Statement by the Privacy Commissioner of Canada to the Standing Senate Committee on Legal and Constitutional Affairs on Bill C-25

May 28, 2026
Ottawa, Ontario

Opening statement by Philippe Dufresne
Privacy Commissioner of Canada

(Check against delivery)

---

Mr. Chair, members of the Committee, thank you for the invitation to appear before you today to discuss Bill C-25, the Strong and Free Elections Act, alongside my colleagues, Diane McLeod, the Information and Privacy Commissioner of Alberta, and Elizabeth Denham, the former UK Information Commissioner, former Information and Privacy Commissioner for British Columbia, and current Chair of the Jersey Office of the Information Commissioner.

Earlier this month, I provided a written submission on Bill C-25 to the House Standing Committee on Procedure and House Affairs. As in that submission, my remarks today will focus on areas of the Bill that relate to the policies that political parties have for the protection of personal information.

As we have seen recently with the data breach of the List of Electors in Alberta, unauthorized use and disclosure of voter information can have serious and concrete implications. For example, I have heard about the danger that this has caused for survivors of domestic violence because their addresses were leaked. It was also reported that the coordinates of a former Alberta Premier were part of this wrongful disclosure, thereby demonstrating that this type of breach can also threaten the safety of all Parliamentarians.

A breach such as this underscores the need for political parties to be subject to the important privacy requirements that are already set out for public- and private-sector organizations under federal law.

Canada’s political parties are not currently subject to federal privacy laws – neither the Privacy Act, nor the Personal Information Protection and Electronic Documents Act (PIPEDA).

In 2018, for the first time, the Elections Modernization Act set out requirements for political parties to develop privacy policies, submit them to Elections Canada, and publish them online.

Those requirements did not, however, include many of the obligations set out in other federal privacy legislation.

I appeared before this Committee in February to discuss Bill C-4, which received royal assent in March. Part 4 of the Bill amended the required elements for existing privacy policy obligations of federal political parties, provided an enforcement mechanism through the Commissioner of Canada Elections, and retroactively excluded federal political parties from the application of provincial or territorial privacy legislation. The recommendations that I put forward for C-4 are consistent with the ones that I am now making for C-25.

Bill C-25 would improve the current regime by:

• Adding new safeguarding requirements, including for personal information that is transferred to third parties;
• Requiring that political parties report breaches to affected individuals in certain circumstances; and
• Prohibiting political parties from selling personal information, disclosing it to cause someone harm, or providing false or misleading information to individuals about the reason for collection.

These are positive developments, but I would continue to recommend additional elements that are necessary to enhance protections for the personal information of electors.

Obtaining consent, limiting the collection, use, and disclosure of personal information, ensuring accuracy, and providing rights of access and correction are important elements of public- and private-sector privacy and data protection laws in Canada and abroad. These should, in my view, be requirements for federal political parties as well.

Privacy breach reporting is another important feature of privacy laws for individuals and regulators. I recommend adding a requirement for political parties to report breaches to an independent regulator, such as my Office, Elections Canada, and/or the Commissioner of Canada Elections within seven days of becoming aware of a breach.

This would ensure timely reporting and provide clarity regarding legal obligations. Moreover, it would enhance oversight, foster accountability, and help prevent repeat harm, providing stronger protection for Canadians.

Finally, Bill C-25 should allow for formal cooperation between my Office, the Commissioner of Canada Elections, and Elections Canada. The ability to collaborate improves the work of regulators and brings clarity to complex issues that cut across sectors and jurisdictions.

On this point, I welcome the Bill’s clarification that the Commissioner of Canada Elections would be able to enter into Memoranda of Understanding (MOU) with appropriate regulators, and my Office will be there to assist in any way that we can.

Political parties handle highly sensitive information. Canadians deserve privacy rules for political parties that provide meaningful standards and effective independent oversight, to ensure that electors’ fundamental right to privacy is protected.

Thank you and I will now be happy to take your questions.