If Europe gets a closer look at Canada, it may not like what it finds

Matt Malone is the author of Open Governments, Secret Canada: Hiding Information Other Countries Share and a research director at the Centre for International Governance Innovation.

The European Union’s recent overtures toward giving Canada special recognition in the bloc are heavily reliant on a view of Canada as a like-minded democracy to European partners.

That was a key message in Prime Minister Mark Carney’s September speech to the European Parliament in Strasbourg. “A Canada-EU alliance would create a beacon for other democracies,” he said, while also warning about the erosion of democratic norms – making an obvious wink at the United States.

The notion that Canada and the EU will forge closer ties on the basis of shared values, however, is at odds with some rather undemocratic features of Canadian governance. In recent years, Canada has drifted further and further away from European standards in a range of areas.

Perhaps the most obvious example is in data protection and privacy, where the European Union has taken on a significant role as a standard setter on questions of digital rights. Its General Data Protection Regulation established an important baseline for the collection, use and disclosure of personal data.

EU chief champions Canada again as bloc’s ‘associate member’

Through that framework, the EU has recognized that “political opinions” are a special category of personal data, meriting the highest degree of protection. The objective of that designation is to ensure strong legal safeguards apply to the manipulation of such data by political parties and their proxy advertisers.

Under Mr. Carney, Canada has moved in the other direction, toward a Wild West approach. Last year, his government – facing public interest litigation that would have seen provincial privacy laws apply to federal political parties – abruptly passed exemptions for federal political parties hoarding Canadians’ personal data. Those provisions will effectively shield the parties from oversight by privacy regulators.

Nevermind that the federal government passed the unusual exemptions with a bill cynically styled as containing “affordability measures.” Enshrining those new rules to inoculate political parties from basic accountability is precisely the kind of conduct that Europe has sought to ward off.

Failing to regulate how personal data is used by political parties is dangerous for several reasons. It lets them weaponize sensitive data – allowing for deeply intrusive voter profiling with no right of complaint or recourse over improper collection, use, retention, or disclosure to others. Canada saw the consequences of that with the “robocall scandal.”

As one expert also presciently warned a Canadian parliamentary committee in 2018: “Imagine what would happen if there was a hack of one of Canada’s major political parties?” His concern was trust in parties and electoral processes themselves. We no longer need to imagine such scenarios.

Opinion: How Canada can have (some) freedom of movement with Europe

The lack of oversight of micro-targeted political advertising also gins up polarization. Donald Trump’s campaign in 2016 seized on the lack of regulation and oversight in the United States to help secure his win. Today, this phenomenon is being turbocharged by generative AI.

Canadians don’t want this. The previous privacy commissioner noted that internal polling indicated strong support for political parties being subject to privacy legislation. More recent polls show that Canadians want greater protection from political parties’ invasive data practices.

Thankfully for Mr. Carney, the main opposition parties have been complicit on this issue (they supported the Liberal Party position in the public interest litigation).

And thankfully for Canada, the Europeans seem to not have noticed or care about Canada’s cavalier approach to data protection and privacy issues in this area, as they continue to welcome closer economic integration between the two jurisdictions.

We have also seen this lack of scrutiny of Canada before. A decision that underpins the arrangement of mostly uninhibited data flows between the EU and Canada was renewed in January, 2024, with only a few expert voices in Europe noting that the EU’s decision was based on a renewal that did not even fully consider Canadian laws.

However, when European regulators do decide to take a closer look at Canada, they may not like what they see.

In the past year, the Carney government proposed sweeping surveillance measures in Bill C-22, its lawful access legislation, in addition to passing vast information-collecting powers under a recently enacted cybersecurity law that our own regulators have warned clears the way for authorities to conduct “the equivalent of unwarranted searches.”

While the European and Canadian friendship is focused on broader geopolitical questions, when the time comes to get into the governance details, such laws may attract concern. They are precisely the kind of measures Europeans have found worrying in the past when deciding whether to permit unrestricted data flows between the EU and the United States.