Bill C-25 Still Lets Political Parties Grade Their Own Privacy Homework

Ottawa is tightening election rules, but the political data machine still gets a softer privacy standard than Canadians should accept.

Bill C-25 is being sold as election protection. Elections Canada says the new rules came into effect on June 18, 2026, and include changes for contributions, party privacy policies, official agents, third parties and electoral district names. It also says that, as of September 21, political-party privacy policies must include basic standards for safeguarding personal data and prohibit certain uses of data.

That sounds responsible until Canadians read the fine print from the privacy watchdogs. Privacy Commissioner Philippe Dufresne told the Senate committee on May 28 that Canada’s political parties are not currently subject to the federal Privacy Act or PIPEDA. In plain English: the parties asking Canadians for trust at the ballot box do not face the same federal privacy framework that applies to many public- and private-sector organizations handling sensitive information.

Dufresne acknowledged that Bill C-25 improves the current regime. It adds safeguarding requirements, breach notices to affected individuals in certain circumstances, and bans on selling personal information, harmful disclosure and misleading explanations about why information is collected. Those are useful changes. They are not enough.

The missing pieces are the accountability core: consent, limits on collection, limits on use and disclosure, accuracy, and rights of access and correction. If a bank, telecom company or federal department mishandles personal information, Canadians expect enforceable rules and a real regulator. Political parties should not get to say, “trust us,” while building voter profiles, targeting messages and moving data through campaign infrastructure.

The risk is not theoretical. Global News reported in May that the Alberta elector-list breach had prompted privacy watchdogs across Canada to warn about legal gaps, including the lack of privacy-commissioner oversight for political parties in most jurisdictions. Dufresne’s own Senate statement pointed to that breach and warned that unauthorized disclosure of voter information can create serious safety consequences, including for people whose addresses must be protected.

Former privacy commissioner Elizabeth Denham was even sharper in her Senate brief. She said Canada is an outlier because federal political parties are not subject to an independent privacy regime, and that Bill C-25 leaves parties to write and police their own rules. That is the problem in one sentence.

A conservative accountability standard should be simple: if government wants more power over elections, parties should accept more transparency over the data they collect to win those elections. Publish a party-data ledger: what information is collected, where it came from, who receives it, what consent was obtained, when it is deleted, what third-party vendors touch it, and how breaches are reported.

Election integrity cannot mean tougher rules for everyone except the political machine. Bill C-25 may be a step, but voters deserve the full privacy receipts before parties ask for another data-driven mandate.