Good news: Privacy wins in Statistics Canada case

Following a privacy investigation, Statistics Canada’s proposed collection of sensitive financial data has been shelved. But we need long-overdue updates to our privacy laws to make sure we’re protected in the future.

Information about our personal finances is one of the most private and sensitive types of data. So when the news broke last year that Statistics Canada was planning an unprecedented collection of financial data - including credit ratings, social insurance numbers, balances owed, balances overdue, debit and credit transactions, mortgage payments and e-transfers, and some real time banking information - of over 500,000 people in Canada, many people were outraged. 

It also quickly came to light that StatCan had already compelled the credit bureau TransUnion to hand over more than 15 years worth of this information to them. 

Why were people concerned?

People were hugely concerned about the privacy implications of such a large collection of highly personal data. There are also significant security risks with gathering this huge amount of data, such as misuse by employees, hacks and leaks. Transparency and consent were also key issues - not only does StatCan have the legal power to take this information without consent, but with no transparency in place, people had no way of even knowing if their information had been accessed. 

The sweeping powers given to organizations like StatCan come from our out-of-date privacy laws, which haven’t been meaningfully updated in far too long. This means they’re not equipped to properly address the changing privacy concerns of our digital age, where the power of big data processing allows agencies like StatCan to gather, correlate, and draw conclusions from our data in ways impossible in earlier eras. 

What did the OpenMedia community do?

To get the Privacy Act the updates it sorely needs, over 7,000 of us signed a petition asking for the Act to be promptly reviewed and updated. 

We also helped people find out if their information had been accessed, teaming up with BC FIPA to provide a how-to guide on filing a personal information request. Over 900 people used the guide to find out whether their banking information had been shared with StatCan. 

What was the response from government to public concern?

The public’s privacy concerns were heard: the Office of the Privacy Commissioner launched an investigation into the information collection, andStatCan agreed to halt the program until the investigation was concluded. 

The investigation was finished a few months later, and though the Commissioner concluded that Statistics Canada had the legal authority to collect the information, they identified significant privacy concerns, mostly around the issues of proportionality, transparency and protection from external threats. These concerns were strong enough that their key recommendation was that StatCan not continue to proceed with the Credit Information Project as originally designed. 

Happily, StatCan has agreed to implement the recommendations in full, which means the program is no longer going forward as originally planned. 

What comes next?

The story doesn’t end there: alongside their recommendations, the Office of the Privacy Commissioner also stated “we are also of the view that Parliament should consider legislative reform of the Statistics Act and the Privacy Act to ensure that the public interest in obtaining personal information from administrative data sources for statistical purposes does not unjustifiably infringe upon the privacy of individuals, including principles of necessity and proportionality.”

While personal privacy won in the StatCan case, it also highlighted how badly needed (and long-overdue) changes to the Privacy Act are, which is as out of date as ever. Thank you to everyone who took action on this important campaign - let’s keep fighting together!

Join our privacy mailing list to be a part of our future campaigns!