Privacy advocates express worries about the safety of Albertans following the exposure of millions of voters’ personal data in a publicly accessible database. Elections Alberta obtained a court order on April 30, requesting the removal of the database containing personal details sourced from a voter information list by the Centurion Project, a pro-separatist group.
The agency clarified that the list was initially provided to the pro-independence Republican Party of Alberta, but it remains uncertain how it was later shared with the Centurion Project. Over 500 individuals are reported to have accessed the database, prompting investigations by the RCMP, Alberta’s privacy commissioner, and Elections Alberta.
The compromised database included electors’ full names, addresses, postal codes, phone numbers, unique identifiers, electoral divisions, and voting areas. The Centurion Project, led by David Parker, justified the database’s purpose as aiding volunteer training and political engagement, likening the information to that found in phone directories.
Privacy experts, however, argue that the breach downplays the risks involved, highlighting the sensitivity of political data such as riding and identifier numbers. Concerns are raised about potential misuse by malicious entities who could combine this data with information from social media, the dark web, and data brokers.
Cybersecurity expert Ritesh Kotak warns that exposed personal details can pave the way for scams and identity theft, creating intrusive profiles of individuals. The breach poses significant safety risks, particularly for vulnerable groups like survivors of domestic violence and politically exposed persons.
Calls for a public inquiry and legislative reforms to safeguard voter information have emerged in response to the breach. Recommendations include enhancing authentication measures and monitoring data access to prevent future unauthorized disclosures. While legislative changes may be considered post-investigations, advocates emphasize the need for immediate action to address existing gaps in data protection laws.