Government added privacy protections to MyDemocracy.ca contract only after privacy commissioner began investigation: documents
Why did a survey asking people's opinion about our 'democratic values' need to know a respondent's postal code? Their occupation? Their household income?

NationalPost.com
Sept. 5, 2017
Marie-Danielle Smith

When the Liberal government launched its MyDemocracy.ca website last December, the online survey — part of an ultimately fruitless public consultation process on electoral reform — was ridiculed. It also raised concerns about privacy.

Why, observers wondered, did a survey asking people’s opinion about our “democratic values” — though not which voting system we should have — need to know a respondent’s postal code? Their occupation? Their household income?

Even as the federal privacy commissioner decided to launch an official investigation, government officials were quick to reassure Canadians that the protection of their personal information was of utmost concern. But according to documents obtained by the National Post, the Liberals only established specific privacy protections for the data collected through MyDemocracy.ca well after the website went online.

While the site’s creator had its own privacy policy in place, the Privy Council Office’s original contract with Vox Pop Labs contained no explicit provisions about keeping respondents’ personal information out of government hands. That first contract, obtained by the Post via an access-to-information request, in fact stipulated that personal information collected through the survey be saved and given to the government.

Weeks after the survey went live, and after questions were raised publicly about respondents’ privacy, the contract was amended.

“This is like a forensic audit of betrayal,” said New Democrat MP Nathan Cullen, a staunch critic of the government on electoral reform and a proponent of moving to a proportional representation system. “How did it happen? Why would the government have been trying to collect so much personal information with so little, or no, protections for Canadians?”

As well as collecting people’s views on electoral reform, MyDemocracy.ca asked users for their gender, age, occupation, education, income, first language and minority identity. Respondents were also asked for postal codes and, if they wanted to be sent a record of their results, email addresses.

While providing the demographic information was optional, Vox Pop Labs originally implied responses without such details wouldn’t be considered; it subsequently edited its privacy policy to make clear they wouldn’t be part of final, weighted results — only aggregate results.

In the wake of the site’s launch, one of the more acute worries was around whether the government — and by proxy, the Liberal Party — would be able to access email addresses collected by the website. Vox Pop founder Clifton van der Linden told the Post in December emails were “not stored and cannot be retrieved by anyone, Vox Pop Labs included.”

Amid broader concerns raised by the privacy commissioner, a PCO official told the Post in December that “protecting personal information is something we take very seriously,” while an official from then-minister Maryam Monsef’s office told the Associated Press, “we are confident the steps we are taking through MyDemocracy.ca are protecting personal privacy.”

But it appears the government had second thoughts about those steps.

The initial September 2016 contract between the government and Vox Pop was formally amended Jan. 4, 2017, though it contains a line stating edits were made Dec. 18 — three days after federal privacy commissioner Daniel Therrien had said publicly he would launch a formal investigation into the survey.

According to Van der Linden, the contract was amended mainly to extend the period for which MyDemocracy.ca would be active (the site was live until Jan. 15). “The modifications to any language around privacy were intended to further clarify the safeguards already in place and which … were already clearly articulated in the MyDemocracy.ca privacy policy,” he said in an email to the Post last week. “No changes were made to the application as a result of the amendment — other than, of course, extending its runtime.”

PCO spokesman Shane Diaczuk echoed that explanation, and in an email to the Post said that “As the contract was being amended already, the government took the opportunity to also clarify and make explicit some of the privacy clauses of the contract to align with what was already occurring in practice.”

The length of the contract was indeed amended, extending the period of work from a final end date of Feb. 1 to Feb. 23, and adding $37,600 to the contract’s pre-tax value.

But the amendment also altered the contract’s terms and conditions to include phrases such as, “Canada does not and will not control, possess or own any personal information,” and “personal information … will not be shared with Canada.” Another addition states personal information must ultimately be “destroyed” or “rendered completely anonymous.”

Parties also changed a statement of work setting out what Vox Pop Labs was asked to do. Present in the second version but absent in the first are several assertions documents or reports “will not contain any personal information.” Where the original contract asked for a “full set of tabulated data,” the new version asked for “a full set of tabulated aggregate data.”

Cullen theorizes this had not been a mistake. The Liberals could have used personal data from the survey to identify groups that cared about electoral reform, then strategize on how best to soften the blow of a promise they intended to break, he said. “It’s incredibly cynical,” he told the Post. “It’s data-mining using Canadians’ money to abuse the promise made to Canadians. How sad is that?”

That the changes were made in the wake of the privacy commissioner launching an investigation doesn’t look like a coincidence either, he said. “It was like the cops showed up and they started to cover their tracks as soon as the obvious and ethical questions were being asked about privacy, and what the intention was.”

Months later, the privacy commissioner has concluded his investigation regarding the web survey. “We are limited in what we can say about our investigations due to confidentiality provisions in the Privacy Act,” said spokeswoman Valerie Lawton. Findings will be made public when an annual report is tabled in parliament at the end of September.

Meanwhile, the government revealed on Feb. 1 — via the mandate letter of the then newly appointed democratic institutions minister Karina Gould — that it would no longer be pursuing the electoral reform that MyDemocracy.ca was supposed to help shape. The whole exercise had cost upwards of $4.1 million.