MICHAEL McEvoy, Information and Privacy Commissioner, has found that political parties are not doing enough to explain to individuals how much personal information they collect, and why.
The findings were published in Investigation report P19-01: Full Disclosure: Political Parties, Campaign Data, and Voter Consent.
The report investigated how the BC NDP, Green Party Political Association of British Columbia and the British Columbia Liberal Party manage the personal information of British Columbians. These parties were chosen because they were the only parties that requested the entire voters lists from Elections BC in the most recent provincial election.
The Personal Information Protection Act (PIPA) generally requires organizations, including political parties, to collect, use, or disclose information about an individual if the individual has given consent. The investigation found that political parties are generally collecting too much information from potential voters, without getting proper consent.
“Some of this collection of information arises from observations made and recorded about a person by a canvasser going door to door, while other examples included ‘scraping’ personal information from social media platforms and disclosing donor lists, birth dates and other data to Facebook,” said McEvoy. “To be absolutely clear, political parties may be allowed to collect and use this kind of information. However, in most circumstances, the political party would need to get that individual’s consent.”
The report also examined how political parties retain and protect the personal information they collect. Although all three political parties develop and publish privacy policies, investigators found a number of deficiencies with retention and audit practices that prevent full compliance with PIPA.
“In addition to over collection, we also found all of the political parties had inadequate privacy training and indefinite retention of the information. This, combined with the vast amount of sensitive personal information collected, leaves political parties, and by default voters, vulnerable. Political parties must ensure the same effort goes into protecting personal information as is put into collecting it,” McEvoy said.
The report has 17 recommendations for all political parties in British Columbia, including that all parties:
* prominently provide a succinct and simple explanation of the purposes for gathering personal information at the point of collection;
* ensure they collect only personal information from social media with the consent of the individual;
* be transparent about how they profile voters; and
* only disclose email addresses to social media providers with express consent of the individual.
The commissioner will follow up with these three political parties in six months to determine if a more detailed audit of party systems, databases or practices is required.
Investigation report P19-01: Full Disclosure: Political Parties, Campaign Data, and Voter Consent is available for download: https://www.oipc.bc.ca/
THE Green Party’s Director of Communications and Strategy Stefan Jonsson, responding to the report, said: “The integrity and privacy of personal information is of utmost importance to the B.C. Green Party.
“Over the last year, we have been making improvements to the security, privacy and integrity of the personal information entrusted to the B.C. Green Party by voters and supporters. We are grateful for the Privacy Commissioner’s report and how it identifies additional ways to improve the protection and privacy of personal information.
“We are reviewing the report in detail, have already implemented some changes, and are putting together a roadmap for additional changes that need to take place. While we have questions about some specific findings and recommendations, we aim to act as quickly as possible and in concert with our members and supporters.
“With the Speaker’s report, past mismanagement of ICBC and BC Hydro, and a general cynicism in politics, our caucus is doing everything it can to restore trust in our democratic institutions. Voters must also have trust in our party, and our commitment to the protection and privacy of personal information is critical to that. ”
