formal collaboration between the Privacy Commissioner’s office, Elections Canada and the Commissioner of Canada Elections

Inclusion of consent requirements

Dufresne noted that the pitched rules for federal political parties in the current Bill C-65 draft did not include the following statutory requirements:

• To seek individual consent
• To restrict personal information collection
• To minimize the use and disclosure of personal information to those purposes for which the information was collected
• To provide a way for individuals to obtain access to their information
• To permit individuals to exercise a right of correction

He pointed out that that these provisions were “basic elements found in both public sector and private sector data protection laws.” He highlighted the federal Privacy Act or the Personal Information Protection and Electronic Documents Act as laws founded on key provisions and principles.

Expansion of privacy breach notification provisions

Dufresne was in favour of the proposed requirement for political parties to notify individuals of breaches in specific circumstances (under subsections 444.4 (1) to (3)). However, he explained that including a requirement to report to an independent regulator as well would better reassure Canadians that incidents involving personal information would be properly handled.

Better oversight and redress

Dufresne presented precedents that allowed for interagency collaboration; for instance, when provisions were introduced into the Privacy Act that permitted the Privacy Commissioner to work together with the National Security and Intelligence Review Agency in 2019. He also pointed to proposed changes in the Digital Charter Implementation Act (C-27) that would allow for the Privacy Commissioner’s office to collaborate with the Canadian Radio-television and Telecommunications Commission and Competition Bureau under the s. 118 in the new Consumer Privacy Protection Act).

The House of Commons Standing Committee on Procedure and House Affairs is reviewing Bill C-65 at present. Dufresne presented his submission on Monday.