Privacy watchdog says StatsCan pilot raised 'significant privacy concerns'
Commissioner Daniel Therrien tables his annual report to Parliament
Canada's privacy watchdog says Statistics Canada did not break current laws — but it did raise "significant privacy concerns" — when it planned to harvest Canadians' personal financial transaction information.
Privacy Commissioner Daniel Therrien said the agency's plan to collect credit histories and do a mass collection of line-by-line financial transaction information from banks without advising people or getting their permission also demonstrates the "inadequacy" of Canada's existing privacy laws.
"Canadians were deeply troubled by these initiatives," Therrien said in a release after tabling his report today.
"This concern was clearly justified given the scale of the proposed collection, the highly sensitive nature of the information and the fact that the information in question would paint an intrusively detailed portrait of a person's lifestyle, consumer choices and private interests."
During his investigation, Statistics Canada officials spoke about their objectives but "did not demonstrate the necessity of collecting so much highly sensitive information about millions of Canadians," Therrien said.
StatsCan ultimately agreed to follow Therrien's recommendation not to implement the projects as originally designed, and to work with his office to retool the initiatives. The commissioner said that commitment to make changes will improve privacy protections and help build public trust.
"Canadians have sent a clear signal that they expect more transparency about why and how we collect and protect their information. Statistics Canada will be more transparent about our programs and the ways in which we collect, process and store data," the agency said in a statement.
To fulfil that pledge, the agency said that it has posted detailed information about how Statistics Canada collects Canadians' information on its new Trust Centre website.
Therrien said he hopes this experience will serve as "lessons learned" for other federal departments trying to use personal data, but warned there could be repeats if laws aren't strengthened.
"Yes, there is a risk that this could happen again, particularly in other departments. But if they take the lessons from Statistics Canada exercises, that is less likely to happen, and what would ensure that it doesn't happen would be to amend the law," he told a news conference in Ottawa.
Therrien launched an investigation in the fall of 2018 following reports that the agency was asking several banks to give it the financial transaction data of about 500,000 Canadians as part of a pilot project.
As first reported by Global News, Statistics Canada was requesting the data without asking the individuals affected for their permission.
Under the Statistics Act, the agency can force third-party organizations to disclose information that would "assist Statistics Canada in fulfilling its mandate."
The Conservatives made sure the story was front and centre during question period in the House of Commons — and the political backlash got so heated the head of Statistics Canada was forced to issue a public statement assuring Canadians that their personal financial data would be safe.
The agency maintains it has a long history of working with sensitive data and has policies and practices in place to ensure personal financial information is also protected. Eventually, however, the data collection project was put on hold while the Office of the Privacy Commissioner investigated.
In the weeks after the story first broke, Statistics Canada was so concerned about the potential damage to its reputation it even hired a public relations firm to help "re-establish" control over its public image.
Therrien tabled his annual report to Parliament Tuesday morning. It also makes recommendations for modernizing Canada's federal privacy laws to replace the self-regulation of companies with enforceable rules and consequential penalties.
Therrien said privacy must be deemed a human right in the face of online companies' power and resources.
"It is untenable that organizations like Facebook are allowed to reject my office's findings as mere opinion," he said.
Stronger privacy laws would not impede innovation, but would build public trust in emerging companies, he said.