Elections Alberta issues cease-and-desist letters over voter info breach, privacy commissioner launches probe

Cease-and-desist letters feature been sent to thomas more than 500 Albertans who accessed a searchable database containing the personal info of millions of voters in the responsibility, patch a new investigation into the affair has been launched.

“I have decided to exercise my authority to investigate these allegations,” Diane McLeod, Alberta's information and privacy commissioner, said in a news release issued Thursday afternoon. 

Elections Alberta and the RCMP have previously announced they are conducting their own investigations.

McLeod said her office's investigation will probe “allegations that the Centurion Project Ltd. Has collected, used and disclosed personal information derived from the Alberta List of Electors."

A website created by the Centurion Project, a separatist group that is registered as a third-party advertiser in Alberta, featured a publicly accessible, searchable database that included the names, addresses and voter registration details of nearly three million people.  

The letters were sent to 23 people identified as having received a voters list from the Centurion Project. The letters were also sent to another 545 people that were identified as having accessed the list.

"The 23 people who were provided the list are required to provide a signed declaration [that] they have complied with the direction. They have 48 hours to comply," Elections Alberta's statement reads.

Elections Alberta was granted a temporary injunction last week against the Centurion Project and the Republican Party of Alberta over the unauthorized use of an Alberta electoral list. The injunction forced the Centurion Project to shut down the database in question.

The agency has said that it has concluded the database was sourced from an official voter list legitimately obtained by the pro-independence Republican Party of Alberta. 

According to Elections Alberta, each electoral list is “salted” with a few fictitious names that makes such documents easier to trace in the event of a breach. Such lists are only distributed to political parties and elected officials and must not be shared with third parties.

How the list managed to change hands remains unclear.

In a statement issued by the Centurion Project last week, the organization said it relied on a "third party" to provide it with datasets for its database tool which it said is used to “help train volunteers on how to be better citizens and to impact the political process.”

McLeod had previously signalled that she may not have the authority to launch a full investigation because Alberta's Personal Information Protection Act (PIPA) does not apply to political parties. 

In her office's news release Thursday, McLeod stated that “Section 36(1)(a) of PIPA authorizes me to conduct an investigation on my own motion to ensure compliance with any provision of PIPA.”

In addition to questions about the Centurion Project’s use, collection and disclosure of personal information, the investigation will also look at whether the group made reasonable arrangements to protect the information, and whether it has an obligation to comply with the duty-to-notify requirements set out in the act. 

The privacy commissioner operates independently of government.

The legal battle over the database is expected to return to court in late July when Elections Alberta will seek a permanent injunction against the Centurion Project and the Republican Party of Alberta.

The date was set following a brief court hearing in Edmonton on Thursday, during which Elections Alberta lawyer Joseph Redman said he had been in contact with lawyers for both the Republican Party of Alberta and the Centurion Project and they agreed to the date.

The temporary injunction issued last week said Centurion Project officials must hand over the names of everyone who had accessed it. The injunction also barred the Republican Party of Alberta from sharing any electoral list with unauthorized users. 

Redman told the court Thursday that all parties needed time to file affidavits and prepare arguments and requested an adjournment, which was granted by Justice Thomas Rothwell.

Lawyers for the Centurion Project and the Republican Party of Alberta were not present in court Thursday and were not immediately available for comment. 

The database has since been taken down and officials with the Centurion Project said it will comply with Elections Alberta's investigation. 

The group’s leader, David Parker, has likened the database to a phone book and said the list was intended to be used by their volunteers to search for friends and acquaintances as they canvassed for supporters. 

The exposure of voter information has prompted calls for legislative changes to better protect voter lists and triggered growing calls for a public inquiry.

Questions surrounding the database, how it was obtained and who signed on to access the voter details have since erupted across Alberta’s political landscape.

The United Conservative Party caucus confirmed Tuesday that caucus staff attended an online meeting last month hosted by the Centurion Project, but said the staff believed the data being presented at the gathering had been legally obtained. 

Premier Danielle Smith has said she only learned about the breach through media reports last week. She said she only learned about the meeting — during which the NDP says Parker demonstrated how the database worked by searching former premier Jason Kenney’s name — when the NDP made it public.

Smith has said she wants those responsible to be "held accountable under the law."

Reporter

---

---