The case for making political parties follow the same privacy rules as corporations

Though it's a topic the major parties don't seem too interested in discussing, the use of mobile apps as a key part of campaigning raises some important questions: What data is being collected? How is it being analyzed? And where is it being shared?

Given how voter data has been misused and manipulated in recent elections around the world, some experts wonder why there isn't more scrutiny of how Canada's political parties use the information they collect.

Whether a party's app is a tool forcanvassers to catalogue information about voters, or a social network to engage and inform supporters, the collection and exchange of information is the core function.

So far, the conversation around technology and the internet during this election campaign has been dominated by promises about price and access.

By now, most of the parties have also touched on issues such as regulation, privacy, data sovereignty, and the effort to keep tech giants such as Google and Facebook in check.

However, while some of the parties are pushing for greater transparency among tech firms, there is a "real concern about [political parties] not practising what they preach," said Prof. Colin Bennett of the University of Victoria, who studies privacy and politics.

Parties exempt from law

Many Canadians might be surprised to learn, for example, that political parties are not subject to the same privacy rules as other organizations, such as governments and corporations, both of which must adhereto the Personal Information Protection and Electronic Documents Act (PIPEDA).

"Corporations and government need to obtain an individual's consent before collecting or using their data, but campaigning parties are not prevented from using people's personal information, which can be collected without opt-in, to pitch their politics," saidAnn Cavoukian, the former privacy commissioner of Ontario and founder of the Privacy by Design framework, which encourages organizations to create technologies that are private by default and let users opt-in to data-sharing features.

This means, for example, a party could text you without youever having provided the party with your phone number. Orthatthe aggregate of your personal information could be used to create a detailed profileso the party could target you with customized campaign messaging.

Bennett points out that political parties use similar strategies as many private companies, including applying data analytics, purchasing ad space on websites such as Facebook and hiring telemarketing firms.

"The techniques of consumer marketing entered the political world a long time ago, so there's no clear reason why they should be exempt from the rules others have to follow."

The Conservatives' app, called the CPC App, is basically a social networking service for the party's supportersthat provides updates and news about the campaign.

If you dig into the CPC App's privacy policy, you can see that it claims rights to user content for purposes that include advertising, marketing, publicity and promotional activities, and takes no responsibility for third-party uses of data that has been uploaded to the app.

Conservative Leader Andrew Scheer introduced a policy platform titled "Cyber Security Measures to Protect Your Personal Data," detailing measures his partywould take to safeguard Canadians' data, including requiring that companies collecting electronic data receive informed consent from Canadians.

But when it comes to his party's own app, the Conservative privacy policy reads, "We have limited control over who views your content while it is being transmitted through the CPC App and no control over who views your content after it has been transmitted through or uploaded to the app or any third-party uses that are made of your content."

CBC reached out to the Conservative Partyto ask aboutthis clause, and about what, if any, accessthe app's U.S.-based developerhas to user data, as well as the Conservative position on whether political parties should be subject to privacy laws.

A party spokesperson didn't respond to those questions directly, but instead sent a link to the privacy policy in question.

The Liberals' app, called MiniVAN, allows canvassers to input data into their smartphone as they're going door to door meeting voters.

When asked about how the app uses voter information, Liberal spokesperson Guy Gallant provided a link to the party's general privacy policy and said, "Protecting the information of the Canadians with whom we engage continues to be a foremost priority for the party in all of our operations, organizing, and digital communications."

While the policy includes a list of what kinds of information the app collects (name, contact information and donation information)and how the party might use the data (to communicate with you),Cavoukian points out the list isn't required to be exhaustive.

Plus, she said,without external oversight or enforcement, the privacy policy is meaningless.

"They can essentially do whatever they want."

Group challenges status quo

In light of this, the Centre for Digital Rights, an advocacy group founded by Jim Balsillie, former co-CEO of BlackBerry-maker Research in Motion, filed a complaint to the Competition Bureau of Canada and a handful of other watchdog organizations, arguing that some partiesdeliberately mislead Canadians with inaccurate privacy policies.

The complaint alleges parties compile data from sources such associal media posts and door-to-door campaigning to amass detailed databasesthat ultimately assess the political leanings of individuals.

The centre's core argument is thatpolitical parties should no longer be exempt from PIPEDA.

While a recent update to Canada's election laws requires each party to have its own privacy policy, it does not stipulate what those policies should contain.

Cavoukian says parties should have to obtain consent before collecting voter data, and specify why they're collecting the information and precisely how they will use it.

The irony is, while some candidates are advocating for greater transparency from big tech, they may be benefiting from the very same tools on the campaign trail, and in so doing, missing out on an opportunity to differentiate themselves.