Commissioner expresses deep concern about potential effects on more than 2.9 million Albertans whose personal information was shared
The Office of the Information and Privacy Commissioner (OIPC) of Alberta is still working to obtain more information regarding the unauthorized release of personal information from the List of Electors generated by Elections Alberta.
On the morning of Thursday, April 30th, the OIPC was informed by Elections Alberta of a potential breach of the List of Electors by a third party.
Throughout the day, additional information was obtained from various sources, including news releases issued by the Office of the Chief Electoral Officer, enquiries from reporters, and news stories, regarding the involvement of a group called The Centurion Project. According to these sources, the group had made public on its website a list of 2.9 million Albertans’ names, addresses and, in some cases, phone numbers; that the source of this information was the List of Electors maintained by the Chief Electoral Officer of Alberta; and that the list may have come from a political party that had legitimate access to the list.
“My office is still working to determine the facts of this case,” said Commissioner Diane McLeod. “However, it appears this matter may fall outside my jurisdiction. My office does not have jurisdiction over personal information contained in the List of Electors that may have been disclosed by a political party. This is because the Personal Information Protection Act (PIPA) does not apply to political parties. As this matter unfolds, we will continue to work to determine whether we have jurisdiction over The Centurion Project. If so, I will investigate to determine whether any violations of PIPA occurred in acquiring the personal information and making it publicly accessible.”
“What happened here is very serious,” added McLeod. “More than 2.9 million Albertans have had their personal information breached. For some of these individuals there is likely a real risk of significant harm given that their home address and phone numbers have been made public. This could be especially harmful for certain individuals. Some examples might be those who work for law enforcement, who are public officials, who are fleeing intimate partner violence and other vulnerable individuals. This incident demonstrates that it is high time for political parties to be made subject to PIPA.”
The List of Electors is obtained under the Elections Act from the Chief Electoral Officer as is authorized by that Act. This Act (section 18) requires the Chief Electoral Officer to distribute a List of Electors to political parties, non-party-affiliated members of the Alberta Legislative Assembly, and to potential candidates in certain circumstances and for specified purposes. The Elections Act governs use and disclosure of this information by those who are permitted to receive it. It is an offence to contravene the Elections Act, and, if found guilty, the fine is up to $10,000.
“This is evidence of a concerning gap in Alberta’s privacy laws as it relates to the collection, use and disclosure of personal information by political parties,” concluded McLeod. “This gap has been recognized by my office, which has been calling for PIPA to be amended to include political parties for decades. During the PIPA review, which is still underway, we renewed the call for political parties to be made subject to the Act. Of note is that BC’s PIPA, which is substantially similar to Alberta’s, does apply to BC’s political parties. I am once again calling on government to make political parties subject to PIPA in the next set of amendments to the Act.”
Through the OIPC, the Information and Privacy Commissioner performs the responsibilities set out in Alberta’s access to information and privacy laws, the Access to Information Act, the Protection of Privacy Act, the Freedom of Information and Protection of Privacy Act during the transition period, the Health Information Act, and the Personal Information Protection Act. The Commissioner operates independently of government.
For more information:
Elaine Schiman
Communications Manager
Office of the Information and Privacy Commissioner of Alberta
communications@oipc.ab.ca
Mobile: (587) 983-8766