Provinces must prioritize protecting voter information

“I think all jurisdictions should take a very hard look at the security provisions that they have within their legislation. And also, I think that legislatures should take a look at the penalty provisions, to hopefully deter anyone who might consider misusing the list.”

— Former Alberta chief electoral officer Lorne Gibson

Provincial governments across the country need to do far more to protect the integrity of voter information and make political parties in particular accountable for breaching privacy laws.

Earlier this year, a separatist group called the Centurion Project had made the names and addresses of nearly three million Alberta voters publicly accessible in a database on its website. The website was shut down after Elections Alberta filed a court injunction.

Voter lists provided by Elections Alberta are seeded with unique fake names, and the organization was able to trace the database back to an official voter list that had been previously — and legally — provided to the pro-independence Republican Party of Alberta. How that list made its way into the hands of the Centurion Project is currently under separate investigations by Elections Alberta and the RCMP, according to The Canadian Press.

This data breach is one of the largest in Canadian history, with Elections Alberta saying that nearly 600 people had accessed the voter list before the website was shut down.

There can be no justification for anyone to misuse this kind of confidential data, and the unauthorized use of such private information by separatist elements in our country only adds a darker and ominous element to an already untenable situation.

“We have heard countless stories about the risks people face having their information made public, including stories from domestic violence survivors, law enforcement, marginalized communities, and more,” a representative of Elections Alberta told The Guardian this month.

While Danielle Smith’s government has blamed the elections agency for not investigating the breach when it first learned of the situation a month earlier, Elections Alberta pointed the finger back at the province, saying the government weakened the organization’s investigative powers last year.

As we have previously pointed out on this page, it’s even more concerning that in most provinces — including Alberta and Manitoba — private-sector privacy legislation directly or indirectly exempts political parties from responsibility if voter privacy is breached. In effect, provincial privacy commissioners lack jurisdiction over how parties handle voter data.

According to a recent CBC report, only B.C. and Quebec have privacy laws that allow political parties to be held responsible for data breaches. While there are legal obligations regarding the specific use of official voter lists in Manitoba, political parties operate with relative autonomy compared to what private companies or government bodies are subject to.

Severe breaches, including identity theft or harassment connected to a data leak, could lead to police investigations or even a civil suit, these are hardly straightforward remedies to privacy breaches.

In Alberta’s case, that reality has left the province’s information and privacy commissioner, Diane McLeod, in a bind. While McLeod has launched an investigation, she says Alberta’s privacy legislation does not apply to political parties. There is no teeth in the legislation to force political parties to be accountable for such a privacy breach, and McLeod has called upon the government to close that legislative gap.

Canadians have a valid concern when it comes to how governments and political parties handle what is otherwise private and confidential information.

In his interview with the Sun last week, Alberta’s former chief electoral officer, Lorne Gibson, suggested that legislatures should look to increase penalties for those who would misuse voter lists.

We understand how valuable these lists are, particularly to political parties that use them during election campaigns. But it’s also true that political parties use these lists to gather even more information about individual voters — including which party they’re likely to vote for, or what party they generally support.

Voter data needs to be better protected, and provincial governments need to take better precautions to prevent its abuse.

After what has transpired in Alberta, Manitoba voters have every right to expect better.