By Nathan Hoo with research from Rex Yeung
Many Canadians only think of Statistics Canada (StatCan) as the agency that asks them to fill out a census every five years, but its powers and mandate extend beyond this. StatCan’s mandate under the Statistics Act is “to collect, compile, analyse, abstract and publish statistical information relating to the commercial, industrial, financial, social, economic and general activities and condition of the people of Canada.” It must also collect and publish statistical information derived from the activities of other government departments and, in coordination with the provinces, develop integrated social and economic statistics for all of Canada.
StatCan sells data sets to public and private clients, bringing in $113 million dollars in revenue in 2018. Companies like InfoCanada use these data sets to sell marketing services. In a phone interview with Paul Lauffin, a Consulting-Analyst from Statistics Canada’s Collection and Regional Services Branch, Mr. Lauffin gave examples of the types of organizations and people who purchased data from StatCan. These included churches, local businesses, municipal wards and local city councillors.
Recently, it was revealed that StatsCan was seeking to acquire personal transaction data from banks and other private financial institutions. Canada’s Privacy Commissioner, Daniel Therrien, launched a formal investigation of Statistics Canada in October of 2018 following a series of complaints. While StatCan had consulted the Privacy Commissioner’s office in a general way about the project, StatCan did not reveal the extent of the data collection, namely that half a million Canadian households would be affected.
The fact that StatCan collects administrative data is not new. As Commissioner Therrien remarked in his comments before the Senate Standing Committee on November 8, 2018, StatCan has been doing this since “perhaps as early as 1921”. Things have changed, however, since 1921. The breadth and volume of data that modern technologies generate dwarfs that of analogue technologies like paper. Commissioner Therrien reminded the Standing Committee of his recommendation to update existing privacy laws to account for the scale of today’s available personal information.
Many are understandably upset that a government agency could request and obtain their private financial banking information without preliminary notification. Unfortunately, few appreciate just how easy it would be for an agency like StatCan to acquire this information, given the outdated nature of the Statistics Act and limitations of current privacy legislation.
Professor Teresa Scassa, Canada Research Chair in Information Law at the University of Ottawa’s Faculty of Law, points out that section 13 of the Statistics Act specifically grants StatCan enormous power to request any “documents or records” from third parties. Read in today’s context, “any documents of record” extends to every bit of digitally collected data.
Professor Scassa also criticises PIPEDA for being an outdated and ineffective protection of customer data. Sardonically, she remarks:
“In case you were wondering whether Canada’s private sector data protection legislation offers any protection when it comes to companies sharing customer data with Statistics Canada, rest assured that it does not.”
Paragraph 7(3)(c.1) of the Personal Information Protection and Electronic Documents Act (PIPEDA), she explains, allows an organization to disclose personal information without the knowledge or consent of an individual if such a disclosure is “made to a government institution or part of a government institution that has made a request for the information, identified its lawful authority to obtain the information and indicated that […] the disclosure is requested for the purpose of administering any law of Canada or a province”. In other words, because the Statistics Act gives StatCan the power to request information to fulfill its mandate, PIPEDA allows StatCan to request information without having to obtain customer consent.
Both Commissioner Therrien and Professor Scassa have called for updated legislation to promote transparency and specifically address the way in which personal information is shared between the government and third parties. As it is nearly impossible to avoid generating a digital footprint in 2018, it is vital that our legislation clearly identified how our personal information may be used and shared between private commercial entities and the government.