OFFICE OF THE INFORMATION & PRIVACY COMMISSIONER for Prince Edward Island. Order No. PP Re: Elections PEI. March 15, 2019

Transcription

1 OFFICE OF THE INFORMATION & PRIVACY COMMISSIONER for Prince Edward Island Order No. PP Re: Elections PEI March 15, 2019 Prince Edward Island Information and Privacy Commissioner Karen A. Rose Summary: This investigation addressed Elections PEI s practice of disclosing to an election candidate, or to their delegate, via an electronic portal, regularly updated information regarding whether each elector has voted. The key stated purpose of Elections PEI s disclosure of who has voted, is to enlist political parties and campaign teams to help to get out the vote. The Commissioner found that this purpose of disclosure does not satisfy clause 37(1)(b) of the FOIPP Act. The Commissioner further found that, in all the circumstances, Elections PEI s disclosure of whether a voter has cast a ballot, contravenes Part II, Division 2, of the FOIPP Act. The Commissioner ordered Elections PEI to stop disclosing this information. Elections PEI also discloses, electronically, a list of electors, to political parties. The Commissioner found that this disclosure is authorized by the FOIPP Act, and Elections PEI has made reasonable security arrangements to protect the list of electors against such risks as unauthorized access, use, or disclosure, in accordance with section 35 of the FOIPP Act. Page 1 of 26

2 As the Commissioner has found that Elections PEI is not authorized to disclose the additional information regarding who has voted, the Commissioner did not address the security arrangements in place to protect this information. Statutes Considered: Freedom of Information and Protection of Privacy Act, RSPEI 1988, cap. F-15.01, ss. 1(i), 15, 35, 37, 38, 50(1)(a) Election Act, RSPEI 1988, cap. E-1.1, ss. 1, 24.1, 62, 115, 116, 129.1, 139(2) Municipal Election Regulations, PEI Reg EC749/17 to the Municipal Government Act RSPEI 1988, c M-12.1, s. 22(2) Election Act, RSBC 1996, c 106, ss. 51, 275 Electronic Commerce Act, RSPEI 1988, Cap E 4.1 Decisions Cited: PEI Order PP , Re: Elections PEI BC Investigation Report P19-01, Full disclosure: Political parties, campaign data, and voter consent, February 6, 2019, 2019 BCIPC 7 (CanLII)] Other Resources Cited: 2015 Report of the Chief Electoral Officer of Prince Edward Island I. BACKGROUND [1] The Office of the Information and Privacy Commissioner (the Commissioner ) commenced this investigation after receiving a question from a journalist. The Page 2 of 26

3 journalist s inquiry was about Elections PEI s practice, on polling day, of allowing political parties to electronically access updates to Elections PEI s voter list, which shows which electors have cast ballots. [2] After making some initial inquiries, the Commissioner commenced an investigation on the Commissioner s own initiative, under clause 50(1)(a) of the Freedom of Information and Protection of Privacy Act (the FOIPP Act ), as Elections PEI is a public body under the FOIPP Act, and the issue may involve disclosure of personal information under Part II of the FOIPP Act. [3] Elections PEI has been helpful and cooperative throughout the investigation. They provided a demonstration of the electronic disclosure process which is at the heart of this investigation, and have been timely and forthright in responding to all of our inquiries. Election Act [4] In order to properly understand this investigation, it is necessary to set out certain relevant terms and procedures described in the Election Act, RSPEI 1988, cap. E-1.1 (the Election Act ). I introduce and discuss them here briefly, as I will be referring to them throughout this Order. [5] Section 24.1 of the Election Act requires Elections PEI to establish and maintain a register of electors, which includes a list of the names of citizens who are eligible to vote, their residential and mailing addresses, contact information, and day, month and year of birth. Over time, between elections, Elections PEI may update the list when they obtain new information. For example, the Chief Electoral Officer of Canada may provide updated information about electors from their lists. In addition, recent changes have permitted Highway Safety to provide information to Elections PEI to carry out such Page 3 of 26

4 updates. The Election Act has different names and functions of the list at various points of an election period. [6] The Election Act defines the expression list of electors collectively as follows: 1. In this Act... (s) list of electors means the preliminary list of electors, supplementary list of electors, or the official list of electors, as the context requires. [7] Elections PEI advises that within 48 hours of the date of the announcement of an election, employees of Elections PEI commence the confirmation process, which may involve going door-to-door, to confirm that the information in the register of electors is accurate. Some jurisdictions call this process an enumeration. [8] When the confirmation process is complete, Elections PEI creates a preliminary list of electors. Elections PEI is required under clause 62(3)(a) of the Election Act to provide several copies of the preliminary list of electors for each polling division in the electoral district, to each registered party in each electoral district. In the weeks before polling day, the candidates have copies of the preliminary list of electors, which includes the names of electors and their civic addresses. [9] Between the confirmation process and polling day, individual electors may still provide updated information to Elections PEI. Shortly before polling day, Elections PEI creates and provides the official list of electors to each returning officer, who are employees of Elections PEI. The official list of electors may vary from the preliminary list of electors to reflect new registrations or corrections between the time of the confirmation process and the polling date. There is no requirement under the Election Act to provide a copy of the official list of electors to each registered party. However, Elections PEI states that they have made a recommendation to amend the Election Act to remove the preliminary list of electors from the legislation, because the list is continually updated, and is Page 4 of 26

5 therefore effectively the official list of electors. In the 2015 Report of the Chief Elector Officer for the Provincial General Election, Elections PEI addressed the move to an electronic list, and made the following recommendation at pages 18 and 29: Recommendation #14: b) Add to this section [section 62 of the Election Act] a requirement, if available, to transmit the preliminary, supplementary and official list of electors electronically to each returning officer, political party and candidate. Political Parties could have access to this on a yearly basis in a non-election year and within 2 months prior to the issue of the Writ of Election. [10] On polling day, the deputy returning officer of each polling station uses the official list of electors as the basis for the poll book. The deputy returning officer records in the poll book, as each elector casts their ballot. Individuals not on the official list of electors may still come to a polling station on polling day and take an oath or affirm that they are eligible to vote. The deputy returning officer collects and adds their name and address information to the poll book. There is no requirement under the Election Act to provide a copy of the poll book to each registered party. [11] The Election Act permits each candidate to designate an official agent to attend at each polling station. The official agent s role is to observe activities at the polling station and ensure that the election process is fair, and to challenge electors based on concerns of eligibility, if necessary. I shall refer to a candidate s official agent by their commonly understood name, scrutineer. The scrutineer must receive permission from the Chief Electoral Officer to enter the polling station, and must agree to maintain the secrecy of the voting. [12] A similar process is set out for municipal elections in the Municipal Election Regulations, PEI Reg EC749/17, of the Municipal Government Act, RSPEI 1988, c M Throughout Page 5 of 26

6 this Report, I shall refer to the Election Act, but note that the principles discussed are equally applicable to the Municipal Election Regulations. The evolution of disclosure practices [13] The Election Act requires Elections PEI to disclose the preliminary list of electors to each registered party. Over the years, Elections PEI has changed their practice to disclosing both the list of electors, and who has voted. [14] Prior to 2007, when an elector presented themselves to vote, an employee of Elections PEI gave the elector s name and address to the scrutineer, usually verbally, so that the scrutineer could compare the name and address to the list of electors in their possession, and determine if an elector should be challenged as a qualified elector. In 2007, a citizen complained about this practice to the Commissioner, leading to an investigation and Order PP ( [15] During the 2007 investigation by the Commissioner, Elections PEI modified their practice. In 2007, Elections PEI assigned a number to each elector on the list of electors. When an elector presented to vote, the returning officer called out the elector s number to the scrutineer, who could identify the individual from their numbered copy of the list of electors. If an elector was not on the list of electors, their name and address would still be called out to the scrutineers pursuant to the previous practice. [16] Order PP , supra, held that Elections PEI s disclosure of an elector s identity at the polling station, before the elector voted, to the scrutineer, was authorized under clause 37(1)(b) and section 38 of the FOIPP Act. A public body may disclose personal information for the purpose for which the information was collected or compiled or for a use consistent with that purpose. The purpose of Elections PEI s collection of this personal information is to monitor the election and to ensure only eligible electors cast a ballot. In 2007, Elections PEI submitted that the purpose of Elections PEI s disclosure was Page 6 of 26

7 for the scrutineers oversight of the election process, at the polling stations. The role of scrutineers is to determine if they need to challenge the eligibility of an elector to vote; for example, if they believe the individual is not old enough, not a resident in the district, or has voted already. To fulfill this role, they need to know the name of the person who presents themselves to vote: Relying upon subsection 38(b), the Chief Electoral Officer submits that having an elector declare his or her name and address at the polling station, in most cases, is the only manner in which election officials can identify an elector, and is necessary for election officials to properly perform their duties. To maintain credibility in the voting process, the officials and respective candidates agents must know the identity of each elector prior to voting, and the agents or candidates representatives must know an elector s name in order to determine if an elector should be challenged as a qualified elector. (page 24 of Order PP , supra) [17] Order PP confirmed that Elections PEI was authorized to disclose who was voting, to scrutineers, in the circumstances described at that time; at the polling station, before the elector had voted, and for the purpose of permitting the scrutineer to decide whether to challenge an elector. There was no indication that this information was disclosed for any other purpose. [18] Elections PEI advises that, in 2014, their practice changed from a verbal disclosure of elector identification numbers, one at a time, to a periodic written disclosure after a group of electors had cast their ballots. Elections PEI describes this practice: In 2014, the practice of calling out elector numbers was again modified, and Form 150 Voter Tracking Sheet was developed. This form was a 7-ply carbon copied form where the elector numbers were recorded by the election officials and were available to candidate agents once every hour. The form could be torn off and identical copies supplied to various agents, while an original was kept for Elections PEI records. This modification improved elector privacy by ensuring that their elector number Page 7 of 26

8 was not publicized. The candidate agent would have to supply the campaign office with the tear away form to compare elector numbers with the list of electors to identify those who had already voted. [19] In 2015, the practice then changed from a hard copy disclosure of who had voted by identifying numbers, to an electronic disclosure. Elections PEI started using an electronic voting information management program to assist with managing the list of electors, and the poll book, on the day of an election. One of the features of the software is an internet portal for candidates, or their delegate, to obtain an electronic list of electors, which has the option of indicating which electors have voted, thereby also disclosing which electors have not voted. The software provider calls this feature Candidate Access, and it is described by Elections PEI in their 2015 Report of the Chief Elector Officer for the Provincial General Election, at page 9, as follows: CANDIDATE ACCESS An additional feature of VoterView was an internet portal called Candidate Access. This allowed Elections PEI to provide secure access through the internet to a portal where, once a candidate or their delegate was approved and given access, they would be able to download an extract of the voters list. With the advance polls using a live voters list, when the download was completed, the list would indicate the electors who had voted. In past elections, candidate agents were at the polls collecting this information by hand and delivering to the candidate s campaign team. The Candidate Access was successful at getting this information to all candidates in a timely manner. [20] Under this new disclosure process, when a candidate registers with Elections PEI, the candidate may designate one individual to receive the electronic credentials to log onto the Candidate Access portal. I shall refer to this individual as the candidate s delegate. Elections PEI requires that the candidate s delegate acknowledge, in writing, that they have reviewed the offence provisions of the Election Act regarding the authorized use of any of the lists of electors. Section 129.1, the offence provision of the Election Act, states: Page 8 of 26

9 Every one is guilty of an offence who uses all or part of a list of electors for any purpose unless the list or part of the list is used (a) by a registered party, a member of such a party or a member of the Legislative Assembly for the purpose of communicating with the electors, including the soliciting of contributions and campaigning; (b) by an election officer for the purpose of carrying out his or her duties under this Act; or (c) by a federal or municipal electoral authority or an education authority under the Education Act R.S.P.E.I. 1988, Cap. E-.02, or an officer of such an authority, for the purpose of a federal, municipal or education authority election. [21] Elections PEI advises that they disclose this information to the candidate s delegate only after an election has officially been called and the candidate has become the officially registered candidate for their electoral district. Information at issue [22] Each political party, or campaign team of a municipal candidate, receives the preliminary list of electors from Elections PEI. The Election Act and the Municipal Election Regulations to the Municipal Government Act requires Elections PEI to disclose this information. As Elections PEI is required to disclose this information, it is not at issue in this review. [23] Via the software, Elections PEI discloses to the candidate s delegate not only the list of electors, but also who has voted. This information is updated for disclosure every 15 minutes during the advance voting period, and when the polls are open on polling day. The information at issue, therefore, is who has voted (and, by extension, who has not voted). Page 9 of 26

10 III. ISSUES [24] The Commissioner confirmed to Elections PEI that the two issues of this investigation are: Issue One: Is Elections PEI s practice of disclosing to the candidate, or the candidate s delegate, whether each elector has voted, authorized by Part II, Division 2, of the FOIPP Act? Issue Two: Has Elections PEI made reasonable security arrangements to protect personal information against such risks as unauthorized access, collection, use, disclosure, disposal or destruction under section 35 of the FOIPP Act? Issues not under review [25] It is important to highlight the narrow focus of this investigation. As noted above, Elections PEI s disclosure of the preliminary list of electors to a political party in a provincial election, or to a campaign team in a municipal election, is required. Therefore, this information is not at issue. [26] Further, the obligations of any political party or any campaign team to protect privacy, is not at issue. Neither political parties nor campaign teams are subject to the FOIPP Act. Therefore, the collection, use, disclosure, retention, security measures, and destruction of personal information by a political party cannot be subject to review by the Commissioner. [27] In addition, information indicating for whom an elector has voted is not an issue of this investigation. Secrecy in voting is a fundamental tenet of a fair election. The Election Act sets out in elaborate detail the procedures to balance this necessary secrecy, with checks to ensure that the process is fair. Sections 116 and 139(2) of the Election Act, for example, require that the secrecy of voting be maintained: Page 10 of 26

11 116. A person in attendance at a polling station, or at the counting of the votes, shall maintain and aid in maintaining the secrecy of the voting (2) The evidence of an elector to show for whom he or she voted at an election is not admissible in evidence in any proceeding under this Act. IV. ANALYSIS Issue One: Is Elections PEI s practice of disclosing to the candidate, or the candidate s delegate, whether each elector has voted, authorized by Part II, Division 2, of the FOIPP Act? [28] Among other things, Part II of the FOIPP Act legislates rules for disclosure of personal information by public bodies. The first step of the Commissioner s analysis is to determine if information about whether someone has voted, is personal information. If it is personal information, the second step of the analysis is to determine whether the FOIPP Act authorizes a public body to disclose the personal information. The third step is an assessment of whether a public body disclosed only information that is reasonably required. Step 1: Personal Information [29] Personal information is defined at subsection 1(i) of the FOIPP Act, as recorded information about an identifiable individual. Information relating to whether a person has voted is not listed among the described categories. However, this is not an exhaustive list. I am satisfied that information disclosed by Elections PEI indicating Page 11 of 26

12 whether someone has exercised their right to vote in an election, is recorded information about an identifiable individual. I find that it is personal information. Step 2: Authority to Disclose [30] The FOIPP Act authorizes disclosure of personal information without consent under several circumstances listed at subsection 37(1) of the FOIPP Act. Elections PEI has not asserted specific provisions of the FOIPP Act. I gather, from Elections PEI s submissions, that they consider themselves to be authorized to disclose who has voted, due to a combination of reasons as follows: a. Disclosure of who has voted for the purpose of permitting political parties, or campaign teams, to communicate with electors to get out the vote, is a purpose consistent with the purpose for which the information was collected. If this is so, disclosure is authorized by clause 37(1)(b) of the FOIPP Act. b. Disclosure of who has voted, for the purpose of permitting a candidate to oversee the election process and potentially challenge a voter, is a purpose consistent with the purpose for which the information was collected. If this is so, disclosure is authorized by clause 37(1)(b) of the FOIPP Act. c. Disclosure of who has voted, for the purpose of permitting political parties or campaign teams, to communicate with electors, is permitted by the Election Act. If this is so, disclosure is authorized by clause 37(1)(e) of the FOIPP Act. d. Polling stations are public locations; therefore, disclosure of who has voted would not be an unreasonable invasion of personal privacy of electors. If this is so, disclosure is authorized by clause 37(1)(a.1) of the FOIPP Act. Clause 37(1)(b): Is disclosure for a purpose consistent with the purpose of collection? [31] Elections PEI describes two purposes of their disclosure of who has voted. The first is to permit political parties and campaign teams to communicate with electors to get out the Page 12 of 26

13 vote. The second is to permit candidates to monitor proceedings and to raise concerns about any elector s eligibility to vote, all without the requirement of a physical presence in the voting location. [32] Clause 37(1)(b) permits disclosure of personal information if it is disclosed for the same or a related purpose for which it was collected: 37. (1) A public body may disclose personal information only... (b) for the purpose for which the information was collected or compiled or for a use consistent with that purpose; [33] Section 38 expands on the meaning of the expression consistent with that purpose, as follows: 38. For the purposes of clauses 36(1)(a) and 37(1)(b), a use or disclosure of personal information is consistent with the purpose for which the information was collected or compiled if the use or disclosure (a) has a reasonable and direct connection to that purpose; and (b) is necessary for performing the statutory duties of, or for operating a legally authorized program of, the public body that uses or discloses the information. Purpose 1: Getting the Vote Out [34] The purpose of disclosure must be consistent with the purpose of collection. Elections PEI records when someone has voted. Purposes of this collection of personal information may be to confirm that each person only votes once, or that only eligible electors are permitted to vote, all of which is part of ensuring a fair election. [35] Elections PEI discloses who has voted to the candidate s delegate, with the understanding that the political party or campaign team will continue to campaign to those individuals who have not yet voted. For example, members of the campaign team may contact individuals who have not yet voted to remind them to vote, or arrange Page 13 of 26

14 transportation to a polling station. Elections PEI identifies this as a key purpose for disclosing who has voted, and states, the voters list is only of value to candidates/parties when they are receiving updated information on those electors who have already voted. [36] Elections PEI raises the point that their disclosure of who has voted, and the subsequent outreach efforts by political parties and campaign teams, encourages people to vote, improving voter turnout. This purpose, to permit candidates and their campaign teams to communicate with the electors to increase the elector turnout, is sometimes referred to as getting out the vote. Elections PEI states: You have indicated that you do not see a relationship between permitting the political parties to communicate with electors and Elections PEI s purpose of collecting the information to confirm the eligibility of individuals to vote, to ensure a fair election. [Elections PEI] would state that there is a great correlation between the very high voter turnout rates on PEI and the fact that the political parties have a network in place to ensure that as many eligible electors as possible are encouraged to get out to vote. This would include contacting any eligible electors who had not yet voted to inform them of the remaining opportunities to vote as well as potentially assist them in getting to a polling location if they are unable to do so themselves. this greatly contributes to the integrity of the outcome of our elections. [37] The province of Prince Edward Island has a history of high turnout of electors during provincial elections. In the 2015 provincial election, 82.1 % of eligible electors voted. Between 1966 and present, there have only been two elections in which the voter turnout dipped below 80% (pages 36-37, 2015 Report of the Chief Electoral Officer of Prince Edward Island). [38] Voter turnout has been fairly consistent in provincial elections for the past 50 years. Political parties have been legally provided with a list of electors to communicate with Page 14 of 26

15 potential voters. We do not appear to be in a situation where it is necessary to provide additional personal information of Island voters to political parties and campaign teams, for the purpose of increasing voter turnout. [39] The question of how to increase voter turnout is a complex one, and has been the subject of much study. It is questionable whether candidates or political parties are the best, or appropriate, stewards of getting out the vote. Political parties and campaign teams are partisan. Unlike Elections PEI, or non-partisan organizations whose purpose is to increase voter turnout, political parties and campaign teams may be more interested in increasing their candidates election performance, than in increasing the overall voter turnout. [40] Subsection 38(a) of the FOIPP Act requires a reasonable and direct connection between the purpose that a public body collected personal information, and the purpose for which it subsequently discloses the personal information. As noted above, the purpose of collection of information regarding who has voted, is to ensure the fairness of the election process. I do not find that Elections PEI s stated purpose of disclosure, to permit political parties and campaign teams to communicate with electors, is consistent with the original purpose of collection. [41] Subsection 38(b) also requires that the disclosure be necessary for performing the statutory duties of the public body that uses or discloses the information, or for operating its legally authorized program. This assessment involves whether disclosure is not merely helpful, but is necessary for either performing statutory duties, or operating a legally authorized program. I accept the Public Body s evidence that political parties or campaign teams contact electors on polling day; this is the purpose for disclosure of the list of electors. However, there is insufficient evidence of the necessity of disclosing who has voted to achieve the purpose of communicating with electors to get out the vote. Page 15 of 26

16 [42] Elections PEI has not provided sufficient evidence to persuade me that the stated purpose for disclosing who has voted to political parties and campaign teams, related to increasing voter turnout, is consistent with the purpose of collection of this information under clause 37(1)(b) and section 38 of the FOIPP Act. Purpose 2: Oversight of Election Process [43] The purpose of disclosure must be consistent with the purpose of collection. Section 38 of the FOIPP Act requires that, to be consistent, the disclosure must have a reasonable and direct connection to the purpose of collection, and must be necessary for Elections PEI to perform their duties. [44] Elections PEI collects information regarding who has voted to help ensure a fair election. In Order PP , supra, Elections PEI s stated purpose of disclosure was to allow scrutineers to obtain enough information to decide if they needed to challenge an elector s eligibility to vote, which is also part of ensuring a fair election. Elections PEI s disclosure to permit a scrutineer to decide whether to challenge an elector s eligibility was found to be consistent with the purpose for which the information was collected. As such, the disclosure to the scrutineer was held to be authorized by subsection 37(1)(b) of the FOIPP Act. [45] The issues before me are not a repetition of the analysis from Elections PEI s disclosure process has changed since Elections PEI now discloses who has voted in a different format, to a person in a different role, at a different time, and for an additional purpose. It was accepted that the 2007 procedure was necessary for Elections PEI to carry out its duty of ensuring a fair election. I do not accept that the current procedure is necessary for Elections PEI to ensure a fair election. I will discuss each change briefly, then review whether the current stated purpose of disclosure is consistent with the purpose for which the information was collected or compiled under clause 37(1)(b) of the FOIPP Act. Page 16 of 26

17 [46] In 2007, the format of Elections PEI s disclosure of who has voted was verbal, in person, and one elector at a time. Today, the format is electronic, remote, and cumulative. The electronic format of disclosure is not in and of itself contrary to the law. If a public body is required or authorized to disclose information in print form, the Electronic Commerce Act, RSPEI 1988, Cap E 4.1 permits that public body to disclose the information in electronic form. However, a question arises as to whether this new format is necessary for Elections PEI to carry out its duties, pursuant to subsection 38(b) of the FOIPP Act. [47] Elections PEI no longer discloses who has voted to the scrutineer. The scrutineer is the candidate s agent, a statutory position with an implicit statutory duty of assisting oversight. Elections PEI now discloses who has voted to a candidate s delegate. The candidate s delegate is not a defined role in the Election Act, but it is unlikely to be the same individual as the scrutineer. Elections PEI states:... The information on who has voted is now securely sent electronically only to the candidate or the designate authorized in writing to receive the voter information from Elections PEI. This removes the possibility that a candidate agent (scrutineer) may also have access to the information on who has voted. [48] Elections PEI points out that the Candidate Access portal allows the candidates to monitor the proceedings, without a physical presence at the polling station, which may intimidate some electors. As noted earlier, the role of the scrutineer, who is present at the polling station, is to observe activities at the polling station and ensure that the election process is fair, and to challenge an elector s eligibility, if necessary. Scrutineers act as witnesses and monitors. Their presence at polling stations is an international standard in the administration of elections. The intended purpose of their presence is to strengthen the public trust in elections and the legitimacy of democratic governance. As this role is imbedded in the Election Act, I do not accept that disclosure to someone other than the scrutineer is necessary for Elections PEI to carry out its duty of ensuring a fair election. Page 17 of 26

18 [49] In 2007, Elections PEI disclosed who has voted as the electors presented themselves to vote, but before they had cast their ballot. Now Elections PEI discloses who has voted cumulatively, to the candidate s delegate, up to 15 minutes after the elector has voted. I am not persuaded that disclosing to the candidate s delegate the names of electors after they have voted is an effective method of ensuring the fairness of an election. A challenge to a person s eligibility to cast a ballot, only after they have cast their ballot, is less effective than the 2007 procedure of having a scrutineer at the polling station. The new procedure is an inadequate protection of the fairness of an election, and is thus unnecessary for Elections PEI to carry out its duty of ensuring a fair election. [50] I find that neither of the two purposes of disclosure identified by Elections PEI authorizes them to disclose who has voted to the candidate, or the candidate s delegate, under clause 37(1)(b) of the FOIPP Act. Clause 37(1)(e): disclosure is authorized by the Election Act to communicate with electors [51] Clause 37(1)(e) permits a public body to disclose personal information if disclosure is authorized or required by another law. 37. (1) A public body may disclose personal information only... (e) for any purpose in accordance with an enactment of Prince Edward Island or Canada that authorizes or requires the disclosure;... [52] Section 129.1, the offence provision of the Election Act prohibits a registered party, a member of such a party or a member of the Legislative Assembly to use the list of electors except for the purpose of communicating with the electors. I accept that using a list of electors to communicate with the electors is an authorized use of a list of electors. However, I do not accept that this provision applies to information regarding whether an Page 18 of 26

19 elector has voted. A list of electors is a defined expression in the Election Act, at section 1(s) and does not include the poll book, which is the only place Elections PEI records who has voted. [53] Section 115 of the Election Act protects the poll book, which is included in the papers transmitted to the Chief Electoral Officer, pursuant to section 112. In fact, the Election Act prohibits disclosure of information in the poll book, as follows: 115. No person shall be allowed to inspect the papers transmitted to the Chief Electoral Officer by any returning officer except under an order of the Supreme Court or a judge thereof. [54] Based on the foregoing, I find that section of the Election Act does not authorize or require disclosure of who has voted to a political party or a campaign team. Clause 37(1)(a.1) : Is disclosure not an unreasonable invasion of personal privacy because polling stations are public locations? [55] Clause 37(1)(a.1) of the FOIPP Act permits a public body to disclose personal information if disclosure would not be an unreasonable invasion of personal privacy. 37. (1) A public body may disclose personal information only... (a.1) if the disclosure would not be an unreasonable invasion of a third party s personal privacy under section 15;... [56] Elections PEI states that voting on PEI and in Canada has always been a public process, while the ballot has always remained secret. Therefore, because it is a public process, it is not an unreasonable invasion of personal privacy to disclose who has voted. [57] Clause 37(1)(a.1) incorporates an analysis of section 15 by reference. The two-step process to apply section 15 of the FOIPP Act is set out in many orders of this office. The Page 19 of 26

20 first step is to determine if the information is personal information pursuant to clause 1(i). I have already found that information disclosing whether an elector has voted is personal information. The second step is a determination of whether disclosure of who has voted would constitute an unreasonable invasion of personal privacy of an elector. [58] Although Elections PEI has not made specific reference to section 15 of the FOIPP Act, the analysis of whether disclosure of personal information would constitute a reasonable invasion of personal privacy requires a review of all of the relevant circumstances, pursuant to subsection 15(5) of the FOIPP Act. The relevant circumstance identified by Elections PEI is that voting is carried out in public. [59] I agree that, with the exception of mail-in ballots, most of the voting processes are transparent. However, there is a difference between seeing an acquaintance attend at a polling station, and receiving a complete, accurate and up-to-date report of who has voted and who has not voted. Consistent with this observation is Elections PEI s policy that no cameras or digital recording equipment is permitted at a polling location without express permission. [60] The fact that most voting happens in a public setting does not mean that Elections PEI may disclose who has voted. The FOIPP Act does not limit its protections to only that personal information which is collected behind closed doors. The FOIPP Act protects all personal information. [61] I am not persuaded that the fact that voting happens in a public setting is determinative in deciding that disclosure of this personal information would not constitute an unreasonable invasion of personal privacy for voters. [62] Elections PEI identified another circumstance which I find to be relevant to a determination of whether disclosure of who has voted would constitute an unreasonable invasion of personal privacy for voters. Elections PEI is aware that the candidate s Page 20 of 26

21 delegate, to whom Elections PEI discloses this personal information, is using and retaining the information for other purposes. They advise: It is well established that political parties maintain their own database of elector information that is a merger of information collected from the Election body as well as information obtained from their membership. Since political parties are not covered under FOIPP, and Elections PEI does not have authority to investigate the systems of a political party under the Election Act there is no way to determine the use of the information provided. [63] The British Columbia Information and Privacy Commissioner recently investigated the collection, use, and disclosure of elector information by political parties in that province. BC s political parties are the only political parties in the country who are subject to privacy protection legislation. The investigation found that the primary source of information for political parties is from Elections BC, from their voters list. Political parties then supplement the voters list with information which they collect from door to door canvassing, telephone canvassing, petitions and social media [pages 13-14, Investigation Report P19-01, Full disclosure: Political parties, campaign data, and voter consent, February 6, 2019, 2019 BCIPC 7 (CanLII)]. [64] As the B.C. Information and Privacy Commissioner pointed out, the largest risk to protection of personal information during elections is the rapid expansion of employees and volunteers in a lead-up to, and during an election, followed by a precipitous decrease immediately after elections, with very little continuity of personnel (Investigation Report P19-01, supra, at page 29). Political parties and campaign teams are made up primarily of volunteers, with variable levels of privacy awareness. Election campaigns are short, and often stressful and passionate races, which may put personal privacy at a greater risk. On PEI, political parties and campaign teams are not legally required to protect the personal information they collect, nor is their handling of personal information subject to review by an independent body. Page 21 of 26

22 [65] Elections PEI has failed to show that the fact that voting happens in a public setting is determinative in deciding that disclosure of this personal information would not constitute an unreasonable invasion of personal privacy for voters. Once this personal information is disclosed, there is no independent oversight, and Elections PEI cannot limit the use that the political party or campaign team will make of it. I find that this is a relevant circumstance in deciding that disclosure of this personal information would constitute an unreasonable invasion of personal privacy for voters. Therefore, I find that Elections PEI has not satisfied clause 37(1)(e) of the FOIPP Act. Step Three: Information reasonably Required [66] As I have found that Elections PEI is not authorized to disclose who has voted, it is not necessary to consider step three, whether Elections PEI is disclosing only information that is reasonably required. Conclusion regarding Issue One: [67] Based on the foregoing, I find that Elections PEI s practice of disclosing to the candidate s delegate whether each elector has voted contravenes Part II, Division 2, of the FOIPP Act. Issue Two: Has Elections PEI made reasonable security arrangements to protect personal information against such risks as unauthorized access, collection, use, disclosure, disposal or destruction under section 35 of the FOIPP Act? [68] Section 35 of the FOIPP Act requires public bodies to adopt reasonable security measures for the personal information in their custody or control. 35. Protection of personal information The head of a public body shall protect personal information by making reasonable security arrangements against such risks as unauthorized access, collection, use, disclosure, disposal or destruction. Page 22 of 26

23 [69] The FOIPP Act does not dictate which security measures to implement. Each public body must make this assessment in consideration of the sensitivity of the personal information and other relevant circumstances. [70] I have found that Elections PEI does not have the authority to disclose who has voted to a candidate s delegate. Therefore, I will not be addressing Elections PEI s security arrangements for this information. However, Elections PEI does have authority to disclose the list of electors to political parties and campaign teams. I will consider whether Elections PEI has reasonable safeguards in place to protect the list of electors from unauthorized access, collection, use, disclosure, disposal or destruction. [71] When Elections PEI discloses the name and address information of electors, they are also implicitly disclosing that these individuals are considered eligible to vote; that is, they are 18 years old, they are Canadian citizens, and they have resided in the district for at least 6 months. I do not consider this information to be sensitive personal information. This does not mean that Elections PEI does not have an obligation to protect the personal information, but it is one of the considerations in assessing the reasonableness of the security measures Elections PEI has adopted. [72] Another consideration, when analyzing the reasonableness of security measures, is to whom the personal information is being disclosed. Elections PEI acknowledges this in the following statement: It is understood by the Office of the Chief Electoral Officer that political parties are not subject to privacy protection legislation and that therefore, the onus to protect the information we disclose is of paramount importance. [73] The software has assisted Elections PEI tremendously with the management of an election. At the same time, Elections PEI has illustrated that they are aware of their obligations to implement reasonable security measures to protect personal information Page 23 of 26

24 in their custody and control. They have taken advantage of tools to modernize their processes, but still take a cautious approach to their statutorily required disclosures. [74] With their obligations in mind, Elections PEI has implemented a number of administrative and technical security measures to protect the list of electors: Administrative: Elections PEI limits the number of individuals to whom it discloses the list (one person per candidate); the recipient provides a written confirmation that they are aware of the limitations on their use (for communicating with electors); Technical the internet portal requires a unique username and password; the internet portal is encrypted; the internet portal permits disclosure to the delegate s address only, and the delegate cannot change the address to whom Elections PEI sends the list; Elections PEI only discloses the list of electors in the candidate s electoral district, or in municipal elections, their ward. [75] Elections PEI considered the possibility of requesting that the political parties and campaign teams return the list of electors at the end of an election, or confirm that the list has been destroyed. However, there is no Election Act requirement for a political party or campaign team to return the information. Elections PEI also considered the challenge in enforcing such an agreement when the information is modified by the political parties and campaign teams, through legitimate, authorized uses during an election period. For these reasons, Elections PEI decided not to pursue these options. [76] On the basis of the information provided by Elections PEI, I find that they have reasonable security measures in place to protect the list of electors which they disclose to candidates or their delegates. Page 24 of 26

25 V. SUMMARY OF FINDINGS and ORDER [77] I find that Elections PEI s practice of disclosing, to a candidate or their delegate, whether each elector has voted, is not authorized by Part II, Division 2, of the FOIPP Act. I order Elections PEI to stop disclosing this personal information. [78] I find that Elections PEI has reasonable security measures in place to protect the list of electors which they disclose to candidates, from such risks as unauthorized access, collection, use, disclosure, disposal or destruction. Commissioner s Message [79] Elections PEI provided information regarding the practices in other provincial jurisdictions. The disclosure practices and legislative framework vary widely between jurisdictions. In Newfoundland, for example, information is disclosed regarding who has voted, but only for advance polls. Elections Ontario will disclose to political parties what it refers to as strike-off information, but only if the political party has filed a privacy policy with Elections Ontario; further, as a security safeguard, the disclosed information does not include name or address of the elector, but only the elector identification number. [80] Following amendments in 2015, subsection 51(2) of British Columbia s Election Act, RSBC 1996, c 106, requires Elections BC, on request, to provide political parties with an electronic voters list, including information regarding which individuals voted in the last general election. Before being provided with this information, political parties are required to file a privacy policy acceptable to the Chief Electoral Officer. In addition, subsections 275(3.2) and (3.3) of British Columbia s Election Act restrict political parties subsequent use of the information to the purposes contained in their Election Act, and not for commercial purposes. Page 25 of 26

26 [81] It may be that our Legislature will see fit to amend the Election Act to permit disclosure of who has voted, to political parties, in future. In the event that this comes to pass, I trust that the foregoing analysis will be taken into account, and that special attention will be paid to the security measures to be put in place to protect this sensitive personal information, to ensure that the elector information disclosed to candidates and their political parties is given the protection that those who participate in the electoral process expect. [82] Elections PEI has demonstrated a clear understanding of their duty to be vigilant about the protection of personal information which is disclosed to political parties, especially so in light of the fact that political parties are not subject to privacy legislation in the province of Prince Edward Island. As noted above, Elections PEI has some awareness of the use of voter information by political parties, once it is disclosed to the candidate or their agent. Elections PEI also acknowledges that the Election Act does not require a notice of destruction for any information provided to a candidate or a political party to ensure that the information has only been used for election purposes. Following up on this comment, Islanders will need to question whether they want political parties to keep, in their databases, information regarding who has voted, possibly accumulated from election to election. [83] I thank Elections PEI for their cooperation and I appreciate their commitment to be compliant with their privacy obligations. Karen A. Rose Information and Privacy Commissioner Page 26 of 26