Proceedings of the Standing Senate Committee on
Banking, Trade and Commerce
Issue No. 48 - Evidence - November 8, 2018
OTTAWA, Thursday, November 8, 2018
The Standing Senate Committee on Banking, Trade and Commerce met this day at 10:30 a.m. to study the present state of the domestic and international financial system (topic: the collection of financial information by Statistics Canada).
Senator Douglas Black (Chair) in the chair.
[English]
The Chair: Good morning and welcome, colleagues and members of the general public who are following today’s proceedings of the Standing Senate Committee on Banking, Trade and Commerce either here in the room or listening via the web. My name is Doug Black. I chair the committee, and I’m a senator from Alberta.
I will ask my colleagues around the table to please introduce themselves to the witnesses.
Senator C. Deacon: Colin Deacon, Nova Scotia.
Senator Tannas: Scott Tannas, Alberta.
[Translation]
Senator Dagenais: Jean-Guy Dagenais from Quebec.
[English]
Senator Stewart Olsen: Carolyn Stewart Olsen, New Brunswick.
Senator Wells: David Wells, Newfoundland and Labrador.
Senator Tkachuk: David Tkachuk, Saskatchewan.
Senator Klyne: Marty Klyne, Saskatchewan.
The Chair: Thank you very much, senators.
Today we are examining the topic of the collection of financial information by Statistics Canada. We have a busy meeting planned, so I’m going to ask that all speakers keep their comments as succinct as possible, and I would ask my colleagues to do the same. With this cooperation, we will be able to get through the three panels we have set this morning.
I would like to take this opportunity to remind us all that our interpretation services are operating live today. I don’t understand what that actually means, because I think they are operating live most days, but it does mean that we’re supposed to ensure that our level of delivery is appropriate.
On our first panel today, I am pleased to welcome, from Statistics Canada, Anil Arora, Chief Statistician of Canada; André Loranger, Assistant Chief Statistician, Economic Statistics; and Linda Howatson-Leo, Director, Privacy Management and Information Coordination.
I thank you all very much for being with us today. Mr. Arora, would you please proceed with your opening comments, following which senators will undoubtedly have questions for you. Thank you very much.
[Translation]
Anil Arora, Chief Statistician of Canada, Statistics Canada: Thank you for giving us the opportunity to share our plan and the details of the current project.
[English]
Honourable senators, I’d like to immediately dispel three major inaccuracies about the pilot project to enhance the statistical system using payments data.
First, no data has been collected to date by Statistics Canada as it pertains to this pilot project. I repeat: Nothing has been collected.
Second, trust is the foundation of how Statistics Canada operates, and we will continue to earn the trust of Canadians.
Third, I can assure you that this project will not proceed until the Privacy Commissioner has done his work and we have addressed the privacy concerns of Canadians.
“Why?” you might ask. Well, the pace at which our economy and society is changing is putting greater pressure on statistical agencies the world over to provide more detailed and timely information for fact-based decision-making. Statistics Canada is a world-leading statistical agency that has, over 100 years, experimented, piloted and worked with Canadians to provide businesses, non-profit organizations and policymakers at all levels of government with the best information possible. Over this past year, honourable senators, we have conducted over 175 consultation and engagement sessions from coast to coast to coast to hear from Canadians on their data needs and how we can do better. The government has set aside resources announced in Budget 2015 to help us find new ways to provide better quality and timely better data.
The issue in front of us today is not simply an academic one. Statistics have far-reaching implications for all Canadians, and diminished quality will have direct impacts on all of us. Economic and social statistics are vital for setting economic and fiscal policy, and as you know, they are used in the determination of OAC, CCP, QPP, establishing equalization payments, and informing economic and social transfer budget allocations. In addition to this, businesses and individuals use the data to make key investment decisions about major purchases, jobs and investments, whether to expand a business or buy a new home.
More specifically, estimates of household spending are used in part to derive the consumer price index. That, in turn, indexes pensions and Old Age Security, directly impacting the income of seniors. It impacts wage rates, labour contracts, Employment Insurance and policies designed to address important issues such as poverty. Eighty billion dollars in revenues from the Harmonized Sales Tax are distributed to provinces based our estimates of household expenditures. HST revenue is, in turn, used by the federal government and provinces to fund public services. The Bank of Canada uses our statistical information to set interest rates and monitor inflation.
The pace at which Canadians are adopting digital services has accelerated rapidly. Today we send money by email, and we get our food delivered through an app. Eighty per cent of all financial transactions are done electronically today, some 21 billion of them alone in 2016.
The Governor of the Bank of Canada has spoken about the emerging gap in our statistics and how transactions that fall below customs reporting thresholds are missing altogether in our financial statistics.
We produce statistics that are used by Canadians daily, and their use and impact are increasing as our economy and society become increasingly digital and global. We have put in a lot of innovative methods over the past couple of years at Statistics Canada, and we have tested new methodologies such as our information on housing, cannabis and tourism, just to name a few. We’re putting out more data in easy-to-consume ways, with more detail in a timely fashion. The case for modernization is clear. Canadians demand and deserve the best information to make decisions, and Statistics Canada is working hard to deliver.
I’d also like to be clear on our innovation agenda. It is founded on the pillars of a solid track record of respecting the privacy and confidentiality of the information that Canadians trust us with. It is not enough to simply say, “Trust us.” We work hard each and every day to earn this trust of Canadians through robust processes, systems, and a culture of privacy and confidentiality.
I would like to now move on to the second part, which is the actual project in question, to outline our discussions with the Canadian Bankers Association and financial institutions over the course of this last year. This is a pilot, and it remains in active discussion. It has not been implemented yet, and no data has been received by Statistics Canada.
We operate in an open, transparent and collaborative manner, working in partnership with our data providers, whether it’s another government department, a province or territory, or a private institution. For nearly a year, we have been working on a design and framework that builds on the trust financial institutions have with their clients and to better understand the technical implications of moving forward with this pilot project. Earlier this month, we received contacts in each of the nine institutions participating in this pilot from the Canadian Bankers Association to better understand their individual needs, to further strengthen the design and to better understand implementation details. We met and corresponded with the Canadian Bankers Association and financial institutions on multiple occasions — 12, to be precise, since April.
The project is designed to follow rigorous methodological principles and privacy by design elements. We have been clear on the need to be fully transparent with Canadians — that the information was to be provided to Statistics Canada for statistical purposes only, and the reasons for doing so — as we have been with all our data providers.
The design has also been developed with input and guidance from the Office of the Privacy Commissioner. We owe much of our processes and systems to their expertise and collaboration with Statistics Canada.
While the notion of 500,000 addresses may seem large, there are over 14 million households in Canada. The chance that a given address is selected as part of our sample is 1 in 28. The chance that the dwelling is actually used in the sample is 1 in 40. The long-form census has a sample of 1 in 4. We will rotate this sample from one year to the next so that a history of information for any one household or individual is simply not possible.
Mr. Chair, as I said at the outset, Statistics Canada takes the privacy of Canadians very seriously. We have developed systems, processes and a culture that has resulted in a strong record of privacy and confidentiality protection. The trust of Canadians is crucial to our ability to provide unbiased, high-quality and timely statistics, regardless of whether it is through a paper questionnaire, the census or from an administrative record.
I can assure you that we will not proceed with this project until we have addressed the privacy concerns expressed by Canadians by working cooperatively with the Privacy Commissioner and with financial institutions.
Thank you very much.
The Chair: Thank you very much, Mr. Arora. We will move immediately to senators’ questions, starting with the deputy chair.
Senator Stewart Olsen: Thank you for being here to offer us some explanation as to this puzzling announcement and media stories. I am interested in what you just said about a pilot project — these are first days that I’m hearing the term “pilot project” — and also that you were clear with Canadians about respecting their privacy. I do think that perhaps that is erroneous because Canadians didn’t know this was happening or that it was, in your words, proposed to be happening.
After reviewing your mandate around the term “administrative data” that Stats Canada can collect from other government agencies, private sector and organizations, Stats Canada can use administrative data to complement survey data and make its own statistical operations more efficient, but 40 per cent of Stats Canada’s current programs are based, in whole or in part, on data available from these administrative sources.
Regarding the personal information of Canadians selected, I understand employees who take an oath of security in your department are the only ones who can access this personal information, and only under certain circumstances. What are those special circumstances?
Other organizations that need to can access this administrative data, but only with the consent of individuals whose personal information is being accessed. How are you sharing this data? How do you assure yourself that they have requested permission from people when you’ve said yourself it’s a bit nebulous and hard to trace? Have you shared this data with ministers’ offices who may call you? Once you share it, does a minister ask for permission to access that data?
Mr. Arora: Thank you very much, senator, for those questions.
Let me be clear again, please: We have not received a single piece of information yet from any of those financial institutions, and we remain in contact with the CBA as well as with the individual institutions to understand their concerns and their individual design. We plan to work with them on their individual needs before any data comes to us.
Second, as I said, it’s not simply a matter of telling Canadians to trust us. We have earned that trust because we have strong processes and systems in place. The instant that data comes us, it actually comes to us in two separate files. We anonymize or randomize the data so that the individual’s name and the record don’t even come to us. Then we essentially have a vault within Statistics Canada where the keys to put those two things together are kept very separate from the individuals who actually process that information.
We’re not interested in the individual transaction between an individual and a vendor or between an individual and another individual. What we are trying to do is harvest out of that the statistics. It’s the information about the types of households, what their expenditure patterns are and what they’re spending that money on so that we can put that into indicators such as CPI. Then we can go to neighbourhood levels and see what’s going on with vulnerable populations, such as individuals who want to get into the housing market or a business looking to expand.
The Chair: You’re repeating your introductory comments. We understand your objectives. If you could please address yourself to the question.
Mr. Arora: Absolutely. The last part, senator, is who do we share this information with? No one. The individual record is not shared with a minister, with a court, with law enforcement officers, CSIS, you name it. Nobody gets access to that individual record.
Senator Stewart Olsen: But your own mandate letter says it can be done.
Mr. Arora: If an individual gives us the permission to share that individual record, and that is up front, then we have the authority to share that. But in this case, no such request, no such provision, exists.
Senator Stewart Olsen: You mean you have not considered asking the people for their permission to access. Is that correct? You’re kind of putting the cart before the horse.
Mr. Arora: There are many cases, as you know. We have 400 survey programs. Many of them are mandatory and many of them are voluntary. In other words, in many cases people choose to give us the information, and in other cases it’s an obligation for them to give us the information.
In this case, given the detail of information that we require at a local level and the demographics, we need the information to be representative, and we need it to be unbiased, in a sense, so we need to be able to equally get at both those who consent and those who do not.
Senator Stewart Olsen: I understand. I think we all get why, but what we don’t understand is and what I asked you what are the circumstances where you could share. If you did share with say a minister or the government, do you inform the government they must get the person’s permission?
Mr. Arora: First of all, disclosure is only given for very special circumstances and for statistical purposes only. We do not give individual records for any purpose whatsoever. To your specific question about whether a minister or the CRA could ask for an individual record, that clearly would not meet the need for any kind of statistical purpose, and therefore it would not be entertained.
Senator C. Deacon: Thank you, Mr. Arora, for your comments. Just quickly, I’m wondering if you could provide something to the committee. I was reading a Twitter thread from Dr. Jennifer Robson about the process researchers go through to access Statistics Canada’s aggregated data sets, obviously at that point anonymized and aggregated. I was quite impressed by that process, and perhaps you could provide that to the clerk in a detailed manner versus taking up time here.
Mr. Arora: Certainly.
Senator C. Deacon: For me, I’m looking at it as somebody from the start-up sector who has built businesses only based on evidence. There is no existence for a business except for good evidence. I was struck by Governor Poloz’s comments about a week ago, speaking about the challenges around measuring in the digital economy and the huge changes. Blockbuster was a thing 10 years ago. There was no Airbnb to speak of or the gig economy and how it has come along. I made three or four purchases on Square last weekend, so I clearly see the need.
I’m interested in the risks of not doing this. Could you could speak to those? I really believe that if Canadians understand how important this is for us to have evidence-based policy and understand how their concerns for privacy are addressed and that the data is only aggregated, then they will be very supportive. We need to make evidence-based policy in this country. I’d like you to speak specifically to the urgency of that need and maybe some global comparators and risks.
Mr. Arora: You are absolutely right. The pace at which things are moving, as you said, is incredibly fast in this digital world. What we are facing are huge gaps in our understanding of the extent to which Canadians are using digital services, whether it’s Netflix or participating as a household sector in generating revenue by renting out their individual homes as part of Airbnb. These services that are being generated from the household sector are a huge gap for us, and we need to make sure that we actually account for them.
Our traditional method of getting at expenditure patterns involves a diary and a pencil, and we’re now getting more than 60 per cent of those whom we reach either refusing or not participating. Even the ones who do go to their bank record and actually look at what they spent their money on, they’re saying to us, “What is the burden that you’re imposing upon us”? Because they have taken their income and look at receipts for every single transaction and roll it up to a small margin of difference between their income and expenditures.
The traditional methods aren’t working given the bias that’s creeping into the data, the timeliness speaks to the pace at which things are going. We’re providing data that is two or three years old, and that’s not sufficient when we are trying to get representative data for low levels of geography that impact vulnerable or specific populations.
Senator Tannas: I have two very fast questions. You did 175 consultations. Did that include the Privacy Commissioner? I wonder if you could confirm that, and we’ll be asking the Privacy Commissioner if his office recalls the consultation session that took place, if one did. Second, are there any other countries doing what you’re proposing to do here with this pilot project?
Mr. Arora: Thank you very much for that observation. The answer to your question is: Yes, I did meet with Mr. Therrien in his office last year to give him a full overview of our modernization effort and the case for why it is what we do. His concerns were specific around how are we going about protecting privacy. We talked about a ship having multiple hulls and protections within it, so it’s a multi-layered type of approach. We have regular meetings with the Privacy Commissioner in general about how we’re using administrative data, and on this specific project on a couple of occasions we walked them through the design elements. We have a very robust, good collaborative relationship. We meet with them formally once every quarter, and then we have phone calls and good collaborative work between Linda’s areas and her counterparts in the offices at the Privacy Commissioner. As I’ve said, many of the systems we have are because of their expertise.
Senator Tannas: And the other countries?
Mr. Arora: I chaired a high-level group on the modernization of official statistics where the leading statistical agencies in the world are looking at these kinds of issues. Using administrative data is nothing new for statistical agencies, nor for Statistics Canada. Our use of administrative data goes back to 1921 for vital statistics, 1938 for import/export records, and so on. That ability to deal with private and sensitive information of Canadians is not something new to us and other countries, whether it’s the Netherlands, Australia, New Zealand, who are all looking to see how we can meet the needs of a society today that requires that detailed data in new and innovative ways. We’re all looking at things like crowd sourcing. We’re looking at how do we do web scraping and how do we use scanner data and how do we go to private companies such as banks and other institutions. The foundational part of that is the privacy and confidentiality protection, because that’s the currency in which we operate.
Senator Tannas: Is what you’re proposing to do in this pilot project being done in any other country?
Mr. Arora: Not necessarily just specifically with the banking data, but I know many other countries are in the process of designing. With us, we haven’t done it either. Let’s be clear. We’re still in the design phase of this project.
Senator Wetston: Thank you for coming today. I think we all appreciate the importance of the work of Stats Canada; speaking for myself, I do. I think we all recognize that.
I think the preamble to my question is, as Senator Deacon indicated, the gig economy, whatever we wish to call it. We all understand that data is a commodity today. We all understand that powerful firms have an incredible amount of data and that you can look to a lot of places, whether it’s banks or companies or Stats Can or governments, that have so much data on individual Canadians.
I guess the question that I have for you is in the cyber area, which I know that you have thought a lot about. Have you experienced any need to address cyber issues within Statistics Canada? That’s my first question.
My second question is: What kind of information or comfort will you need to have in your discussions with banks and the Privacy Commissioner to go from pilot to implementation of this project, and included in that is what kind of notice will you give to Canadians in the event you decide that this project is something that you’re going to proceed with?
Mr. Arora: Thank you very much, senator, for those thoughtful questions.
No one is immune from cybersecurity. It is a reality today and we all have to deal with it. As long as we’re in the digital world, we have to worry about this every single day. We don’t do this all by ourselves, of course. We have trained experts within the Government of Canada, whether it’s in our Shared Services area or our CSC. There are processes and procedures in place.
Within Statistics Canada, we go even further than that. We have multiple layers, so even if there was penetration to a certain level and it goes even deeper, we build within the design of how it is that we parse out the information that belongs to individuals versus the anonymized records and we put that information in areas that are not accessible and connected. The design that we have in place always works with how do we anonymize the data within, how do we substitute the indicators or identifiers we’re interested in and then use that as a stream of information to produce statistics that are important for us. It is always going to be a preoccupation. As long as we want to work in today’s digital economy and society, it’s a reality and we are going to have to continue to work at it. We’re always going to leverage on the best practices and we’re always going to work really hard to make sure that we protect that information from what is now a reality.
On the second question in terms of the degree of comfort that we would require before we move from pilot to implementation, obviously the first thing is that we want to make sure that the banks inform their clients. We know that relationship between the bank and the client is so important, just like the relationship we have with respondents. We want to make sure they inform the clients that this is something entirely for statistical purposes. That information and that public communications rollout hasn’t happened yet. We were in the process of going from discussions with the CBA, the association, to the individual institutions, because that information exchange has to happen between the institution and its clients. That’s the next phase of this part, and we want to be transparent. We provided what that would look like potentially, and that’s the kind of work we have to do.
Of course, the Privacy Commissioner is an important partner in this. We don’t do this because we’re on two different sides. We do this in a collaborative way. We know their needs and we know what we have to do as a statistical agency. At the end of the day, we’re on the hook for providing representative data, and people will make decisions that impact all of us based on that. I have to stand behind the representativeness and the quality of that information. What we do is we make sure that the expertise of the Privacy Commissioner is baked into the design of this pilot project.
Senator Tkachuk: For clarification, the bank would inform their client, or would they ask permission of their client?
Mr. Arora: They would inform the client, sir.
Senator Tkachuk: We’ve done it, so thank you very much, basically? There is a big difference between “inform” and “ask permission.”
The Chair: I think we have the answer.
Senator Tkachuk: I’m with you.
Senator Wallin: When the Prime Minister was questioned about this in the House of Commons, he said:
High quality and timely data are critical to ensuring that government programs remain relevant and effective for Canadians.
Did you take that statement to be political approval for the project you’re doing, or a directive?
Mr. Arora: The notion of high-quality and timely data for decision-making? I don’t know how one can argue against it.
Senator Wallin: It’s their statement. I’m just wondering how you interpret it.
Mr. Arora: Second, the government is committed. The minister made a public statement last June saying that Statistics Canada will modernize and look at innovative ways to increase the quality of data. The budget itself, in 2018, has a whole section that talks about money set aside, $51.3 million, for a number of initiatives that we are undertaking, including the modernization of the agency.
Senator Wallin: Okay. Then I’ll put it another way: When the government put the money in the budget, was it clear what this project was?
Mr. Arora: We have been working on our modernization agenda even before I became the Chief Statistician. We have been experimenting and doing pilot work, as I said. We have done that over the course of the last year on so many different areas: housing, cannabis and others.
Senator Wallin: Would you say today that you are still in the pilot project phase or the design phase or exploratory stage?
Mr. Arora: I think we are well along our way in terms of design with the CBA, and now the hard work of working with individual institutions begins. We want to make sure that that occurs. Again, it has to occur in a way that is open and transparent and where the privacy of all the institutions and the privacy commitment that we have as Statistics Canada is respected.
Senator Wallin: Given the words that I just quoted to you from the Prime Minister, which were posts, the details of this becoming public, you take that as a mandate to continue?
Mr. Arora: Well, it’s our mandate. We always try to provide good-quality and timely data; that is correct.
Senator Tkachuk: You told Bill Curry of The Globe and Mail that the reason for collecting this information is so that Canada is governed by facts rather than anecdotes and fake news. What exactly is the scope of the problem you are referring to? What evidence do you have that collecting that personal banking information of 500,000 — I think it’s households, not people; right?
Mr. Arora: Dwellings.
Senator Tkachuk: What evidence do you have that that will ensure Canada is governed by facts rather than anecdotes and fake news?
Mr. Arora: I’ll start with the second question first. It’s 500,000 dwellings. As I said, it’s 1 in 40 in terms of what we actually use. It’s a subset of that 500,000. The reason we need that number is because the data are demanded at the neighbourhood level, so you have a neighbourhood that is about 500,000 dwellings. You have to have a representative sample. Especially when I’m trying to get at single parents, at youth, at some of the vulnerable populations — immigrants, et cetera — you have to have a representative sample that is reflective of what is going on in that particular area. We have tried, of course, to keep that burden to an absolute minimum to make sure that it will give us the quality of data that we can stand behind.
On the first question, when there are gaps, the further the statistical agency gets away —
Senator Tkachuk: I want you to focus on the banking information. That’s what we’re interested in here. I understand all this other stuff that you can get from all kinds of people, but you’re here because of your interest in scooping up banking information of individual Canadians, and that’s what I want you to focus on. Why do you need that, in relation to the question I asked you?
Mr. Arora: Sir, we are interested in getting high-quality expenditure data from households. We’re interested in knowing: What does a typical household spend its money on? How are those patterns changing? How much digital service are they procuring today? What do their cellphone or online transactions look like? How many of them are actually generating income from their household? We are trying to get at what does the basket, if you like, of expenditures look like in Whitehorse as opposed to downtown Toronto or downtown Vancouver? What are the differences?
Those expenditure patterns feed into the consumer price index. The consumer price index is what is used to benchmark pensions. It’s used to determine what is the level of poverty in this country, as was just announced in terms of official measures. That’s how we determine who is 50 per cent below the median or above. That’s when a lot of the programs kick in to help those types of populations.
It’s not just for the social programs. Businesses themselves use it. Banks themselves use this information about what are the components of inflation, for example, that they need to then look at, and even things like the inputs into the policies about whether someone should be given a mortgage or not. Are they overly leveraged? What does their expenditure pattern look like as opposed to their income?
For that type of expenditure data, instead of getting it from Canadians through diaries and getting them to fill it out — which, as I said, is now only representative of about 40 per cent of the sample that we select — we can get higher-quality data from those transactions that people are undertaking in an electronic world, and the banks have those transactions. We’re not interested in what exactly that transaction was. We’re interested in the intelligence of it so that we can then benchmark those indicators for purposes both in the private and government sectors and for society. If we don’t have that, what is the alternative?
Senator Tkachuk: Can you define “fake news” for me and provide examples of where this has become a problem that threatens the governing of Canada? And why do you need names to the statistical information?
Mr. Arora: I have multiple accounts. I have a savings account and a chequing account. A family has a number of accounts, lines of credit, et cetera. I don’t think I’m telling you anything that is secret. I think it’s the case for many Canadians, and I use myself as an example.
It’s a fact that we have to be able to take those individual combinations, if you like, of people with a number of accounts and be able to say this is the income and expenditure pattern for a household. We’re interested in our economic families.
Senator Tkachuk: I got all that, but why names?
Mr. Arora: Because a name is the only way I can duplicate and unduplicate those records.
The Chair: I think that answers —
Senator Tkachuk: It’s not a very good answer, but it’s the only answer he has.
Senator Wells: There are so many places I want to go with this, but I have a supplementary on an earlier question. You said you have not received information from banks. Have you requested information from banks and not received it?
Mr. Arora: We worked with the CBA, and the last meeting we had with them in August was to get contacts in the individual financial institutions, because that’s not something we have, and we were told to inform each of those institutions of the legal imperative under which we are operating. That’s exactly what we have done. We have reached out to those individuals that we were given and we’re now starting to work through: What are the individual needs? What are the system needs? How do they work with their data? How it is that they are going to inform their clients? Those are the next steps.
Senator Wells: What about as reported on Global News by David Akin and Andrew Russell, “StatsCan scooped up 15 years of personal financial data from Canadian credit bureau”? That was obviously without consent from anyone other than your enabling legislation. Would that be included in your answer of perhaps fake news or something separate from what you’re requesting or hope to be receiving from the other Canadian financial institutions?
Mr. Arora: The project you’re referring to is TransUnion, and we reached out to them not for this particular purpose but to find out the degree to which Canadian households are leveraged. It’s a part of our housing statistics framework. We’re trying to get at: How are housing prices going up? To what degree are people overextending themselves or can’t afford them?
To get at credit information, we worked — again for over a year — with TransUnion to get that information to us. We have not received 15 years of information; we have only received a couple of years of information. The overall project is for a duration of 15 years. We will again be using the same processes of anonymization and using the individual records for statistical purposes.
Senator Wells: Thank you for allowing me that supplemental question. Now my question.
The Chair: Now the main act.
Senator Wells: So 500,000 dwellings. We have heard 500,000 Canadians, and clearly a dwelling is more than one Canadian, on average. What amount will give it statistical integrity for your pilot project? Is it 500,000 dwellings? Would you wish more? Is it necessary to have less? What gives it statistical integrity? What is the number, please?
Mr. Arora: Thank you very much for that question. We start with an assumption that we have needs in so many communities, so many cities and so many areas. Then we say: What is the smallest sample that we need? Our estimate at this stage is that 350,000 dwellings, when you divide them up by all the communities that we have in this country, should get us a good sample, as I mentioned, for those traits that I talked about earlier.
In fact, the sample design is such that we are going to ask the banks for an oversampling — in other words, additional administrative records — so that the banks themselves don’t know which records were used to actually build our statistical model. So it is a pilot that —
Senator Wells: So 350,000 was the answer, and I understand that. You’re asking for more than you need. You’re getting 100 per cent of what you’re requesting and receiving, and this is a pilot project. Through the enabling legislation that StatsCan clearly has, will you request and receive 500,000 next year? Is that part of the pilot project? When does the pilot project end and when is the decision to assess whether this pilot was a success or failure? I can’t imagine it being a failure when you’re requesting 100 per cent of the data on an oversampling number of 500,000 versus the 350,000 that gives it statistical integrity. It can’t be anything but deemed a success when banks are compelled to give you everything. Does it end after a one-year pilot, or does it continue? When does it end?
Mr. Arora: Thank you for your question. The first question is we haven’t received a single data point yet; so it’s not receiving. We are working towards a design.
The pilot project, of course, has operational issues, and how do we get, in an anonymized way, or through individual files, how do they parse it out, et cetera? There is the operational side of it. There is the communication side and the transparency side. There is the privacy protection side of it. There is a whole statistical side that we will work through the course of the next year. If we have too much of that sample, we will reduce it. If we don’t have enough, we will work out how we will still be able to get at the high-quality data we need.
Just because we have more volume, it doesn’t necessarily turn into higher quality. We may still find that, with the trade-offs, if you like, from going from sample error to bias error in administrative records. We are prepared to do all that work. The course of the next year is all of that, and we want to work with people who use that data to determine if it is now hitting the mark, because we are clearly not hitting the mark today.
So it is part of trying to solve the gaps and the needs that policymakers and Canadians have today with obviously the least amount of sample that we require. As I said, this is representing 2 per cent of those 21 billion records that are happening in one year. It’s 1 in 40 dwellings that will participate in this pilot project.
Senator Wells: Of course, policymakers are assumed to be government policymakers. Can this micro-information, this detailed information, be used for micro-targeting and taxation purposes by the government?
Mr. Arora: No.
Senator Wells: So a policymaker could not look at metadata or anonymized data and not make a policy recommendation on taxation when every record that comes from my credit card is available to them?
Mr. Arora: We will only put out aggregate data. We are going to say that for a particular geographical neighbourhood, the type of households that are present, this is the expenditure pattern for it. It has all sorts of uses for business to policymakers. They are never going to use your record or my record to make a specific decision about an individual business or a Canadian citizen.
Senator Wells: I understand that it’s not my record because it’s anonymized, but the data writ large for taxation purposes.
Mr. Arora: We’ll have to see what the policy uses are of aggregate anonymized data that makes sense. They have —
The Chair: The answer is “possibly.”
Mr. Arora: Well, again, it’s possible, but that’s not the intent of this.
The Chair: We just want the answers.
Mr. Arora: They are never going to get an individual record to say so-and-so isn’t paying their fair share of taxes.
The Chair: We are not arguing; we just want to move it along.
[Translation]
Senator Dagenais: I heard what you said about your objectives. I think that collecting banking information is tantamount to taking an economic shortcut. There are other ways to obtain these statistics.
Canada Post admitted that some of its confidential data on the sale of cannabis was stolen.
The government’s computer systems, such as the Phoenix pay system, show its incompetence in this area. Your proposal — and I want to hear your comments on the matter — would result in an unnecessary and very dangerous intrusion into the privacy of Canadians. I think that banking information is as confidential as personal medical information. I don’t understand why you wouldn’t consider other methods.
You talked about home buying, statistics and the importance of keeping Canadians well informed. Canadian citizens can find all the information that they need through social and electronic media. We don’t need these statistics.
I think that you’re taking an economic shortcut by using banking information.
Mr. Arora: Do you have a question?
Senator Dagenais: I want your opinion on what I just said. Don’t you think that this method is an unnecessary intrusion into the lives of Canadians? I would compare this method to collecting data from patients’ medical records. I think that this is the same thing that you’re proposing and that this isn’t necessary.
Mr. Arora: Thank you for your question. First, we manage very sensitive information every day. We have files on the health of Canadians and on legal aspects, such as education. We’ve been doing this work every day for 100 years.
This isn’t the first time that we’ve needed to protect privacy or the confidentiality of Canadians’ data. This task is part of our job. When we compile statistics, we always start with personal information. It’s the beginning of the process.
No records have been stolen from our systems, which is quite exceptional. We’re not like any other government department. We don’t share microdata with others. We can’t do that in our situation.
Senator Dagenais: If there are young adults in the home or children who are taking care of their parents in the home, how will you proceed?
Mr. Arora: For the census, we’ll determine the family income. We’re not interested in the information of only a single individual, but in the information of an entire community. Our work doesn’t focus on transactions between individuals or between an individual and a company, but on statistics. Our process is designed to facilitate this aspect.
[English]
Senator Klyne: Thanks to our panel for being here. As I look at this in an overarching sense, there are two agendas. One would be the economic agenda, which is measurements around various questions and the end users that would use that. That is very macro, but it can also be boiled down to micro because it’s built up from that. I understand that.
With regard to government programs, they can survey their own clients. They can provide that data to you within government programs. Their users, their clients. Government programs can do their own surveys.
The other side of this is the societal changes that you seem to be interested in, and to me that’s taking it further than demographics; it’s going down into the psychographics. What are the likes, dislikes and behaviours of households in various regions, FSAs?
I find that part to be all very redundant from the point of view that banks or financial institutions have a very robust and rigorous analysis of their client household data. It is very robust and very rigorous. I cannot underscore that enough.
I don’t understand why you need individual records when you could ask them to roll it up for you into an aggregate as you would like it, by FSA or household. They have unbelievable data that they collect, synthesize and analyze to get their answers about households, clients, trends and buying patterns. Why couldn’t you just ask for a scrubbed roll-up or aggregate from them in the various categories you need? I ask this in the paramount issue of privacy.
Mr. Arora: Thank you very much for both those questions.
In Canada, we have a centralized statistical system, unlike in the States where there are 14 agencies that collect different aspects, from labour to trade, et cetera. In Canada, Statistics Canada is the national statistical agency. That’s how it was founded, with all the mandates you see outlined within the Statistics Act. As a national statistical agency, we even coordinate with provinces and territories. Yes, while certain departments can have surveys of their own, when it comes to the national statistical system, we are the place.
In terms of your second question, sir — I don’t want to be too cute about it — they are no better a statistical agency than we are a bank. We do statistics; they do banking. Our design intersects, in a sense, with their respect of their clients when it comes to privacy, and we’re trying to figure out how do we bring our statistical design to how it is that they have their information. That is the work that we have been doing for a year and what we will continue to do, making sure that the privacy is absolutely respected but, at the same time, allowing me to do the work of providing Canadians and policymakers with the best information that they expect and deserve from us. That’s the work that we’re doing now.
Senator Klyne: I think you underestimate the financial institutions and the data they collect and their household client data. They can spin that like nobody’s business. In fact, it’s their business. They know how to look at the demographics and the psychographics of their clients by household. They will tell you the number of the households. You know that they can tell you the education and other demographics by FSAs. They can roll that up in an aggregate for you without the names, and they can answer any questions you have in that regard.
The Chair: So a suggestion.
Mr. Arora: That’s exactly the work that is going forward.
Senator Klyne: It gets rid of the privacy issue.
Mr. Arora: I have to say, they don’t have the income. They don’t have many of the demographic aspects.
Senator Klyne: They have a lot of data when they take an application for a mortgage, a personal line of credit or a credit card. The credit cards can break that all down. If you want to know about persons in the U.S. or Europe, they can break that all down.
The Chair: We will leave it at that, Senator Klyne. That’s a suggestion for your consideration as you consider whether you move on.
Before we move to the next panel — and unfortunately, senators, we’re not going to be able to do a second round because we’re going to hear from the Privacy folks next — I just wanted to offer a couple of observations that I would encourage you to react to.
There is absolutely no doubt that anyone around this table, as you have heard from the questions, doubts the integrity of your organization at all. We recognize the value you bring to Canadians, Canadian agencies and Canadian business. For that, we’re thankful.
We are very conscious — perhaps it’s because we have just finished a very comprehensive review of cybersecurity — that despite all the best intentions in the world, things happen. There are a couple of things for your consideration that we have all learned. In 2017, 10 million Canadians were hacked. That’s basically a third of our population. In mid-October, there was an article in the Toronto Star. They obtained some documentation that, staggeringly, the federal government networks block an average of 474 million hacking attempts a day. These numbers are stunning to us. There is no reason to think that your agency, as a treasure trove of information, is not being attacked, based on those numbers, millions if not tens of millions of times a day. That is what worries us. How can you assure Canadians that the data that you — to use your word — harvest, if you decide to move forward, is going to be safe? That’s what we want to know from you.
Mr. Arora: Thank you very much. I take all your comments to guide us in our work going forward. It is very helpful commentary, and I appreciate the time that you have given to providing us with your advice.
All I will say in response is, first, privacy and confidentiality is something that every single employee at Statistics Canada thinks about as they walk in the door every morning and as they go home at night. We know the trust of Canadians is built on the ability to be able to protect that privacy and confidentiality.
The second point is that yes, this is a reality of the digital world that we live in today. The answer to that isn’t working the paper and pencil and books and so on. In fact, we have seen that when we have paper that moves around with confidential information from one point to the next through tens of thousands of employees, it’s not any better. We have the same risks. In fact, in many cases, they have been even further multiplied.
This is the world we live in. We have to get better. We have to continue to work hard. We have to build in even stronger processes to be able to assure Canadians that it’s not just “trust me,” but as I said, that we have robust processes and systems. That’s why we require the expertise of people like Daniel Therrien and his expert staff to make sure that we work together in what is the reality of today. Not a single data point has ever been breached from any of our servers, and we want to keep it that way.
The Chair: Thank you very much, panel. We appreciate you taking the time today.
Senators, thank you for your tremendous questions.
Honourable senators, continuing our examination of the collection of financial information by Statistics Canada, in our second panel, I am pleased to welcome, from the Office of the Privacy Commissioner of Canada, Daniel Therrien, Privacy Commissioner; Lara Ives, Director, Government Advisory Directorate; and Sue Lajoie, Executive Director, Privacy Act Compliance Directorate. As an individual appearing by video conference from Toronto, we have Ann Cavoukian, Distinguished Expert-in-Residence, Privacy by Design Centre of Excellence, Ryerson University and former information and privacy commissioner of Ontario.
Welcome to you all. Mr. Therrien, would you start with an opening statement, please.
[Translation]
Daniel Therrien, Privacy Commissioner, Office of the Privacy Commissioner of Canada: Good morning, honourable senators. I want to thank you for the invitation to speak about the collection of financial administrative data by Statistics Canada. It’s obvious that a number of Canadians have concerns about this activity.
After receiving complaints related to Statistics Canada and its collection of personal information from private sector organizations, I opened an investigation. To be clear, the investigation is the result of the complaints received, not an invitation from Statistics Canada. That said, we’re pleased that Mr. Arora, the Chief Statistician, has welcomed this investigation.
My legal obligation from this point forward is to investigate these complaints fairly and impartially under the law. I therefore can’t prejudge the outcome of the investigation.
I also want to remind you that the Privacy Act requires that investigations be conducted in private, which prevents me from sharing the details of ongoing investigations. However, I can tell you that I’ve received 52 complaints on this matter to date. At the end of my investigation, I’d be happy to submit my findings to this committee, if you so wish.
[English]
Statistics Canada has been consulting with us for some time on its administrative data collection program. Indeed, Statistics Canada regularly consults us on the privacy implications of many of their initiatives; it is always open to a dialogue and often accepts our recommendations. However, the purpose of these consultations was not to pronounce on the legality of the program but rather to make suggestions that Statistics Canada could consider in its development.
My office does not have the authority to preauthorize programs being developed by federal agencies. We do not preauthorize; we do not rule on whether a projected pilot is consistent with the law or not. We provide more general advice on best practices and recommendations that departments may wish to accept or not. We make findings on compliance issues in the strict sense of the law as a result of the formal investigative process, which we have just launched.
Beyond the law as it is, which will be the subject of the findings of our investigation, I will say this: While administrative data has been collected by Statistics Canada for decades, perhaps, from what I read recently, as early as 1921, it is clear that a number of Canadians are concerned with the scale of personal data of a financial nature to be collected by the agency.
I have often spoken publicly about the need to modernize our privacy laws in both the private and public sectors. One of my recommendations, first made in March 2016, I think is particularly relevant in this instance, and that is, that the Privacy Act, the public sector law, be amended to require that the collection of data by public sector organizations, such as Statistics Canada, be authorized not when relevant or useful to government programs, but only where necessary and when the scope and breadth of the data collected is proportional to the public policy goals the data is intended to serve. This is a simple and, I think, uncontroversial amendment that would increase significantly the privacy of Canadians, while bringing our law in line with relevant international standards.
These are my opening remarks, and I look forward to your questions.
The Chair: Thank you very much, Mr. Therrien.
Ann Cavoukian, Distinguished Expert-in-Residence, Privacy by Design Centre of Excellence, Ryerson University and former Information and Privacy Commissioner of Ontario, as an individual: Thank you for inviting me to speak to you today.
I would like to start by pointing out the consequences of unilaterally, without any consent, accessing the personal financial data of half a million households from our banks, the institutions that we have come to rely upon for privacy and security relating to our financial data. As you no doubt are well aware, trust in the organizations that house our personal data, both private and public sector, is dropping dramatically. There’s presently a growing trust deficit. This should come as no surprise since personal data are increasingly being used for purposes never intended — hacked, sold and transferred to government and law enforcement often without a warrant.
The concern for privacy is steadily on the rise in our society. Just look at all of the objections to what StatsCanada is proposing. I checked this morning. There are over 20,000 people who have already signed a petition opposing the release of their financial data to StatsCanada, and that’s in under a week.
With due respect, I must respond to Mr. Arora’s comment that StatsCanada is doing privacy by design. I assure you that it is not. I created privacy by design. It is predicated on consent and personal control. Both are totally lacking here.
The prospect of surveillance on the part of government is very objectionable to most people and is viewed as a major invasion of their privacy and their freedom. I know these are harsh words, but that’s how many people feel. The issue is not simply a legal issue but a moral one. It infringes on our fundamental right to privacy, especially from the government. It may be legal, but it is not viewed as being ethical.
Justification for the need of our personal data by Statistics Canada does not justify extracting it directly from citizens’ banks without their knowledge or consent. Even the legality of this measure on the part of the banks releasing that data directly to Statistics Canada is now being questioned by many lawyers.
Rex Murphy quoted a Statistics Canada official as saying that the reason they can’t ask for consent is because no one would give consent to this practice. So what does that tell you? It tells you that law-abiding Canadians do not want their most sensitive, personal information handed over to the government.
Even the former head of Statistics Canada, Mr. Wayne Smith, resigned two years ago over data security concerns that he said threatened the strength of Statistics Canada. Imagine now, with daily cybersecurity attacks mounting, this will form a treasure trove of sensitive financial data that will serve as a magnet for hackers. Mr. Arora suggests that won’t happen because they have such strong security measures. With due respect, a lot of major companies and government departments have already been hacked and had data breaches, so it is impossible to say that will never happen.
What are the solutions? The technological drive towards more privacy is growing dramatically and accelerating with a GDPR being introduced in the European Union, which includes constraints, for the first time, by privacy be design measures. Blockchains coupled with secure peer-to-peer networks, trusted enclaves, new encryption methods such as Secure Multi-Party Computation and homomorphic encryption are growing. These are amazing technologies to protect privacy and promote data utility.
We are relentlessly innovative as a society. If customers can no longer trust their banks to keep their financial data private and secure from third parties, especially the government, they will turn elsewhere. Society will innovate to replace these institutions with new ones, equipped with technologies that will make it inordinately difficult to pry into one’s most sensitive financial data.
That direction, using artificial intelligence and blockchain as a backbone, is already happening in a number of areas, and this will only accelerate unless the government tries to pass even more restrictive regulations to prevent it. If we wish to preserve our privacy, which forms the foundation of our freedom, do we as a free society truly want to allow further restrictions to the very freedoms we hold dear? I think not.
My suggestion to you is that we must get creative and turn to innovation. If Statistics Canada needs this kind of information to help run the country, then we must create new methods by which their questions may be effectively answered without violating citizens’ privacy. We need a win-win model.
Privacy is all about control — personal control of the uses of your data. Unfortunately, it’s totally lacking here. That’s why there has been such a reaction against this one. People finally heard about it. There was no transparency associated with it. David Akin with Global News happened to leak it, and that is when everyone hard about it. If Stats Canada needs this information, we can do this, but we have to ensure that personal control is retained in terms of the uses of your very sensitive personal information.
We need to put pressure on Statistics Canada to become truly innovative and come up with new ways that do not infringe upon our privacy, such as securely de-identifying all the personal data at source by the banks. They should de-identify this before sending it to the government. Data minimization and de-identification are essential tools that are readily available today. We can do this.
Thank you very much.
The Chair: Thank you very much, Ms. Cavoukian.
We will move to question, starting with the deputy chair.
Senator Stewart Olsen: Thank you for being here. I’m concerned with one of the answers that we got. I want to ask you not a specific question but perhaps a general question.
This is almost totalitarian in its scope. I think many Canadians will begin to think we’re living in an Orwellian nightmare here, where the government can access every single thing they would like to access simply by saying, “You must do it.” They want the banks to do the informing — at least that’s my understanding from the statements just before us. They want the banks to inform Canadians that they are giving — they don’t ask for their permission, but are giving — the information to StatsCan. Once it reaches Statistics Canada, they will take that as a tacit okay from a tacit agreement from Canadian citizens. Then they can go about passing on the information should they think, according to their mandate, that it can be used or is needed somewhere. I think that’s where we come to the area that I’m afraid about, namely, once it gets to StatsCan, then it can go elsewhere at the behest of StatsCan, once again, without permission from Canadians. In other words, we’re developing a chain where your information gets passed on and passed on and passed on. Could you share your thoughts with me, in a general way, about what’s happening?
Mr. Therrien: I think we were all struck in the recent news by the amount of data from a large number of dwellings in a very detailed way. I think that is what strikes large segments of the population as an important part of the issue. As we investigate this matter based on the complaints we have received, this will be an issue that we will examine. If we step back, what Statistics Canada calls administrative data collection, that is, information obtained from either departments of government or private institutions, is something that has been happening for a long period. Historically, that has been happening. Again, I think what is raising a lot of concern currently is what I call the scale, the breadth and the scope of information that is being sought.
I cannot say how we will conclude the investigation, but the legal framework is certainly more permissive for Statistics Canada in terms of what it can collect from government institutions and private institutions than if Canada had the same laws that apply in many other jurisdictions, including many Canadian provinces, where the standard for lawful collection of information by public institutions is necessity and proportionality, as opposed to what the law is currently. I think that’s an important issue.
The Chair: Senators, if you could indicate to whom you are addressing your question, our witnesses would know who is expected to answer.
Senator Tkachuk: This is to the Privacy Commissioner. Mr. Arora told us he had a number of meetings with you. I don’t know how many he had. Maybe you could tell us how many meetings he had with you. Did he explain to you how many people were going to be involved in this statistical gathering through the banks?
Mr. Therrien: As Mr. Arora explained, we met on these issues once, a bit more than a year ago. Since then, there have been a number of meetings with my colleagues. Do you have the exact number?
Lara Ives, Director, Government Advisory Directorate, Office of the Privacy Commissioner of Canada: In the last year, we’ve had six meetings, but not all specifically with respect to their administrative data collection program.
Mr. Therrien: They have been talking to us about administrative data collection for a long period, including in the past year. We were not told until very recently about the number of households subject to this data collection pilot involving the banks. It was a discussion more at the general level where we gave advice on issues such as transparency and ensuring that individuals whose data was collected had a right to access it and to correct it if need be. A number of privacy principles were discussed at a high level of generality, but the number of households, which I think is a significant factor here, was not discussed with us until recently.
Senator Tkachuk: Was the reason for your investigation the act itself? You had been dealing with this matter for a whole year now, from what I understand, so you knew he was going to the banks and you knew he was getting private information. Maybe you didn’t know the number, but I don’t know that. Did you start your investigation when you found out about this, or did you start your investigation when the public became aware of this?
Mr. Therrien: We started the investigation because individuals complained, made complaints to our office, which leads to an obligation on our part to investigate the issues raised. Before these complaints, we had discussions about administrative data collection in general, about certain pilot projects in general, but not about numbers until very recently.
Senator Tkachuk: Mr. Arora wouldn’t have taken away from you permission to proceed, that it was okay with you and that he felt he could proceed?
Mr. Therrien: That’s never the basis on which these consultations take place. He knows.
Senator Tkachuk: Did you express reservations to Mr. Arora?
Mr. Therrien: First of all, again, numbers were not mentioned. We were talking about a pilot project not dissimilar in many respects to other administrative data collection projects that have been going on for nearly a century. We transmitted to Statistics Canada the general privacy principles that would apply without saying — because that is not our mandate at that stage — whether what he was proposing was, in our view, lawful or not. So now, I welcome the fact that he will not act until we are satisfied. Now that we are in investigative mode, we must conclude whether what is being proposed here is lawful or not.
Senator Tkachuk: As the Privacy Commissioner, if he came to you and said, “I want to get into the banking information of Senator Tkachuk,” that’s different than wanting to get into the banking information of 500,000 households. Or is it all the same?
Mr. Therrien: I think proportionality is very important. Mr. Arora made the argument just prior to me that he seeks to make the number of people affected as low as possible. That’s his objective. He and I need to have a discussion about that.
Senator Tkachuk: I understand that. So you’re not there protecting my personal information; you’re protecting the volume of personal information?
Mr. Therrien: I’m going to focus on whether, point one, what he is proposing is lawful under the current law, which does not have a proportionality test. Beyond the current law, we will have discussions with Statistics Canada on the proportionality issue. Essentially, in clear terms, do the public policy objectives that he outlined this morning require collecting information from as many people and at the level of detail that the pilot envisages? That will be the conversation.
The Chair: Mr. Therrien, do you feel in your conversations with Statistics Canada that they were forthright with you?
Mr. Therrien: I think so. I think this perhaps speaks to the legal framework we have in Canada. We’re an ombudsman, not a court. Departments do not come to us for legal blessing; they come to us for general recommendations. In that context, that colours the amount of information provided because the law is clear that we don’t pre-authorize. Departments or agencies like Statistics Canada must act lawfully, and it is for them to decide what is lawful.
Senator Wells: Thank you, Mr. Therrien, for appearing here today. Explain to me the difference between protecting the privacy of Canadians as the Privacy Commissioner and providing guidance to another government agency that has essentially carte blanche over accessing Canadians’ data? Could you explain to me the difference on where your emphasis would be?
Mr. Therrien: I would not say the department in question has carte blanche but rather wide latitude in collecting the personal information of Canadians for statistical purposes.
When we interact with an agency like Statistics Canada, not having pre-authorization authority, we have discussions around general legal principles. We don’t look into the details of the program. They explain the program in general terms, and we give them advice on what we think are the most relevant principles, such as transparency, access, correction and, of course, having adequate security safeguards to protect the information in question. The conversation essentially occurs at that level. Now that we’re investigating, it’s going to become much more detailed.
Senator Wells: So the heat has been turned up recently, and that has obviously generated a lot of publicity and has generated activity from your office and maybe a defensive mode from the government and StatsCan.
In your view, has the government been fully transparent about this project since it began? And if not, what would be the shortcomings? Why are we only hearing about it now if discussions have been going on for a long time?
Mr. Therrien: I think it was certainly a surprise. We did not know about the numbers until very recently. I think this is a crucial fact. We recommended to Statistics Canada to be transparent. They took certain measures to be transparent, which are not meaningless measures, but obviously they fell way short. So I have to conclude, given where we are today, that the measures that Statistics Canada took were deficient on the issue of transparency for sure.
Senator Wells: Could I ask Ms. Cavoukian a question?
The Chair: Absolutely.
Senator Wells: Thank you, Ms. Cavoukian, for your presentation. I appreciate some of the public comments you have made. Are there any specific legislative changes you would like to see with regard to consent of Canadians and their privacy?
Ms. Cavoukian: Section 13 of the Statistics Act, which compels organizations like banks to divulge the information being requested to Statistics Canada, I think has to be amended. I think we need amendments. I don’t know how old the Statistics Act is. I’m assuming it’s quite lengthy.
The concern I have been hearing is that section 13 of the Statistics Act is actually unconstitutional. It authorizes warrantless seizures in violation of a reasonable expectation of privacy under section 8 of our Charter of Rights and Freedoms that cannot be justified in a free and democratic society under section 1 of the Constitution. That’s one area.
I think it’s so vital that there be far greater transparency. I don’t know the sections in the Statistics Act relating to that, but I have received dozens of calls and emails from people very upset about this. They say, “How can this possibly be? We just learned about it.” And we only learned about it because David Akin went public with the story, and that’s when everything started. Imagine that you already have over 20,000 people who have gone to a website to declare their objections and sign a petition. That has been in less than a week.
I think it’s time for a review of the Statistics Act and the methods by which they are permitted to obtain very sensitive information without any notice or consent of the individuals involved.
The Chair: Thank you.
Senator Wells: I just want to say that this some of the things I am hearing are very troubling to me, and I’m sure it’s troubling to most Canadians. I think there should be a continuation of this forum at the earliest opportunity.
The Chair: We’ll discuss that subsequently.
Senator Wallin: I have just a question to Mr. Therrien and then a question to Ms. Cavoukian.
I’m hearkening back to the words of Stats Canada. In order to conduct valid statistical research to help governments and ensure government programs are effective, but maybe even more generally, to conduct valid statistical research, do we need names and addresses attached to the financial data?
Mr. Therrien: I’m not the expert, but I hear Statistics Canada say that they need that data initially to ensure that the data is valid and accurate.
Senator Wallin: Ms. Cavoukian, do you have a comment on that?
Ms. Cavoukian: I disagree with Mr. Arora. You see, in order to obtain the data in a personally identifiable form, you immediately put the data at risk. This is a treasure trove of data. It will attract hackers and be such a magnet. So even though they eventually anonymize the data, why would you subject it to that kind of risk? Why wouldn’t you allow the banks to very securely — and there are strong protocols on to how to securely de-identify the data. Give it to Statistics Canada for the work it needs to do, no question, but without risking the personally identifiable portions of the data that can be linked with very sensitive financial transactions, as you can well imagine. This is not information we share with anybody. Rarely do we share it with colleagues and friends.
There is very little trust in government now. People often say, “Corporations are divulging our personal information” and they get very upset about that. So then how come we say it’s okay for government to do that, to demand this information from its citizens? How is that different from corporations saying they are using your personal data in order to serve you better?
Senator Wallin: I guess what I’m trying to get at is I understand you need to verify and know that I have a bank account and therefore there is all the activity that I have encountered, but that bank account exists and that activity is there for the record. Even if they took the activity, do they really need the name?
Ms. Cavoukian: If I can add one more point: Why do they need the name?
Senator Wallin: That’s my question.
Ms. Cavoukian: That’s the point I’m trying to make. There are countless studies on de-identification, very secure de-identification of information. You can use other methodologies. There’s so much —
Senator Wallin: We’ll circle around on that.
[Translation]
Senator Dagenais: Thank you, Mr. Therrien. I’ll repeat what I said earlier to the Statistics Canada representative. I think that banking information is as personal as medical information. It may be more expensive for Statistics Canada to use other methods. By using banking information, Statistics Canada is taking an economic shortcut.
I’m all the more concerned because — and I understand that you can’t talk about this — you’ve already received 52 complaints concerning Statistics Canada. Why should we trust Statistics Canada? Correct me if I’m wrong, but the Statistics Canada representative said that their statistics help Canadians, for example, make a decision when they want to purchase a property or take out a mortgage. Why would I need Statistics Canada when I take out a mortgage if the banking services will provide all the necessary information?
Mr. Therrien: Regarding the issue of whether the financial information is sensitive, the answer is obviously yes. A Supreme Court decision rendered about two years ago confirms this fact.
Is Statistics Canada’s pilot project and collection of data from other institutions, such as departments and companies, an economic shortcut? As part of the investigation, I’ll ask Statistics Canada about alternatives. Statistics Canada is proposing to collect the type of information and scope of information. We’ll need to have serious discussions with Statistics Canada to find out if there are any alternatives. Why doesn’t the census work? Why don’t more ad hoc surveys, which are conducted without checking bank accounts, work? That’s my way of answering your question about the shortcut.
Senator Dagenais: Thank you, Mr. Therrien.
[English]
Senator Wetston: Do you speak to the banks as well, Mr. Therrien, about this issue? Will you speak to the banks about this issue? Because I view the banks as being caught between a rock and a hard place in this particular situation. That may be an overcharacterization of it, but I kind of see it that way. I realize I’m not asking about your investigation, which is a compliance investigation. Normally compliance leads to a finding of legality or illegality, but you don’t comment on legality. Maybe you do need amendments, but that’s another issue. Can you comment on my question?
Mr. Therrien: We have had discussions with certain industry sectors. If we go beyond this pilot project having to do with banking information and move to administrative data more generally, we have had discussions with other industry sectors who have, as you suggest, raised concerns among other concerns whether their disclosure to Statistics Canada would be consistent with the private sector or privacy law, PIPEDA. We have had conversations along those lines, which we have brought to Statistics Canada, and that leads to discussion about the legality of Statistics Canada’s practices, and that’s what we’re investigating.
Lara, did we talk to the banks specifically?
Ms. Ives: No, we haven’t spoken to the banks. At the time we discussed this with Statistics Canada in the summer, our understanding was that they were still in discussions with the Canadian Bankers Association, OSFI and various other parties. We haven’t been engaged since then.
Senator Wetston: I have just a quick follow up, and I do have a question for Ms. Cavoukian, if I could. Maybe second round, if we don’t get it this round.
The reason I’m asking you this is, is it possible that the compliance issues that you’re investigating would apply not just to Stats Canada but also the banks? We have privacy laws in PIPEDA obviously. I am wondering about the framework in which you may be looking at this issue.
Mr. Therrien: There is definitely a link, and PIPEDA does have language that refers to lawful authority for disclosure, which makes an implicit link to the Privacy Act and to the Statistics Act. This is one of the issues we need to rule on in the investigation.
Senator Wetston: Thank you for that.
May I ask one quick question, or do you want me to wait for second round?
The Chair: Do you mind waiting for second round?
Senator Wetston: No, I don’t.
The Chair: Thanks very much.
Senator C. Deacon: I am looking forward to asking two questions, as with others.
Looking at the need for Statistics Canada to provide all levels of government and many businesses with accurate public data to put forward public policy, how do we help? I’m all for Dr. Cavoukian’s suggestion for getting creative here. How do we get over the challenge for Statistics Canada that opt-in data would not be statistically accurate? That’s one of the challenges. Just quickly, you’re aware that’s a challenge. That’s something they have got to deal with. So that’s the first question.
The second question is related to the need for excellent privacy policies and privacy protection policies in all organizations. How do we help Canadians with the fact of using Mint or TurboTax and other Intuit products, Air Miles and all the data that we are already giving up to a lot of organizations, and I think many times not even the least bit aware of how that information is being used and protected? How do we help Canadians balance that with the need for excellent data at a federal and provincial and corporate level of statistical data? Those are my two questions.
Mr. Therrien: On the consent issue, consent obviously is an important privacy safeguard and is the rule in Canada. There are situations where consent is not legally required, and here we are in front of one of these situations where Parliament, when it adopted the current Statistics Act, determined that consent was not required in certain instances. Statistics Canada puts on the table the view as experts that if consent was applied absolutely, that this would affect the quality of the data. They are the experts. That’s what they say. My job is not to apply consent in each and every case because that’s not the law that we have in Canada. My job is to ensure that where data is collected without consent, that it meets the requirements of the act and is proportional and so on and so forth. So it’s not black and white.
Senator C. Deacon: And in terms of helping Canadians with the fact that they are already sharing massive amounts of transactional data? Right now the Government of Canada doesn’t have access to any of that sort of information, which is widely shared, and perhaps the extent to which that privacy is being given up and how well that information is being protected is not understood.
Mr. Therrien: I think that leads to a discussion around transparency and what is actually required to be transparent with individual citizens and consumers. Assuming that we’re in a situation where consent is not required when Statistics Canada collects information, Canadians are certainly entitled to know that this is happening. Transparency is not something at a stratospheric level. It’s something that should lead to fairly clear notices to individuals that your data that you’re giving to the bank or to another private company may actually be collected by Statistics Canada for the public policy purposes that are implicit in the Statistics Act.
The Chair: Dr. Cavoukian, have you anything you wish to add?
Ms. Cavoukian: As Commissioner Therrian said, consent is not across the board, and it would impact the value of the data obtained by Stats Canada because it would, in my view, be missing large amounts of data because people don’t want to release their data to the government. My suggestion — very strongly in this area — is that we have to rely on the technologies that can strip the personal identifiers, both direct and indirect, from the data, but the banks have to do that at source, meaning right at the time. The data that is contemplated being accessed by Stats Canada is strongly de-identified and then sent to the government, to Stats Canada.
At the very least, what you can say to the public is we have relationships with our banks. We assume that they’re going to secure our data, not just give it out without our consent or authorization, but they can say when the personal identifiers are stripped from the data, the data might still be sensitive but it is no longer personally identifiable so the privacy laws would no longer apply to it because it’s not personal information.
That is the most prudent way to proceed, because it still enables Stats Canada to obtain much-needed information for the work that it conducts, but you can give assurances to the public that you don’t have to worry about the privacy issues. Your data remain confidential, safe and secure with the bank, who you entrusted it to.
Senator C. Deacon: Thank you.
Senator Wetston: This is to Ms. Cavoukian. I know of your work. I worked in Ontario and am quite familiar with your leadership in Ontario. You’ve talked before about the trust deficit, which I think may be apparent in society today and something that we’re all concerned about. We realize and I recognize that Mr. Therrien is in investigative mode here and it’s difficult for him to share some information. When I relate the trust deficit to the data overload that we have in society and the issue of the relationship between data overload and privacy, it’s more difficult to maintain privacy in our society today. A lot of that is related to technology, and a lot of it is related to the market power of the huge firms that control a great deal of data. Data is gold today. I think we know that. Can you share with the committee some of your thoughts about these relationships and how it might inform us as to how we think about this issue?
Ms. Cavoukian: Thank you for that question.
I want to direct you to the very strong privacy law that has just come into effect in the European Union, the General Data Protection Regulation, the GDPR. It came into effect in May. It has strengthened privacy laws literally all around the world. It is one overarching law that is replacing the privacy laws of the 28-member countries, but also, countries all around the world are amending their existing legislation, like ours, which is no longer considered adequate to meet the requirements of this new law.
Commissioner Therrien has already gone to our federal government last year and said we need to strengthen PIPIDA, it’s dated, early 2000s, and we need to add privacy by design to it, as they have done in the EU.
The reason I’m pointing to that is this is going to be a huge game changer because all of a sudden it shifts the focus away from the needs of both governments and private corporations and towards the needs of individuals as data subjects. It’s returning control back to the individual and strengthening the protection of their data dramatically. I can’t tell you what a huge game changer this has been.
In that context, when we apply that in this case with the demands of Statistics Canada, who have gone to the banks and apparently have been talking to them for a year, and obviously most of the public, like me, had no awareness of that, that’s why we’re being struck by the lack of transparency and accountability when they want to access our most sensitive data.
In terms of all the complaints that I’ve received from the public, and this petition with over 20,000 people, they don’t like the way this has been conducted. I didn’t know this was a pilot. I just learned that now. Certainly the public has no awareness of it, and they are objecting very strongly to this.
The reason I mention that is I am the eternal optimist. You must have privacy and data utility, privacy and security. We must have both. It can’t be an either/or equation. In my view, you can’t lead by doing this in terms of the perception that it’s happening behind our backs, and we just happen to learn about it because of some reporter who went public on it.
I just need to add one more point. There is concern on the part of the Canadian Chamber of Commerce that says banking information collected by Stats Canada is not only incredibly invasive but that the scooping of this data could threaten our trade with Europe under the new General Data Protection Regulation. There is a great deal of concern that it’s going to hurt trade.
The Chair: Thanks very much, doctor. Senator Tkachuk, do you have a quick supplementary?
Senator Tkachuk: I have a quick question to the Privacy Commissioner. When you met with Stats Canada, did they tell you it was a pilot project, or did they tell you it was just a project that they were doing?
Mr. Therrien: When I met with them more than a year ago, I think we were talking administrative data collection generally. Since that time, there have been a number of meetings with Ms. Ives and others on two manifestations of this financial data more recently, and the credit score information that was alluded to earlier. I believe the pilots were disclosed to us in early 2018 for credit information and in the summer for the banking information.
Senator Tkachuk: Okay, thanks.
The Chair: Before we welcome the third panel, I’m going to thank to the panellists for their tremendous presentations. You have been very helpful. Thank you very much.
Honourable senators, continuing our examination of the collection of financial information by Statistics Canada, for our third panel today, I am pleased to welcome Neil Parmenter, President and Chief Executive Officer, Canadian Bankers Association; and Sandy Stephens, Assistant General Counsel, from the Canadian Bankers Association as well; and Greg Basham, Consumer Representative, Consumers’ Association of Canada.
Thank you for being with us today. Mr. Parmenter, please proceed.
Neil Parmenter, President and Chief Executive Officer, Canadian Bankers Association: Thank you, Mr. Chair. The Canadian Bankers Association would like to thank the committee for inviting us to provide our views on this important issue.
Banks are in the customer service business, with a history of building long-standing relationships with customers. At the centre of those relationships is trust, anchored in a commitment to protect the privacy and confidentiality of customers’ personal information.
Banks are trusted custodians of significant amounts of personal information. Banks take their responsibility to protect customers’ information very seriously and are committed to meeting not only the requirements of privacy laws but also the expectations of their customers. Simply put, privacy is in the banks’ DNA.
Banks have developed and adhere to robust standards to ensure data is protected and accessed appropriately. Banks have invested heavily in cybersecurity measures and work cooperatively to share the latest intelligence and best practices in order to safeguard against threats to our systems.
The CBA and our members have been clear that we have serious concerns over the privacy implications of the Statistics Canada transaction-level data request. I want to be clear that no customer transaction data or other personal information has been transferred to Statistics Canada under this request.
The CBA and its members are encouraged that the Office of the Privacy Commissioner has launched an investigation into this data request. We welcome the more detailed consideration of the request by the Privacy Commissioner.
Banks understand the value of the important work done by Statistics Canada. The banking industry continues to be a leader in innovation as well and in developing and adopting new technologies for customers, while remaining focused on customer trust and confidence. Trust and confidence of the Canadian public is critical. As such, the banking sector continues to emphasize the central importance of protecting the privacy and security of customer financial data and personal information.
We look forward to your questions. Thank you.
Greg D. Basham, Consumer Representative, Consumers’ Association of Canada: Thank you for the opportunity to speak to the Senate Banking Committee, and thank you for the opportunity to have read your report on cybersecurity.
I want to make just a few points.
First, the proposal before us from Stats Canada as presented today and what we have heard is simply a non-starter for Canadian consumers.
Second, Canada needs to get on the right side of history. The GDPR has been a game changer, as we just heard a few moments ago by Privacy by Design. All around the world, companies, including a company I’m associated with in the Far East, have had to change their rules and their operations because you’re dealing with European citizens and individuals with stronger control and huge punitive penalties that could put you out of business if you’re a small start-up company. California, in 2020, is going to bring in a law that will give consumers and individuals the right to know what information someone has, why they have collected it, how it’s used, and they will be able to prevent, if that law goes forward, that data being sold or shared with other people. It’s important that Canada be on the right side of history.
Trust in government has been mentioned today. Consumers don’t trust the government to have the level of information and knowledge — I would never have said this statement until the election of the forty-fifth President of the United States because I probably would have been laughed at. But when we see the trend towards populism and authoritarianism across democracies today, it has to be scary, because in the future the implications are, if this data is collected in the form that Stats Canada is asking for today, senators, I assure you there is nothing left but just turn the switch on and bring that data in in real time, because those will be the mechanisms that eventually a data society will have.
We need to modernize the Privacy Act. We need to recognize that data profiling and predictive analytics have been a game changer. Unless we make these changes, we will fail as a society. We’re not freer because of more security that’s come from crises. We’re actually less secure. We need to redress that balance between what does it mean to be a citizen of this country, and who is serving who? Is a citizen to serve the interests of government, or is government to serve the interests of Canadians?
I thank you for this opportunity today.
The Chair: Thank you very much, gentlemen. We will now move to questions, starting with the deputy chair.
Senator Stewart Olsen: I have two brief questions. My first one is on the difference between a dwelling and household. If you ask for the information from a dwelling, does that mean one of those huge apartment buildings and everybody in that? We were corrected several times when we used the word “household.” Just for the scope of the data being asked for.
Mr. Parmenter: I would love to answer your question, senator. I unfortunately don’t know the answer to that one. That would be better directed to Stats Canada.
Senator Stewart Olsen: I should have done that.
The other thing is banks have very good oversight bodies. Statistics Canada, I’m not sure they have any oversight body. One of the big problems I have, from what was said today, is that they are going to ask the banks to inform their customers, not ask their customers for permission but inform their customers that this data has been requested by Stats Canada and you will be sending it on. Can you just give me a little bit about what you think about that?
Mr. Parmenter: I think it is important for everyone to remember — and I know there has been much discussion about customer notification — the reality is it was the industry’s view that Stats Canada was in the exploratory phase of this particular project. Customer communication, if it ever came to that, would obviously be a part of that plan, but it would be premature to do that with all of the, I would say, significant unanswered questions. We have discussed many of them here today. That would always be part of a bank’s commitment to transparency with its customers. But, as I said, I don’t think we’re there yet. We welcome the Privacy Commissioner’s investigation into this. The industry still has many serious concerns with the nature of the request and many unanswered questions.
Senator Stewart Olsen: My concern is that the banks would take the heat from customers, not Stats Canada. That was pretty much where I was going.
Mr. Parmenter: Yes. I understand that, senator. I think our view is we would like to still understand the totality of this proposed project and get concrete comfort and answers to a lot of the questions we have asked before we’re in that kind of place. Absolutely.
Senator Stewart Olsen: Thank you.
Senator Wells: Thank you for appearing as witnesses to this important work that we’re doing.
I’m going to reference the statement that the CBA put out when the story first broke. Banks believed this proposed data acquisition project was still in the exploratory stages and were not aware that Statistics Canada was moving to compel disclosure of this information. You’ll recall that statement from your release. Do you feel the banks were misled or kept in the dark on this? You’re now at the sharp end of this. Stats Canada is as well, but the banks are at the sharp end of this. Nothing compels business like the collective voice of the consumer. I think that’s what is going to be hitting you now. So, were you misled or kept in the dark on this plan? How are you going to react to how the consumers are now reacting?
Mr. Parmenter: I would say that, as you heard earlier today, discussions with Stats Canada on the proposed project have been ongoing for months. As I said, I don’t think we were at a point where there was comfort, resolution or agreement to move to the next phase of the plan. There were still many unanswered questions that the industry needed to get comfort with. I think what you are referring to there on the notification is the surprise, as it were, when the compel letters went out to a few of our individual banks. The first we heard of it, frankly, was on that Friday from Mr. Akin at Global.
Senator Wells: Are you concerned that with this compulsion that you now have or that you will have from Stats Canada, that consumers will turn away from data collection methodologies of purchase like debit cards and credit cards, which are a big part of the banks’ business, back to cash where it’s entirely anonymous at the point of sale?
Mr. Parmenter: We just heard from the Privacy Commissioner that his investigation is ongoing. The results of that investigation will be available in the new year. We’re interested to see what that report yields.
I don’t think we’re at that point yet. There are still many unanswered questions, and the project is not live. Our concern is being able to answer the more foundational questions about sharing this customer data.
Mr. Basham: I would like to answer that question. We heard earlier from Privacy by Design that people will create other methodologies for payments, et cetera. We have bitcoin now. That will just dramatically explode that path towards more anonymity, thereby putting law enforcement and other security people at a huge disadvantage, because it can’t be monitored now.
Senator Wallin: I think in response to a question from Senator Deacon, we heard from Dr. Cavoukian that consent would limit the value of the data because too many people would simply say no, but you can “anonymize,” if that’s the word, the data at a much earlier point?
Mr. Parmenter: You’re touching, senator, on some of the questions that we have asked StatsCan. As we look at possible paths forward and possible alternatives, these are the sorts of questions that we’re raising, many of which are still unanswered.
Senator Wallin: My question is, can you?
Mr. Parmenter: I can’t give you a definitive answer on that right now, senator, but I know that the banks are doing their own due diligence in real time on the nature of these requests and considering a variety of options.
Senator Wallin: Thank you.
Senator Tkachuk: I’ll start off with a comment. I am a bit of a populist. That’s why I’m repelled by what Stats Canada is doing. It’s the present government that is defending this program in the House of Commons right now.
I would like to ask, Mr. Parmenter, what you mean by comfort? When you say the banks need comfort, what do you mean by comfort?
Mr. Parmenter: What we really mean is there are still large, unresolved issues. The biggest one is the most foundational, which is sharing this private customer information. That issue remains unresolved.
Senator Tkachuk: Would the banks go to court to protect the privacy of their customers, or would they just let the government stamp all over them?
Mr. Parmenter: As I mentioned earlier, all of the banks are doing their due diligence on the nature of this request, including the legal implications. They are studying this issue carefully.
Senator Tkachuk: Would they go to court to protect an interest? What if they pushed the envelope? Would they go to court?
Mr. Parmenter: I wouldn’t want to prejudge and speak for individual actions, but I’d say all options are on the table. I think the banks are taking the nature of this request very seriously. Banks in Canada are always going to be interested in complying with the law, senator. I’m sure you can appreciate that.
Senator Tkachuk: I understand that.
Mr. Parmenter: There are obligations to customers, to government and to other stakeholders. All of those factors are being explored and studied.
Senator Tkachuk: I think the big problem is that when I go to a bank, it’s almost like an understood contract that what happens with my personal information stays in that bank and it’s not released. You would be breaking trust with your customers by moving that information out. That, to me, would give me reasons to go to court. I want you to give me comfort, is what I’m asking.
Mr. Parmenter: As I said, senator, every option is on the table. The banks are exploring all these issues. As you pointed out, when customers open an account or purchase a product from a bank, the understanding is that information won’t be shared with any third party without that customer’s consent. That’s consistent with PIPEDA. All of these issues are being explored and studied within this context.
[Translation]
Senator Dagenais: I want to thank our witnesses. According to some of my sources of information, about 4.5 million incidents of theft and hacking of personal data have been recorded over three years. Thank goodness that you aren’t part of these statistics.
These statistics on hacking and identity theft even concern federal and provincial government institutions. You should be concerned when it comes to submitting banking information to government institutions such as Statistics Canada. If I’m dealing with a bank and, for some reason, my data is hacked or stolen, I can change financial institutions. However, if my data is hacked at the federal government level, I can’t change governments. I understand your concerns.
How can you explain the transfer of our personal information to a government institution that has had about a 17.5 per cent rate of incidents of theft, hacking and negligence at both the federal and provincial level?
These statistics are also public. Everyone has access to them.
[English]
Mr. Parmenter: Thank you, senator. As I mentioned in my opening remarks, I think the concerns are bucketed largely in two categories. There are obviously the privacy concerns, but there are also concerns over the security of that data. I’m sure, as you can appreciate, individual banks just conducting their own business of banking take those two issues incredibly seriously and have very stringent regulations and practices to ensure both privacy and security. Given the nature of this request, those two factors are weighing heavily in terms of how the banks are studying this issue.
[Translation]
Senator Dagenais: I’ll get straight to the point. Has Statistics Canada or any other government agency pressured your association to obtain the data, to disclose the identity of your clients?
[English]
Mr. Parmenter: No, senator. The request has been described in terms of the compel letters that some institutions have received. That has been the extent of it, but certainly no pressure, no.
Senator C. Deacon: I’m focused on data protection within the bank itself, based on what you just said and the hacking that occurred, I think earlier this year, when the data of 90,000 Canadians was exposed. The concern I have relates to an Accenture survey of banking executives that said 78 per cent were really comfortable with the security practices at Canadian banks. That was senior executives. I really liked the response of the StatsCan commissioner when he said he worries about it every day and it’s a concern every day. To me, comfort in this area is a worrisome thing. I offer that as an observation. We have got to really worry about that.
I want to build on what Senator Wallin was just speaking about. I’m a real believer in evidence-based decision-making. It’s central. Government needs to have really good evidence in order to make the best monetary policy, fiscal policy and social policy decisions. Looking for a way to do this versus saying it’s a bad thing, how do we help get better data on our economy’s CPI and the willingness to find a path forward, potentially, that allows for anonymization of data, the willingness to look for an alternative that allows for a solution to be found so that we can have CPI indicators that we can rely on, a good understanding of the effects of the digital economy and how that is changing the lives of Canadians? Can you speak to the willingness to explore that road? I think it’s a really important road to be looking at.
Mr. Parmenter: We agree, senator. To be clear, we think Statistics Canada plays an integral role for both government and the broader Canadian economy. Our issue is not with StatsCan per se, just to be clear. The concerns we have are the nature of this particular data requests. I take your point. We’re hoping we can continue a dialogue as to alternatives and explore different ways that StatsCan can obtain data.
On the cyber point, to make that clear, when we talk to member institutions and ask them for their number one concern, cyber is always at the forefront. That’s because, obviously, you can never be complacent on that issue. It’s the number one issue of bank boards and bank managers as well.
Senator C. Deacon: You should get Accenture to redo that survey.
Senator Wetston: Thank you for coming here today. I have just a quick question following up on Senator Tkachuk’s and my other comment to Mr. Therrien about the banks being caught between a rock and a hard place here.
You’re not agents of Stats Canada or the government, obviously. As I see it, if you say no, just say no and don’t supply the information, you may in breach of requirements from Stats Canada. If you say yes, you may be violating PIPEDA privacy laws. That’s kind of where I see the conundrum for you. Do you see it that way?
Mr. Parmenter: Clearly, senator, there are obligations that I mentioned earlier to both customers and the government and different statutes covering those two pieces. When I say that member banks are currently reviewing the totality of the request and considering doing their due diligence, those are many of the issues that are being explored.
Senator Wetston: Mr. Basham, CAC has compiled thoughts within your organization about your position here today, obviously. I appreciate your opening statement because I think it reflects many issues that we all think about and think are important, but there is importance in data collection and there is importance in protecting privacy. Have you or CAC had an opportunity to present submissions to the federal government on privacy reform and what you might suggest as the appropriate way to balance the accessibility of data today, which is obviously omnipresent in the society, versus what you think might be improvements to the Privacy Act that we might be able to think about?
Mr. Basham: I will talk about going forward in the future. We would like to comment on a change to the Privacy Act to make sure that they are recognizing the basic principles of control and knowledge on the part of individual Canadians about how their data is used. We don’t have a specific set of things that we need done or would like done, but we want to recognize the fact that the Privacy Act, as the Supreme Court of Canada said, has quasi-constitutional status. In the Charter of Rights and Freedoms, sections 7 and 8 don’t speak to the specifics of personal data, but we want all of the regulatory regimes around privacy to be reflective of the modern economy. At the same time, the cornerstone has to be the right to privacy on the part of individual Canadians.
I’m sorry, I can’t speak to whether we were asked for our comments on the other questions.
Senator Stewart Olsen: I have just a small question, Mr. Parmenter. Can you tell me who received those compliance letters?
Mr. Parmenter: It’s our understanding that there were nine banks contacted.
Senator Stewart Olsen: Which ones? Can you share that?
Mr. Parmenter: Respectfully, senator, I think that was a communication between Statistics Canada and the individual banks, so I wouldn’t be comfortable sharing that information. My apologies for that.
The Chair: Witnesses, thank you very much. You have been very constructive and very helpful in our deliberations. We’re appreciative to you.
Senators, we will suspend and quickly go in camera for a few moments to digest what we’ve heard today. Thank you very much.
(The committee continued in camera.)