Statistics Canada’s Move to Collect Canadians’ Banking Info Goes too Far

It is sad how badly Statistics Canada has botched their financial data acquisition initiative. They do incredibly important work for Canada, collecting, compiling, and reporting on the data that governments need to make informed decisions. They have a strong record of doing this job well.

When the Harper government cancelled the mandatory long-form census, there was an uprising of public support from many people and groups in Canada, CCLA included. That goodwill has lingered in our collective consciousness. So it is unfortunate that the agency has squandered that social capital with the current proposal to collect initially identifiable (albeit ultimately de-identified) records pertaining to half a million Canadian households without planning to ask consent or provide notice.

To do so, they rely on the authority of the Statistics Act, written in the age of paper files and folders, to demand information from third parties, and on an interpretation of section 7(3)(c.1) in PIPEDA, our private sector privacy law that allows businesses to disclose information without notice or consent of the individual to a government institution in order to administer a law.

But judging from the public outcry, this is one of those times when what is legal and what is right or fair don’t feel like exactly the same thing.

Financial information is profoundly sensitive and deeply personal. It is also highly revealing of the intimate details of our daily activities—where we spend our money reflects our necessities, our priorities, and our frivolities. And there are strong social norms about money. While we regularly ask new friends what they do, most of us would never ask them how much cash it brings in. When a colleague buys a new house, we might ask what neighbourhood it is in or how many bedrooms it has, but probably not how much she paid for it.

None of that means we don’t need accurate, detailed and reliable information about how much people make or how they spend it to develop evidence-based public policy. We do. And we clearly need a way to collect such information in sufficient quantity and quality to do the necessary analyses. Up until now, StatsCan did this through voluntary surveys. The 2016 financial security survey asked 20,000 potential participants to voluntarily provide information about their income and spending habits. StatsCan argues that participation in such surveys is getting too low to get good data. What they don’t explain is why, if a potential participant pool of 20,000 was presumably adequate (and realistically, the number they asked was inflated to account for the fact some people wouldn’t respond), why is it proportionate to ask for data about 500,000 households—which realistically means over a million individuals– now? And if traditionally such data was collected on a voluntary basis in the past, why is it suddenly necessary to do so without consent? Note, we don’t ask why they prefer to do it without consent, because that’s clear: from a research perspective your sample will be more representative of a population if individuals don’t self-select to take part. What we ask is why is it necessary?

The words necessary and proportionate are important. When we are asked to give up privacy rights for public good, the purpose for the invasion must be genuinely necessary—not just easier or desired—and the degree of invasiveness must be proportionate to the societal benefit we receive. Big data thinking, which is at the heart of the StatsCan project, says more is better. For purposes of analysis, it probably is. But how about from a social benefit perspective, when the privacy interests of individuals in their banking information are weighted into the equation? Even when the information is going to be ultimately reported in aggregate, it will also be held, according to the privacy impact assessment in anonymized but highly detailed individual microdata files that may link the financial data with other demographics held by StatsCan. There are also valid concerns with data security when it is held by Shared Services Canada—remember, the last chief statistician resigned when forced to use that data service. At a minimum, these are not risks people should be forced to take; informed consent should be a baseline requirement.

StatsCan shot for the stars on this one. We need to bring them back to earth, but we also need to remember that here on earth, we still need sound data to create evidence-based policy. This has become a highly charged political issue, which is not going to facilitate the measured debate we so badly need. We must have a hard but essential public conversation about what kind of data is truly needed, in what quantity, and how and from whom it can be collected in ways that are demonstrably fair, privacy-protective and secure.

RESOURCES

CTV News: Majority of Canadians oppose StatCan’s plan to access bank data

CTV News: Statcan’s plan to harvest Canadians’ private banking info on hold

Global News: Stats Canada requesting banking information of 500,000 Canadians without their knowledge

Global News: Trudeau defends Statistics Canada move to collect banking info of 500,000 Canadians

Global News: Personal data scooping by StatCan could threaten trade with Europe under tough new privacy rules