PREO Policy

Effective: from January 1, 2024

Section 1: Scope of Policy

This policy applies to the New Democratic Party of Ontario (the “Ontario NDP”) and its candidates, members of the Legislative Assembly, and any person or entity (including relevant third party service providers) representing or working for the party on a paid or unpaid basis.

Section 2: Restrictions on Use of Elector Data

Any person or entity who obtains information, directly or indirectly, from the Permanent Register of Electors for Ontario or from a List of Electors through Ontario NDP must comply with the requirements under section 17.4 of the Election Act to:

Only use the information for electoral purposes; and
Not to use the information for commercial purposes.

Requirement for Written Acknowledgements

Any person or entity who has obtained information, directly or indirectly from the Permanent Register of Electors for Ontario or from a List of Electors through New Democratic Party of Ontario may only disclose it to others after obtaining their written acknowledgement that they are bound by the restrictions on use in section 17.4 of the Election Act, as reproduced in section 2.0 of this policy. (see Appendix B)

Section 3: Privacy Requirements

Chief Privacy Officer: The Provincial Director of the Ontario NDP shall act as the Chief Privacy Officer and shall be responsible for the management of all processes and protocols necessary for tracking all individuals accessing elector information and ensuring the security of said information. The Chief Privacy Officer shall also be responsible for regular review of said protocols, and shall be the primary point of contact for both ONDP staff/volunteers and Elections Ontario in the case of a suspect

Printed Documents with Elector information:It is not the Practice of the New Democratic Party of Ontario to utilize printed elector information. In the case where it is required, elector information is contained to our offices and not transported, stored in a secure location (a locked filing cabinet within a secure office) and is destroyed at the earliest opportunity via Shred-It or similar secure shredding services. Volunteers are only privy to the portion of elector information required to fulfill their immediate responsibilities.

Electronic Documents with Elector Information: All electronic information provided by Elections Ontario is accessible in it’s raw format only by designated staff who are directly authorized by Elections Ontario via the request form provided by Elections Ontario. Relevant data is merged into the Ontario NDP elector information database (Populus) - data from Elections Ontario is downloaded directly to secure servers once the lists have been merged into our systems it is then securely deleted from these servers. The Populus database is encrypted and are accessible only via a secure network. All users of Populus are assigned a unique, secure username and password and are required to acknowledge they will adhere to the Populus Privacy policy and user agreement (attached as appendix A) prior to gaining access to the database. All individuals accessing elector information (including staff, volunteers, candidates and MPPs) are required to sign an acknowledgement that they have read and understand the privacy policy prior to being granted access to any elector information.

Training on Privacy Controls:

Before accessing elector data all users are to be trained on this privacy policy. This includes:

Internal privacy and security protocols (device security, password protection, online security).
Having specific annual trainings on data privacy and security for party staff.

Section 4: Tracking of Distribution

In providing any individual or entity with a copy of information from the Register, extract of the Register, or List of Electors (either electronic or hard copy), the following information must be tracked:

The date of distribution;
Who the information was provided to;
How the information was provided (e.g. type of document, electronic copy of PREO, paper copy of List of
Electors etc.);
Confirmation that the written acknowledgment has been signed, and
Confirmation of the date the copy is returned (if applicable).

Section 5: Loss or Theft of Information

In the case of loss or theft of elector’s personal information from the Permanent Register or an extract of the Register for a specific electoral district, the following procedures are to be followed:

Upon discovery of the breach, the staff, volunteers or candidate involved shall immediately inform the Chief Privacy Officer.
The loss or theft must be immediately reported to the Chief Electoral Officer
The breach should be contained and the source of the breach identified. Upon discovery of the circumstances that that led to the incident a full report documenting all details of the breach should be provided to the Chief Privacy Officer.
Upon resolution, all internal policies, processes and procedures must be reviewed to prevent future incidents.
If required, affected individuals are to be contacted and advised of the potential breach.

Section 6: Specific Responsibilities for Candidates for the Party

All candidates are responsible for:

Complying with the restrictions on use of the information as required under section 17.4 of the Election Act
Securing written acknowledgements as required under section 17.4 of the Election Act
Tracking the distribution of copies of the List of Electors provided by the Returning Officer to the candidate, in paper or electronically, as required by the Guidelines for the Use of Electoral Products
Complying with the processes identified in the Guidelines for the Use of Electoral Products in the case of
loss or theft of a copy of the List of Electors
In addition to the requirements for notification in the case of loss or theft under the Guidelines, the candidate should also notify the Provincial Secretary of the Ontario NDP.
Ensuring the secure destruction of all copies of the List of Electors as required under the Guidelines for the Use of Electoral Products.
Complying with all filing requirements under the Guidelines for the Use of Electoral Products

Section 7: Specific Responsibilities of Members of the Legislative Assembly for the Party

All Members of the Legislative Assembly are responsible for:

Complying with the restrictions on use of the information as required under section 17.4 of the Election Act
Securing written acknowledgements as required under section 17.4 of the Election Act
Tracking the distribution of copies of the extract from the Permanent Register of Electors for Ontario as provided by Elections Ontario to the Member, in paper or electronically, as required by the Guidelines for the Use of Electoral Products.
Complying with the processes identified in the Guidelines for the Use of Electoral Products in the case of loss or theft of a copy of the List of Electors
In addition to the requirements for notification in the case of loss or theft under the Guidelines, the Member should also notify the Provincial Secretary of the Ontario NDP.
Ensuring the secure destruction of all copies of the extract from the Permanent Register as required under Guidelines for the Use of Electoral Products.
Complying with all filing requirements under the Guideline.

Section 8: Appendices

APPENDIX “A”
Agreement between the New Democratic Party of Ontario
and users of the Populus Database

Where a electronic acknowledgement is required under section 17.4 of the Election Act, the Agreement appended hereto as Appendix “A” shall be utilized. This applies to all users of Populus, the ONDP database.

1. Introduction

As a user of Populus, you hold a position of trust with the Ontario New Democratic Party (“Ontario NDP”), and will encounter and handle personal information which is sensitive and must be kept confidential. The unique nature of your access to data in Populus requires utmost trust, particularly because of the politically sensitive and partisan environment in which the Ontario NDP operates.

This policy (the "Populus Policy") governs your use of the Populus online voter database to collect, use and disclose the information accessible therein. By logging into Populus, you acknowledge and agree that you have read and understand this Populus Policy and voluntarily accept the duties and obligations set forth in this Populus Policy.

2. Protected Information

Protected Information that is subject to this policy includes:

Elector Information: Elections Ontario provides The Ontario NDP with an Electors List which includes names, addresses, date of birth and elector id. The use of this data is governed by the Ontario Elections Act.
Personal Information: Information from sources other than the Elector List that can be used to identify a person. This includes, phone numbers, emails, financial, and employee data.
Confidential Information: All other data owned by the Ontario NDP except to the extent it is readily available through public sources at the time it is accessed.

Elector Data and Personal Information is protected as set out in this policy whether or not it is otherwise available from public sources.

3. Sole Purpose of Elector Data

The Ontario NDP, and its Populus users, are entitled to use Electoral Data solely for electoral purposes that are directly associated with electing representatives to the Ontario Legislative Assembly (the “Sole Purpose”).

Acceptable uses of Elector Data include:

Communicating with electors
Including for soliciting contributions during election campaign
Recruiting party members

The collection, use and disclosure of any Elector Information for any purpose other than the Sole Purpose is strictly prohibited.

4. Permitted Purposes of all Data

By using Populus to collect, use and/or disclose Protected Information, you agree as follows:

Your collection, use and disclosure of Elector Data will be only for the Sole Purpose as outlined in section 3 and not for commercial purposes.
Your collection, use and disclosure of any Protected Information other than Elector Data will be only for the Primary Purpose, or another purpose specifically permitted under this Populus Policy, the Ontario NDP’s Privacy Policy or another written instrument of the Ontario NDP.

Protected Information may only be collected, used or disclosed on a need-to-know basis. You agree to limit your collection, use and/or disclosure of any Protected Information to the minimum amount necessary to fulfill a permitted purpose.

5. Non-Disclosure

By using Populus to collect, use and/or disclose Protected Information, and in consideration of your access to the Protected Information, you agree:

To hold the Protected Information in strict confidence and to take all reasonable precautions to protect such Protected Information (including, without limitation, all precautions the NDP employs with respect to its own confidential materials);
To maintain the Protected Information in trust and confidence for The Ontario NDP, including by making commercially reasonable efforts to protect the Protected Information from any harm, tampering, unauthorized access, sabotage, access, exploitation, manipulation, modification, interference, misuse, misappropriation, copying or disclosure;
Not to disclose any Protected Information or any information derived therefrom to any third person or party; and
Not to copy or reverse-engineer any Protected Information.

You further agree that you will not divulge, except as may be required by law, court order or other legal compulsion, any Protected Information to which you may become privy in the course of using Populus. You further agree that you will not divulge Protected Information in accordance with this provision unless, prior to such disclosure, you first notify The Ontario NDP in writing of such disclosure requirement, and assist The Ontario NDP in protecting the Protected Information from disclosure.

The above non-disclosure obligations apply to your employers, employees, officers, directors, contractors, agents and professional advisors (“persons for whom you are responsible”). You agree that persons for whom you are responsible who have access to any Protected Information shall sign a nondisclosure or similar agreement substantially identical to this Policy. You are fully responsible to ensure that you and the persons for whom you are responsible handle Protected Information as required by this Populus Policy, and you are liable for any loss or damage arising out of their failure to do so.

The above obligations to protect Protected Information survive the termination of your use of Populus and your involvement, direct or indirect, with The Ontario NDP. Personal Information and Elector Data may never be divulged, and must be protected indefinitely.

6. Breaches of Obligations

By using Populus to collect, use and/or disclose Protected Information, you agree:

To notify The Ontario NDP promptly of any unauthorized collection, use or disclosure of Protected Information that comes to your attention; and
To provide, and to cause any person for whom you are responsible to provide, prompt and accurate responses to any questions or requests for information from The Ontario NDP respecting the use of Populus.

Any breach of the obligations set out in this Populus Policy may be the basis for discipline, termination or legal action, in addition to any other remedy that the Ontario NDP or any other party may have for damages related to the breach.

You agree that any breach whatsoever of the covenants, provisions and restrictions in this Populus Policy shall constitute a breach of that your obligations to the Ontario NDP which may cause serious damage and injury to the Ontario NDP and which cannot be fully or adequately compensated by monetary damages. You accordingly agree that in addition to claiming damages, The Ontario NDP may seek interim and permanent equitable relief, including without limitation interim, interlocutory and permanent injunctive relief, in the event of any breach of this Populus Policy. All such rights and remedies shall be cumulative and in addition to any and all other rights and remedies whatsoever to which The Ontario NDP may be entitled.

7. Return of Protected Information

Upon written request by The Ontario NDP, you agree to immediately return to The Ontario NDP all Protected Information and all documents or media containing such Protected Information and any or all copies and extracts thereof, provided that where such Protected Information is in a form incapable of return or has been copied or transcribed into another document you agree to immediately destroy or erase it as appropriate.

8. No Warranty

You agree and acknowledge that no representation or warranty, express or implied, is or will be made, and no responsibility or liability is or will be accepted by The Ontario NDP or by any of its respective directors, officers, employees, agents or advisers, as to, or in relation to, the accuracy of completeness of any Protected Information made available to the users of Populus.

9. No Waiver

The failure of The Ontario NDP to enforce its rights under this Populus Policy at any time for any period shall not be construed as a waiver of such rights.

10. Agreement to Policies and Subsequent Amendments

The Ontario NDP reserves the right to submit an amended Policy to Elections Ontario at any time. Once that new policy is approved you will be required to agree to such amendment before making any further use of Ontario NDP data following its enactment, and your further use of party data constitutes acceptance of such amendment.

APPENDIX “B”

Where a written acknowledgement is required under section 17.4 of the Election Act, the Agreement appended hereto as Appendix “B” shall be utilized.

Agreement between the New Democratic Party of Ontario
and users of Permanent Register of Electors for Ontario

The undersigned (hereinafter the “User”) agrees, in accordance with the New Democratic Party of Ontario’s (the “Ontario NDP”) Policy governing the use of Permanent Register of Electors for Ontario (“PREO”) Products (the
“Policy”) as well as section 17.4 of the Election Act, as amended, to the following provisions as a condition of license for use of the list of electors prepared from the PREO. I acknowledge the following regarding the information I may have access to directly or indirectly from the PREO, whether the information is in printed or electronic format:

I will only use such information for electoral purposes;
I will not use such information for commercial purposes;
I will only disclose such information to another person after obtaining their written acknowledgement that they are bound by these restrictions;
I will not disclose information I obtain from this list to any other person or organization;
In the case of any breach or suspected breach this Agreement or the Policy the Provincial Secretary of the Ontario NDP shall be informed immediately and shall inform the Chief Electoral Officer of Ontario of the nature and details of the breach;
All copies of the PREO and/or the Electoral List produced or distributed by the User, in either hard or soft copy, with be tracked, handled and destroyed in an appropriate manner, with supporting documentation completed where applicable;
I agree that I will only use this PREO materials for the purposes of furthering the electoral goals of the NDP, and will not knowingly provide this information to any person or organization that does not share these goals;
I understand that there is no commitment on the part of the Ontario NDP to provide user support with respect to the use of the PREO by any means.;
My access to the list of electors is at the sole discretion of the Ontario NDP, and may be revoked at any time by the Ontario NDP;
Users of the Ontario NDP’s software who are not Provincial NDP incumbents or NDP Provincial Riding Associations must obtain copies of elector list for their electoral districts from the appropriate sources. The Ontario NDP does not agree to provide the relevant portion of the electoral list to any group other than Provincial NDP incumbents or NDP Provincial Riding Associations;

Approved by: Kevin Beaulieu, Chief Privacy Officer, Ontario NDP
December 8, 2023