Letter to the Standing Committee on Procedure and House Affairs on the privacy implications of Bill C-25

May 14, 2026

Chris Bittle, M.P.
Chair, Standing Committee on Procedure and House Affairs
Sixth Floor, 131 Queen Street
House of Commons
Ottawa ON  K1A 0A6

---

Dear Chair:

I am writing to present my views on the privacy implications of Bill C-25, tabled on March 26, 2026. While Bill C-25 would make several amendments to the Canada Elections Act and enact the new An Act to change the name of certain electoral districts, 2026, the focus of my comments will be on provisions pertaining to requirements for political party’s policies for the protection of personal information (privacy policies).

Role of the Office of the Privacy Commissioner of Canada

As Privacy Commissioner of Canada, my mandate is to oversee compliance with both the Privacy Act and the Personal Information Protection and Electronic Documents Act (PIPEDA). The Privacy Act governs how federal government institutions handle personal information and PIPEDA governs how personal information is handled by private sector organizations in the course of their commercial activities. My mission is to protect and promote the privacy rights of Canadians.

Political Parties and Privacy Requirements

Political parties are not currently covered under either the Privacy Act or PIPEDA. In 2018, Parliament enacted Bill C-76, the Elections Modernization Act. Bill C-76 amended the Canada Elections Act to require political parties to develop specific privacy policies to protect personal information, to submit those policies to Elections Canada and to publish them online. Although there have been changes made to these requirements since 2018, it remains that the prescribed content of these policies falls short of privacy related requirements in either the Privacy Act or PIPEDA.

Comments on Bill C-25

Bill C-25 would bring improvements to the current privacy policy requirements under the Canada Elections Act. These include:

• New safeguarding requirements, including for personal information that a political party has transferred to another person or entity;
• A requirement to report privacy breaches to affected individuals in certain circumstances;
• Prohibitions on political parties providing false or misleading information to individuals about why personal information is collected, selling personal information or disclosing personal information for the purposes of causing harm; and,
• The addition of new violations for which an administrative monetary penalty can be levied, to also include privacy policy requirements for political parties under Part 18 of the Canada Elections Act.

Recommendations

Despite these improvements to the privacy policy requirements contained in the Canada Elections Act, I believe that more could be done to better protect electors’ personal information. Specifically, I recommend the addition of three elements:

1. Minimum Privacy Standards
   
   Unlike the key provisions and principles that underpin the federal Privacy Act and PIPEDA, the rules proposed for federal political parties do not include baseline statutory requirements, such as for parties to obtain consent, limit the collection or disclosure of personal information to identified purposes, or provide means for individuals to seek access to or correction of their personal information. In Canada and abroad, obtaining consent, limiting collection, use and disclosure, ensuring accuracy, and provision of access are basic elements found in both public and private sector data protection laws.
   
   Recommendation 1: Bill C-25 should establish requirements for political parties to seek consent, limit collection, use and disclosure, and provide a mechanism for access and correction to personal information.

2. Privacy Breach Reporting
   
   Privacy breach reporting is also an important aspect of privacy protection, in both the public and private sector contexts. While the provisions for individual notification are an important first step, a requirement to report privacy breaches to an independent regulator such as my Office, Elections Canada, and/or the Commissioner of Canada Elections, would provide Canadians with reassurance that incidents involving their personal information are being handled appropriately. Reporting breaches to a relevant regulator is essential as it would add independent oversight, foster accountability, and help prevent repeat harm beyond the individual’s notification itself.
   
   To ensure meaningful oversight, there should also be prescriptive wording on the timeliness for breach reporting in this bill. Clear, short timelines for reporting would allow for an effective response, provide certainty to political parties about what is legally required, and be consistent with modern international norms.
   
   Recommendation 2: The privacy breach notification provisions in Bill C-25 should be expanded to require reporting not only to affected individuals, but also to a relevant, independent body such as the Privacy Commissioner of Canada, Elections Canada and/or the Commissioner of Canada Elections without unreasonable delay and no later than seven calendar days after a political party becomes aware of the breach.

3. Improving Oversight
   
   Effective oversight and redress are critical elements in improving data protection and ensuring clear, coherent regulation. Allowing inter-agency collaboration improves the work of regulators and brings clarity to complex issues that cut across sectors and jurisdictions. I would therefore recommend including the ability for my Office, the Commissioner of Canada Elections and Elections Canada to consult and collaborate, given that we all have a role to play in this space.
   
   Recommendation 3: Bill C-25 should allow for formal collaboration between my Office, the Commissioner of Canada Elections and Elections Canada.

Conclusion

In conclusion, Canadians deserve a privacy regime for political parties that provides meaningful standards and independent oversight to protect and promote electors’ fundamental right to privacy. I hope that the above recommendations help to inform your consideration of Bill C-25.

Sincerely,

c.c.: Christine Holke, Clerk of the committee