What does the Elections Alberta voter information breach mean for your privacy?

secrecy experts ar voicing concerns for Albertans’ refuge after the personal info of millions of voters in the responsibility was made public through a searchable database.

Elections Alberta was granted an injunction on April 30 that it had sought, asking to have a pro-separatist group called the Centurion Project pull down its database containing personal information based on a voter information list. 

The agency said the list was legally provided to the pro-independence Republican Party of Alberta but that it does not know how it was transferred to the Centurion Project.

More than 500 people accessed the database, according to Elections Alberta. 

The RCMP, Alberta’s privacy commissioner and Elections Alberta are investigating what happened. But what does this incident mean for your personal information?

The contents of the database included information from the list of electors, said Elections Alberta. This means information such as electors’ full legal names, addresses, postal codes, telephone numbers, unique identifier numbers, electoral divisions and voting areas could have been included.

The Centurion Project, which is registered as a third-party advertiser in Alberta, is led by longtime political organizer David Parker. In a social media post on X on April 30, Parker compared the information in the database to information that can be found in phone books — something privacy experts take issue with.

To make this comparison is “downplaying the potential risk” of the breach, said Jason Woywada, the executive director of the BC Freedom of Information and Privacy Association (FIPA) in Victoria.

FIPA is a non-partisan, non-profit group established to defend privacy and freedom of information rights in Canada.

The Centurion Project has said it relied on a "third party" to provide it with datasets for its searchable database which it says was intended to “help train volunteers on how to be better citizens and to impact the political process.” 

Woywada said he isn’t just worried about the publicizing of personal information, but also what bad-faith actors can potentially do with it. 

People who had accessed the list can cross-reference that information with other details found through social media, the dark web and third-parties like data brokers, Woywada said.

Data brokers buy and sell information such as purchasing habits and online activity. 

“It's bad enough when your phone number, your home address, your name is made available more readily through illegitimate means,” Woywada said. “It's more problematic when that information can be appended to.

“Every individual in Alberta faces the risk now of them being targeted in very specific ways with very specific messages by very specific people to lobby them and and take advantage of their susceptibility to different messaging to move their opinion.”

Cybersecurity expert and lawyer Ritesh Kotak noted that social media accounts and people’s financial details can get breached, especially once scammers and fraudsters get ahold of personal information.

With each breach, scammers can get closer to creating phishing campaigns, risking the potential for identity theft, he said.

“When you start taking these pieces of data and putting it together, it really creates an intrusive picture around somebody,” Kotak said. “You may not have all the pieces to complete the picture, but you definitely know what the picture is.

“That's what makes this troubling.”

Privacy experts call Alberta electoral list breach 'troubling'

Once your data is made public, Kotek said it can easily be downloaded and memorialized, making it difficult to protect yourself after the fact.

For some voters, having their personal information exposed can cause serious safety concerns, said Woywada.

In a news release, FIPA noted that people affected by intimate partner violence, those who are politically exposed, political candidates, election workers and others can be at heightened risk of harm if their personal information is made public.

Aaron Paquette, a city councillor in Edmonton, has said his team is helping a woman facing domestic violence relocate because she fears her personal information may have been made public by the database. 

“This is an extremely disturbing event. This has been a breach of absolute confidentiality.”

People affected by this breach, who are fearing for their safety, should contact police, Paquette said.

Domestic violence groups raise safety concerns after Alberta voter list breach

As investigations continue, the exposure of private information has prompted calls for a public inquiry into the matter as well as legislative changes to better protect voter lists.

To prevent a breach of this kind from happening again, Kotak said Elections Alberta should consider creating ways to authenticate and track who accesses data, from where and when. 

“We do entrust them to hold our data safe and secure,” he said while speaking about Elections Alberta. “We know that the information is going to be shared, but there has to be more that needs to be done.”

Elections Alberta has said it cannot prevent unauthorized distribution or use of the list of electors provided to authorized entities because of how provincial legislation is currently written. 

But Woywada said he thinks change needs to be made sooner rather than later.

“The UCP can take action in the legislature to change the legislation,” he said. “They know that there are gaps right now that they could address. They don't need another inquiry in order to figure that out.”

Reporter

Add some “good” to your morning and evening.

---

---