THE STANDING SENATE COMMITTEE ON BANKING, TRADE AND COMMERCE
EVIDENCE
OTTAWA, Thursday, May 9, 2019
The Standing Senate Committee on Banking, Trade and Commerce met this day at 10:31 a.m. to examine and report on the potential benefits and challenges of open banking for Canadian financial services consumers, with specific focus on the federal government’s regulatory role; and, in camera, for the consideration of a draft agenda (future business).
Senator Douglas Black (Chair) in the chair.
[English]
The Chair: Good morning and welcome, colleagues and members of the general public who are following today’s proceedings of the Standing Senate Committee on Banking, Trade and Commerce either here in the room or listening via the web. My name is Doug Black, a senator from Alberta, and I chair this committee.
Would the senators in the room be good enough to introduce themselves to our panel, starting on my left.
Senator Wetston: Howard Wetston, Ontario.
Senator C. Deacon: Colin Deacon, Nova Scotia.
Senator Duncan: Patricia Duncan, the Yukon.
[Translation]
Senator Dagenais: Jean-Guy Dagenais from Quebec.
Senator Verner: Josée Verner from Quebec.
[English]
Senator Stewart Olsen: Carolyn Stewart Olsen, New Brunswick.
Senator Marshall: Elizabeth Marshall, Newfoundland and Labrador.
Senator Wallin: Pamela Wallin, Saskatchewan.
The Chair: Today will mark our final meeting on the study of the potential benefits and challenges of open banking for Canadian financial services consumers, with a specific focus on the federal government’s regulatory role. We will then focus on producing our final report, which we expect to table in the Senate in June.
We have one panel today, and it’s my privilege to welcome back, because all of these individuals have appeared before with us, from the Office of the Privacy Commissioner of Canada, Gregory Smolynec, Deputy Commissioner, Policy and Promotion Sector; accompanied by Arun Bauri, Strategic Policy and Research Analyst, Policy, Research and Parliamentary Affairs Directorate.
From the Department of Finance Canada, we welcome back Annette Ryan, Associate Assistant Deputy Minister, Financial Sector Policy Branch; and Julien Brazeau, Senior Director, Strategy and Coordination, Financial Institutions Division, Financial Sector Policy Branch.
Mr. Brazeau, there’s no way to make an acronym or something out of that?
Julien Brazeau, Senior Director, Strategy and Coordination, Financial Institutions Division, Department of Finance Canada: We’ll work on that.
The Chair: Thank you for returning to speak to us today. We last heard from this panel in February, and we thought it was fitting to discuss with you what we have heard to date to close out our study.
We will commence with opening remarks. I believe Mr. Smolynec is going to commence and then followed Ms. Ryan, and then we’ll go to questions and answers.
[Translation]
Gregory Smolynec, Deputy Commissioner, Policy and Promotion Sector, Office of the Privacy Commissioner of Canada: Thank you for the invitation to reappear before the committee. I am once again accompanied by Mr. Bauri, senior policy analyst.
The Standing Senate Committee on Banking and Trade has heard from a number of witnesses on the advantages associated with open banking but also on the potential risks.
When we first appeared before you in February, we recommended that open banking in Canada be built upon a foundation that includes respect for privacy and other fundamental rights at its core. Specific recommendations we made included that: express meaningful consent be obtained from consumers; both technical and privacy standards be developed to ensure consistent ground rules; companies be accredited or licensed before being authorized to participate in open banking; PIPEDA be reformed to provide the Office of the Privacy Commissioner with stronger enforcement powers, including the power to make orders, impose fines for non-compliance with the law, as well as the right to independently verify compliance, without grounds, to ensure organizations are truly accountable for protecting personal information.
Since then, we have followed the hearings with great interest and noted that many comments echoed a number of the recommendations we made during our last appearance. We also participated in one of Finance Canada’s roundtables as part of their cross-country consultations on the merits of open banking and found that there was widespread agreement in the viewpoints of many participants. Though there was admittedly not 100 per cent agreement on these points, common ground included the need for consent, strong privacy laws and standards to be developed.
On the matter of enhanced regulation, I will also note that the managing director of the International Monetary Fund, Christine Lagarde, recently warned that innovation in the banking sector needs to be accompanied by regulation in order to maintain stability and trust in the system.
You heard from witnesses on the Australian open banking model, which has incorporated complementary regulatory roles for both its competition and privacy regulators.
Our office currently does not have the ability to co-operate and share information with other regulators, such as the Competition Bureau, which can lead to gaps in enforcement when there is overlap in our mandates.
Any reform to PIPEDA to facilitate open banking should address this current gap so that we can work together with the Competition Bureau and any other regulators that may be involved. Limitations in our ability to co-operate on common investigations could potentially hamper the effective and efficient implementation of open banking, putting at risk the confidence of Canadians to participate.
[English]
As I mentioned, we noted the strong call from witnesses that appeared before you for individuals to be able to expressly consent to participate in open banking. On this point, we are pleased to hear the comments of the senior official from Innovation, Science and Economic Development Canada, ISED, who spoke of the importance of the Office of the Privacy Commissioner’s meaningful consent guidelines when looking at c reform.
Commissioner Therrien provided recommendations for updating PIPEDA in this very way during his appearance before this committee on Bill C-74. We do note that the committee’s report on Bill C-74 specifically stated that:
The committee feels that Canada’s privacy laws need to be updated and made consistent with global standards
To elaborate on this point, individuals should have the right to control their information, which includes being able to meaningfully consent to how their information is used and to whom it is disclosed. Providing Canadians with control in this manner will help foster trust and assure them that they are not the product in open banking.
We hope that any recommendations from this study include PIPEDA reform, including on consent.
In following the testimony of witnesses who appeared before the committee, we noted with interest the testimony of one witness on moving the privacy framework in Canada toward a rights-based model. This is a matter we are currently seized with and which we believe is a current gap in the legislative landscape concerning privacy.
The rights of individuals who participate in open banking is a central issue to both this study but also to the digital economy as a whole. I would add that it is also fundamental to our democratic rights and to the functioning of our democracy.
Commissioner Therrien has expressed concern that long-standing privacy rights and values in Canada are not being given equal importance within a new digital ecosystem that is eagerly focused on embracing and leveraging data for various purposes. Privacy is not a right we simply trade away for innovation, efficiency or commercial gain.
In closing, we thank the committee for undertaking this very important study and for providing us with the opportunity to appear again. We look forward to reviewing the results of this study and of Finance Canada’s consultations on the merits of open banking. If and when a decision is made to proceed with open banking in Canada, we would be pleased to further engage with officials to discuss how to best incorporate privacy considerations into the open banking model. We would also be pleased to assist in the development of the necessary standards and, of course, to play a role in oversight.
Thank you, and I would be happy to answer any questions you may have.
The Chair: Thank you very much, Mr. Smolynec.
Ms. Ryan, please go ahead.
Annette Ryan, Associate Assistant Deputy Minister, Department of Finance Canada: Thank you, chair. We would like to thank you for inviting us back to speak to you in the context of open banking. We followed your own study with interest. Thank you very much.
[Translation]
My intention today is to provide you with an overview of what has taken place since we last appeared before you. I will then turn things over to my colleague Julien Brazeau, director general, who is leading the work of the open banking secretariat within the department. Mr. Brazeau will discuss the results of our consultation process and the next steps.
[English]
At our previous appearance, we framed the consultation exercise within the context that Canada has a globally competitive, stable and resilient financial sector that is supported by a well-functioning legislative framework and a regulatory system that is recognized throughout the world for its prudence and balanced approach.
This framework, as we discussed at our last appearance, sets out sound principles for the regulation of financial institutions that are rooted in three core objectives. To frame today’s discussion, I would like to repeat that these are: stability, which means that the sector is safe, sound and resilient in the face of stress; utility, which means that the sector meets the financial needs of an array of consumers, and that the interests of consumers are protected; and efficiency, which means to us that the sector provides competitively priced products and services, passes efficiency gains to consumers, accommodates innovation and contributes to economic growth. It’s with these principles in mind that the government undertook a review into the merits of open banking. The review accords with the department’s objective of ensuring that Canada continues to have a globally competitive financial sector that promotes consumer choice while also delivering financial stability and economic growth.
As the committee has heard, the review is being conducted by an advisory committee appointed by Minister Morneau, with support from our secretariat housed in the Department of Finance.
The committee’s mandate is to consider whether open banking would provide meaningful benefits to Canadians, and they’re also mandated to deliver a report assessing the potential merits, keeping in mind the highest regard for consumer privacy, security and financial stability.
As you may recall, when we last appeared before you, our public consultation period had just concluded, and the committee, supported by the secretariat, was in the process of hosting multi-stakeholder round tables in Vancouver, Toronto and Montreal. I’m pleased to report that the department received over 100 unique written submissions, and both the committee and the Department of Finance have engaged with over 200 stakeholders through the public round tables and bilaterally. Work continues on the organization of an additional round table in Iqaluit.
With that summary, I will turn to my colleague, Julien, to discuss some of the themes that arose during these consultations.
Mr. Brazeau: Thank you, Annette.
Thank you, members of the committee, for the opportunity to be here again. As others have stated, I have been watching your study with interest and look forward to hearing its results.
Before I begin, for the benefit of all committee members, I thought it would be useful to reiterate what we feel to be the definition of open banking. In our view, open banking is a privacy-protective and consumer-controlled means for consumers to direct a financial institution to share their transaction information with an accredited third party of their choosing. Open banking recognizes that consumers should be in control of their information and be able to benefit from its use.
[Translation]
Throughout the engagement process, the committee and secretariat heard from a broad range of stakeholders from traditional financial sector stakeholders and civil society organizations close to the lived experience of consumers and small and medium-sized business owners.
Through focus groups, the committee heard directly from Canadians. It also engaged with international policy makers to understand best practices in other jurisdictions.
[English]
For the purposes of our discussion today, I will discuss five key takeaways from our consultations with Canadians. The first is that open banking is already here. A key theme during our consultation was that consumer-led data-sharing exists in a significant way in the market today. As the committee has heard from a number of witnesses, millions of Canadians are already providing their login usernames and passwords of their bank accounts to third-party service providers that rely on a technique called screen-scraping to give their clients an aggregated view of their finances.
For most stakeholders, the benefits of open banking are widely recognized. This included a recognition from non-federally regulated financial institutions, such as credit unions, which expressed a great deal of interest in being able to participate in any open banking framework as they view the prospect of not being able to participate as a potential competitive disadvantage.
The second takeaway is that while open banking could enhance risks, in particular those related to cybersecurity and privacy, those risks exist today, and the risk of inaction is viewed as more significant. Stakeholders felt that a core benefit of moving forward with open banking would be a more secure, standardized means of sharing data.
The third takeaway is that while there is a great deal of alignment on the merits of open banking, views on the role of government still differ vastly. There is, however, baseline agreement among stakeholders that government has an important convening role to play, bringing a diverse group of stakeholders together to determine a path forward. In this same vein, other first-mover jurisdictions have adopted a variety of different models. The department is examining and monitoring those closely.
The fourth takeaway is that there is a sense of urgency in moving forward with open banking. Stakeholders are of the view that Canada has a strong internationally competitive financial services sector. Given the adoption of open banking frameworks in other large global markets, stakeholders expressed the view that failure to move forward could result in lost ground on innovation and competitiveness. In this regard, there was also strong desire for the government to make clear its intent and set clear timelines.
Finally, there was a recognition that open banking must be framed as part of a much broader discussion about Canadians’ ability to use, control and protect their data. Stakeholders noted that the benefits of open banking are not limited to financial transaction data, and facilitating broader, more secure data-sharing has the potential to improve Canada’s economic growth and productivity potential. Stakeholders also expressed a desire for the department’s work on open banking to be aligned with other related initiatives under way, including the Department of Finance’s payment modernization exercise and the Innovation, Science and Economic Development Canada’s digital and data study. In this context, the principal question that remains for the committee in their review is to opine on whether action is required on the part of the government.
As this committee will know, the review process has been broken into two phases, and the advisory committee is in the process of developing a report on the “whether” that will be delivered to the minister in the spring of this year. Following the delivery of the report, the department and the committee will look to re-engage with stakeholders in a more targeted manner on the broad themes raised in the consultation and considerations for enabling an ecosystem that is accessible to all participants.
With that, I will conclude my remarks. I’d be pleased to answer any questions the committee may have.
The Chair: Thank you, Mr. Brazeau. We will indeed turn to questions, starting with the deputy chair.
Senator Stewart Olsen: I have one question for Mr. Smolynec and one question for Ms. Ryan.
You brought up in your presentation that the oversight body is crucial. Do you have any ideas on the oversight body as to whom it should be? Bear in mind that my focus, and the committee’s focus, is consumer protection. We have to be assured that guiding this forward we will be confident in who is doing the oversight.
Mr. Smolynec: I can’t say we’ve theorized oversight for open banking in any kind of detailed way. We’ve noted examples of oversight as it’s unfolding in Australia, for instance. We do see the potential for shared oversight between different regulatory agencies. It’s conceivable to have oversight shared between the Competition Bureau, for instance, and our office.
We are more than ready and willing to participate in the development of the oversight model. Given the substantial and large concerns about privacy in open banking, it’s very suitable for our office to participate in oversight. But exactly the division of labour on oversight is not yet theorized by us.
We point out, as I mentioned in the statement, that shared responsibility for oversight has to be enabled by legislative reforms that would enable inform sharing between the bodies.
Senator Stewart Olsen: You made some very good points in the types of legislation, with the importance of privacy being paramount.
Ms. Ryan, you and your colleague’s presentation was excellent, and I’m pleased to see the consultations that have taken place. In your last paragraphs you detailed that more consultations will be taking place, but the fourth takeaway is that there is a sense of urgency in moving forward. How do you square those two?
Ms. Ryan: Senator, the sense of urgency is very much something that we heard in the consultations, yet the need to balance risks is one of the other core messages. These are not simple questions, and given that the committee has been working on the question of whether we should move ahead, that positions us to think about what we’ve heard in terms of how we would move ahead. Inasmuch as these have been established as stage questions, we’re certainly not going to not use the valuable feedback we’ve heard in how we might move to respond to that urgency.
Mr. Brazeau: That question goes, as well, to this theme that arose, which is that the topic of open banking needs to be framed more broadly in terms of what we want to do on data. There’s a number of government initiatives under way at the moment. I noted ISED’s investigation into data and digital and this decision about whether we take a sectoral approach, whether we just move forward with data sharing in the context of the financial sector or look to a broader economy-wide lens is an important question that still needs to be resolved because that will have a bearing on who plays what role in terms of oversight and regulation. Certainly, we do recognize a desire for the sense of urgency, but also stakeholders have said we need to get this right and we want to do exactly that.
Now that we’re coming to the end of the “whether,” we do want to focus and get all those players together. While we’ve had a good discussion on the “whether,” stakeholders haven’t articulated their views fully on the “how.” That’s what we want to drive to. There is momentum on those discussions and want to keep going with that.
Senator Stewart Olsen: Thank you very much.
[Translation]
Senator Verner: My question is for Mr. Smolynec, from the Office of the Privacy Commissioner of Canada.
In recent weeks, privacy protection for sensitive information exchanges such as those in open banking has often been mentioned, as has the Australian model. I’m not sure whether you read an article in Le Soleil on May 1, but recently, despite everything, the major Canadian banks, such as the Desjardins Group, joined forces with SecureKey Technologies to launch the Verified.Me application with great fanfare. The application is not for exchanging banking information about consumers, but rather for authorizing your financial institution to provide information to verify your identity.
To give a concrete example, the article states that when we want to buy a plan from a mobile phone company, instead of showing our driver’s licence, which contains much more information than necessary, we can do so online using the Verified.Me application, which will allow the bank to confirm our identity and give only a few specific details about us. That’s only the beginning of what we are discussing today.
In short, I wanted to know whether, by any chance, you were consulted, as an organization, when the major banks launched the application on May 1.
Mr. Smolynec: We did not have a request for consultation from the banks, and we did not conduct a study on this particular application.
We had a number of discussions, including within the government and the Treasury Board Secretariat, about the use of identity verification and banking accreditation systems, for example, to file tax returns on the Revenue Canada website.
But we did not receive a request for consultation about the Verified.Me app in particular.
Senator Verner: The article mentions that the application was created in partnership with SecureKey, a firm known for having fairly robust privacy measures. In your opinion, is there any risk with such technology? I see your colleagues nodding, so they have heard something about it.
Mr. Smolynec: It depends on the details of the system in question. Some measures are more robust and can protect personal information and identity, but it depends on the system.
Mr. Brazeau: Digital identity is an issue that has been raised a number of times by financial institutions and financial technology companies, because the more individuals participate in the ecosystem, the more necessary it will become to ensure that individuals are properly identified, especially if they allow access to their data. We are aware of the initiative.
Of course, clients give their consent when participating in the service. We think it’s quite an innovative service, but we’re still studying it to see how the system works and how it could fit into an open banking system.
Mr. Smolynec: It is also an issue with the government’s digital strategy.
Senator Verner: Okay, thank you.
[English]
Senator C. Deacon: Thank you to the panellists. This is an important point to hear from you because I view you as rate-limiting step in the progress. Your actions will determine what happens, and that’s important.
Mr. Smolynec, one of your comments was: Privacy is not a right we simply can trade away for innovation, efficiency and commercial gain. It’s already being traded, so the actions so far by the Privacy Commissioner have created an environment where that’s already happening.
I’ll give you an example. My spouse was just out of the country. She has never given her email address to anybody other than our financial adviser. The bank that hires that financial adviser has now traded that email address to Visa, who could send her an email receipt from another country, a transaction in another country, without her ever having provided that information.
We are already in a situation where the big banks are sharing our information without our knowledge, without our consent. I’m concerned about the fact that we may act in a way that is harmful to new entrants into this marketplace because we are viewing them as the risk, versus our banks and the way we are currently behaving in our culture and economy and under our privacy laws.
I want to hear you speak a bit about the urgent need to act. Right now there are 3.5 million Canadians who are not protected. They are at risk. There are already actions being done on the part of our banks, without our knowledge. It’s not informed consent. We may have given consent, but it’s not informed consent in terms of sharing our private information. There is a need to make sure we are still part of an innovation economy, that these companies that are at the prow of the ship of our future economy can pick up and go to another jurisdiction in a heartbeat — or, conversely, if we have good laws, can come here. I’d like you to speak to that, because it’s a tough balance and I’m worried that maybe you are struggling to find it.
Mr. Smolynec: Among the things brought to mind by your question is the image of privacy as being balanced against economic growth or innovation, or as a barrier to entry to a market, or as a barrier to innovation and growth, or, in some other cases, to accessing public services. These are discourses we sometimes hear coming from different quarters. We note it. Perhaps we are positioned to be attuned to these kinds of discourses that see privacy as a barrier, as a counterweight to these other obviously desirable things.
It’s our view that if you plan for privacy, if you design models — business models, for instance — that from the outset incorporate privacy into the design of the models, privacy by design — in the case of private enterprises, you have developed, let’s say, privacy impact statements on the part of government service providers — this image need not actually prevail, so to speak. You need not dichotomize these things in that way. Privacy could be the foundation for innovation, economic growth and entry into the markets.
We are not supportive of, for instance, any kind of carve-outs for new market entrants in any kind of future legislation. We believe the law should apply to all.
On that point — and I’m not speaking to the particular case you mentioned because I’m not familiar with the details — but if there are banks or others who are unlawfully disclosing information, we’d like to hear about it.
Senator C. Deacon: I don’t know if they are unlawfully doing it. I suspect that, unbeknownst to her, she has given that information to her bank such that they could transfer it without her knowledge, without her consent.
My point is that a lot of the new entrants are, in fact, not requiring a carve out. It’s the banks that require a carve out. What they are doing right now is actually not privacy by design; it’s the corollary of that.
I want to have a sense from you that you understand that new entrants are not going to be penalized and that we are going to look at all market participants in a way that enables a productive move toward consumer data rights versus informed consent of the use of data.
Mr. Smolynec: As far as our office is concerned, we are highly aware and sensitive to the issues between different sizes of enterprises and what challenges they may face. We want to ensure there is a level playing field. We also want to ensure that any actions we take or anything we propose does not get in the way of any innovation or growth opportunities. There is a high level of sensitivity to that in our office.
As part of the transition to the Office of the Privacy Commissioner of Canada, we’ve developed business advisory services, based in our Toronto office. We note, happily, that we have a high level of advice sought by small and medium-sized enterprises from our office, which has proven to be productive. We are aware and conscious of these issues.
Senator C. Deacon: Ms. Ryan and Mr. Brazeau, it’s the fact that you’re questioning whether to do this, as your first question. I wrote down the word “pace” at the end of your comments, as in “snail’s pace.”
This is already happening. Things are already happening with our banks and others in terms of sharing information without real consent. New entrants are struggling to compete, and there are consumers who are not being protected.
I’m worried about pace. Can you give us some confidence? We have a six-month period where, because of the election and other factors, very little will get authorized from a legislative standpoint. How do we keep things moving? How do we make sure that some of these serious issues are being addressed with haste — not carelessly but with haste?
Mr. Brazeau: It’s an excellent question. The announcement in Budget 2018 about our undertaking a study into the merits of open banking was received without much fanfare because the reality was that few people knew what open banking was at the time. While we have some sophisticated players in the ecosystem, including our big banks and some of the larger fintechs, we’ve found that there has been education of a lot of other groups about what open banking is, and what its potential benefits and risks are. We’ve had to do that education to ensure these people can participate constructively in these consultations.
To your point, something we’ve heard during our round tables is a view that we have now moved beyond the “whether” to the “how”; that there is an acceptance that we are now moving to the “how”; and that because it is here, it’s a question of how we frame it to protect Canadians, as you said.
In terms of reassuring you on the pace of our work, the advisory committee report, as I said, will be coming to the minister not later than the month of June. However, we also want to be working with stakeholders. Obviously, there is a role for government to play in gathering the ecosystem. Even in the six months leading up to an election, there is a runway there for us to work constructively with stakeholders. Stakeholders, now that they have moved beyond the “whether” to the “how,” are thinking constructively about what a framework looks like. We are committed to engaging them — including the advisory committee, whose appointment will last until the end of 2019 — with a view to providing a solid recommendation to government within a new mandate so that we can move quickly.
Senator C. Deacon: Thank you very much. In the second round I might ask about specific actions you’re taking during that six-month period.
The Chair: We’ll make sure we get back to that.
Senator Wallin: I want to come back to some of the same questions that my colleague Senator C. Deacon has raised.
To Ms. Ryan or Mr. Brazeau, where are we on the establishing structure? We heard testimony from the U.K. and Australia. The industry took the lead. They just went and did it, and government can say, “Here are some rules,” or whatever. My own biases on this, because of the “snail’s pace” reference, is let’s get industry doing it and then you react to it. Is that reasonable?
Mr. Brazeau: It is in certain respects. We want to encourage industry to come together and move quickly in terms of finding a solution.
Senator Wallin: How about allow them, or ask them to do it, or say they have to do it by Tuesday?
Mr. Brazeau: One thing we have heard in our consultations is the need for government to set a clear timeline to get all the stakeholders at the table working constructively. I expect there will be a recommendation in that regard in the forthcoming report.
Senator Wallin: What is your own thinking? Let industry do it and you monitor it? My own biases are that we don’t want government creating and overseeing this structure because you do move too slowly. The royal “you.”
Mr. Brazeau: Point taken. Agreed, we want to encourage industry to come together. I don’t think government is always best-placed to be setting standards and all the necessary rules. We want to make sure, as the stakeholders and the ecosystem come together, that they are looking at a system that will deliver on key policy objectives, including competition and utility. If a market solution does evolve, it has to be for the entire market, not for a subset of players who have rigged the system in their favour. We are very supportive of industry coming together as long as they are guided by those policy principles in doing so and for us to be able to play that challenge function.
Senator Wallin: Do you have a list of those policy principles ready to go, or are you still waiting for this consultation process?
Mr. Brazeau: Without wanting to scoop the advisory committee report, my sense is that their report will be setting out principles that should guide those discussions.
Senator Wallin: A question to Mr. Smolynec on the oversight function. When you say you want to share the duty with the Competition Bureau, I get nervous. We have way too many cooks in the kitchen when you do that. How do we find an oversight body where, if Senator Deacon’s wife needs to make a complaint, or a large business or small start-up, wants to say that his is not working or what are the rules, don’t we need a separate structure?
Mr. Smolynec: I suppose it would depend on the nature of the complaint. If the complaint is about the handling of someone’s personal information and a violation of their privacy rights, the complaint should come to us. If it’s a question of the competitive nature of the industry, which may not be the case, and what we heard about then would go to the Competition Bureau.
Senator Wallin: Do you think you can deal with this, given what’s already on your plate and the enormity of these issues? Are you equipped to do this? We are looking at things we should recommend and put in our report, or do we need a structure within whatever this other private sector body emerges as and every detail that’s built into that?
Mr. Smolynec: In terms of resources, fundamental to the prospects of open banking would be to have suitable enabling legislation, and not just for open banking but writ large because of the state of the digital economy, and also the changes that are in some ways analogous in the public sector. We have to have serious substantial privacy reform of both the Privacy Act and PIPEDA.
With those reforms, both in fundamental senses, including a rights basis to that legislation, but also the empowerment of this office with order-making powers, fining powers and everything that goes with a full-functioning regulator, together with that we would need additional resources fit for the purpose that is being designed.
Ms. Ryan: The issues involved in open banking span a range of very large policy areas — consumer policy, competition policy, financial policy, privacy policy, and touch their respective regulatory functions.
Other countries have taken a vastly different set of approaches to that question of who regulates and what the right balance is between regulatory oversight versus private sector cooperation.
Julien’s point about bringing the public along in this discussion is critically important. The consultation process, as well as your process, is the way we are looking to know where we set the guardrails for what the bigger and smaller players are already doing so we can steer this process toward the outcome that is right for Canadians.
Senator Wallin: I don’t disagree with that. While we are educating people so they are making these decisions consciously or asking that their consent is sought, that they have some rules to say to them that these are the rules in place which you can use, not that we are consulting you about whether you worry about this. Of course, we do. That is kind of a given.
Ms. Ryan: Understood, senator. Thank you.
Senator Duncan: Thank you to the panel for your presentation. My questions follow up on Senator Stewart Olsen’s comments. I heard Mr. Brazeau’s presentation reference stakeholders in Vancouver, Montreal and Toronto and a round table in Iqaluit. The British presentation that we had from Mr. Imran Gulamhuseinwala talked about, first of all, the need for this consideration of open banking, and the open banking implementation entity was struck as a result of a review of banking in the U.K.
In the presentation, he very much emphasized two things, or the two takeaways I got was an increased level of service and competition for consumers and the recognition and a special agency, for lack of a better term, that was mandated to specifically deal with the vulnerable sector.
Those who are not prepared to read the 19-page, “Yes, I give my consent,” or those who don’t have a bank account, and I didn’t hear any of those elements in the consultation with Canadians or the stakeholders.
I’m deeply concerned because Vancouver, Montreal, Toronto and Iqualuit are not representative of the whole of Canada. And Iqualuit isn’t, oh, yes, we have heard “north of 60.”
Those are my concerns. What I have heard, when I go home and say “open banking,” and beyond the blank stare, it’s, “Are you going to protect my privacy, and what does that mean?” Anybody under 30 knows exactly what you are talking about and is online doing this, but who is looking after their savings account? That’s my rant.
Mr. Brazeau: I agree that the term “open banking” itself is a misleading term. That is something we have heard in our consultations that it gives the sense that your banking information is open for anyone to take. When I try to explain to my mom what I’m doing, she thinks I’m trying to extend banking hours. It doesn’t speak much for what it is.
In the hopes of reassuring you in terms of the outreach we have been doing, in addition to the round tables that we did, we have also reached out directly and met bilaterally with a number of civil society groups, the prospers of the world, the Vanier Institute, to try to get their views as well. We have also done public opinion research across the country, not just in the large centres, both online and in person to get consumers in and get their specific views and tease out those views and their worries about issues such as privacy.
For those who are not part of the major centres and have difficulty accessing regular banking services or are underserved, all those findings will be part of the committee’s report as it moves forward.
We are dedicated to continuing that outreach and reaching those vulnerable groups. The Financial Consumer Agency of Canada has a digital literacy leader whom we have been reaching out to as well who has a vast network of organizations that work in this space. We have heard as well internationally about the need to put the consumer first and to have them be a leading voice in the framing of this discussion. We do want to carry that out.
Senator Duncan: It’s incredibly important. There shouldn’t be a delay in this initiative. My question in that response is who is holding the larger stakeholders, the banks, where are they in listening to consumers and hearing what you are hearing?
Mr. Brazeau: We made a conscious effort in our round tables to ensure that a variety of views were expressed. We made a conscious effort when we were doing breakout rooms to have the big banks paired with civil society groups, the Canadian Association for Retired Persons talking about what their members had at heart, and small fintechs and small- and medium-sized businesses and their challenges in terms of getting loans.
We have heard back in terms of the views of the people that have participated in the round tables that they found them quite constructive in that it allowed them to get a sense of what other stakeholders, both big and small, were thinking.
Senator Marshall: I would like to say to Mr. Smolynec I don’t have a question for you. I know you are at the table and you realize you have an important role to play and we are all counting on you to protect our privacy. My questions are for Ms. Ryan and Mr. Brazeau.
We are talking about the urgency for open banking, and it’s already here. Br. Brazeau, you indicated in your opening remarks the report that is going to be delivered to the minister this spring. What other information can you give us on the timelines? You are rather optimistic about the timelines because the report, you are still doing consultations. We are about five weeks away from Parliament shutting down for the summer and then everybody is going to be on the campaign trail. There is an election coming. Even if this government is returned or if there is a new government, it’s going to be a while before a decision is made.
This is a big project. It seems to me it’s still in the early stages and I don’t even know if there is enough information to establish timelines. I’m always interested in timelines, implementation dates and costs. The timelines, do you have any idea of a road map with fixed dates or is it still too early?
Mr. Brazeau: We do have a preferred work plan and timing that we think is best. Obviously we can control what we can control. The political powers that be, in terms of when policy is adopted and legislation is passed, that is directly outside of our control. In terms of when the report is going to be filed, the public consultations and the round tables have ended. The report is drafted. It will be coming to the minister shortly. The advisory committee at part of the round tables has already signalled to stakeholders that they will be re-engaging with them in the months of June and throughout the summer to talk about implementation and what that looks like.
The reality is, though, that to the extent that we will be requiring changes to legislation and regulations, those will likely take place under a new government. We think there is sufficient urgency. I would imagine the advisory committee is going to recommend the government continues to prioritize this as an issue going forward.
Senator Marshall: Have you given any thought as to when you would like to see an implementation date, even a decision made by the government to move forward?
Mr. Brazeau: In an ideal world if I could control all the decisions, I would think that once the report is released and stakeholders come together on an implementation landing zone that we would be in a position by the end of 2019 or early 2020 to propose changes to legislation and actually implement.
Senator Marshall: Government moves slowly, though. Thank you.
Senator Wetston: Sorry I had to step out so I may have missed some of the questions and answers.
I would like to talk to you about risks. I took note of the fact you want to get this right because of the risks. You need to think about if you don’t do it, you are going to have more risks to face. If you have 4 million people who are screen scraping, you are going to have 7 million in another year and maybe another 3 million then. I have mentioned this to you before, those of you from Finance, that my concern is allowing activity to occur and not moving more quickly. There are some good examples of that in this country.
Do you have concerns that you may not be moving quickly enough on this? I’m not suggesting you don’t have all the impediments, government policy, legislation, consultation and a whole host of issues. Can you give me some sense of your views on that. I know it has come up a number of times.
For Mr. Smolynec, I would like to ask you, there is no question the privacy legislation, PIPEDA, is important. We have seen what other jurisdictions have done in using various government instruments to deal with this market competition policy and privacy in Australia, combination of competition policy and trustee in the U.K. Mr. Brazeau comes from a competition policy background. I think you would enjoy the opportunity to think about that.
What powers do you need in the event that tomorrow we have this open banking environment? We have standards. We have protocols. We have all this in place. What do you need to effectively protect consumers and their privacy rights in Canada?
Mr. Smolynec: One of the things we’d like to see in new legislation is the ability of the Office of the Privacy Commissioner to be able to triage, to evaluate risks to privacy when receiving complaints. Right now we respond to all complaints. This is something that concerns sizes of businesses as well. There is no carve out in the law but we should be able to have some discretion in choosing which investigations based on the risk to Canadians and privacy. That’s maybe not the main thing. That’s an important aspect of law reform as well.
From the high to the low, we recommend rights-based privacy legislation. It sounds a little esoteric, perhaps, but the basic idea is Canadians in a democracy should be free from corporate and state surveillance. They should be able to develop free from corporate and state surveillance and this should be ensured in a legislative framework. There are a series of rights, as well, that without minimizing them, enable Canadians to have information about how their information is handled, access to that information, the ability to correct their information, et cetera.
In terms of the powers of the office, there are a series of essential things that we don’t currently have: Order-making powers; the ability to fine; to ensure that there is compliance; and to deter enterprises and organizations from disregarding the law. These are some of the fundamental requests that we have. As we have testified in front of this committee and other committees before, there is a list of law reform recommendations.
Many of the issues confronting open banking are issues that have their points of similarity or analogues — pardon the term — in other parts of the digital economy. The issue of having law reform is pressing. We say that open banking is taking place. There are all kinds of digital innovations, both in the private and public sectors, that have now outpaced our legislation. That has been the case for many years.
This is something our Privacy Commissioner has emphasized to various parliamentary committees for the duration of his mandate and that his predecessor emphasized to various parliamentary committees in her time. There is an issue of speed and urgency, but we would expect that the Parliament would legislate on these issues.
Mr. Brazeau: If I may add, as I stated in my opening remarks, what we heard is while there are increased risks to cyber and privacy, the risk of inaction is greater. We recognize that urgency.
When we take a look at jurisdictions like the U.K. and Australia, these are broad, horizontal issues that transcend just the financial sector, privacy cybersecurity at large. The issue of standards as well do take time to bring to ground. Even in the U.K., they were a first mover, it took them over a year and a half to move to implementation. Australia gave six months but they’ve had to extend that by another six months so that their institutions could be ready to do it.
We’re mindful that, despite our best intent to want to move forward quickly, it will take some time to put a system in place. We’re hoping to take advantage of a fast follower, noticing that Australia built on the U.K.’s approach and was able to come to standards much more quickly. There are some advantages there to have.
Senator Wetston: I fully appreciate that the U.K. and Australia are common-law jurisdictions and we are a common-law jurisdiction. While many aspects of our legislation and our approach to the issues will vary, there are good models there for us. I know you’re looking at that.
My only follow-up there is that we just had a C.D. Howe Competition Council round-table discussion about whether the Competition Act is up to scratch to be able to deal with the evolving environment that we’re facing today. We’re in a very different environment today. I’m questioning whether or not the way that we’re looking at it is capturing the essence of what is really going on.
I don’t take issue with anything that you’ve said, but we need to step back and ask ourselves: What is the appropriate model today? We’re looking at this a little traditionally; finance and the Competition Bureau and privacy. We need to step back and think about that, because this is going to get ahead of us and it is Canadians that are going to be put at risk. I’m very concerned about that.
I take no issue and I have great respect for what you’re saying, but, we’re at a key point here and we need to understand and move on it. Even if we do things incrementally, we should do that incrementally to ensure that we’re moving ahead to capture the essence of these challenges.
[Translation]
Senator Dagenais: My thanks to our guests. My first question is for Mr. Smolynec.
Mr. Smolynec, when people deal with the banking system, whether it is open or not, they are often in a rush. Any refusal of consent could delay the process. People will then check “yes” and say to themselves that they have no choice if they want things to move faster. You keep referring to express consent. Many people give their consent without actually assessing the risk. In your opinion, to what extent could the open banking system increase the risk for those clients?
Mr. Smolynec: Of course, the problem is that consent forms are very often not easy to read or complete.
For information purposes, we have developed guidelines on consent. Recently, we held consultations across Canada on the issue. The guidelines on our website indicate how organizations may go about obtaining the express consent of clients. It is neither impossible nor difficult. There are guidelines, and it can be done without using very complicated forms.
Let me make another point. Financial data is sensitive and requires express consent. There is case law on the issue. So it’s not just a question of whether or not the person wants consent. Consent is required. The risk depends on the details, such as how the system will work and how to establish measures or standards to ensure that consent can be given effectively in the open banking system.
Senator Dagenais: I now have a question for Mr. Brazeau.
Mr. Brazeau, in your opening remarks, you talked about the need to be competitive. You know that Americans are turning their backs on the banking system right now. I also think most trade is with the U.S., our neighbour to the south. Internationally, do you know who will benefit from the open banking system we want to set up? Is it worthwhile to proceed quickly?
Mr. Brazeau: Following today’s discussion on urgency, it is important to proceed quickly. Market dynamics in the U.S. are quite different. There are more than 1,000 banks in the United States, whereas the Canadian market is much more concentrated. One of the department’s policy pillars is the issue of competition and efficiency.
Canadians are also recognized to have a high level of trust in their financial institutions. We believe that current financial institutions will fare well in an open banking system. We also hear that the survival of small financial institutions will be impossible without access to data.
The government’s objective with open banking is to ensure that all players can participate, while watching out for unintended effects, such as the issue of large technology companies having access to the data, which could strengthen their position in the market. We are working on all those issues right now. Telling you that we have the answers to all those questions would be a lie; however, they are being studied.
Senator Dagenais: Thank you very much.
[English]
Senator C. Deacon: I want to build on what Senator Wetston was talking about and the need for us to be disruptive or change the game. A linear approach here may not be sufficient to address the pace of change that’s already going on, and the reality is you’re working with a government department, a government agency, that’s going to be between governments while the world keeps moving quickly around us.
You have heard where we’re at. What would you recommend we focus on in our report? What are you worrying about the most and how can we help?
Ms. Ryan: Thank you, senator. We are genuinely looking forward to your report. You’ve heard from a wide range of individuals and businesses. We’re looking for that sense of priority from the policy space, both the areas where you see a range of problems now — and you’ve spoken to some today — as well as the areas that we should put priority on going forward.
As we look at the space before us that involves questions of legislation, regulatory oversight, principle-based standards or more prescriptive standards, the sense of knowing where to start, how to put sequence and priority and staging to the very many large questions that lie before us, what can be approached from a sectoral basis versus areas where we should, as you say, step back and look at our laws of general application that go across all sectors. These are the type of questions that we’re looking at. To the extent that you can give that wider sense of what urgency and consensus look like from your hearings, we’re very keen to see it.
Mr. Brazeau: I’ll add that your voice will elevate this issue tremendously in terms of the attention that’s paid to it from both a political and a policy perspective. That’s tremendously important.
As well, your ability to look beyond normal government silos. Obviously we’re working as the Department of Finance, understanding this has to be framed within a broader government context as well. You have spoken with other departments who are seized with different issues but bringing those issues together. Your views on how those things need to come together and how we need to be thinking innovatively about these things is very helpful for us.
Ms. Ryan: If I could have one further thought, senator. To the extent that your report is more readable for the general public, that aspect of bringing everybody along together on this issue is something that you’re well positioned to contribute strongly to.
Senator C. Deacon: I’m wondering if there’s anything from —
Mr. Smolynec: Thank you very much. It would be desirable from our point of view if you could reiterate what you said in your report on Bill C-74, the committee feels that Canada’s privacy laws need to be updated and made consistent with global standards. A call for privacy law reform is helpful, including the enhanced powers and a rights basis. And then specifically with respect to open banking that the OPC is included in the development of open banking standards from the privacy perspective and in the oversight of open banking as well.
Senator C. Deacon: And you’re willing to prioritize your effort in that regard; correct? To move quickly.
Mr. Smolynec: Yes, yes.
Senator C. Deacon: Thank you.
Senator Stewart Olsen: Just a couple of questions. In support of our finance department, we have one of the finest departments in the world. I’m not sure why we need — and this is heresy, I know — all these public consultations. You guys know what needs to be done. You know how to manage things appropriately and properly. We’ve been very safe in your hands for years managing all of this.
My concern is you talk about enabling legislation. I’m not sure there’s not another way to go about this, rather than putting through weighty enabling legislation. My concern is that perhaps instead of doing more consultations, you should deal with the now. Even if it’s an interim protection, we need to bring that forward. I can’t see any other way. We can go on for another year, year and a half. In the meantime, more and more Canadians are being put at risk.
What would you think about an interim protective measure that might allay some of our fears and certainly protect Canadians?
Mr. Brazeau: We certainly welcome your views, on what that could look like. Again, we certainly do recognize a sense for urgency. We want to consult again with the private sector on conditions for implementation. Maybe we can recast that as we want to engage with them on what implementation looks like and start putting forward solutions. It’s less of a consultation in terms of what your view about this is, and more we’ve recognized the issue exists. Now what can we do constructively work together, both as government in terms of enabling some of these policy levers and you as the private sector in terms of players who are going to implement this in moving forward? Certainly interim solutions would not be out of the question, but we would have to work with industry to find out what those are.
Senator Stewart Olsen: I consider you guys the experts, and industry is always going to be putting forward their own “how can we get ahead with this?” I’ll leave it at that. Thank you.
The Chair: Panellists thank you very much. This was very helpful. You were, as I indicated to you privately before, our cleanup team. We’ve heard a lot —
Senator Wallin: In the nicest possible way.
The Chair: As a Calgarian, I know the importance of a cleanup team, the Calgary Stampede Parade. This is important. I’m not suggesting that we’ve much of that, either.
I would simply say to you this is very helpful. We’re cognizant that we have a unique opportunity here to try and help frame an important conclusion to the work that’s being considered by you all. We’ve heard you very clearly. You likely have a clear understanding from us as to the tone that we likely will develop. We’re getting to it. We’re going to have a report out in June, and I hope that that will be helpful to you. Thank you for your contributions.
(The committee continued in camera.)