B.C. political parties have been giving Facebook voters’ data, a provincial information and privacy commissioner’s report on political parties handling of voter information released Feb. 6 says.
The governing BC NDP is the worst offender, giving Facebook voters’ names, phone numbers, cities of residence and dates of birth, while the BC Liberals have uploaded only financial donor lists to the global social media site, Michael McEvoy’s report said.
Computer/Unsplash
The Green Party also uses a technological tool to link email address to social media profiles, something the commissioner said lacks consent.
“All of the parties need to do much better to ensure they are within the boundaries of the Personal Information Protection Act (PIPA),” he said in an interview.
“Facebook for example, will match the emails (or other supplied identifiers) with the voter’s Facebook account if they have one. The party then advertises to that individual through their Facebook newsfeed,” McEvoy’s report said. “All three parties use this advertising strategy.”
McEvoy called the practices “privacy-invasive techniques used to gain electoral advantage.”
He said the law does not allow such practices without express consent of the individual from whom the data was collected. But, he said, that’s a challenging legal issue for many people. “They may not even know what to complain about,” he said.
McEvoy said unless precautions are taken, parties could use high-tech tools to profile and micro-target voters, something McEvoy called a risk to democracy.
That risk, he said, revolves around trust between the parties and voters. “If that trust breaks down, it impairs the system,” he said.
Both the Liberals and NDP pledged to review the report work with the commissioner.
Protecting the privacy of British Columbians is extremely important to us and we are always open to ways we can improve,” said NDP provincial director Raj Sihota. “We will review the commissioner's findings and recommendations in detail, and determine the appropriate steps to further improve how we protect privacy and personal information, beginning with updates to our privacy policy,” Liberal director of communications Deanie Wong said.
Information Collected
The report said B.C. parties aren’t properly explaining to voters how much personal information they collect on them and what they do with it.
Such information includes: age, sex, ethnicity, religion, income, education, professional status, income, family status, years at residential address, workplace, political activities, credit card details and voters list data among others.
McEvoy’s work looked at how the NDP, Greens and Liberals manage and protect  such information. He found deficiencies in retention and audit practices preventing full compliance with PIPA.
Parties collect data given voluntarily through door-to-door and telephone canvassing or through petitions, data brokers and social media.
“Some of the parties analyze and profile the voters in their database,” McEvoy’s report said. “They use the personal information collected about voters to infer demographics and predict support. Again, parties need consent to use personal information for this purpose.”
Further, such information might be given to a company like Facebook “to find and target individuals who may share similar attributes or political leanings.”
"In addition to over-collection, we also found all of the political parties had inadequate privacy training and indefinite retention of the information,” McEvoy said. “This, combined with the vast amount of sensitive personal information collected, leaves political parties, and by default voters, vulnerable. Political parties must ensure the same effort goes into protecting personal information as is put into collecting it.”
Another method of data collection is through professional and business directories although only the NDP admitted using the method to identify potential party donors to the party. McEvoy said there appears no reasonable connection between such directories and donations. As such, he said, the practice could run afoul of the law.
On availability of party privacy policies, it was once again the NDP that came under fire.
McEvoy said the Liberals and Greens have policies on their websites while the NDP has posted one of three policies.
“The BC NDP’s decision to split their privacy policies into three documents and only publicly publish the one that relates to their website traffic is not consistent with PIPA’s overall objectives of transparency and accountability in this area. For one thing, the public would not be aware of the presence of two of the policies. More importantly, the policy that most comprehensively describes the BC NDP’s privacy practices is not readily accessible to the public.”
In addition to complaints to his office, McEvoy said the decision to look into the B.C. situation was spurred by the case of Cambridge Analytica and its use of personal data “to psychologically profile U.S. voters is one example that sent shockwaves around the world.” The company is alleged to have harvested information from 50 million Facebook users to help President Donald Trump take the 2016 U.S. election.
The commissioner made 17 recommendations , including that parties:
• prominently provide simple explanation of purposes for gathering personal information at the point of collection;
• not collect the personal information of voters, including but not limited to gender, religion, and ethnicity information unless the voter has consented to its collection;
• ensure they collect only personal information from social media with the consent of the individual;
• be transparent about how they profile voters;
• only disclose email addresses to social media providers with express consent of individuals;
• parties should be transparent about how they profile voters, and;
• parties should be clear about the ability to, and the consequences of, withdrawing consent for collection, use, and disclosure.
McEvoy has begun discussions with B.C.’s chief electoral officer, including work to create a privacy policy for parties to agree to prior to receiving voters’ lists. IN the last election, the list given to the three parties covered 3.3 million names.
Another idea McEvoy is considering is a code of practice governing how political
parties handle personal information.
Such a code is under consideration by U.K. privacy commissioner Elizabeth Denham, McEvoy’s B.C. predecessor.
Denham has proposed such a code would deal with matters such as personal data analytics, online advertising and the use of social media.
“Myself and BC’s chief electoral officer have discussed jointly advancing this idea to political parties,” McEvoy said.
