Richmond Hill residents concerned about councillor collecting data on 'not secure' site

A pop-up warning reads 'Your connection to this site is not private. Information you submit could be viewed by others'

Yorkregion.com
Jan. 29, 2021
Sheila Wang

Richmond Hill regional councillor Carmine Perrelli’s "shop local" initiative seems to be neither local nor safe, residents say.

The regional councillor has been running a "free" face mask distribution event on his personal website in a widely publicized bid to support local businesses during COVID-19 since Jan. 18.

Many residents said they found themselves being directed from Perrelli’s home page to a different site -- with a domain extension for Spain and a “not secure” warning in the address bar -- when attempting to fill out the order form online for the masks.

“Can you explain why you would be using this site instead of your city email, especially since it’s not secure and you’re promoting to buy local, yet none of this site information, location or hosting seems to even be in Canada, let alone local?” resident Greg Gardiner asked Perrelli in an email on Jan. 25.

Gardiner said he got a reply two hours later that appeared to be like an auto-reply confirming the receipt of an online submission, even though the resident had never ordered any masks from him.

In order to receive the promised free masks, residents are asked to enter their personal information such as their name, home address, email address and phone number on the “not secure” site with an URL of "rhdat.hol.es."

“Perrelli is famous for collecting residents' personal information,” Howard Doughty, past president of Coalition of Richmond Hill Ratepayers, wrote to the Liberal.

He warned about the potential risks of entering personal data on the unsecure website.

A pop-up warning in the address bar of the site reads “Your connection to this site is not private. Information you submit could be viewed by others.”

An online IP tracker traces its IP address to KVC Hosting LLC, a U.S. web hosting company based in Oklahoma City.

This is not the first time that the regional councillor has been questioned about collecting residents’ personal information.

In November 2019, a number of residents raised concerns about a community survey conducted by Perrelli which required the respondents to provide their personal information before submitting opinions about the city councillors and municipal affairs.

Doughty also pointed out that Perrelli paid to advertise the face mask initiative on social media.

On one of the sponsored posts, dozens of residents who wanted free masks complained that the site did not work properly. Perrelli then asked them to email him their information instead.

“I have received thousands upon thousands of requests so far,” Perrelli posted on Twitter, Facebook and Instagram on Jan. 26, with a photo of him in an office filled with carton boxes of big white envelopes with his photo and name on.

The staff was working overtime to get the masks out, he said in the post.

The regional councillor didn’t respond to a request for comment about where the masks were from.

At the Jan. 7 council meeting, Perrelli said the masks were paid by donated funds and cost "no tax dollars."

"I'm highly doubtful of the money trail," said resident Michel Lauzon. "Must cost his staff time and effort for his self-promotion. That's not on his expense report."

The mask distribution event is “not a city initiative,” and Richmond Hill was also not permitted to collect information shared with members of council on their websites, city spokesperson Kathleen Graver responded on Jan. 26.

Mayor Dave Barrow said, "The councillor is free to make his own decisions."

Records received or created by a councillor acting in a private capacity are considered “personal records,” which are not subject to the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA), according to the city's guide for councillors obtained by the Liberal.

Members of council should use records in their possession for their intended purposes only and must not use confidential information for personal or private gain, the guide says.