Federal Political Parties Must Follow BC’s Privacy Law, Commissioner Rules

Federal political organizations are required to follow British Columbia’s privacy law, according to an order the province’s Information and Privacy Commissioner released Thursday.

The order was made following a citizen’s complaint about an email they received from an NDP riding association.

“Since I have decided that [the Personal Information Protection Act] does apply to the organization, the inquiry will continue into the merits of the complainants’ allegations,” said commissioner Michael McEvoy’s ruling.

The act, known as PIPA, gives people in B.C. the legal right to find out what personal information an organization may have about them, how they’ve used it, and to whom they have disclosed it.

Two federal parties have said they believe the B.C. law doesn’t apply to them, and none of the four main parties fully complied with recent requests The Tyee made to them under it.

McEvoy’s inquiry stemmed from an April 2018 complaint made to his office about an email the Courtenay-Alberni Riding Association of the New Democratic Party of Canada had sent a few months earlier inviting people, including the two unnamed complainants, to a “meet and greet” with Leader Jagmeet Singh.

One of the individuals wrote to the local NDP member of parliament, Gord Johns, and sent a copy to the federal party as well, to express concern about how the riding association got the email address and he and his spouse’s personal information.

“Exactly what information has your organization collected about myself and my wife?” he asked, citing the Personal Information Protection Act. “When and how was our information obtained and where was it sourced? Who has our personal information been shared with? Who has had and will have access to this information? How is that information currently being used by your organization, and how has it been used up to this point?”

When the NDP failed to respond, they complained to McEvoy’s office, who followed up with the party.

In a November 2018 letter quoted by McEvoy, the NDP argued that “PIPA does not apply to the activities of Canada’s New Democrats” and the information and privacy commissioner lacked the jurisdiction to investigate.

“The organization argued on constitutional grounds that PIPA does not apply to its collection, use or disclosure of personal information,” McEvoy said in the summary to his order. “It contended that PIPA is outside the province’s legislative authority to the extent that PIPA applies to the organization. It also argued that, under the constitutional paramountcy doctrine, the Canada Elections Act and other federal statutes prevail over PIPA.”

McEvoy found that he does have jurisdiction, and after considering submissions from the complainants, the NDP, B.C. Attorney General David Eby and the advocacy group Freedom of Information and Privacy Association, he rejected the NDP’s arguments and found PIPA does apply to federal political organizations.

McEvoy was unavailable for interviews since the matter is ongoing, a further hearing being needed to consider the merits of the complaints against the party.

“It’s a very important decision,” said Colin Bennett, a University of Victoria political science professor who’s an expert on privacy protection. “It tells federal political parties that the standards that apply to their provincial counterparts should apply to them as well.”

Bennett said that while he expects McEvoy’s order to get tested in court, it shouldn’t really be a big issue for the parties to comply with B.C.’s privacy law. “Every other organization in Canada has to apply basic privacy principles. Why should federal political parties be any different?”

Mike Larsen, the president of the Freedom of Information and Privacy Association and the chair of the criminology department at Kwantlen Polytechnic University, said McEvoy had made a good decision that has national importance.

“We’re happy to see it moving forward,” he said. “There are going to be a lot of eyes on it because it has implications across the country.”

There’s been increased public interest in privacy laws in the wake of Facebook’s admission last year that the personal information of tens of millions of people was improperly shared with Cambridge Analytica, a digital advertising company that had the ability to connect the data to individuals’ psychological profiles.

The improperly shared Facebook data included information from more than 600,000 Canadians, and there were various connections to people who had worked on political campaigns in Canada, including through AggregateIQ, the Victoria, B.C., firm that was instrumental in the 2017 Brexit referendum.

There is, however, no federal law in Canada allowing individuals to find out what political parties know about them and how they’ve used the information.

The NDP has called for making all federal political parties subject to federal privacy law provisions.