Alberta premier, opposition face off amid voters’ data breach investigation

There was a war of words at the Alberta Legislature on Wednesday about who knew what about a data breach affecting nearly three million Albertans.

Words between Premier Danielle Smith and Opposition leader Naheed Nenshi were heated at the legislature Wednesday afternoon as the two went back and forth on a data breach that leaked the private information of nearly three million Albertans.

On Tuesday, the New Democrats released information alleging that United Conservative Party president Rob Smith and UCP Caucus director Arundeep Sandhu attended a Centurion Project meeting on April 16 where a database of Albertans’ information was shown to attendees for instructional purposes.

The UCP denied that Rob Smith was ever at the meeting, calling it a “flat-out lie,” being used to drag the president “through the mud.”

“We now know that the premier’s office knew that Albertans were at risk for weeks and did nothing,” said Nenshi.

Without confirming the names of the UCP members in attendance, Smith said a staffer at the meeting was there for research purposes, and was not aware that the information being shared was obtained illegally.

“That was not disclosed on the call,” said Smith. “There was no way to know that this was Elections Alberta data.”

Smith mentioned a letter the NDP received from journalist Jen Gerson, saying she was tipped off to a separatist group having access to Alberta’s list of electors.

“(Nenshi) had a screenshot of the letter that Jen Gerson had sent to Elections Alberta. We didn’t have that … Why didn’t he tell government?”

The Centurion Project is currently under investigation by RCMP and Elections Alberta following a data breach that saw about three million voters’ personal information made public.

Elections Alberta alleges that the voter list was obtained illegally. An injunction was granted to the agency to prohibit future use of the data.

It is alleged that the Republican Party of Alberta, a registered political party which is permitted to have the electors list, gave said list to the Centurion Project, a group mobilizing for Alberta’s separation from Confederation.

The Centurion Project and the Republican Party of Alberta were required to identify every person and entity they shared the voter information with by Monday end of day. CTV News Edmonton reached out to Elections Alberta to confirm the information was submitted, but were told that the agency couldn’t comment as the matter is now before the courts.

The investigation

The Alberta government said it will not be conducting its own investigation or initiating a public inquiry, despite calls to, saying they are confident in the capabilities of Elections Alberta and the RCMP.

Retired RCMP investigator Neil LeMay says neither agency has the resources to properly conduct an investigation.

“There’s this thing that the public inquiry is going to interfere with the police investigation – that’s just nonsense and a political spin from our premier,” said LeMay, adding there is no legislation that prohibits a public inquiry in tandem with a police investigation.

Mounties are also only 50 per cent staffed right now, said LeMay.

“They’ve got a murder, a sexual assault, a child abduction … where do you think this elections list investigation is going to fall?” he said. “It’s going to be priority number 10 on a daily basis across the province.”

Diane McLeod, Alberta’s privacy commissioner, said she should have information to share Thursday about whether her office has jurisdiction to get involved in the investigation.

Class action lawsuit?

Privacy breaches, even to this extent, are not uncommon.

But a common way of dealing with them and holding those at fault to account, especially when millions of people are impacted, is a class action lawsuit.

“That’s one of the main vehicles that you would use to make these claims, because typically individual damages for privacy breaches aren’t that high in Canada,” said lawyer Robert Martz. “You tend to want to aggregate all the claims together and bring it that way.”

It is still possible to file individual claims during a class action lawsuit, a move Martz says former premier Jason Kenney could potentially pursue after his personal information was shared to those who attended the Centurion Project meeting.

“Usually that’s warranted where they’ve suffered a specific harm that’s much more significant than the rest of the people who had their privacy breached,” said Martz.

Kenney took to social media Tuesday, saying he would be pursuing legal counsel to advise him on recourse regarding the use of his personal information.

“While I have been targeted specifically, the broader data breach may also effect [sic] vulnerable Albertans, including victims of domestic violence, journalists, activists, judges, and other public servants for years to come,” said Kenney.

An Edmonton city councillor said their team was working to relocate a woman facing intimate violence and her children following the breach.

“It’s pretty tough to predict what kind of individual award might be. I think it’s much easier when you talk about someone having to rehouse based on the release of that information,” said Martz.

While a class action lawsuit has yet to be filed, Martz said it is likely to happen sooner than later, even if the investigation into the privacy breach is still ongoing.

“Depending on what the investigation says, that could be a powerful tool in any lawsuit,” he said. “But you wouldn’t need to wait for that. A person whose information had been released, which would be most people in Alberta, could step up as a plaintiff in the proposed class action and get it started immediately.”

With files from CTV News Edmonton’s Nicole Weisberg