Canada’s privacy watchdog says Statistics Canada did not break current laws but it did raise “significant privacy concerns” when it planned to harvest Canadians’ personal financial transaction information.
Privacy Commissioner Daniel Therrien said the agency’s plan to collect credit histories and do a mass collection of line-by-line financial transaction information from banks without advising people or getting their permission also highlights the “inadequacy” of Canada’s existing privacy laws.
“Canadians were deeply troubled by these initiatives,” Therrien said in a release after tabling his report.
“This concern was clearly justified given the scale of the proposed collection, the highly sensitive nature of the information and the fact that the information in question would paint an intrusively detailed portrait of a person’s lifestyle, consumer choices and private interests.”
During his investigation, Statistics Canada officials spoke about their objectives, but “did not demonstrate the necessity of collecting so much highly sensitive information about millions of Canadians,” Therrien said.
StatsCan ultimately agreed to follow Therrien’s recommendations not to implement the projects as originally designed, and to work with his office to retool the initiatives. The commissioner said that commitment to make changes will improve privacy protections and help build public trust.
“We also hope that this experience will encourage other federal departments to fully consider privacy issues as they work to align their activities with the federal government’s strategy to make more strategic use of the data they collect,” he said in his report.
Therrien launched an investigation in the fall of 2018 following reports that the agency was asking several banks to give them financial transaction data of about 500,000 Canadians as part of a pilot project.
As first reported by Global News, Statistics Canada was requesting the data without asking the people impacted for their permission.
Under the Statistics Act, the agency can force third-party organizations to disclose information that would “assist Statistics Canada in fulfilling its mandate.”
The Conservatives made sure the story was fodder during question period and the political backlash got so heated the head of Statistics Canada was forced to issue a public statement assuring Canadians that their personal financial data would be safe.
The agency maintains it has a long history of working with sensitive data and they have the policies and practices in place to ensure this financial information is also protected, but eventually the data collection project was put on hold while the Office of the Privacy Commissioner investigated.
Statistics Canada was so concerned over the potential damage to its reputation in the weeks after the story first broke it even hired a public relations firm to help “re-establish” control over its public image.
Therrien tabled in his annual report to Parliament Tuesday morning, also making recommendations for modernizing Canada’s federal privacy laws to replace the self-regulation of companies with enforceable rules and consequential penalties.
During a news conference in Ottawa, he said companies like Facebook should not be able to dismiss his findings as merely an opinion, and should be held to account for privacy breaches.
Stronger privacy laws would not impede innovation, but would build public trust in emerging companies, he said.