Alberta elector list breach shows legal gaps across Canada, watchdogs warn - BERITAJA

Privacy watchdogs crossed Canada opportunity the breach of Alberta’s voters database by a separatist group has prompted a renewed push for legislative reforms, pinch B.C.’s privacy commissioner pointing to his state arsenic an illustration of really privateness laws should beryllium reformed crossed Canada.

Alberta privateness commissioner Diane McLeod has called connected the provincial authorities to alteration its backstage assemblage privateness rule to springiness her agency jurisdiction complete governmental parties — a “concerning gap” that her counterparts opportunity exists successful their provinces and territories, arsenic good arsenic federally.

Only B.C.’s Personal Information Protection Act (PIPA) includes governmental parties arsenic organizations that are taxable to a privateness commissioner’s oversight, a truth McLeod has many times raised.

In an interview, B.C. privateness commissioner Michael Harvey said the Alberta incident should service arsenic an opportunity to fortify privateness laws passim the country, including successful his ain province.

“I would do it today,” he said.

“My dream is that Canadians aftermath up and commencement demanding amended of their governments successful this regard.”

Alberta Premier Danielle Smith said earlier this period that her authorities will hold for the investigations by McLeod’s office, the RCMP and Elections Alberta to reason “before commenting further and assessing whether immoderate early legislative changes request to beryllium considered.”

In statements to BERITAJA, respective privateness watchdogs said they person pushed the rumor for years and would impulse action successful ray of the Alberta breach.

A spokesperson for the Office of the Privacy Commissioner of Canada told BERITAJA that national privateness commissioner Philippe Dufresne has “long called for Canadian privateness authorities to beryllium modernized” to protect electors’ privateness and information by including governmental parties, including successful parliamentary grounds arsenic precocious arsenic February this year.

A Yukon Accountability agency spokesperson said it supports Dufresne’s calls to update the national Personal Information Protection and Electronic Documents Act (PIPEDA), which applies to organizations successful provinces and territories — including Yukon — wherever location is nary balanced backstage assemblage privateness law.

Nova Scotia privateness commissioner David Nurse said successful an email that the Alberta breach “has exposed risks related to the database of electors that I had not thought of before, specified arsenic the consequence to a unfortunate of home unit if their reside is revealed.”

“I would promote the government, successful practice pinch the Chief Electoral Officer, to reappraisal the existing laws and policies governing the usage of the database of electors, and see what we could study from the Alberta experience,” he said.

A spokesperson for the Office of the Information and Privacy Commissioner of Prince Edward Island said the commissioner “would support immoderate legislative changes that would thief amended protect the individual accusation of voters from unauthorized access, usage aliases disclosure.”

The Office of the Information and Privacy Commissioner of Ontario, wherever location is besides nary provincial backstage assemblage privateness law, said it called for governmental parties to beryllium covered nether early authorities during consultations successful 2021. The state has not passed specified a rule successful the years since.

A spokesperson for Newfoundland and Labrador’s Office of the Information and Privacy Commissioner said it made a akin submission during a 2020 statutory reappraisal of that province’s privateness law. The alteration was included successful the last recommendations to the legislature, which did not walk immoderate amendments.

“As pinch her predecessor and different Canadian Information and Privacy Commissioners, Commissioner Kerry Hatfield remains concerned about the truth that governmental parties successful Newfoundland and Labrador are not taxable to immoderate substantive privateness laws aliases oversight thereof,” the agency spokesperson said.

Privacy watchdogs, which are independent from government, mostly person order-making powers that could compel backstage organizations to return basal steps to protect individual data.

Citizens could trigger investigations by submitting a title if they consciousness their information was utilized inappropriately aliases exposed, and could entree their accusation from organizations nether the law.

In provinces and territories different than B.C., arsenic good arsenic federally, the protection of elector accusation is taxable alternatively to predetermination laws that restrict the sharing of voters’ lists to elected officials, governmental parties and statement officials. The accusation could only beryllium utilized to solicit donations, enlistee statement members and pass pinch electors.

A 2018 associated resolution from each 13 provincial and territorial privateness commissioners and the Office of the Privacy Commissioner of Canada urged their respective governments to walk authorities that requires governmental parties to comply pinch privateness laws and to create independent oversight for those organizations.

Both Harvey and McLeod signed the solution successful their erstwhile roles arsenic the privateness commissioners for Newfoundland and Labrador and Yukon, respectively.

Provinces and territories person not amended their privateness laws to see governmental parties arsenic organizations.

A spokesperson for Manitoba Ombudsman Jill Perron said the agency stands down the 2018 associated solution and encourages the authorities to see a regulatory privateness compliance model that includes governmental parties.

“It is important that individuals person assurances that location is simply a ineligible request for governmental parties to protect the privateness of that information,” Perron said successful a statement.

A House of Commons committee study successful 2018 recommended akin amendments to PIPEDA and much oversight for the OPC complete governmental and 3rd parties, including regular audits of their privateness practices.

Instead, the national authorities passed authorities later that aforesaid twelvemonth that it said would fortify privateness protections and requirements for governmental parties nether the Canada Elections Act, which the privateness watchdogs’ solution warned did not spell acold enough.

Elections Canada noted the main electoral serviceman has worked pinch the national privateness commissioner to rumor joint guidance to governmental parties connected protecting voters’ individual accusation and has pushed to reenforce the privateness norm successful national predetermination law.

“Elections Canada takes the privateness of electors very earnestly and useful continuously to support individual accusation secure,” a spokesperson said.

Provincial and territorial elections agencies, however, told BERITAJA they would support further strengthening voters’ privateness protections successful legislation.

Elections Quebec spokesperson Julie St-Arnaud-Drolet said the incident “gives region for thought and demonstrates that specified transmissions could put susceptible individuals astatine consequence successful the arena of information breaches, unauthorized communications, aliases unregulated access.”

“We whitethorn yet make recommendations to the legislator to supply amended protection for electors,” she said.

Yukon main electoral serviceman Max Harvey said successful an email that “legislative recommendations whitethorn follow” from his office’s reappraisal of the territorial elections enactment and will see really different jurisdictions, including Alberta, whitethorn respond.

“In the interim, lists will proceed to beryllium issued to governmental parties arsenic per the legislative requirements,” he added.

New Brunswick’s main electoral officer, Kim Poffenroth, past week called connected the province to look into stronger authorities regarding what New Brunswick candidates could do pinch elector data.

“There are rules successful authorities but location is not the aforesaid benignant of robust authorities successful accusation privateness that authorities and Elections New Brunswick person to comply with,” she said.

Elections New Brunswick raised similar concerns successful a 2025 study connected electoral information privacy, wherever it recovered New Brunswick has outdated elector privateness laws. The study recommended removing susceptible voters’ accusation from lists and requiring parties to supply privateness policies anterior to receiving the data.

Elections agencies successful Quebec, Manitoba, Saskatchewan and Yukon told BERITAJA they are intimately monitoring the business successful Alberta and would see immoderate recommendations that look from the investigations.

Harvey said B.C.’s PIPA, passed successful 2004, gives his agency “broad authority” to analyse each parties responsible if a akin voters’ database breach occurred successful his province.

“We person the authority to analyse the governmental statement and really they sewage (the voters list) and the quality of really they disclosed it,” he said. “If location was an statement (that received the list), I’d beryllium capable to analyse them too.”

Harvey added his agency could besides collaborate pinch and supply expertise to the RCMP and Elections BC successful their ain investigations into a privateness matter regarding governmental organizations.

“This is unsocial to British Columbia successful Canada,” he said.

Harvey noted he has testified successful Alberta’s ongoing PIPA reappraisal to advocator for the inclusion of governmental parties nether the privateness law.

Lawyers for Elections Alberta person said successful tribunal that investigators wished a database of voters’ names and addresses allegedly published by a group called the Centurion Project matched a elector database provided past summertime to the pro-independence Republican Party of Alberta.

They said it was unclear if a statement charismatic gave the database to the group aliases if it was obtained done different means.

McLeod and different watchdogs person said the publishing of elector accusation put various groups astatine risk, including friendly partner unit survivors, nationalist officials and members of rule enforcement. They opportunity those exposures should compel legislatures to enactment swiftly to reside the privateness rule gap.

The Yukon Accountability spokesperson, however, said the circumstances of the Alberta incident has besides underscored “a reality that the consequence of breaches perpetuated by individuals pinch morganatic entree to the information could ne'er beryllium afloat mitigated.”

“Robust privateness policies and procedures, on pinch physical, method and administrative safeguards, are champion practices that could thief forestall privateness breaches and let organizations to respond quickly erstwhile they do occur. ”

Harvey said B.C.’s ain privateness laws could beryllium further strengthened successful ray of the Alberta breach, including by giving his agency code-making powers and administrative penalties to unit compliance.

He added circumstantial measures for governmental parties, for illustration entree controls and auditing procedures, would besides beryllium valuable.

“In our democracy, our accusation that successful the possession of governmental parties is of precocious value and I deliberation it needs to beryllium protected strongly,” he said.

“What could beryllium much important than the functioning of our democracy?”

—With files from Global’s Rebecca Lau and Anna Mandin, and BERITAJA