Alberta privacy commissioner investigates alleged Centurion Project data breach

Alberta’s privacy commissioner has launched an investigation into the alleged leak of the province’s entire electoral list.

Diane McLeod’s office is looking into allegations the Centurion Project, a pro-separatist group, published the personal information of three million Albertans in a database accessible to all.

The privacy commissioner says that would be a violation of the Personal Information Protection Act (PIPA).

BACKGROUND: RCMP investigating Alberta voter info published by separatists, as injunction granted to shutter database

The Centurion Project was notified of the investigation on Wednesday. David Parker, the project’s founder, has denied any wrongdoing in the case, initially claiming he obtained the personal information from a phonebook.

The database was taken down last week following a court order, and Elections Alberta and RCMP have announced separate investigations into the data breach.

“Section 36(1)(a) of PIPA authorizes me to conduct an investigation on my own motion to ensure compliance with any provision of PIPA,” said McLeod in a news release. “I have decided to exercise my authority to investigate these allegations.

“I also have authority under PIPA to order compliance where non-compliance is found during an investigation.”

The investigation will examine if the Centurion Project had the authority to collect, use, or disclose the personal information; if the group made reasonable security arrangements to protect the information; and if it had an obligation to comply with the duty to notify.

“Additional issues may be considered based on evolving circumstances or in response to evidence received,” the news release reads.

Parker has said the goal of the Centurion Project is to recruit and identify those who support the idea of Alberta separating from Canada ahead of a potential referendum this fall.

568 people accessed voter list: Elections Alberta

Elections Alberta says it believes 568 people accessed the voter list at the heart of the privacy breach — that 23 people were given full copies of the list while another 545 accessed it through the online database.

The database was traced back to an official voter list Elections Alberta had legally distributed to the pro-independence Republican Party of Alberta. Voter lists are only distributed to elected officials, political parties and party officials and can’t be shared with third parties.

Investigators acting on information from an anonymous tipster probed the database published by the Centurion Project and matched the fake names to a list given to the Republican Party in 2025, according to a lawyer for the Alberta elections agency.

Elections Alberta says cease-and-desist letters have been issued to people the Centurion Project says accessed the list.

Who knew what, when?

The governing United Conservative Party and Opposition Alberta NDP have been trading blame over who knew what.

A UCP caucus staff attended a virtual meeting on April 16 hosted by Parker that allegedly explored how to access the database of personal information.

Alberta NDP Leader Naheed Nenshi revealed this week his party has video evidence the list was discussed and displayed. Former Alberta premier Jason Kenney’s personal information was allegedly displayed on the call.

Alberta’s UCP caucus later confirmed a staff member attended the meeting but specified that organizers of the Centurion Project call assured attendees the data on display was “obtained legally.”

“At the time, the staff observing the meeting had no reason to believe the website in question was unlawful,” said caucus communications director Shanna Schulhauser, who explained caucus staff “regularly attend events of political interest.”

The NDP says that staffer should have immediately reported the suspicious list to the premier and the police. The Opposition says it emailed the RCMP about the situation on April 17 – the day after the meeting.

“The premier’s staff member sat through a meeting where her friend David Parker gleefully shared Jason Kenney’s information,” said Nenshi in the legislature Wednesday. “’Look what I can do. Look what you can do.’ And her staff didn’t tell anybody. It’s just business as usual for this government.”

“There was no way for him to know that this data was illegal,” Premier Danielle Smith retorted. “That was not disclosed on the call.”

The premier fired back further, saying Nenshi should have told the legislature sooner because he knew about the meeting and had a letter from a journalist who was concerned the list was illegally obtained.

–With files from The Canadian Press