The government “fell short” and “should have been more prudent” in preventing users’ personal information from being shared with third parties as they interacted with a much-maligned online electoral reform survey, Canada’s privacy commissioner has found. MyDemocracy.ca employed third-party scripts that could disclose users’ personal information to Facebook without their consent as soon as they loaded the website, according to the commissioner’s investigation. The responsible Privy Council Office also never conducted a privacy impact assessment related to the initiative. About 360,000 people had participated in the survey in December and January. An investigation from the privacy commissioner’s office says information retrieved about individuals could lead to “a fairly accurate picture of one’s personal activities, views, opinions, and lifestyle” and “be quite revealing about an individual’s Internet-based activities.”
Commissioner Daniel Therrien found no evidence PCO was trying to match individuals to their responses, but IP addresses and other information was shared with Facebook automatically, “thereby increasing the risk that users’ interaction with the website could not be truly anonymous” — and the government didn’t obtain consent before information was shared. Users who were simultaneously logged into Facebook could be identified.
The commissioner’s office did not consult Facebook or investigate its use of the information. Consequences could have been unintended since scripts were ostensibly there to facilitate sharing results on social media after completing the survey, but a different design would’ve avoided any breaches, the report says.
e picture of one’s personal activities, views, opinions, and lifestyle” and “be quite revealing about an individual’s Internet-based activities.”Commissioner Daniel Therrien found no evidence PCO was trying to match individuals to their responses, but IP addresses and other information was shared with Facebook automatically, “thereby increasing the risk that users’ interaction with the website could not be truly anonymous” — and the government didn’t obtain consent before information was shared. Users who were simultaneously logged into Facebook could be identified.The commissioner’s office did not consult Facebook or investigate its use of the information. Consequences could have been unintended since scripts were ostensibly there to facilitate sharing results on social media after completing the survey, but a different design would’ve avoided any breaches, the report says.
Full Article: Government ‘fell short’ in protecting privacy during electoral reform consultation, privacy commissioner finds | National Post.