Political Parties and the Public’s Privacy

In most democratic countries, the opportunities for political parties to capture and use personal information to identify and target voters are constrained by comprehensive privacy protection laws. This is not the case in Canada.

Canadian political parties are not generally covered by Canadian privacy legislation – either at the federal or provincial levels. Generally, individuals have no legal rights to learn what information about them is contained in party databases, to access and correct that information, to remove themselves from the systems, or to restrict the collection, use and disclosure of their personal information. Parties can typically capture personal information from multiple sources, analyze it freely, and mobilize it to target messages on the doorstep, through email and text, and over social media platforms. A ten-year campaign to bring Canada’s federal political parties (FPPs) under the umbrella of comprehensive federal privacy law, and the oversight of the Office of the Privacy Commissioner of Canada has been met with stiff and generally unified resistance. Political parties are still the one category of organization in Canada over which individuals have few, if any, legal privacy rights.

Rather than amend federal privacy legislation to cover the personal data processed by the FPPs, as has been recommended by many individuals and groups, the federal government has concluded that the Canada Elections Act (CEA) is the appropriate statutory vehicle to regulate their personal information practices. The government’s latest attempt to shield federal political parties from effective regulation, is manifested in the amendments to the CEA Part IV of Bill C­4. C‑4 passed the House in December 2025. Through some vigorous campaigning, however, Part IV was subjected to some close scrutiny by the Senate Committee on Legal and Constitutional Affairs. As a result, the Senate took the unusual step of amending Part IV and adding a three-year sunset clause designed to give the government time to develop some credible privacy rules, consistent with those it is happy to impose on the private sector and government agencies. We do not yet know whether the House will accept the Senate amendment.

Section 446.2 of Bill C­4 is intended to provide for a “national, uniform, exclusive and complete” privacy regime for FPPs. Section 446.3 stipulates that the provisions of the FPPs’ privacy policies apply broadly to “any registered party or eligible party, as well as any person or entity acting on the party’s behalf, including the party’s candidates, electoral district associations, officers, agents, employees, volunteers and representatives.” In actuality, the privacy provisions in Bill C-4 do not constitute a “national, uniform, exclusive and complete” regime for the protection of personal information processed by the FPPs for several reasons.

First, the Canada Elections Act is not the appropriate statutory vehicle for imposing privacy obligations on the FPPs. Privacy protection law is that vehicle. Contemporary privacy protection law is complex and requires far more than the obligations for the transparency included in Part 4. The provisions are not “complete”. On the contrary, they are incomplete. 

Second, privacy law should include all ten principles in PIPEDA, supplemented with proper and enforceable provisions for independent oversight and accountability. The current provisions proposed in Part 4 amount to little more than requiring political parties to indicate what they do, and give “illustrative examples.” In practical terms, these amendments permit the FPPs to collect whatever personal data they wish from whatever sources, and process it in any way they please, provided they mention that that is their practice. No further transparency is required. As well, there is no external statutory standard for the legal processing of personal data, as is the cornerstone of international data protection law. 

Accordingly, there is nothing to oblige the FPPs to follow the same practices imposed on private sector organizations and public bodies. FPPs could (and by all accounts do) collect different categories of personal data from different sources. They could (and by all accounts do) share it widely within the larger campaigning ecosystem. They could (and by all accounts do) follow different security practices and standards.

Given the above, it is clear that Part 4 amounts to little more than “self-regulation” and therefore, by definition, cannot be a uniform standard.

Third, and contrary to the claim in Section 446 (2) that these amendments will provide for a “national, uniform, exclusive and complete” privacy regime for FPPs the amendments actually do nothing of the sort, when one considers the entire network of individuals, organizations and companies involved in contemporary political campaigns. A 2025 report from Open Media, based on analysis of national and provincial filings on campaign expenditures, reveals over 90 companies in Canada that work for political parties at federal, provincial, and municipal levels and which are obliged to comply with PIPEDA. The report demonstrates that the campaigning ecosystem in Canada is extensive, dynamic, and complex. All organizations within this ecosystem need to abide by the same rules with respect to the protection of personal information.

Fourth, there is no meaningful oversight or enforcement mechanism. The provisions in Bill C­4 are designed to enforce compliance by individuals and organizations that work in some capacity for the FPPs. 

• They do not address the deeper question of whether or not the practices of the FPPs (as reflected in their privacy policies) violate the reasonable expectations of privacy of Canadians. 

• There is no clear process for complaint investigation and resolution.  

• There is no indication of what individuals are supposed to do if they are dissatisfied with the response received from the party’s privacy officer. 

• There is no recourse for Canadians whose personal information in the hands of political parties is breached or disclosed without consent

At root, this issue is not only about privacy rights. It is about the heath and resilience of our democracy, and about restoring the trust Canadians have in their political institutions — including political parties. The application of privacy law across the campaigning environment can assist in enforcing more transparency and the rebuilding that trust. Political campaigning is changing dramatically as elections increasingly become more “data-driven” and voter analytics, predictive modelling, and artificial intelligence tools drive campaign communications. The need to develop and apply a strong and consistent set of enforceable privacy rules is urgent.

If you are concerned about this issue or want to learn more, visit https://www.ourcommons.ca/petitions/en/Petition/Details?Petition=e-7237

Colin Bennett is Emeritus Professor of Political Science and Fellow at the Center for Global Studies at the University of Victoria, British Columbia.