Alberta’s elections agency said Thursday it believes 568 people accessed a voter list at the heart of a massive privacy breach involving a separatist group.
The group, called the Centurion Project, had created a publicly accessible database containing the names and addresses of nearly 3 million Alberta voters.
The website was shut down last week after Elections Alberta secured a court injunction.
Lawyers for the agency said it traced the database back to an official voter list that was legally provided to the pro-independence Republican Party of Alberta. How the list changed hands is under separate investigations by Elections Alberta and the RCMP.
A spokesperson for Elections Alberta, Michelle Gurney, said Thursday that the Centurion Project identified 23 individuals who were given full copies of the voter list, while another 545 accessed it through the database when it was still active.
The group was ordered to provide the information as part of a court order. Gurney said cease-and-desist letters have been sent to all those identified as accessing the information.
“The 23 people who were provided the list are required to provide a signed declaration they have complied with the direction,” Gurney added.
Centurion Project says its goal was to recruit separatist supporters
The Centurion Project has said its goal was to identify and recruit as many supporters of Alberta independence as possible ahead of an expected referendum this fall. A spokesperson for the group said it relied on an unnamed third party for the data.
Gurney didn’t provide names for those receiving cease-and-desist letters, but some in the separatist movement have shared on social media letters they received.
The letters, signed by chief electoral officer Gordon McClure, explain that the Centurion Project was not legally entitled to have the voter list, as such lists are provided only to political parties, party officials, legislative members, and election candidates.
Privacy watchdog launches investigation
Opposition NDP Leader Naheed Nenshi told reporters he was happy to see the cease-and-desist letters but remains concerned. “The Centurion Project took the database down from the public, but they still have access to it,” he said.
A third investigation into the breach was also announced Thursday by the provincial privacy watchdog.
Privacy Commissioner Diane McLeod said in a news release that she planned to investigate whether the Centurion Project’s actions violated the Personal Information Protection Act, which regulates how private-sector operators collect and use private data.
The investigation could lead to a public report with recommendations to prevent similar leaks in the future.
The commissioner last week called for legislative changes as a result of the breach, saying her office should be given oversight of political parties and their use of private information as is done in British Columbia. Smith had rebutted the call, saying the government would wait for the results of the other investigations before considering legislative changes.
Data breach raises safety concerns
The data breach has raised safety concerns for many, including those seeking anonymity from abusive partners.
It has also been the subject of heated debate in the legislature.
The Opposition NDP revealed this week that a United Conservative Party caucus staffer attended a virtual meeting held by the Centurion Project two weeks before the issue came to light.
During the meeting, the NDP said the group’s leader demonstrated how the website worked.
Smith has insisted the staffer had no reason to believe at the time that the database wasn’t above board and that she didn’t know about the voter list leak until she read media reports last week. Nenshi said Smith is either lying or needs to take responsibility for an “incompetent” caucus culture.
The NDP said it notified police about the breach the day after the April 16 meeting. Smith has said the NDP should have also told her government, even though the caucus staffer was in the meeting.
Smith’s caucus is trying to get legislature Speaker Ric McIver to formally sanction Nenshi over failing to inform the government, saying he put public officials at risk.
Nenshi said he acted responsibly and didn’t trust Smith on the issue, given her prior ties to the founder of the Centurion Project.
McIver said he would issue a decision Monday.
This report by The Canadian Press was first published May 7, 2026.