Alberta’s massive voter data breach is just the beginning

Privacy breach that affects 2.9 million Albertans just a start unless Parliament apply privacy rules to political parties

May 5, 2026 — Last week, Elections Alberta obtained a court injunction forcing the separatist Centurion Project to take down a public, searchable online database containing the personal information of 2.9 million Albertan voters. Elections Alberta reports the data came from information legitimately obtained by the Republican Party of Alberta. Because Alberta's private sector privacy law expressly excludes political parties, the province's privacy commissioner is now reporting it may not have jurisdiction to investigate or take action in this massive abuse of voters' personal information.

"Albertans just watched a separatist group put millions of voters into a searchable online database, and Alberta’s privacy commissioner doesn't even have clear jurisdiction to investigate. That's not a loophole — that's the system working exactly the way the parties want it to," said Matt Hatfield, Executive Director of OpenMedia. "Every federal political party has fought to keep themselves and their agents exempt from real privacy law. Voters didn't ask for that exemption, and 80% of us want it gone. Parliament needs to act before the next federal election, not after the next breach."

The federal Privacy Act has not been meaningfully updated since 1983, and despite a recently launched consultation, does not apply to political parties. PIPEDA, Canada’s federal private sector law, doesn't apply to them either. Provincial and Federal Privacy Commissioners, Senators, and even a 2018 committee of MPs have asked Canada’s government to place political parties under binding, externally accountable privacy laws. Comparable democracies, including the U.K., the European Union, New Zealand, South Korea, and Brazil, all subject political parties to comprehensive privacy laws. Instead of following suit, Canada’s Bill C-25 is currently slated to require only a minimal list of elements political parties’ privacy policies should include, with no binding external review or oversight. Bill C-25 omits out the foundations of every other privacy law in Canada — no purpose limitation, no consent requirement, no right of access or correction, no retention limits — meaning Canadians still will not be able to find out what parties know about them, fix it when their data is wrong, and can't stop parties from using it their data however they want.

“Millions of Albertans have had their names, physical addresses, and phone numbers permanently leaked to everyone who downloaded this treasure trove of government-provided personal information while it was up,” continued Hatfield. “That data is now somewhere on the Internet for good, and risks causing Albertans real harm. Unless Canada’s federal government passes true privacy reform that includes political parties in genuine oversight, not Bill C-25’s potemkin protections, millions more Canadians will join Albertans in the years ahead – having their private information thrown on the Internet, not from a hack, but from an intentional blank space in government policy.”

A recent Ipsos poll commissioned by OpenMedia, BC FIPA, and the CCLA found that 80% of Canadians want federal political parties subject to the same privacy rules as businesses and public sector organizations, and just 10% support the status quo that lets parties write their own rules.

A new campaign organized by these three organizations is asking people in Canada to sign Parliamentary petition e-7237, which calls for fundamental party privacy reform. Interested parties can learn more at voterprivacy.ca.