Prepared by: BC Freedom of Information and Privacy Association (FIPA)
Date: June 16, 2025
Issue: Urgent concerns regarding Part 4 of Bill C-4, An Act respecting certain affordability measures for Canadians and another measure.
Summary:
Part 4 of Bill C-4 proposes amendments to the Canada Elections Act that would exempt federal political parties from modern privacy laws, creating a regime where parties are held to standards far below those governing businesses, governments, and national security agencies.
These provisions threaten the privacy rights of Canadians, open the door to data misuse, and undermine the integrity of Canadian democracy.
Key Concerns:
Sweeping Privacy Exemptions for Political Parties Amendments 44, 45, 46
Part 4 (Amendments 44 and 45) repeals Sections 385.1 and 385.2 of the Canada Elections Act, eliminating previously proposed requirements for political parties to have privacy policies subject to Elections Canada review.
Amendment 46 introduces a clause requiring a self-certified privacy policy from each party (s. 407(1)(c)), with no independent oversight, enforcement mechanism, or complaint process.
This move enshrines a double standard in federal law: political parties are not held accountable to federal privacy standards like those in the Personal Information Protection and Electronic Documents Act (PIPEDA) or the proposed Consumer Privacy Protection Act.
Erosion of Public Trust in Democratic Institutions
The proposed changes contradict international norms that stress transparency and accountability in political data use.
Political data abuses, exemplified by the Cambridge Analytica scandal during Brexit and its Canadian affiliate AggregateIQ, show how unregulated political profiling can undermine elections and manipulate voters.
Bill C-4 reintroduces a risk landscape where microtargeting, surveillance, and voter manipulation can flourish with impunity.
Obscured by Budget Legislation
The amendments are included in a budget implementation bill, minimizing scrutiny and public debate despite the substantive privacy implications being unrelated to fiscal matters.
This tactic short-circuits democratic deliberation, avoiding a standalone policy discussion on how political parties should handle Canadians’ personal data by placing this discussion in the Standing Committee on Finance (FINA) rather than Standing Committee on Access to Information, Privacy and Ethics (ETHI).
Contrary to Public Expectations and Global Trends
Public polling consistently shows that Canadians expect their personal information to be protected, especially by those seeking their votes.
Many democracies are moving toward stricter regulation of political data (e.g., the UK’s ICO recommendations post-Cambridge Analytica).
By contrast, Canada would be legislating a carve-out that allows political parties to write their own rules, something not afforded to businesses, hospitals, or even police forces.
These proposed provisions may put efforts to deepen integration between Canada and its European Union allies at risk as they are incongruent with the General Data Protection Regulations (GDPR), which standardize data protection across the European Union.
Potential Consequences:
Loss of international standing in privacy and democratic standards.
Increase in data-driven political disinformation and manipulation, particularly through third-party digital contractors.
Public backlash and growing cynicism about politics and elections.
Constitutional challenges over unequal privacy rights and protections.
Recommendations:
We respectfully urge Members of Parliament to:
Withdraw Part 4 from Bill C-4 immediately to prevent the passage of these regressive provisions.
Support a comprehensive, standalone review of privacy obligations for political parties through public consultation and committee study.
Ensure that political parties are subject to modern, enforceable privacy standards, overseen by an independent regulator such as the Office of the Privacy Commissioner of Canada.
Supporting References
FIPA’s Backgrounder on Bill C-4 Part 4, including its call to action
Principles of Consent, Purpose Limitation, Data Minimization, Individual Rights, Data Security, Accountability, International Co-operation. Evidenced in: General Data Protection Regulation (GDPR), Asia-Pacific Economic Cooperation Privacy Framework, Council of Europe’s Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, ISO 27701, Personal Information Protection and Electronic Documents Act
Organisation for Economic Co-operation and Development
You help us fulfill our mandate and stay independent. Every contribution – big, small, one-time, or recurring – makes a difference. Click here to donate.
