VICTORIA – Michael McEvoy, information and privacy commissioner, has found that political parties are not doing enough to explain to individuals how much personal information they collect, and why.
The findings were published in Investigation report P19-01: Full Disclosure: Political Parties, Campaign Data, and Voter Consent.
The report investigated how the BC NDP, Green Party Political Association of British Columbia and the British Columbia Liberal Party manage the personal information of British Columbians. These parties were chosen because they were the only parties that requested the entire voters lists from Elections BC in the most-recent provincial election.
The Personal Information Protection Act (PIPA) generally requires organizations, including political parties, to collect, use, or disclose information about an individual if the individual has given consent. The investigation found that political parties are generally collecting too much information from potential voters, without getting proper consent.
“Some of this collection of information arises from observations made and recorded about a person by a canvasser going door to door, while other examples included ‘scraping’ personal information from social media platforms and disclosing donor lists, birthdates and other data to Facebook,” said McEvoy. “To be absolutely clear, political parties may be allowed to collect and use this kind of information. However, in most circumstances, the political party would need to get that individual’s consent.”
The report also examined how political parties retain and protect the personal information they collect. Although all three political parties develop and publish privacy policies, investigators found a number of deficiencies with retention and audit practices that prevent full compliance with PIPA.
“In addition to over collection, we also found all of the political parties had inadequate privacy training and indefinite retention of the information. This, combined with the vast amount of sensitive personal information collected, leaves political parties, and by default voters, vulnerable. Political parties must ensure the same effort goes into protecting personal information as is put into collecting it,” McEvoy said.
The report has 17 recommendations for all political parties in British Columbia, including that all parties:
* prominently provide a succinct and simple explanation of the purposes for gathering personal information at the point of collection;
* ensure they collect only personal information from social media with the consent of the individual;
* be transparent about how they profile voters; and
* only disclose email addresses to social media providers with express consent of the individual.
The commissioner will follow up with these three political parties in six months to determine if a more detailed audit of party systems, databases or practices is required.
Investigation report P19-01: Full Disclosure: Political Parties, Campaign Data, and Voter Consent is available for download: https://www.oipc.bc.ca/reports/investigation-reports/