Green Party removes training videos that showed voters' personal information

May talks cyber privacy in Waterloo From CTV Kitchener's Max Wark: Green Party Leader Elizabeth May expressed concern for corporate cyber surveillance while in Waterloo.

OTTAWA – The Green Party of Canada has removed a series of campaign training videos accessible from its website and informed Elections Canada of the "oversight" after CTV News discovered that they contained voters' personal data.

In a statement Tuesday evening the Green Party said that Elections Canada has been contacted about the "error," which has since been corrected.

"Due to an oversight, a small number of videos hosted in an internal training section on our website contained visuals of some Elections Canada information. The information primarily pertains to names and addresses, and only included a small number of Canadian voters," the party said in a statement.

The videos were included as part of a publicly accessible Google Drive that the party calls an "Organizing Toolbox" that can be accessed by following a link on the party website. It contains handbooks on canvassing, tip sheets on various aspects of running campaigns, organizational charts, and how-to’s on contacting voters, among other election-focused volunteer guides.

Until Tuesday afternoon this trove of campaign guides included a folder with recorded webinars aimed at training people working on Green Party campaigns. Some of these video tutorials walked through how to use the party's voter information system, "GVote," and through a screen share, revealed some pages of voters' personal information contained within the system -- information that is only meant to be viewed by those with authorized access.

Despite the party statement calling it an "internal training section," party spokesperson Debra Eindiguer said that while it was a mistake that the videos were publicly viewable, the rest of the database of training documents is meant to be public so volunteers across the country can access it.

In a follow-up statement, Green Party Director of Communications John Chenery further clarified that this was "the party inadvertently allowing access to some internal training videos."

This "oversight" was revealed on the day that the party rolled out its pledge to protect Canadians' personal data.

In an interview, May told CTV News that she was "not at all deterred by this unfortunate incident which has now been corrected."

What the videos showed

The video tutorials showed step-by-step how to use the system that organizes all Green Party voter data—called "GVote"—to perform various functions, such as organizing get-out-the-vote initiatives, determining who has requested lawn signs, and how to send an email to voters in specific ridings.

In some videos the personal information listed included voters’ names, addresses, and their phone numbers. Others also showed people's email addresses, whether they were an active party member or volunteer, and how they scored in terms of support for the party.

In some cases the limited lists of names shown appeared to be people who have expressed interest in the party, while another visual shown appeared to be a residence-by-residence list of voters in a certain riding.

Until the party took them down, these videos could be downloaded and shared with anyone with access to the link. It remains unclear how long these videos had been up, and whether anyone at the party will be reprimanded for what Eindiguer called "obviously an incredibly terrible mistake."

CTV News contacted more than a dozen of the people whose names and information was visible in the videos. Seven people responded and confirmed that their information shown in the videos was accurate and that they were not aware that it was accessible in this way.

All parties have some form of a voter information database, which is fundamental to running voter contact on the ground in each riding. The information contained in these systems is generally a combination of:

The Elections Canada information is provided under conditions that the authorized recipients take "reasonable precautions to protect the security and confidentiality of the personal information of Canadian Electors," including restricting who has access to this information, and technical safeguards to minimize the risk of unauthorized access.

CTV News has reached out to Elections Canada for comment.

Party pledges to protect data

On Tuesday the Green Party highlighted its position on privacy protections, saying that it was the first to call for federal privacy laws to apply to all federal political parties. The party said that despite it not being required by law, the Greens have a "strong privacy policy," and that it's "shocking" how inadequate current laws are.

Speaking to the privacy promise on Tuesday morning, May accused the "larger political parties" of being interested in collecting Canadians' data and "not interested in protecting it."

Her concern was the "dangerous" collection and use of personal information for purposes that Canadians are unaware of, such as targeting and influencing voters' opinions.

"Data protection is emerging as one of the major issues of our time. Data is exceedingly valuable and its wholesale collection and misuse is a credible threat to democracy," said the party in its policy statement.

The party's privacy policy, which is posted on its website, promises that the Greens ensure the confidentiality and security of people's personal information. It says that personal information can be used to communicate with people, process donations, and can be "shared internally" between riding associations and candidates, as well as shared with third party providers who are contracted out to make phone calls, for example.

Further, the policy says that the party has safeguards in place to prevent the "unauthorized use, sharing, loss and theft of information," and that the party applies "several different access levels to data within our systems," to ensure that employees and volunteers "only gain access to information as needed."

As part of a series of elections law changes, the Liberals required political parties to post their privacy policies online, but stopped short of subjecting parties to tougher privacy rules and oversight for the data they harvest from the electorate, despite calls from May and others to do so.