When news broke earlier this year that the accounts of maybe 600,000 Canadian Facebook users had been compromised, Ottawa swung into action to shut down this alarming example of creeping surveillance capitalism. Scott Brison, then acting minister of democratic institutions, said his government had dispatched Canada’s national spy agency to make sure the privacy of Canadians had not been compromised. “Social media platforms have a responsibility to protect the privacy and personal data of citizens,” said Brison.
But when news broke last week that Statistics Canada wants to expand its inventory of data on Canadians by collecting real hard-core personal information on the banking activities of 500,000 Canadians annually, the Trudeau government was suddenly not at all concerned about privacy breaches or even the principle of privacy protection. Instead of waving a red flag over the prospect that StatCan would end up with computers full of private financial details on millions of citizens, Prime Minister Justin Trudeau brushed off privacy concerns, which he implied take a back seat to the government’s need for “high quality and timely data.” Such data, he said, are “critical to ensuring government programs remain relevant and effective for Canadians.”
Spoken like a true central planner and enthusiastic purveyor of policy-based evidence making. Nobody seems to know why StatCan wants to begin collecting personal banking information on individual Canadians, information that Canada’s bankers are rightly reluctant to provide. In the all-new era of fintech and blockchain, the great concern among regulators is how data privacy will be protected. At StatCan, the concern is: “How do we get our hands on the data?”
An official tweet Wednesday from Anil Arora, Chief Statistician of Canada, failed to clarify the agency’s motives. He called the bank data collection plan a “pilot project.” He said more than 75 per cent of Canadian consumer purchases are conducted online and that StatCan “has to have access to these data in order to provide all Canadians with the timely and quality statistics they need in areas such as housing and debt and the impacts of transitioning to a GIG economy.”
The gig economy? Is that an economic phenomenon big enough to justify the accumulation of personal banking transactions of most of the population? As for the consumer purchases of Canadians, online or otherwise, credit card data might be more informative, although one hopes StatCan has not gone after that data as well as the credit bureau information it has surprisingly already collected.
StatCan’s assurances on privacy protection are not all that reassuring. In a document dated October 2018 — obtained by David Akin at Global News— the chief statistician describes his agency’s “Generic Privacy Impact Assessment related to the acquisition of financial transactions information.” It is clear that the names of millions of Canadians, their bank account numbers and transactions, their bill payments and personal activities, will be collected and stored in government computers. StatCan is not merely getting useful generic data on the spending and banking habits of Canadians, it is collecting the actual spending and banking habits and names of individual Canadians.
It is one thing to collect and analyze statistics based on anonymous data. It is quite another to “require” — Arora’s word — that the banks provide “individual payments and income history.” Even though billions of bits of private, individual and personal information will be collected, StatCan says that, “Under no circumstances will the personal information obtained from financial institutions be used to perform credit, expenditure or income checks on individual Canadians.” He said none of the resulting statistical reports will include any personal data.
That’s not good enough.
There are two larger issues here, aside from the obvious breach of individual privacy without permission and the fact that detailed day-to-day banking information on Canadians is a much more deeply personal than daily Facebook activities.
The first issue is security. StatCan says billions of bits of personal data will be collected using a “secure file transfer protocol” and stored behind “network firewall and access rules” with “functional and current anti-virus software.” Only people with “work-related need” will have access. All very nice, but we’ve heard all this before from any number of corporations and government agencies that have suffered data breaches.
It is one thing to collect and analyze statistics based on anonymous data. It is quite another to ‘require’ that the banks provide ‘individual payments and income history’
The second and more important issue is the use to which the data will be put, not just today but in the future. StatCan itself has in the past shown a willingness to jump aboard political trends. It is famous for cranking out research on the 1% wealth gap, income distribution and pay inequities. It jumped aboard the marijuana bandwagon with a “Cannabis Stats Hub” which seemed to be promoting a booming industry and a Liberal agenda.
StatCan’s explanation of its current objectives are already vague. But a decade or two from now, some new interventionist government with bold planning ideas and a fresh ideological agenda could decide to dig deeper into the personal banking data storehouse.
Politics is filled with planners and interventionists whose need for more data is universal and never-ending. In future, current privacy rules — such as they are — could easily be overthrown in the name of the public interest.
In this internet era of Big Data, there are constant warnings about the risks of “surveillance capitalism” through the likes of Google and Facebook. The greater risk has always been surveillance statism.
Kudos to Canada’s Privacy Commissioner Daniel Therrien for launching an investigation into Statistics Canada’s bank data raid.