Fair Vote Canada Volunteer Error Exposes 134,336 Voter Records
What Happened — In March 2024 a volunteer for Fair Vote Canada inadvertently published a 2020 dataset containing 134,336 unique email addresses, names, physical addresses, phone numbers and, for some donors, the amount and date of political contributions. The exposure was discovered when the data appeared in public breach repositories.
Why It Matters for Trust & Control Assurance
- The incident illustrates a gap in data‑handling policies and continuous oversight of who can access or publish personal information.
- A control‑assurance program would require documented consent, regular review of data‑access permissions, and auditable evidence that privacy controls are enforced.
- Leveraging Verisq’s CookiePLUS Privacy capability provides a single source of truth for consent records and data‑subject request handling, supporting a defensible audit trail.
Who Is Affected – Non‑profit political advocacy groups, NGOs handling supporter data, and any organization that stores personally identifiable information (PII) and political donation details.
Recommended Actions
- Map the breach to the “privacy and data‑protection” control area (e.g., NIST CSF Protect – Data Security).
- Conduct an immediate review of data‑access permissions for volunteers and third‑party contributors.
- Deploy a consent‑management solution to capture, store, and evidence lawful bases for processing personal and political data.
- Document the incident response steps and retain evidence for audit readiness.
Technical Notes – Exposed data fields: email, full name, mailing address, phone number, donation amount and date. The breach stemmed from a human error (volunteer mis‑configuration) rather than a technical vulnerability. Source: [Have I Been Pwned – Fair Vote Canada breach]