Green Party says its 'inadvertent' disclosure of voters' personal info 'not a serious issue'

OTTAWA – The Green Party of Canada says that after speaking with Elections Canada, it believes that "inadvertent" disclosure of voters' personal information in a series of campaign training videos is "not a serious issue."

On Tuesday the party removed the videos, which were publicly accessible from its website, after CTV News discovered that they contained real voters' personal information hosted within the party's voter information database.   

On Wednesday CTV News alerted the party to additional videos hosted in another section of its open database of campaign guides, which also appeared to show voters' personal information on screen briefly. They were removed Wednesday afternoon.

"We have contacted Elections Canada and have been advised that their preliminary assessment indicates that this is not a serious issue," said party spokesperson Rosie Emery in a statement. The party wouldn't comment on what internal next steps, if any, it will be taking going forward.

Elections Canada spokesperson Ghislain Desjardins told CTV News that while there are strict penalties for the misuse of voter information, the relevant offences under the Canada Elections Act "require the misuse to be intentional," and that generally speaking, "inadvertent disclosure of personal information" would not be an infraction.

Ultimately, it will be up to the Commissioner of Canada Elections Yves Cote—the independent office in charge of enforcing federal elections law—to conclude whether or not the party has contravened the Canada Elections Act.

Cote's office would not say whether it is looking into this matter. The system is complaints-based.

"We do review all complaints that are submitted to our office to determine whether they fall under our mandate," said spokesperson Michelle Laliberte in an email. Should this instance be deemed a contravention of the Act, it would likely only be made public if there was a compliance agreement made, an administrative monetary penalty issued, or charges laid.

It remains unclear how long the videos had been available in this campaign training database, which is accessible by anyone who follows a few links through the party's website.

The Green Party noted that in these videos only "a small number" of Canadian voters' information was shown, but it included lists of dozens of names, and depending on the video, some combination of: addresses, phone numbers, email addresses, whether they were an active party member or volunteer, and how they scored in terms of support for the party.

CTV News contacted more than a dozen of the people whose names and information was visible in the videos. The people who responded were either surprised and unimpressed, or didn’t express overt concern, noting that the level of personal information is generally already publicly accessible.

All parties have Canadians’ info

All parties have some form of a voter information database, which is fundamental to running voter contact on the ground in each riding. The information contained in these systems is generally a combination of Elections Canada's voters lists, information collected from public data sources, and information gleaned from people at the door, or when they interact with a party online.

This is information only meant to be viewed by people with authorized access. This kind of voter information from Elections Canada is provided to parties under the condition that they take "reasonable precautions to protect the security and confidentiality of the personal information of Canadian Electors," including restricting who has access to this information, and technical safeguards to minimize the risk of unauthorized access.

The Elections Canada information is allowed to be used to communicate with electors, solicit donations, or recruit party members, and Elections Canada says that training party workers to use these lists in order to carry out these tasks is a "permissible use."

Parties are also provided with guidelines for what to do in the event of an inadvertent disclosure of personal information.

Under current law political parties are required to post their privacy policies but there is nothing stricter, nor is there oversight on the data they collect. Elections Canada is not responsible for enforcing parties' privacy policies.

OpenMedia— a civic engagement organization that focuses on internet policy—released a report just ahead of the election that found that none of the parties come close to meeting peoples’ expectations of privacy protections, from being able to see what information a party has collected about them, and being aware of how that data is being used.

• Spy agency warns campaign teams 'more likely' targets of cyber attacks

Because they are in possession of so much personal information, political campaigns, their staff, volunteers and candidates are considered prime targets for attempted foreign interference and cyber attacks during this election.

As a result, the federal political parties have been encouraged to strengthen their cyber security defenses, enhance awareness about the potential ways data can be compromised, and have been receiving expert briefings on securing their campaigns.