A new report reveals that Victoria firm Aggregate IQ collected and used the personal data of millions of voters without their express consent.

The report is based on an investigation conducted by the Office of the Information and Privacy Commissioner for British Columbia and the the Office of the Privacy Commissioner of Canada.

Aggregate IQ provides election-related software and political advertising services and has worked with SCL, the parent company of Cambridge Analytica, on various U.S. and political campaigns between 2014 and 2016 and the Brexit referendum in 2016.

See also: A controversial Victoria company accessed the BC Green Party’s voter database in 2016

The firm, headquartered on Pandora Avenue, breached Canadian privacy laws after failing to ensure that appropriate consent was obtained before using and disclosing the personal information of millions of voters in British Columbia, the United States, and the United Kingdom.

More specifically, the firm was provided with personal voter information from SCL that included the psychographic profiles, ethnicity and religion, political donation history, birthdates, email addresses, magazine subscriptions, association memberships, inferred incomes, home ownership information, and vehicle ownership details of a large number of people.

They then used voters’ names and email addresses to deliver political ads to them through Facebook on behalf of SCL and other third-party clients. Aggregate IQ also leveraged Facebook’s “lookalike” audience feature, which allows advertisers to target broader groups of users that have similar characteristics.

According to the findings of the investigation, the firm did not do enough to verify the consent of the people whose information was disclosed, some of whom would be surprised to learn that their data was used to target them for political ads.

“The AIQ investigation shows how sensitive personal information can be used by political campaigns to sway voters. This highlights once again the urgent need for law reform to protect democratic processes and the fundamental human right to privacy,” said federal privacy commissioner Daniel Therrien.

“The federal government has said that Parliament should study how to bring federal parties under privacy legislation. We urge the government to move quickly with this review and amend the law.”

As a result of these findings, Aggregate IQ consented to delete all personal information that is no longer needed for legal or business purposes, and to implement policies for obtaining valid consent in all future transactions.

The BC and federal offices will follow up with AIQ in the coming months to confirm that it has implemented the investigation recommendations.