Federal Election and the Protection of Personal Information
Posted on Sep 25, 2019

Privacy has long been considered an essential value in supporting a democratic society. Democratic societies are renewed through elections, and a rigorous administration of the process ensures results are fair and credible.

Voting by secret ballot in Canada was an innovation of the 19th century, allowing electors to avoid much of the intimidation and rivalry that had existed around the voting station. It subsequently became very difficult to link a vote to a single person.

But by the beginning of the 21st century, technological changes allowed political parties in Canada to amass and purchase large data bases of information. Specialized software helped political analysts decide where to target different political messages, based on individual voter profiling. Elections had become data-driven.

And once more, it is again easy to influence electors, this time without their knowledge or consent. Yet despite the amount of personal information under their control, federal and provincial political parties across Canada, with the exception of British Columbia, have no privacy laws that apply to them. But the federal government has now moved to encourage political parties to observe privacy protection standards.

New privacy requirements for political parties
But recent amendments to the Canada Elections Act have created novel obligations for federal political parties using personal information. In the absence of compliance with privacy legislation, parties must now create their own privacy policies as a condition of registration, submit such policies to the Chief Electoral Officer and publish them online.

In this new context the Office of the Privacy Commissioner of Canada, together with the Chief Electoral Officer, have prepared joint guidance to assist electoral candidates, incumbent officials, political party staff and volunteers in complying with these new requirements. Any subsequent change in the privacy policy of a political party must be notified to the Chief Electoral Officer as well as updated online.

What the guidance says
Possible misuse of personal information in the context of elections has been the subject of recent investigation in many countries and these investigations form the background to the topics discussed.

The guidance notes that the revised Canada Elections Act does not require political parties to comply with international privacy standards. But political parties will nevertheless have to define and publish on their web site six core elements of a privacy policy. These are:

  • The type of personal information collected and how it is done;
  • How the party protects the personal information under its control;
  • How the party uses this personal information and under what circumstances it may be sold to a third party;
  • The type of training given to employees who have access to personal information under the party’s control;
  • A description of how personal information online is collected and used by the party and how and when it uses cookies;
  • The name and contact information of a person to whom concerns about the party’s policy can be addressed.

International standards and further reading
While not part of the new legal requirements, the internationally recognized Fair Information Principles FIPS, which form the basis for Canada’s private sector law, the Personal Information and Electronic Documents Act PIPEDA, are usefully listed in the guidance in a form that is adapted to the realities of political parties.

Digital political ad registries
Political parties, their supporters, online platforms, websites and applications may all be caught in new provisions for political advertising registries, based on exact factual circumstances. Basically, these new requirements seek to make the interests behind political advertising in Canada more transparent and to prohibit online foreign interference in federal elections.

Now, platforms (Internet sites or applications) who sell advertising space for what is identified as partisan or election advertising must create digital advertising registries as soon as they start displaying ads. This requirement will apply once a monthly unique visit threshold to the site in Canada is achieved: three million for sites chiefly in English, one million for sites chiefly in French and 100,000 for other languages. The registry must identify the ads published on the first day they are displayed as well as the name of the person who authorized its publication.

Issue advertising is also regulated, but only during the defined electoral period. Issue advertising is defined as a message which takes a position on an issue with which a candidate or registered party is associated, without identifying the candidate or party in any way. Now a tagline is required stating who authorized the ad.

Further information on requirements for political parties and platforms selling advertisements to be published on other sites can be found at:

More than a page of further resources are included, including provincial, federal and international links on the question as well as in-depth scholarly analyses.

Jennifer Stoddart served as Privacy Commissioner of Canada (2003 to 2013) and previously chaired the Access to Information Commission for Quebec. She is currently a strategic advisor in the Privacy and Cybersecurity Group of the Canadian law firm Fasken.

Ms. Stoddart’s article, “The Federal Election and the Protection of Personal Information,” is part of Fasken’s new series on federal election laws.

A previous Fasken article, “Upcoming Federal Elections: Employees' Right to Vote,” is available here. It provides an overview of the applicable employment laws ahead of election day, on October 21. <>