Several senators attacked Statistics Canada’s controversial plan to force banks to hand over personal spending data of tens of thousands of residents at a hearing today as an unnecessary intrusion of privacy.
“I’m repelled by this,” Sen. David Tkachuk told the Senate banking committee Thursday at a hearing into the plan, which was only revealed a week ago by a news agency.
“It’s almost totalitarian in scope,” said Sen. Carolyn Stewart Olsen.
And privacy commissioner Daniel Therrien told the hearing that StatsCan hasn’t been transparent enough about the proposed amount and breadth of data it wants.
Tkachuk and Stewart Olsen demanded to know why StatsCan needs raw data from banks that includes customer names and addresses to better determine trends in household spending than the way its been doing for years.
StatsCan chief statistician Anil Arora testified the plan – still being finalized – would see the government agency anonymize the data before processing it. He also insisted StatsCan has tough privacy and security measures to protect the original data.
But that didn’t stop Sen. Jean-Guy Dagenais from accusing the agency of wanting to take “an economic shortcut” by using the Statistics Act to demand banks turn over the information rather than have the banks strip the information of personal identifiers.
“I don’t understand that you don’t have other means,” he said. “Don’t you think that what you’re doing is a useless intrusion into Canadians’ private lives? It’s just as personal as going to get our healthcare information from doctors’ files. You don’t need it.”
Some senators were also uncomfortable that it will be up to the banks to notify customers their data was being shipped to StatsCan, with Stewart Olsen suggesting the banks – not the government – will take the heat.
Arora responded by saying StatsCan has managed personal information for 100 years. “This is nothing new, to protect the privacy and confidentiality of data we have on Canadians … We’ve never had a record that was stolen from our systems. We have a track record that is exceptional.”
Protecting the data wasn’t the only issue raised. Testifying by teleconference from Toronto, privacy expert Ann Cavoukian complained bank customers wouldn’t have to give consent to their data being copied to StatsCan.
Canadians’ trust in institutions is already dropping over personal data concerns, she said. She also noted 20,000 people have signed a petition demanding the turn over of personal banking data to StatsCan be blocked. Instead, she urged the agency to be more imaginative.
“We should turn to innovation,” she said. “If Stats Canada needs this kind of information to help run the country then we must create new methods by which their questions may be effectively answered without violating citizens’ privacy. We need a win-win model. Privacy is all about control over the uses of your data. And unfortunately, it’s totally lacking here,” she said, a reference to the fact that StatsCan has been quietly working on the idea for months. “That’s why there’s been such a reaction against this one.”
Privacy commissioner Therrien said Statics Canada should be asked if there are alternatives. “The propose to collect information from different sources, and they’re collecting information they consider necessary for the scope of their inquiry. Therefore we need to seriously look at what are the alternatives? Is the census not working? Could we conduct short-term surveys?”
For his part, Arora emphasized that the project is still being designed and StatsCan hasn’t yet received any data from a bank. Nor, he added, will it proceed until federal privacy commissioner Daniel Therrien has issued a report on the possible legal and privacy implications of the plan.
The problem, Arora said, is with Canadians doing more business online – both spending and receiving income – StatsCan is having trouble giving timely data to the government for policy-making. Such data goes towards fixing the Consumer Price Index – used, among other things, for setting government pension payments – and inflation numbers.
Until recently StatsCan has been relying on residents to fill out daily spending diaries. However, he said, the number of people willing to do it is dropping.
500,000 households
If the pilot project goes ahead, bank data from 500,000 households would be collected and then anonymized by StatsCan. The agency doesn’t need individual spending patterns, but spending by dwelling. Having the raw data with names and addresses allows StatsCan to filter out duplicate bank accounts, he said. The data is needed for statistical purposes only, he emphasized.
While initially data on 500,000 households, that would be winnowed down to 350,000 in the final anonymized dataset the agency would use.
Assuming the plan goes ahead, StatsCan would keep pulling in more data from households from the banks each year, he said, but on a rotating basis. That way creating a history of a household’s spending “is simply not possible,” he said.
The chance of any Canadian dwelling being selected in one in 28, he said, with the chance of that dwelling actually being used in the anonymized sample for processing is one in 40. By comparison, one in four households will be asked to fill in the long form census every 10 years.
Suprised at numbers
Therrien testified that in addition to consulting with StatsCan earlier this year on issues he just opened a formal investigation after receiving 52 complaints. But while StatsCan had told him generally last year about the pilot, he said he was surprised to learn over the summer that it would involve hundreds of thousands of households.
While in the earlier talks with StatsCan his office could not make a ruling on a federal program’s legality, as part of the new formal investigation Therrien said he can make a determination on whether it complies with the law. He also noted that in 2016 he recommended the federal Privacy Act be changed to allow federal public sector organizations — including StatsCan — be authorized only to collect data “only where necessary and the scope and breadth of the data collected is proportional to the public policy goals the data is intended to serve.” The Act today allows agencies to gather any data “when relevant or useful” to Ottawa. Changing the Act would significantly improve the privacy of Canadians, he said.
Banks might sue
Neil Parmenter, CEO of the Canadian Bankers Association, which represents the major banks, said its members have “serious concerns about the privacy implications of the Statscan request” for raw data.
Asked if banks might sue to prevent turning over data, he replied, “all options are on the table.”
“This isn’t a legal issue,” said Cavoukian, “It’s a moral issue. It infringes on our fundamental right to privacy, especially from the government. It may be legal, but it is not viewed as being ethical. Justifications of a need for personal data from Stats Canada does not justify extracting it directly from citizens banks without their knowledge and consent.”
(This story has been updated from the original to include more of privacy commissioner Therrien’s testimony)