Bill C-4: Join a Political Party in Canada and Mess Up Your Life?

That “other measure” from “BILL C-4 An Act respecting certain affordability measures for Canadians and another measure” is bizarre. Ok. Bizarre isn’t quite strong enough. I’ll let you come up with something better after reading this post.

Part 4 of the bill - the other measure - “amends the Canada Elections Act to make changes to the requirements relating to political parties’ policies for the protection of personal information”.

What changes? Well Subdivision C of the Canada Elections Act would now state that federal political parties “cannot be required to comply with an Act of a province or territory that regulates activities in relation to personal information”. They would, instead, be bound only by each “party’s policy for the protection of personal information”.

Ok. But wouldn’t parties still be regulated by federal law? Sadly not. The Privacy Act only governs the way federal government institutions handle data. And PIPEDA (Personal Information Protection and Electronic Documents Act) only covers private organizations engaged in commercial activity.

How’s the bill moving along? It passed second reading in June by a vote of 235 to zero.

Why would anyone think this is a good idea? It’s possible that party organizations - which do, after all, operate in all provinces and territories - have worried about data protection compliance being complicated by overlapping jurisdictions. They could also be trying to get ahead of existing pressure from privacy commissioners in B.C. and Quebec.

But the costs to individual Canadians could be enormous.

What kind of data are we talking about?

It’s true that signing up for party membership usually involves sharing nothing more than some combination of your name, address, age, email address, and phone number. But that’s only the beginning. Because those few details give data professionals enough of a base from which to build deep profiles.

For example, those data points could be cross referenced with information scraped from social media platforms or compiled from online interactions, donation histories, court records, and even employment backgrounds¹ that were purchased from data brokers.

What could parties do with all that data?

Any party with access to such data would be professionally negligent if they didn’t use it to build detailed profiles about every name on their list. It’s almost too easy to convert social media histories into rich narratives about your personal health; religious, ethnic, and demographic background; family and economic status; and emotional preferences and weaknesses.

Such information can be used to create personalized and manipulating ad campaigns. In 2025, only an utterly incompetent² party would pass up the opportunity to serve variable and/or misleading emails and text messages to individual demographic (and psychological profile) slices at any level of detail.

For a best-case scenario, try to imagine how many unpatched smartphones, tablets, and laptops share digital access to campaign databases. Now think about how chaotic campaigns can get and how data integrity considerations probably don’t rank among even the top 10 or 20 organizational priorities.

What harms could come from abuse of such data?

Everything we’ve seen so far could be true for anyone with a computer and an internet connection. What Bill C-4 would change is that federal political parties would face no legal restrictions in what they’re allowed to do that all that data.

That means they’d have no clear duty to:

• Protect their data from exposure and misuse

• Report breaches

• Submit their data activities to external audits

• Correct errors or remove defamatory information

• Avoid selling their data - and the insights that the data has produced - to third parties

In other words, parties will have a free get-out-of-jail-free card. As a result they’d have precious little incentive to police themselves for negligence and abuse.

All of which means that, for the low, low price of a single party membership card, you’ve bought yourself vulnerability to the threat of identity theft, harassment, and exposure of your sensitive (and likely controversial) political views. Employers, landlords, insurers, neighbors, old enemies, new enemies, future enemies? They’d be crazy not to drink deep from this Pierian spring.

Also, think about it: who do you know who can grow especially close to political parties? Governments, that’s who. And do you know what governments could do with databases of citizens who don’t think the same way they’d like them to?

Unlikely? Perhaps. But Bill C-4 would make it mostly legal.

The best part is that this will all be considered law retroactively from May 31, 2000!³ So any old data in parties’ databases is also covered.

All things considered, am I likely to join or even donate to a Canadian political party in the foreseeable future? Nope. Not happening. The mere fact that they want this power tells me everything I need to know about their long-term goals.

---

Here’s more stuff to read:

1. Do you have any idea how much information your LinkinIn profile actually reveals about you?

2. “Utterly incompetent” may be our best hope right now.

3. “The headings before section 446.‍1 and sections 446.‍1 to 446.‍4 of the Canada Elections Act, as enacted by section 47, are deemed to have come into force on May 31, 2000.”