THE STANDING SENATE COMMITTEE ON LEGAL AND CONSTITUTIONAL AFFAIRS
EVIDENCE
OTTAWA, Thursday, February 12, 2026
The Standing Senate Committee on Legal and Constitutional Affairs met with videoconference this day at 1:30 p.m. [ET] to study the subject matter of Part 4 of Bill C-4, An Act respecting certain affordability measures for Canadians and another measure.
Senator David M. Arnot (Chair) in the chair.
[English]
The Chair: Good afternoon. My name is David Arnot. I’m a senator from Saskatchewan and chair of this committee.
I invite my colleagues to introduce themselves.
[Translation]
Senator Miville-Dechêne: I am Julie Miville-Dechêne from Quebec.
[English]
Senator Tannas: Scott Tannas, Alberta.
Senator Cuzner: Rodger Cuzner, Nova Scotia.
[Translation]
Senator Clement: I am Bernadette Clement from Ontario.
[English]
Senator Prosper: Paul Prosper from Nova Scotia, Mi’kma’ki, territory.
[Translation]
Senator Moncion: I am Lucie Moncion from Ontario.
[English]
Senator Simons: Paula Simons, Alberta. I come from Treaty 6 territory.
Senator Pate: Kim Pate. I live here on the unceded, unsurrendered and unreturned territory of the Alongquin Anishinaabeg.
[Translation]
Senator Saint-Germain: I am Raymonde Saint-Germain from Quebec.
[English]
The Chair: We are meeting to continue our study of the subject matter of Part 4 of Bill C-4, An Act respecting certain affordability measures for Canadians and another measure.
Our first panel this afternoon is Mr. Matthew Alexander Hatfield, Executive Director, OpenMedia, by video conference; Mr. Tamir Israel, Director, Privacy, Surveillance and Technologies Program, Canadian Civil Liberties Association, by video conference; and Elizabeth Denham, Former Information and Privacy Commissioner of the United Kingdom and British Columbia, also by video conference.
We welcome you and thank you for joining us virtually here today as witnesses before our committee. We will start with OpenMedia, followed by the Canadian Civil Liberties Association and then Ms. Elizabeth Denham. Each witness has five minutes to introduce their presentation. I’m going to hold you very tightly to those five minutes. We have a number of senators who wish to ask questions. Just so you know, the senators are restricted to four minutes for the question and the answer, so the answer should be fairly succinct, if possible.
Please, Mr. Matthew Alexander Hatfield first.
Matthew Alexander Hatfield, Executive Director, OpenMedia: Good afternoon. I’m Matt Hatfield, and I’m executive director of OpenMedia, a grassroots community of 230,000 people in Canada who work together for an open, accessible and surveillance-free internet. I’m joining you from the unceded land of the Tsawout on Salt Spring Island in B.C.
Who protects the rules that make our democracy work? We’re lucky to be heirs to a great democratic tradition that has painstakingly figured out a lot about what those rules should be. Following that tradition, we put in place checks and balances of power between different government bodies. We trust most people in government will usually do the right thing, but we have transparency requirements, external verification and appeals processes to make sure they do.
We don’t let anyone set the rules they themselves will be judged by, but there is one group in Canada at the heart of our democracy who don’t believe they need any external accountability. That’s Canada’s three great federal political parties: the federal Liberals, the Conservatives and the NDP.
When it comes to the most sensitive type of data in our whole political system, data about how Canadians vote and what motivates them to choose one party over another, these three parties have decided between themselves that there should be no real oversight over what they’re allowed to do with voter data, no law they have to follow besides rules they write for themselves.
Part 4 of Bill C-4 is a crude fig leaf that says whatever vague description a political party puts in a dense legalese of its privacy policy. That’s good enough for Canadian democracy. Parties have argued that following basic privacy laws, like all other Canadian entities, would be too burdensome during an election, yet they could easily be subject to a review of their practices after an election, with penalties or conditions applied for their next campaign.
Bill C-4’s attempt to immunize parties retroactively back to 2000 from any privacy law makes it very clear this is not about setting good practices for future elections but immunizing them from any accountability for their practices in past or future elections.
When you ask Canadians what the law should be here, we’re of one mind: Privacy laws should be applied to political parties, just like everyone else. When OpenMedia and B.C. FIPA polled on this some years back, 72% of Canadians said so across partisan lines. You don’t see that level of agreement on much else in politics.
Now, the hope of the party seems to be that this will stay an invisible issue. The system will mostly work and nothing will ever go too badly wrong, but I am here to tell you that something is going to go very wrong if you pass Bill C-4’s current text into law.
Recently, I met with some of the companies that work for federal political parties to learn about how they do their business. I assure you that they do not talk about anything as basic as using personal information online or employing cookies like Bill C-4 does when selling us services. They talk about their capacity to geo-target people so tightly they reach only a handful of people in certain physical offices, people like the staffers who work for you. They boast about being able to identify not just that someone is likely to vote and for whom they will probably vote but to determine whether that person went to a polling booth on election day and voted.
That is just the start. We’re several years into the AI revolution, long enough that most of us can say AI is not a useless fad. AI bots that create extremely convincing arguments, images and video are here to stay and are getting better extremely quickly. We’re only just beginning to see what is possible if those bots are turned into agents operating in the external world — AI political operatives who use the vast surveillance data markets we have allowed to exist on every Canadian and develop specific political pitches to bombard each and every one of us, materials developed with a target audience of just one Canadian voter. What will be possible for parties to do in a few years will make canvassing voters on their doorsteps or through their phones look like a pointy stick next to an atom bomb.
We are looking at a bill that will let each individual party set their own rules about how they will use this technology. That doesn’t make any sense. Politics is an arms race, and in Canada, the party that is first past the post wins the great bulk of political power.
You can never rely on self-regulation in an arms race. Mutual disarmament with independent verification that you have complied is the only way to keep this race from being as destructive to our privacy and democracy as it can be. That’s why I’m asking you to refuse to pass Part 4 of Bill C-4 into law. Please insist the House do the right thing and place political parties under PIPEDA. I know that may be difficult, but I’m asking you to try.
Not everyone understands or believes in the role of Canada’s Senate in our democracy, but this is specifically what you are here to do: to not let the narrow and short-term self-interest of the parties in our democracy do serious damage to the system itself.
Nearly 5,000 Canadians from OpenMedia’s community have written to House leaders to ask them to place parties under real privacy law. I’m asking you to join them.
Thank you, and I look forward to your questions.
The Chair: Thank you, Mr. Hatfield.
Mr. Israel, please proceed.
Tamir Israel, Director, Privacy, Surveillance and Technologies Program, Canadian Civil Liberties Association: Mr. Chair, honourable members of the committee, good afternoon. Thank you for inviting us to speak to Part 4 of Bill C-4 today. We are very pleased to be here and to appear before you.
Part 4 proposes to immunize federal political parties from future and historical violations of provincial privacy laws while putting no meaningful protections in place at the federal level. At a time when data-driven political campaigning around the world is becoming more privacy intrusive and has greater potential for shaping or even manipulating our political discourse, Part 4 is a step in the wrong direction.
Political parties are subjecting people to intrusive scrutiny, and the ability to leverage this data-rich ecosystem to manipulate the electorate in real time is growing daily. Data-driven political campaigning is also not limited to elections, but instead is becoming integral to how political parties interact with the public all year round.
In the United States, one study going back as far as 2020 reported that a political party had amassed more than 3,000 data points on every single voter in the United States, while online ads have used demographic information to target Black Americans with the express intention of deterring them from voting.
Data-driven campaigning increasingly attempts to guess people’s detailed psychometric profiles, as well as a range of financial, political, demographic, religious and other characteristics. Frequently, the rich profiles political parties rely on are outdated or inaccurate, yet these political profiles continue to shape the political messaging that each voter receives.
Against this backdrop, Bill C-4 fails to include any of the hallmarks that are integral components of any effective privacy framework and that are staples of privacy protection in Canada and around the world. It lacks any substantive limitations on what political parties can do with people’s personal data, as long as some measure of public notification is provided.
There is no governance framework in place to ensure notification is robust and accurate. There is no obligation to provide more detailed or fine-grained explanations to the electorate regarding how their personal information is processed.
Part 4 categorically immunizes political parties from any obligation to provide individuals access to their personal information and correct it. Importantly, there is no regulatory framework for scrutinizing how personal data is being amassed, kept and deployed by political parties. This approach leaves privacy protection largely to the discretion of the parties themselves and encourages a race to the bottom on data-driven campaigning.
Part 4 does not stop at failing to put in place any effective privacy framework at the federal level. It removes any obligations federal political parties might have under provincial laws and immunizes them from historical violations. The legislative process that has brought us Part 4 raises additional concerns.
Part 4’s inclusion in a finance bill, the lack of any meaningful debate regarding its implications in the other place and the fast-tracking that has been imposed on this committee for its consideration of Part 4 are all deeply concerning.
The impetus by political parties to shield themselves from any type of accountability for their privacy practices is additionally problematic in terms of the data-driven campaigning ecosystem it endorses. People in Canada do not want this lawless approach to their personal data and expect Parliament to put in place reasonable rules for how political parties collect, use and disclose personal information.
We recommend deleting Part 4 from this legislative proposal and instead recommend applying Canada’s personal privacy framework PIPEDA to federal political parties.
Thank you for your time. I appreciate your questions. Thank you.
The Chair: Thank you, sir.
Senator Batters: First of all, I would like to put a question to Mr. Hatfield from OpenMedia. In your open letter, you call upon the government to introduce a new federal bill on consumer privacy. I’m wondering if you could explain what, in your view, that new bill should contain. What would its essential elements and minimum protections be?
Mr. Alexander Hatfield: In this case, you’re referring to reform of what was once Bill C-27 — the next stage of Bill C-27. During that process, we provided a minimum amendments package to the government on how Bill C-27 should be strengthened. Since then, hearing what we’re hearing from the government, there is some concern they might actually wind up doing much less than Bill C-27 even imagined around our privacy.
It is extremely important that our regulators have really meaningful penalty powers to apply to companies that violate our privacy. Currently, we’re in a system in Canada where, even when folks are found to be violating privacy, they will pay very negligible fines, a few million dollars, which for these companies is just the cost of doing business. If you get caught, you pay it and you move on. It’s not an incentive to actually fix these systems. We would like to see political parties covered by this as well, but of course, political parties would also need to have meaningful penalties applied.
Senator Batters: Thank you.
To Mr. Israel from the Canadian Civil Liberties Association, Bill C-4 would require Elections Canada, through the Chief Electoral Officer, to hold at least one annual meeting on political parties’ protection of personal information. In your view, what topics do you think that meeting should cover, and what concrete outcomes should it aim for in order to have real impact on the parties’ practices on this?
Mr. Israel: Thank you for the question. Part of the challenge is that, in order to have a meaningful impact on the parties’ practices, we need the right legislative framework in place, and I don’t think that that’s going to be the case. That being said, if this conference could lead to concrete examples of how the political parties are currently using their information and how they’re collecting, using and disclosing information, including from third-party vendors in particular, and if we could document some of the types of information that they have on voters and how they’re using it in concrete ways, that could do two things.
It could form the basis for better law reform practices in the future, although I do think we already have that basis very clearly established at this stage. It would also help with scrutiny of how some of the vendors that political parties are relying on, which are commercial parties and should be regulated by at least some of the laws we have in place, and are facilitating a problematic, data-driven campaigning paradigm.
So I would advocate for very detailed auditing and information gathering and then making that available to the public so that we can all see what’s happening. Because right now, there is no vehicle for really scrutinizing what political parties are doing, how they’re collecting information and how they’re sharing it.
[Translation]
Senator Miville-Dechêne: Good afternoon. I’ll be asking you my question in French.
I’d like to hear you talk about the issue of personal information. In your view, what personal information should the parties have access to and what personal information should they not have access to? I ask because we heard from a previous panel that the parties could probably obtain a person’s name and address, but asking voters who they plan to vote for seems to be problematic. I’d like to hear what you have to say about questions that are appropriate to ask, unless you don’t think they should be able to ask any questions. What topics should they not ask about at all?
[English]
Mr. Israel: In the Canada Elections Act, there is already some information that’s provided directly to federal political parties, and it facilitates their ability to interact with the public. I think it’s very important to maintain that right. This includes contact information, information regarding where people live and this type of information, and it comes with some restrictions on how that personal information can be reused.
The concern that we’re seeing, though, is that in this data-rich ecosystem, there is so much that can be collected and used. I would encourage you to hear from the former commissioner on this point because she has examined these issues extensively in Canada and abroad as well.
This basic information is already available to political parties through the Elections Act and facilitates their campaigning for the public around election time, and we’re not advocating for a rollback of that type of information. That is important information for them to have. It’s the really open-ended, “get whatever you can” from the exceedingly data-rich world that we’re living in that we’re really concerned about putting some sort of guardrails around. Thank you.
Senator Miville-Dechêne: So they wouldn’t even have to ask questions. They can just strip the internet and try to find information. Is that what you’re saying?
Mr. Israel: Under this regime, there are no substantive limits on what they can do in terms of how they collect personal information. As long as it’s captured at some level of generality in their privacy policy, this places no limits on what information is being collected, from whom it could be collected, how detailed, what types of really intrusive personal characteristics — they could try to guess certain people in the voting public have — or how long they keep those profiles on people. There is just nothing. It really is a very open-ended paradigm that is deeply concerning for us. There are just no limitations at this point on what political parties can do.
Senator Miville-Dechêne: Okay, thank you very much.
Senator Prosper: Chair, can you see if Ms. Denham is available for questions?
The Chair: She isn’t available right now. They’re still working on the issue. We’ll try to adjust to make it fair for everyone.
Senator Prosper: Okay, thank you.
Mr. Alexander Hatfield, in your evidence, you spoke about equal standards as well as the existence of double standards having a way of eroding trust and undermining democracy. You talked about digital sovereignty and foreign dependence, where information is processed and stored outside of Canada, and the unchecked access of information.
Mr. Israel, you spoke of privacy as foundational to democracy, in part due to its quasi-constitutional nation, where Bill C-4 fails to reflect universally accepted privacy principles. You also spoke about data-driven campaigning without safeguards — those practices risk manipulation, discrimination and the erosion of democratic trust.
Can each of you please state some of your top changes if Bill C-4 continues on? Please provide comments on the existing enforcement mechanisms in terms of their sufficiency.
Thank you.
Mr. Alexander Hatfield, maybe we’ll begin with you first.
Mr. Alexander Hatfield: Part 4 of Bill C-4 is not fixable, because the intent is to create a system where the parties set their own rules. It is a legislative framework that removes the possibility of legislation or effective governance around it.
The only solution at this stage is to strike that portion and to ask the parties to do something serious around this.
There is an idea that being subject to PIPEDA or subject to other laws would be incredibly restrictive. PIPEDA is not nearly restrictive enough, frankly. Private parties are able to gather a huge amount of information about us to create these vast profiles. All of that targeting is already occurring in the private sector, and it is currently legal under privacy laws.
But parties aren’t even being held to the limited standard of PIPEDA. Essentially, they’re being held to no meaningful standard besides whatever their very vague policies describe, which they can simply amend if they decide they want to do something. Because far more invasive targeting — based on this data — will be possible within the next few years, it is extremely important right now to place some basic limits and disarm them a little bit from going as far as it can go.
Mr. Israel: I would agree with that.
It is important to note that, for example, in British Columbia, the provincial political parties are already campaigning with these rules in place. These are not rules that are impossible to navigate and to do political campaigning around. They just put some limits in place so that it’s not really completely open-ended and so that there is some way to provide some scrutiny. An independent regulator can make sure that nothing inappropriate or disproportionate is being done.
Part 4 of Bill C-4 is really not heading in that direction, and I hesitate to think about how it could be directly fixed. The easiest thing that we can do here is what my colleague from OpenMedia just suggested, which is to simply amend our federal private-sector privacy law PIPEDA so that political parties are subject to it. That would be an easy way to leverage the existing infrastructure in the federal Office of the Privacy Commissioner and apply it to political parties on a moving-forward basis.
Senator Prosper: Thank you.
Senator Simons: I’m disappointed. I was really looking forward to hearing from Ms. Denham, but I do have questions for the other witnesses.
Mr. Alexander Hatfield, I want to start with you. You talked about the fact that you found the penalties under PIPEDA insufficient for private corporations. In the testimony we heard this morning, we were told that the penalties under this provision for parties that break their own rules, which they are allowed to set themselves, would be $50 for an individual and $300 for a party.
What do you make of those as deterrents to breaking the rules?
Mr. Alexander Hatfield: I find that absurd. There is maybe some consideration there for very small political parties that a high financial penalty might deter political activity. That’s perfectly fixable with the penalties: We could set them relative to the membership or financing of the party.
We need to have actual deterrents here, and we simply don’t. The parties imagine that this is in their short-term interests. They think having as wide a net as possible to do what they can with voter data will give them an advantage in the next election, and it may. However, this is very damaging to the core of democracy and the long-term functioning of the system that we’re all in, including the parties.
Senator Simons: Each of you has talked about hypothetical scenarios in which this information could be weaponized, but I wondered if you could each come up with a specific example of — I don’t want to call it a worst-case scenario but — a possible scenario. Parties gather so much information, and often voters don’t know that parties have this information on them. If I go to a hospital, I understand that my health information is being put on record. If I enroll in a post-secondary institution, I understand my personal information is on record. But I don’t think I understood before work on Bill C-4 began how much information about me a political party might have.
Can you each give me an example of a strategy — not that I want you to be giving them ideas — that a party could adopt to use this information maliciously, or that would enable a third party with whom this information is shared to weaponize it?
Mr. Israel: Regrettably, I don’t think we need to use our imaginations here. And I don’t even think many political parties would classify this as misuse, but the starkest example that we have is this: In the wake of the Cambridge Analytica disclosures, essentially, what happened was that a quiz was circulated on Facebook that asked people random questions about their lives. That quiz was masquerading as a massive data-harvesting tool that collected information on hundreds of millions of people around the world, including from Canadians. That was detailed, sensitive information, and the information was not just from people who took the quiz but anybody who was connected with them on the platform. That information was used to create detailed psychometric profiles on people, and then it was used during the U.S. elections to inundate people in the run-up to the elections — one or two days before the elections — with millions of messages that were personally designed to manipulate them into either showing up at the voting booth or staying away.
It’s difficult to measure what the direct impacts of that ecosystem were on the actual election, because we don’t have the data to do that type of assessment. This was a decade ago at this point. Things have only evolved since then, and the ability to create these profiles and very detailed, crafted messages based on them, and then inundate people with them in real time is a way that is shaping how the political discourse is happening. It’s very negative.
That would be my example.
Mr. Alexander Hatfield: The examples are nearly limitless. We are talking about voter discouragement and misinforming voters, as well as providing very different messages to different types of voters. We are entering a world in which less and less political messaging is experienced from the same source by all of us. For the parties, that is a huge but dangerous opportunity for them to essentially be a different party to different people in Canada.
It absolutely needs to be fixed.
The Chair: We have 30 minutes left. Ms. Denham, can you now speak for five concise minutes? Please proceed.
Elizabeth Denham, Former Information and Privacy Commissioner of the United Kingdom and British Columbia, as an individual: Thank you for your patience. Good afternoon, Mr. Chair and members of the committee. I’m very honoured to participate in this hearing this afternoon.
I was invited because I was the Information Commissioner in the United Kingdom from 2016 to 2021. I was also the Information and Privacy Commissioner for British Columbia from 2010 to 2016.
In my years as the head of a privacy authority in the U.K., I had two priorities, and these were areas that I think the public was very concerned about. Number one was children’s privacy and number two was electoral integrity. Both of these policy concerns — safeguarding our children and safeguarding our democracy — continue to be impacted by rapidly advancing technologies, data mining and profiling.
My opening remarks are really going to be about my hands-on experience as a national regulator in the U.K., where political parties are subject to comprehensive data protection law and oversight.
In 2017 my office undertook an 18-month investigation. We’ve been hearing about it from the other witnesses, and the investigation was into the British analytic company Cambridge Analytica, Facebook, as well as 30 other organizations for allegations of the misuse of personal information in election campaigns. What we found was that there was a disturbing disregard for voters’ personal privacy by players across the whole political campaigning ecosystem, in which personal data is collected, shared and used to target and influence voters, often without transparency and without consent.
Political parties play a central role in this data ecosystem, but so do data brokers, political data analytic companies and social media platforms. I think this investigation, as we’re still talking about it today, was an inflection point when the public in the U.K. and internationally became aware of the invisible processing of sensitive information: their political opinions, their wealth, their age, their connections, their race, their purchases, their income and their networks.
This was a timely investigation because, almost 10 years ago now, in 2017, analytics and microtargeting techniques were evolving. We knew that taking action then to enforce the law was vitally important because more advanced tools, such as AI-generated deepfakes and precision cyberattacks, would only increase the risks to citizens’ trust and confidence in future elections.
Well, that time is here. In the U.K. and the EU, there are comprehensive data protection laws that extend across that whole political ecosystem, including political parties, and the last time we checked, democracy was alive and well.
Now, outside of Europe, New Zealand, South Korea, South Africa, Brazil and many other nations include political parties in their data protection and privacy laws. There is no exemption there for political parties.
Canada is an outlier when it comes to extending independent oversight for political parties’ use of personal data and breach notification and reports to an independent authority.
In 2018 the ETHI committee — an all-party committee of the House — studied election integrity in the wake of Cambridge Analytica and Facebook, and the committee unanimously voted to include political parties in federal privacy law. That was eight years ago, and nothing has been done.
Oversight of Canada’s political parties is even more important today, given the government’s desire to strengthen and preserve democratic institutions and preserve trust and confidence in elections. Canadians will look askance at cynical efforts to take away their rights at a time when geopolitical unrest has turbocharged the risk of foreign influence and cyber attacks and when hostile states are interfering with elections by deliberately targeting personal information repositories.
The Chair: Excuse me, ma’am. I am sorry. We are really tight for time. We need to go to questions.
[Translation]
Senator Saint-Germain: Thank you to the people on the panel. My question is for you, Ms. Denham. I’m particularly interested in your former role as British Columbia’s privacy commissioner. First, how do the personal information protections in this bill compare with those in British Columbia’s Personal Information Protection Act? Simply put, are voters going to lose protections because of the provisions in Bill C-4 when compared with the protections British Columbia’s act affords them?
[English]
Ms. Denham: Thank you for your question.
Yes, indeed, voters and personal data that is collected by federal political parties of B.C. citizens would be affected by Bill C-4. They would lose rights unless the courts — and there is an appeal before the courts — actually oust application of British Columbia’s Personal Information Protection Act, or PIPA, to federal political parties.
That is one of the issues right now. There is an appeal that the three political parties, as you know, have initiated against a decision of a lower court.
Let me say that B.C.’s PIPA does include the application of parties that are operating in British Columbia. It provides a right of access by voters to their data that is held by a political party and a right of correction. There are breach notification requirements. That is the only province where you really have comprehensive data protection legislation that covers federal political parties.
In my experience, in B.C., we did deal with political parties that were using social media profiles to vet political candidates. Michael McEvoy, my successor in the role, investigated political parties quite widely to see what kinds of data they were collecting, and I know you will be talking to Michael Harvey, who is the current occupant of that role, and he can give you up-to-date news about what is happening with the political parties.
Senator C. Deacon: Thank you very much, Ms. Denham and the other witnesses.
I’m wondering if you could be specific in your recommendations to this committee and the Senate as to actions that should be taken to rectify the situation that is being created by Bill C-4.
If you could just give us a summary and maybe build on each other, if you could, starting with Ms. Denham, since you have had a shorter time on the screen.
Ms. Denham: Part 4 of Bill C-4 is a really blunt instrument, and I agree with the other witnesses, my colleagues, that it needs to be studied and debated.
Political parties and political candidates are making the point that there should be some special status for political parties because of the role they play in our democracy, because of political speech and because there should be a right to collect data for democratic engagement. I totally agree with that, but it is a blunt instrument to take the rights away, and there are more surgical ways to balance democratic engagement with personal privacy.
I can follow up in writing to the committee. My recommendation would be to look at the U.K. General Data Protection Regulation, or GDPR, provisions for political parties, because there are some exceptions. There are some legitimate interests for political parties to collect data, but it doesn’t take away the rights of U.K. citizens.
There is a middle road that we could surgically discuss. The operation of consent in elections is difficult and challenging, but looking towards a deemed consent provision for reasonable collection of personal data would work.
Removing any application of privacy law from political parties means that all of the supply chain that my colleagues are talking about, the data supply chain, is going to be used and abused — I can guarantee you — if political parties as the central agency in this political ecosystem are not subject to the law.
Senator Pate: Thank you to all the witnesses.
Ms. Denham, I would like to provide you with an opportunity to expand a bit upon the similarities between the provisions and the situation created now through this legislation and the conditions that you investigated when it came to Cambridge Analytica and what some of the potential risks are beyond what you’ve already discussed.
Ms. Denham: The Office of the Information Commissioner was able to investigate political parties and audit political parties to make findings of how they’re collecting, using and disclosing personal information because political parties are subject to the law.
The implications of Part 4 would mean that provincial law wouldn’t apply to federal political parties. I mentioned that we investigated 30 organizations that were connected to Cambridge Analytica, data brokers and other social media platforms. There was so much illegal activity going on in that ecosystem that it was really important that we did a deep dive into that investigation because it did change the practices in the U.K. We were able to actually develop a code of practice for political parties, which levelled the playing field.
It is not fair that really well-funded political parties can use all of this data and implement all of the mechanisms and the analytics of the AI that is out there, whereas smaller political parties wouldn’t have the ability to do that. So having the law as a foundation and then building some specific codes of practice and detailed requirements for political parties works really well in the U.K. In the U.K., we have not seen the kind of mischief or illegal activity that we found when we investigated in 2017.
So I would advocate for the comprehensive inclusions of the rights of voters to be able to understand how their data is being used to target them in campaigns and elections.
Senator Pate: Thank you.
Senator Cuzner: Mr. Israel, you referred to the rules in B.C. as not being completely onerous and that the parties comply, for the most part. From a federal perspective, by complying with a different set of rules across the country, are you more in line with having a nationwide set of rules that would be more logical and workable?
Mr. Israel: Absolutely. Putting in place a comprehensive set of regulations at the federal level would be preferable. In Canada, we have a framework where we have a federal privacy law, and the provincial privacy laws are assessed to the degree to which they are substantially similar to the federal law. So there is alignment between what provincial law requires and federal law requires. The only difference, of course, is that no law currently applies to the federal political parties at the federal level and only the B.C. law applies to ridings that are operating within B.C., which is why we’re particularly concerned to see that these rights are being removed, moving forward, as well as retroactively, while nothing meaningful is being put in place at the federal level.
Senator Cuzner: I see Mr. Hatfield agreeing with that.
Mr. Alexander Hatfield: Yes, very much so.
Senator Cuzner: The following panel will be a number of representatives from the political parties. If a key question were to be posed to them, what would that be? The smiles come on.
Mr. Alexander Hatfield: I would like to know why they don’t think that they should do something that the majority of Canadians think they should. I would like to know why they think special rules or special lack of rules should apply to them alone. I would put to them that they are not considering how out of control the situation may get, as AI agents become more and more a feature of politics.
Ms. Denham: I would ask them whether they have considered the geopolitical risk, the cyber intrusion and the foreign influence in our political actions and elections. How are you going to protect personal data if there is no requirement to report something like a cyber incident to an independent authority?
Canada is out of sync with the kinds of protections that other jurisdictions in liberal democracies are putting together. So I wonder if they have thought about those risks.
Mr. Israel: I would ask them to consider the ecosystem they are putting in place and how this could really force them to a race to the bottom that they are not necessarily even wanting to engage in.
If a political party in the next couple of years decides to really increase their collection of personal data and start leveraging it to an even greater degree, because there are no rules in place, every party is going to be trying to outdo each other. That is an ecosystem the current parties may not want to be placed in, but it is one that is regrettably potentially one that they might face if we don’t have any meaningful rules in place.
Senator Cuzner: Thank you.
Senator Dalphond: My question is for Ms. Denham. Thanks to all of you for participating.
In the U.K., the general act that applied to businesses will apply to political parties, with some exceptions. Could you elaborate on the exceptions, and who is doing the oversight, an electoral officer or the Privacy Commissioner?
Ms. Denham: The law in the U.K. applies to public bodies: government bodies, commercial entities, not-for-profit agencies and political parties. So it is a very broad and comprehensive law. However, there are special provisions that really allow and support political parties to collect information for legitimate electoral purposes, such as communicating with voters and communicating with members of the political party, because, obviously, there is knowledge about that citizen with whom they are communicating and they wish to receive communications from the party.
There is also a provision in the law that allows political parties to target individual users as long as the data that they are collecting is not intrusive or overly sensitive. I will give you an example of that. The kind of data that is available is demographic data, and I think people understand that. But collecting or inferring the race of an individual and profiling individuals according to sexual orientation or race is off the table. So there are some guardrails around the intrusiveness of the collection of the data in order to communicate with them.
Senator Dalphond: Who supervises that?
Ms. Denham: It’s the Information Commissioner of the U.K., not the electoral officer, because of the subject matter expertise and because the law applies broadly across commercial, government and political players.
Senator Dalphond: Thank you.
Senator Clement: Thank you all for being here and your testimony. This is all rather mind blowing, right?
Social media platforms already know that I’m a Black woman who is really into “Heated Rivalry,” and I’m telling everybody publicly.
Here is the thing: I have been a former candidate, and so I know the whirlwind of an election process. Most of the people on the ground are authentically into democratic engagement, but most of them are volunteers and it is fast, so I take the point about needing surgical, clear rules and guidelines to help during that process.
What I would like to know is this: Is this piece salvageable? Can we work with what we have here? Or do we just need to delete this? If we do not proceed with this piece and we do look at new legislation, how do we keep up with everything?
Mr. Hatfield, you were talking about AI agents. We already know AI agents are meeting on social media platforms and commenting about us. How do we draft legislation that keeps up with the changing landscape?
Ms. Denham: The end of my presentation or opening remarks was really about the importance of technology-neutral laws and codes because if you try to regulate one technology, like AI, then you have to think about quantum and agentic AI, so it needs to be technologically neutral.
Your question is this: Has the train left the station? I think in 2017, when we looked at the techniques for microtargeting, especially in narrowly contested constituencies, we said, we better do something now and raise the alarm before the technology becomes more intrusive. Well, that is where we are today, and I think we have to try.
There are models around the world. It’s not rocket science. We can look at other models, like in the EU and the U.K. where we share values, so we can at least try. I completely understand that the engagement involves a lot of volunteers, and you have to make it clear and simple. But as I say, the surgical approach is better than no guardrails whatsoever, which is what we have right now with this proposal.
Mr. Alexander Hatfield: I agree we have to try. The function of Part 4 of Bill C-4 is to say that political parties don’t have to try. We have allowed a faster valence economy to develop. Of course, that is what leads to the targeting you are aware of, but what wasn’t possible before, which is becoming very possible, is the fine-tuned targeting of not just people who share your broad attributes but also specifically you. An AI agent can take in a thousand points of data and influence your specific vote, which is going to escalate the abuse quite a bit.
Mr. Israel: To add to what my colleague said, we are facing a lot of challenges on the privacy front, with a lot of AI tools coming in and causing additional problems.
At the very least, we have core principles that we know can at least provide a framework for an ongoing investigation into how these tools are impacting society. Our toolkit is going to have to evolve.
What we have with Bill C-4, Part 4, is not even the basic starter toolkit that is applicable in other places and that we already know provides some measure of support. I do understand, obviously, during campaigning specifically, that maybe there is room for different rules, but some principles, like proportionality and necessity, are core, overriding considerations that should apply throughout.
The other set of points to think about, more generally, is that campaigning is not limited anymore to the election period. It is an all-year-round activity that we need to come to grips with.
Senator Simons: Thank you very much to all of our witnesses. Bill C-65, which was a previous iteration of this legislation, had much stricter rules. For example, it made it an offence not to tell people if their privacy had been violated. It made it an offence to share the information maliciously. Is there any purpose that you see to our attempting to say, amend this by putting in language we have imported from the former Bill C-65, or do we say, this is unsalvageable and we need to start over?
Ms. Denham: We are all saying that this discussion about privacy and political parties needs to be studied and debated. It deserves its own bill.
It is a sensitive issue. We know that Canadians care about their privacy. Poll after poll tells us this. To your point, this legislation doesn’t even go as far as proposals that have been considered year after year in other bills. It’s a cynical attempt to shut down Canadians’ privacy and Canadians’ rights. I think studying the bill, discussing the bill and letting Canadians have their say are what’s important, but I agree with you. The other provisions in Bill C-65 were at least a starting point.
Senator Prosper: Thank you all for your testimony here.
Ms. Denham, you talked a bit about geopolitical risks and cyber intrusion. You talked about the risks to the whole ecosystem, including data brokers and supply chains. If you don’t keep those elements in check, it goes to the heart of election integrity.
You offered a solution where you need a legal foundation, but with respect to federal political parties, specific roles and practices are required, in addition to that curtailed, more surgical approach, geared toward them. I believe you said that the overall product of that, given your experience, is that it levelled the playing field. It made it equal among federal political parties. What we heard earlier is that it might be cumbersome or a financial burden for the smaller political parties. Is that level playing field integral to our democracy and the integrity of elections, in your opinion?
Ms. Denham: Yes, I believe it is. There are maybe 20 federal political parties, small and large, and they should have the same rules instead of making their own rules and complying with them. We should establish the playing field to decide what level of intrusiveness is acceptable in democratic engagement. As I said, we need a code of practice that is even more specific and that gets to all of the steps and all of the functions that political parties carry out for democratic engagement. So the surveillance of voters, the collection of data on the doorstep, the contracts they have with the supply chain of data and all of those things are addressed.
It starts with basic oversight and inclusion in the federal private sector privacy law.
The Chair: To all of the witnesses, on behalf of the Standing Senate Committee on Legal and Constitutional Affairs, I thank you for your attendance here today. We really appreciate you joining us on short notice. Thank you for your thoughtful responses to our questions.
For our second and final panel in this grouping, we are pleased to welcome legal counsels from several of the major political parties. First, Mr. Michael Wilson, Outside Counsel, Goodmans LLP, Conservative Fund Canada, by video conference; second, Alexis Levine, Outside Counsel, Blake, Cassels and Graydon LLP, Federal Liberal Agency of Canada, by video conference; third, Carmela Allevato, Senior Counsel, Allevato Quail and Associates, New Democratic Party of Canada, by video conference.
Thank you to all three witnesses for joining us today. We’ll begin with opening remarks before we move to questions. Each witness will have five minutes. Please stay within the five-minute limit. Each senator — we have 12 senators — will have four minutes to ask questions and receive answers. Please be succinct.
I’ll start first with Mr. Michael Wilson. Please proceed, sir.
Michael Wilson, Outside Counsel, Goodmans LLP, Conservative Fund Canada: Mr. Levine and I have coordinated our remarks. It might make more sense to start with him, and then I can follow him.
The Chair: Mr. Levine, please start, and then it will be Mr. Wilson, followed by Ms. Allevato. Mr. Levine.
Alexis Levine, Outside Counsel, Blake, Cassels and Graydon LLP, Federal Liberal Agency of Canada: My name is Alexis Levine. I lead the public and political law practice at Blake, Cassels & Graydon LLP. I have previously served as an adjunct professor of public law and decision making at Osgoode Hall Law School, and I am often called on to advise on public and political law matters. I have served for more than a dozen years as the principal external legal counsel to the Federal Liberal Agency of Canada, the chief agent of the Liberal Party of Canada. I am joined today by my counterparts at the Conservative and New Democratic Party.
Part 4 offers a rare cross-partisan point of consensus amongst major political parties in Canada and was unanimously supported in the House at the committee and vote stage. There are excellent reasons for that.
You have heard about the need for a robust privacy regime under the Canada Elections Act, or CEA, to protect voters’ data. That is a legitimate concern. However, that is not the focus of my remarks today.
I am focused on Section 446.2 of the amended CEA and the key jurisdictional question of who gets to decide which rules govern communication with Canadian voters by federal political parties. Is it Parliament or provincial regulators? That is the most important question at issue here.
In Bill C-4, Parliament is reasserting, yet again, that rules governing communication with voters by federal political parties are the exclusive purview of Parliament, not provincial legislatures. To decide otherwise is to undermine Canadian democracy.
I will note that communication with voters necessarily includes both speaking to voters and receiving responses and information from voters. For democracy to work, dialogue must go both ways. Provincial regulators have articulated the position that provincial privacy laws should govern federal political parties. That position is untenable.
First, provincial privacy laws are commercial in nature and not the appropriate mechanism through which to regulate political parties. Canada’s 20 registered federal political parties — even the big ones — are largely run entirely by volunteers. Asking volunteers to comply with as many as 14 conflicting and overlapping provincial and federal laws is not realistic. This would frustrate the previously expressed intent of Parliament that there be a single, national, comprehensive privacy regime applicable to political parties within the Canada Elections Act. All voters should have the same rights, wherever they live, and the rules should be clear.
Second, most provincial commercial privacy laws are far more one-sided than is appropriate in this context. When regulating communication by federal political parties with Canadian voters, we need balance to allow for democratic dialogue. Political parties need to be free to communicate with, and keep track of, the feedback they are receiving from, voters.
The Hogue Commission reported last year that misinformation is the single biggest threat facing Canadian democracy. Direct dialogue combats that risk. Parliament has repeatedly chosen to create space for this critical democratic function. Provincial commercial privacy laws are in no way optimized for that.
Some advocates have said that privacy law should apply to political parties in the same way as other laws of general application, like traffic laws. Privacy law is not the same because, in respect of elections, it goes to the very core of what political parties do, which is to communicate with voters. To regulate this activity is to regulate federal elections themselves, which clearly is the jurisdiction of Parliament.
You have heard suggestions for further additions to the privacy regime under the Canada Elections Act. That is a legitimate policy debate. Parliament tried to address more comprehensive reform most recently in Bill C-65, which had broad support but died in committee at dissolution last March. With a new government and 117 new members of Parliament, big policy changes — especially to an election bill — take time to build consensus. I hope that a bill similar to C-65 will be put forward very soon. But in the meantime, the House has not delayed advancing Part 4 so as to unanimously reassert federal jurisdiction on this issue.
I do want to observe that, while the debate over potential refinements or enhancements to the Canada Elections Act is legitimate, that is a question of policy, not jurisdiction. Provincial regulators should not get to assert jurisdiction over federal elections just because they do not like the policy choices Parliament has made. Section 41 of the Constitution Act, 1867 clearly indicates it is for Parliament to make laws relating to federal elections, and Parliament has done exactly that.
There is already a significant privacy regime built into the Canada Elections Act, and this bill will expand that. Section 56 of the act restricts the use of voters list information to a handful of permitted uses, such as to enable parties to communicate with electors. Section 385 of the act requires each party to publish a fulsome privacy policy and to share the policy with the Chief Electoral Officer. Compliance with the policy must be certified annually by the party’s leader and privacy officer.
Failure to comply with the policy is a violation of the act, subject to administrative monetary penalties, independent enforcement and other potential sanctions.
Section 385.2, to be revised to become Section 446.2, states that the purpose of these provisions is to provide for a national, uniform, exclusive and complete regime applicable to registered parties. It’s that statement that Parliament is seeking to reaffirm in Part of 4 of this bill, and it should be non-controversial. You should not hesitate in asserting exclusive and paramount federal jurisdiction on this issue.
Thank you, senators.
The Chair: Thank you, sir.
Mr. Wilson, do you want to add anything?
Mr. Wilson: I will speak briefly to echo Mr. Levine’s points and to introduce myself. My name is Michael Wilson. I am outside counsel of record for the Conservative Party of Canada.
At the heart of the question before the committee, at the heart of Part 4, Bill C-4, is a simple question: Who decides what rules will govern how federal political parties communicate with Canadian voters: Parliament or provincial regulators? The answer must be that Parliament regulates the core activities of federal political parties.
Communicating with voters across Canada is tantamount to regulating federal elections themselves. This must plainly be a federal responsibility. We are not the United States, where national elections are regulated on a state-by-state basis.
I also want to emphasize briefly that Canadian’s federal political parties are largely volunteer-run organizations. They are not businesses. Imposing the 13 overlapping provincial and territorial commercial privacy regimes on national volunteer-run parties is not appropriate and would frustrate the intent for a single national framework within the Canada Elections Act.
All voters should have the same right to hear from political parties wherever they live. Communication in a democracy is two ways. Parties must speak to voters, and voters must speak to parties. Parties must be free to record that feedback and to respond to it.
Privacy regimes focused on commercial transactions are not fit for purpose when applied to political dialogue. Parliament needs to affirm its exclusive role over federal party voter communications and adopt Part 4 of the legislation before the committee. Doing so upholds a single national standard and protects the two-way conversation at the heart of democratic representation.
Thank you for your time.
The Chair: Thank you, Mr. Wilson.
Carmela Allevato, Senior Counsel, Allevato Quail and Associates, New Democratic Party of Canada: Good morning and thank you for inviting us to be available to you, to answer questions and to express a few words.
We need to keep in mind that if there is no central, single regulatory body that governs the privacy obligations of federal political parties, what we end up with is a patchwork of 14 different jurisdictions with different regulations and different consequences.
It’s also important to make sure that we know that what we’re dealing with before the Court of Appeal is the issue of retroactivity. It has always been the intent of Parliament to have a single regulatory system over the federal parties. That has always been the case and will continue to be the case.
I would be happy to answer any other questions. Thank you.
The Chair: Thank you. My goal is to make sure that every senator who wants to ask a question gets a chance. I have 12 senators and 45 minutes. Please be concise.
Senator Batters: Thanks to all of you for being here. Two of you on the panel I know: Mr. Wilson with the Conservative Party and Mr. Levine. Mr. Levine and I were stuck on a plane together one time for a very long delay about a year ago. That was a nice conversation we had on that flight.
Mr. Levine, you outlined an important part of this bill and provided us with some indication as to why this is important. What you were saying is that it’s important to institute a national, uniform, exclusive and complete regime.
Yes, this bill does aim to establish that national framework. In your view, what are the operational risks of a system where a party must comply with different provincial requirements, especially during a national election campaign?
Mr. Levine: Thank you for the question, senator. I’m glad you remember that flight delay as fondly as I do. It’s nice to see you again.
The scenario where you have 14 different regimes overlapping and conflicting could result in a couple of different bad results. You could have a scenario where political parties in some jurisdictions are unable to focus on that key mandate of communication with voters because they are dealing with regulatory requirements, responses to information requests from voters, regulatory inquiries and rules about the uses of certain tools; whereas, in another part of the country, you have a completely different regime.
You could have a scenario where volunteers are unwilling to get involved in political activity because of the complex regulatory regime with 14 different jurisdictions overlapping and conflicting with each other. This is a reality we already see in the political process because of the complexity of the legal regime. We do see volunteers unwilling to take on certain roles. That is a problem that could become more pronounced.
You could have provincial regulators pursuing their own particular agendas. The key here is that Parliament has really sought to create a space for political parties to be able to engage in dialogue, not in an aggressive way. Political parties are the most scrutinized entities in our governance system, more than businesses and charities. They are already subject to intense behavioural scrutiny.
It is important that they have an opportunity to engage with voters and receive their feedback. To have that policy conversation and go back to that voter and say, two months ago you raised this issue with me, and we’ve come up with a solution. What do you think about it? We need to be able to do that.
Senator Batters: Mr. Wilson, thank you for being here as well. Some witnesses have expressed concern that a model based on each party’s own policy amounts to self-regulation.
Could you give us some concrete examples of internal controls you already use with the Conservative Party of Canada to ensure compliance with your policy?
Mr. Wilson: Yes. The first point I will make is, as Mr. Levine noted, we are highly scrutinized organizations. We have in place privacy policies that are available on our websites that set out what information we collect, what we do and the fact that we don’t sell information to third parties. All of that is available to people.
There is also training. There is some limited staff at the national level. There is training. When we’re running election campaigns, we’re talking about volunteers in 343 ridings in 10 provinces and three territories. You’re trying to train and work with volunteers using data tools that have password protection and controls so that people can only have limited access to what they need to do their volunteer work.
Again, there is a real risk. The question before the committee is a jurisdictional one. As you look at the next step of what kinds of policies you might want to overlay on to that jurisdictional exercise of authority, you’re dealing with volunteers, not with commercial enterprises.
If you’re looking at a riding CFO in one of 343 ridings, it’s not the same thing as being a CFO of a TSX-listed company who is making six or seven figures. It’s got to have a different fit-for-purpose design.
Senator Batters: Yes, it’s volunteer.
[Translation]
Senator Miville-Dechêne: Mr. Levine, you said that you wanted freedom. I took from your remarks that the political parties wanted to be free. However, it’s clear from Part 4 that there is a lot of freedom. You said parties shouldn’t be likened to private businesses because they’re different, but we heard the rather compelling comments made by Elizabeth Denham, the former information and privacy commissioner of the United Kingdom and of British Columbia. She told us, on the contrary, that Europe and Great Britain are of the view that privacy requirements should apply equally to everyone, with some adjustments for political parties.
You have responsibilities, but Part 4 does not provide for an independent authority with the power to investigate you to identify any wrongdoing. That seems especially odd to me given all the scandals involving the manipulation of people’s personal data.
How can you say that you want freedom and that you don’t want to be subject to the laws everyone else is subject to? The committee is not denying that there needs to be specific legislation for political parties. We don’t want you to be subject to 14 different laws, but we do want you to be accountable. An independent authority is probably the best way to make sure that political parties don’t do whatever they want.
[English]
Mr. Levine: Senator, if I can, let me make three quick points in response to your question that had a number of different elements to it. I apologize that I’m answering in English instead of in French.
The first point would be that there are independent agencies, particularly the Commissioner of Canada Elections, who certainly have the ability to enforce the Canada Elections Act.
The second point I would make is that, in the matters that Commissioner Denham was referring to that were investigated, many of the bad actors, particularly the key bad actors, were private-sector entities that would be subject to commercial privacy regimes.
The third point, though, which I think is the key one, is the difference between a political party and a business. A business, when they interact with a customer, has a contract, a transaction and an exchange of value at the outset, an opportunity to set the terms of the relationship. When they return to that customer, it’s to make another sale. Political parties’ mandate is fundamentally different. We are largely run by volunteers. The number of interactions per staff member at a political party runs into the millions, whereas in a business it would be in the tens of thousands.
We do not have that initial contract engagement, transaction and exchange of value, and political parties have a mandate to communicate with upwards of 40 million voters in this country. It is necessary, to facilitate that public interest mandate, that a different regime that gives space for that democratic dialogue be developed for political parties than the regimes that apply to commercial actors.
[Translation]
Senator Miville-Dechêne: I take it that you reject models like Quebec’s, which include the right of access. Part 4 of Bill C-4 has no right of access for users whose data were used inappropriately. In that sense, you’re not accountable either.
[English]
Mr. Levine: Senator, the right of access is a very interesting and tricky question. On the whole, I think it’s a good thing that a voter or a citizen has a right to know what information an organization has about them. The concern, again, with political parties, where it’s different with political parties, is you need to be concerned about tactical use of those rights in the course of a campaign. You can see an example where a local campaign might flood an alternative campaign with all kinds of access requests and use up campaign resources and limit the ability of that campaign to engage in dialogue.
I personally don’t have any substantive disagreement with the idea of a right of access, and I actually think the information the political parties in Canada hold on voters is a whole lot less interesting than is being suggested by some of the committee’s witnesses. Certainly, some of the things that have been described are not things that I’m aware of any political party in Canada doing.
But you need to be careful when designing a framework around these questions with political parties that you design it with enough balance that we’re not stifling democratic dialogue or creating new problems.
Senator Prosper: Thank you to our witnesses here before us. I have a question for Mr. Levine. I’m curious about the linkage between Part 4 of Bill C-4 and the litigation currently before the B.C. Court of Appeal. I’m looking at a letter dated November 20, 2025, which is part of the court record — it is a public document — filed with the Court of Appeal registry. It’s there, written by partner Cathy Beagan Flood with your firm, but written on behalf of the appellants, that is, all government parties: the Liberal, Conservative and New Democratic Parties of Canada. Specifically, in the letter, I’m going to quote it directly and maybe get your thoughts on the linkage between the bill and the action:
Bill C-4 is advancing through the House of Commons and has completed consideration by the Standing Committee on Finance on October 29, 2025. We understand that the Senate has already studied the bill and it is expected to be passed back to the House of Commons for final approval this month. It is anticipated that Bill C-4 will be passed and receive Royal Assent in short order, such that the complainants will lack standing to pursue their complaint and the appeals will be moot.
It goes on.
This letter is dated November 20, 2024. Can you further extrapolate the linkage between this bill and the current litigation before the courts?
Mr. Levine: Yes, I’m happy to, senator. I will say, obviously, the information about the timing of study in that letter was not the latest and greatest or up to date.
Let me say this: I want to be very careful not to comment in too much detail about a matter before the court. I want to respect the process that is happening at the British Columbia Court of Appeal, and I don’t want to litigate that matter here.
My late colleague Peter Hogg was very fond of talking about the importance of the dialogue between the legislature and the courts, and that is very much what has been happening in this matter. It’s entirely appropriate for Parliament here to be participating in that dialogue and making its intention clear that there be a single, national regime related to privacy that governs political parties in the Canada Elections Act and that this is the jurisdiction of Parliament.
Ultimately, there are very valid differences of opinion that people will have about the substance of privacy law, but the jurisdiction question is really where I am focused. I would put to you that a law regulating federal elections and communications with voters has to be a law passed by Parliament.
If the Senate and the other place wish to study the substance of a new law, a new bill that I hope gets brought forward on these issues soon, and make recommendations in that regard, certainly, on a personal level, I think that’s the right thing to do. I think Bill C-65 had a lot of excellent protections in there, and that’s a very good starting point to jump off from, but I do not think that the Parliament of Canada should be ceding jurisdiction over the regulation of communication with voters by federal political parties to the provinces.
Senator Prosper: Thank you.
Senator Simons: I want to pick up right where Mr. Levine left off. I take your point, and I think I largely agree with the fact that it ought to be a federal regulatory authority because elections in Canada are national.
What concerns me about the letter that Senator Prosper just read into the record, and which I had not previously seen, is the suggestion that we, as a complementary body of Parliament, are being rushed to take action, the better to frustrate the actions of the Court of Appeal in British Columbia.
You’re not the first person we’ve heard from today who talked about the will of Parliament. Parliament has two houses: the other place and the Senate. Until the Senate has announced its will, the will of Parliament has not been spoken.
So I am concerned to hear Senator Prosper read this letter into the record because it presupposes that we are being — I come from Alberta, cattle country. I feel a little bit like we’re a cow being put into one of those chutes. And perhaps I could ask the three of you. I don’t think Ms. Allevato has spoken yet. What are we to make of the fact that our concurrence is being taken for granted and that you are leveraging an opinion about the Senate in an effort to frustrate the litigants in the case before the B.C. Court of Appeal?
Mr. Levine: I’ll leave it to Ms. Allevato to respond.
Ms. Allevato: I’m happy to respond.
Senator Simons: I would like to hear from you too, Mr. Levine.
Ms. Allevato: That was certainly not the intent. The purpose of the letter was to advise the court of where matters stood. It had always been the position of the parties that it was Parliament, the federal Parliament, that had the authority to regulate privacy.
Throughout the course of the proceedings, there was, as Mr. Levine said, this dialogue going on between the courts and Parliament, and that is where we were at. There was certainly no intention of taking anything for granted.
Senator Simons: It seems like a trespass on the privileges of this body.
Mr. Levine: Senator, your concern regarding the letter is noted and acknowledged. It is a valid concern. There has been some difficulty dialoguing with the court and counsel trying to assess what the status of legislation was. We had broad support for Bill C-65. Everyone anticipated that would move forward quite expeditiously. It ultimately did not do so, for no reason related to the substance of the legislation but related to broader political events.
There was an understanding, which it sounds like it was misinformed, with respect to the affordability act that Part 4 is linked to and the speed with which it was moving, but certainly we all have deep respect for the role of this body and for the sober second thought you bring to the table here and to the appropriate questions you’re asking. As I say, the questions about the substance of protections in the Canada Elections Act are absolutely valid ones.
I would urge that not to cause you to hesitate in asserting your jurisdiction.
As to whether that then makes the litigation in British Columbia moot, that is where I will decline to comment on a matter that is before the court and leave that to the wise litigators who will have that conversation with the Court of Appeal.
Senator Simons: Let it be said for a body where many of us, not all, are non-partisan and belong to no party, the argument that the parties all believe this is a great idea is not persuasive.
[Translation]
Senator Saint-Germain: Thank you and welcome to all of you.
I’d like to start by recognizing, on one hand, the important role political parties play in our electoral system and, on the other hand, the importance of taking into account their special status; they aren’t public, government or private entities. That’s an important consideration.
I don’t think anyone here is challenging the importance Bill C-4 places on federal jurisdiction over political party oversight. We have two questions, mainly. First, does the new act being proposed take away from citizens — especially voters — protections afforded to them under certain provincial or territorial laws?
Second, given the specific nature of your role and the work you do, I’d like to give you a chance to respond to the allegations we’ve heard here. I’m talking about claims that political parties collect a lot of data without people’s consent or knowledge and link those data to come up with something of an ideological profile of people. I’d like you to tell us about the data you collect, the need for it and the way you use it, but also the way you protect it.
[English]
Mr. Wilson: I’m just pulling up the Conservative Party of Canada’s privacy policy that discloses what information we do collect.
I listened to some of the earlier testimony, and like Mr. Levine, I think the imagination of prior witnesses as to the kind of information political parties in Canada collect and use is far more creative than anything that happens in reality.
We collect contact information, such as name, address, email address, date of birth and telephone number. We may also collect information regarding your residence, family members, language preference, political views or affiliations, voting preferences, donations and related financial information, like payment method and billing information, and other information you choose to share with us.
That is what the Conservative Party of Canada collects. It is disclosed on our website and has been for some time. The bogeyman of things you heard this morning or earlier this afternoon, I don’t know where that finds its base in reality.
Senator Saint-Germain: How do you protect this information?
Mr. Wilson: That is also disclosed in the privacy policy, but it is on password-protected databases. We have volunteers in 343 ridings across the country collecting information and dialoguing with voters on doorsteps, in subway stops and grocery store parking lots. The information flows back and forth between volunteers and voters. To the extent it’s recorded in our system, it is in password-protected databases.
Mr. Levine: Senator, you asked about whether this bill will take away provincial protections that are in place. The answer is no. At the moment, British Columbia is the only province asserting that provincial privacy law applies to federal political parties. That assertion has been stayed, pending ongoing litigation. I do anticipate this assertion goes well beyond British Columbia, that this is a matter that will ultimately have implications in a number of jurisdictions, which is why it is important that Parliament assert its exclusive and paramount federal jurisdiction on this.
However, the result of Bill C-4 will be to enhance the privacy regime — not as much as some of you would like, I will acknowledge — under the Canada Elections Act, and it will not change the current application of provincial law to federal political parties.
Ms. Allevato: I was going to invite you to look at the privacy policy. All of the parties have them on the website, and it has specific details of how it’s collected and how it’s protected. It’s fairly robust. It isn’t unusual, and it complies with the principles of the protection of privacy.
As I said at the very beginning, our primary concern is the potential for a patchwork of regulations across the country. It has already been said, but I think it bears repeating: Political parties are volunteer organizations for the most part, and it is very difficult to run a federal election when you’re trying to operate in all of the different ridings in the different provinces. I really encourage you to think about that.
Senator Saint-Germain: Thank you to all of you.
Senator Tannas: Thanks for being here. Certainly, I think we all have come to understand the urgency of the letter to the court that was read out in part. It demonstrates an expectation that we need to get on with this, and I agree that we can’t have a patchwork across the country for national parties.
However, I’m curious as to why, in this particular instance, the government chose to strip down the guts of the bill to almost nothing. It is as close to an empty box as you can get. Fair enough, we have heard little bits of things like:
There might be something coming soon. We hope there was something coming. There was broad consensus around a series of things, but it just wasn’t the right time.
Got it.
Could you individually express if you have any problems with the following points: the elements of Bill C-65; access to individual information by Canadians where they could request the information, review it for accuracy or request to see what information is being held; for parties to report a data breach, not just to people that may be exposed but also to an independent third party.
Is there anything on that list that you would object to in your own views?
The other question, maybe at the same time if you’re confirming or pointing something out, is this: Were you consulted on the idea of stripping this down and leaving all of the elements behind for another day?
Mr. Levine: Senator, I will try and answer the many questions that you have asked, being mindful of the time.
With respect to Bill C-65, there is no lack of support for the elements that are in there, but the convention is that electoral reform legislation requires consensus as much as possible. Governments typically try not to impose electoral reform legislation without broad consultation. There were 117 new members of Parliament, and given the timing that has been noted, it would not have been possible to build the kind of consensus around everything that is in Bill C-65 in the time necessary.
So while I can’t speak for the other place, it does seem that they made a conscious choice here to put forward at least the bare minimum to assert jurisdiction, with an intent to revisit the issue more substantively later. I very much hope and expect that that is the case.
I do support the elements that are in Bill C-65. The other two elements you raised, access to information and data breach, are complicated. As a general concept, as I said earlier, I think access to voter information is a good thing. It needs to be built in a way that prevents abuse and prevents tactical gamesmanship in that process, which is tricky.
With respect to data breaches, sometimes, particularly when talking about foreign interference, the purpose of the breach is to force disclosure.
For the Liberal Party, I can say that, if that were ever to happen, we would work closely with the Security Intelligence Threats to Elections Task Force, SITE Task Force for short, that has been set up by CSIS, the Communications Security Establishment and the RCMP to address what the right move forward would be. That agency, the SITE Task Force, has the ability to make public statements, but it might not be the right solution. Here again, where political parties are different than businesses, it would not be the right solution to impose a one-size-fits-all disclosure requirement on political parties.
Mr. Wilson: I largely echo what Mr. Levine has said. I wasn’t involved in shaping the legislation. My position is not something that we were asked to do, but largely, we were in agreement with the contents of Bill C-65, and I share Mr. Levine’s concern about the other two elements you raised.
The Chair: Ms. Allevato, do you want to comment?
Ms. Allevato: Yes. There is consensus on the content of the previous bill. I wanted to point out, and it is also in the public record in that case, where in response to a request for disclosure by the complainants in that case, the NDP provided, in addition to names, the civic address, previous address, phone, email, communication policy, election history, information that the party had in hand, the donor history and information about the email list. I wanted to point out that the party, under the privacy policy, provides this information, discloses already what information they have on hand with respect to any individual who makes a request for disclosure.
Senator Cuzner: Anyone who has been around an election and worked an election or has offered themselves up would know that an election is anything but a commercial enterprise. It is a couple of months of chaos.
That being said, I have a huge amount of respect for the Canadians that step up to offer themselves up. As has been said by the panel, they are primarily volunteers, more so financial agents — pretty much you need a CA — and that’s done on a volunteer basis as well. It’s been getting tougher to get volunteers.
I like your comments as to the increased measures and what kind of impact that will have on the recruitment and the retention of volunteers.
Mr. Levine: Senator, that is an excellent question. As I alluded to in response to an earlier question, we do have a very litigious and highly scrutinized political regime as it is. The Commissioner of Canada Elections issued 92 administrative monetary penalties last year, I believe, and comparable amounts in previous years.
It is already very complicated to be a political volunteer, particularly a political volunteer taking on a more senior role. Asking those volunteers to understand and abide by the complexity of 14 jurisdictions’ rules is simply untenable, and I think we will see people simply say, as important as public policy is to me, I am going to find a different way to participate in the process because this is simply too complicated. That will reduce political dialogue.
Senator Cuzner: I asked the previous panel: If you had a question to pose to this particular panel, what would it be? It was more a statement, I guess.
Does this panel understand what is at stake with the issues around the protection of personal information, around misinformation and disinformation, and foreign interference in our campaigns? The integrity of our elections and the trust of Canadians are at risk, but what I get from your testimony is you’re saying that is more of a policy. Bill C-4 is jurisdictional as opposed to more of a policy issue.
Mr. Levine: It is, senator, but I think what Bill C-4 is saying is that we cannot allow provincial regulations to collapse the space to have democratic dialogue. Parliament made an intentional choice, and it has made that choice again and again to ensure there is room for political dialogue. That political dialogue is the best tool we have to combat foreign interference, misinformation and disinformation that the Hogue commission spoke about.
The last thing we want to do is impose rules that are going to limit the ability of Canadian political parties to actually engage voters on the doorstep and on the phone in that dialogue, and meaningfully push back on disinformation and misinformation that may be coming from other jurisdictions.
Mr. Wilson: Again, the question being one of jurisdiction: a patchwork of provincial commercial focused privacy regimes is not the answer to international geopolitical threats and geopolitical risks. I think the national entities that have been established as the issues of emerging geopolitical threats and impacts on our elections come to the forefront more: the kinds of entities we work with, such as the Canadian Centre for Cyber Security, the Canadian Security Establishment, the RCMP, CSIS — these are the kinds of agencies that political parties turn to for help when there are cyber issues or when you’re dealing with geopolitical threats and data.
That is all better addressed at the national level and it is another reason why, whatever the policies and frameworks that get put in place, it has to be clear that federal political parties and their communications and management of data are regulated at the national level.
Senator Dalphond: Thank you, witnesses, for being here. I have questions where the answers can be yes or no.
I understand that you all have a privacy policy. The following three questions can be answered yes or no, and then I have another question. First, providing for access to information; second, the right to correct; third, the duty to report in case of breach; and fourth, the undertaking not to sell or share the information.
Mr. Wilson: Accuracy, the right to correct, we have. Political parties don’t want to have inaccurate information, so accuracy of personal information to provide updates, yes. A commitment not to sell, yes. Access is not provided expressly, although it might flow from the question of accuracy.
I missed the fourth one while taking down the list.
Senator Dalphond: Data breach — you experienced it last year, so you report it.
Mr. Wilson: It’s not subject to private policy, but we did have a data breach last year, and we did report it to those who were or may have been affected.
Senator Dalphond: Thank you. Mr. Levine?
Mr. Levine: My answers will be very similar to Mr. Wilson’s. Yes, we have a right to correct, and, yes, we have a commitment that we will not sell information that is in the privacy policy.
While we don’t formally offer a right of access in every instance to prevent abuse, we certainly have provided access in the past when requested to do so. With respect to breaches, as I alluded to earlier, in the event that we were to suffer a data breach, we would reach out to the SITE Task Force and work with the intelligence agencies to determine the best response.
But, as I said, that is not a one-size-fits-all answer for Canadian political parties.
Ms. Allevato: It is a similar answer here.
Senator Dalphond: The U.K. has adopted a different approach. They have a law that applies to businesses, government and political parties — with some adjustments for political parties — and is supervised by the same independent officer.
Why would that be a problem here in Canada? Because it is effectively the same model in Europe and a member of the European Union.
Mr. Levine: Senator, we didn’t receive a lot of details about the British model in the testimony of the commissioner that we heard earlier. I will observe that they do have the thing that the three of us are advocating for, which is a single, comprehensive, exclusive, uniform, national regime.
Once you have that, it becomes a question as to which of the enhancements, such as those found in Bill C-65, you want to take a look at. Certainly, to the extent we are talking about a single, national regime, I endorse the British model. However, we would need to have a much longer conversation about the details than we could have this afternoon.
Senator Dalphond: Mr. Wilson, do you agree?
Mr. Wilson: Yes, I think that comment is fair.
I do note that Commissioner Denham’s comments, which we all echo and agree with, are that political parties, even in the U.K., are regulated differently than commercial entities, and that is important to keep in mind. We’re not businesses, and we’re not commercial entities. We have a different democratic purpose to serve.
I’m not overly familiar with the U.K. regime, but I did take out of Commissioner Denham’s testimony that nuanced issues are regulated around privacy issues around political parties in democratic institutions.
Ms. Allevato: I have nothing to add, except for one point: Who would be the regulator? The issue was between whether it would be the Privacy Commissioner or the CEO. I think that is an issue that would have to be addressed very closely in terms of the balance.
Senator Dasko: Thank you, witnesses, for being here today.
I find it rather odd that political parties are just trying to describe themselves as almost the local chess club: They’re all just a bunch of volunteers, and they are just working away in a community in a very low-key way. Research does show that, throughout Canadian history, I believe the figure is 99% of all members of Parliament have been chosen through and by political parties. So, political parties are the gatekeepers to our most important democratic institution, and that is our elected Parliament — at least I believe it to be near the top of importance in terms of our institutions of democracy.
So, we must build public trust and confidence in our system, especially in the times we’re in.
My questions were identical to Senator Dalphond’s; I had the same three items I was going to ask the parties in terms of your practices: access by individuals to the files, the ability to change — I think we answered that — breaches of privacy being reported and if you sell the data. I think we did get answers to all that, do you feel? Yes.
Let me just ask a few other questions. First, the comment was made earlier that you do data collection by volunteers. You must be collecting data from other sources beside volunteers. Are you not? Can I ask one of you? For example, do you collect data from polling companies? Do you use polling companies to collect data, Mr. Levine?
Mr. Levine: The sources of how we collect data are in the privacy policy. If you look at the front page, it says how we obtain personal information and what we do with it. I won’t belabour the point by reading it all out here, but you will find that the ways we obtain data are much more vanilla than you might expect.
Typically, a polling company is engaged to provide a neutral assessment about the prospects in a particular electoral district or a particular region. That is inconsistent with voter tracking at the record level of support. There may be vendors that could be used, certainly for calling services by campaigns; that is certainly something that gets done.
But the vast majority of interactions that we have as a party with voters, and the information we receive, are, in fact, made by volunteers. That statement is one that I can quite comfortably stand behind.
Senator Dasko: Mr. Wilson, what other sources do you use beside volunteers?
Mr. Wilson: There are people that fill out online forms. That would be one source. Phoning.
Your question on polling — strictly speaking, polling would not be used to capture individualized data. There would be similar things like voter identification calls, which are phoning, where you are actually asking for the voter to identify if they support the party, yes or no; would they like to volunteer, yes or no; would you like to take a lawn sign, yes or no. That all could be done by volunteers or paid vendors that do that as a profession.
As with Mr. Levine, the people who are out knocking on doors across the country — I would suspect the main source of data collection is by phone, by volunteers or paid calling, but not polling, strictly speaking, which would be blind to the identity of the person providing the answer.
Ms. Allevato: The way the party collects personal information is if someone chooses to provide us information when they become a donor, when a member voluntarily subscribes to the party’s communications, when they register for an event or sign a petition in person or online that is by the party, when they complete any forms on NDP.ca and through voter contact activities like door-to-door canvassing and phone calls. Those are all set out.
It is the same answer with respect to polling.
Senator Dasko: Is the data consent-based in terms of collection?
Ms. Allevato: Yes.
Senator Dasko: Mr. Levine, is all of your data consent-based?
Mr. Levine: I’m not sure I understand the question, senator. You will have to be a bit more concise in what you’re asking.
Senator Dasko: Do the respondents agree to provide you with information based upon certain principles?
Mr. Levine: I take the position that there is implied consent when you knock on a voter’s door and begin a conversation with them, asking them about policy or support issues. Do we read a lengthy consent statement as to our entire privacy policy before we knock on that door? We don’t. And, frankly, if we did, we would be significantly limiting the democratic dialogue. That is one of the things that —
Senator Dasko: You mean you would be limiting your data collection. I think —
The Chair: We are out of time.
I want to thank the witnesses for appearing before the committee here today. Your answers have obviously been very helpful to us. Thank you for coming on short notice.
I remind honourable senators here that our final meeting of the day begins at 4:15 p.m., in 45 minutes, and it will last for two hours with two panels. In addition, from 6:15 p.m. to 7:15 p.m., we’ll be discussing how we might respond to the order of reference.
(The committee adjourned.)