THE STANDING SENATE COMMITTEE ON BANKING, TRADE AND COMMERCE
EVIDENCE
OTTAWA, Thursday, April 11, 2019
The Standing Senate Committee on Banking, Trade and Commerce met this day at 10:30 a.m. to examine and report on the potential benefits and challenges of open banking for Canadian financial services consumers, with specific focus on the federal government’s regulatory role.
Senator Carolyn Stewart Olsen (Deputy Chair) in the chair.
[English]
The Deputy Chair: Good morning, senators, ladies and gentlemen and special guests. Welcome to all of you, members of the general public, who are following today’s proceedings of the Standing Senate Committee on Banking, Trade and Commerce, either here in the room or listening via the web.
My name is Carolyn Stewart Olsen. I’m deputy chair of this committee, filling in for Senator Doug Black who is not able to be here with us.
Today marks the eighth meeting on our study of the potential benefits and challenges of open banking for Canada’s financial services consumers with specific focus on the federal government’s regulatory role.
During the first portion of our meeting today, I’m pleased to welcome Michael Geist, Canada Research Chair in Internet and E-commerce Law, Faculty of Law, University of Ottawa.
Dr. Geist, welcome and thank you for being with us today. Please proceed with your opening remarks and then we’ll go to questions and answers for you.
Michael A. Geist, Canada Research Chair in Internet and E-commerce Law, Faculty of Law, University of Ottawa, as an individual: Thank you very much. Good morning, everyone. As you just heard, I’m a law professor at the University of Ottawa, where I hold the Canada Research Chair in Internet and E-commerce Law, and I am a member of the Centre for Law, Technology and Society. My areas of specialty include digital policy, intellectual property, privacy and the Internet. I appear in a personal capacity representing only my own views.
The committee’s study on open banking has been exceptionally interesting and insightful, candidly providing more context, nuance and information than the Department of Finance’s consultation on the issue. Yet the review has left me somewhat puzzled. Open banking is typically framed before this committee, by government consultation and in the media, as a matter of if or sometimes when. In other words, sometimes the debate is whether we need it and others suggest that it is only a matter of time.
However, I believe the record confirms that open banking is effectively already here. While the banks have largely not provided data portability to their customers, millions of Canadians already provide their banking data to third parties who frequently use screen scraping to gain access to the banking information. This is presumably provided with customer consent since they are the ones with the necessary login information. The screen scraping approach is widely recognized as risky given questions about the security of the sensitive data, including login information, the identity of third parties and the absence of industry standards.
The willingness to use these third-party services even in the face of the friction that exists without easy data portability, points to the real risk for government policy. In my view, the real risk lies in doing nothing, not doing something.
The prospect of account aggregation, the use of AI and the identification of alternative products and services may sometimes only come from a third party provider. Canada needs to act quickly to facilitate a marketplace that responds to customer demands, fosters innovation and addresses long-standing consumer frustrations with a banking system that invariably insists that trading cost competitiveness for stability is a virtue.
If we adopt a consumer-centric perspective on the issue, we should recognize that consumers have demonstrated their interest in open banking, but they have been placed at risk by banks that make it difficult to port their data and by absence of associated policies and effective privacy safeguards.
Looking through the transcript, I’ve heard several senators ask witnesses what can or should be done. I would like to offer three recommendations.
First, Canada’s private sector privacy law must be updated. Simply put, the law was drafted more than two decades ago and is no longer fit for purpose. There are important debates about the legal protections for data, but the immediate issue is that Canadians rely on PIPEDA for their statutory protections. This law does not have an effective enforcement mechanism meaning there is limited recourse in the event of a potential misuse whether by the big banks or by a third-party provider.
Moreover, privacy law standards that are increasingly common in other jurisdictions are simply absent from the Canadian landscape. In fact, the Privacy Commissioner of Canada has recently taken to re-interpreting the law as a means of expanding its scope and relevance. For example, just a couple of days ago, the OPC, the Office of the Privacy Commissioner, released a new consultation that included its preliminary view that it now believes that cross-border data disclosure of personal information require prior consent. The proposed approach is a significant reversal from long-standing policy that relied on the accountability principles to ensure that organizations transferring personal information to third parties are the ones that are ultimately responsible for safeguarding that information.
The proposed change in approach has enormous implications for e-commerce data flows and potentially open banking. It points yet again to the need for legislative review and reform of the law rather than OPC guidelines that, if adopted, will likely end up being challenged in Canadian courts.
Second, the government needs to mandate data portability for consumer and small business banking. The major banks may talk sweetly about their potential support for open banking, but it was only in 2017 that the Canadian Bankers Association was issuing warnings about open banking risks to consumers and the economy as a whole.
Third party innovative services exist precisely because they offer products and services not offered by the big banks. The way to restore the safety of Canadian consumers who face real risk with screen scraping is to mandate their data must be openly shared by the banks where the customer provides an informed consent to do so. There are undoubtedly securities protocols and standards to be developed, but the starting point is regulated support for a consumer-focused system that gives consumers control by opening their data at their request.
Third, as the committee identifies consumer protections and other safeguards, recognize that the difference between big banks and third party financial providers will become increasingly blurry for many Canadians. That blurring already exists in other sectors. Think of telecom and incumbent providers who operate alongside third-party services like Skype or WhatsApp that offer functionality that was once limited to incumbent providers.
I believe the same will ultimately be true in banking as consumers come to rely on new service providers who offer their services alongside the big banks. That suggests that consumer protections and the identification of risks should take a big picture perspective. In fact, just yesterday, the CBC reported that a report from the Financial Consumer Agency of Canada about aggressive sales tactics by the big banks underwent revisions after early drafts were provided to the government and the banking sector. The revisions included the removal of proposed consumer protections. In other words, we should not pretend that it is only new technologies and third parties that bring consumer risks.
I look forward to your questions.
The Deputy Chair: Thank you very much, Mr. Geist. We’ll turn to our first questioner, Senator Klyne.
Senator Klyne: Good morning and thank you for your attendance with us this morning.
I was going to ask you about reflection on Australia and the United Kingdom with regard to PIPEDA. You kind of lobbed that out there. I don’t think you’re suggesting that PIPEDA should be cast aside, but should be built on to put some teeth into it. Is it as simple as that or are there other elements missing? I have a second question as well, but I will let you give an answer to that.
Mr. Geist: I wasn’t suggesting that PIPEDA could be cast aside. I was trying to make the case that I think we’re now talking about a two-decade-old law from when it was first drafted. I think it is widely regarded, if we compare it to what we find in other jurisdictions, notably the EU, as being inadequate. Frankly, I believe that the Privacy Commissioner of Canada finds it inadequate at this point in time.
I struggle with some of the interpretations we’ve seen out of the Privacy Commissioner’s Office over the last year or so as I think they find themselves constrained by a law that’s no longer fit for purpose. I just mentioned the change they announced about 48 hours ago involving cross-border data transfers. They adopted a somewhat similar approach with respect to the so-called right to be forgotten, reading in a right to de-index into the law. That is also currently now before the courts as it’s disputed as to whether or not PIPEDA is there. I think this simply reflects a law that doesn’t meet the kinds of standards that we find in other places. To the extent to which we want to talk about consumer safeguards in an open banking context where people want to have the ability to make their banking information available on a more frictionless way, it is dependent upon ensuring privacy safeguards and we don’t have that right now.
Senator Klyne: Thanks. I assume that PIPEDA 2.0 will find its way into some regulatory framework and be built on that basis.
Mr. Geist: We can hope. PIPEDA includes a mandatory five-year review. The most recent changes, some of which only took effect last year, were the result of the hearing back in 2006.
So if we contrast how long it took from the first set of hearings, literally 2006-07 to review, to take more than a decade from when those recommendations made their way into the legislative process, were passed, regulatory frameworks and then ultimately took effect — and contrast that with the speed at which other jurisdictions have moved on open banking, I would suggest there’s a significant disconnect between the speed with which we moved only privacy safeguards and the way in which the sector is moving.
Senator Klyne: I have to comment on that last part. I want to think, with open banking looming on the horizon, that somebody is actually making the connections now and might try to get there a little sooner than history would demonstrate.
We heard from your colleague Teresa Scassa on April 4, and she provided very important information, not only about who owns consumer data, but who owns and controls the information derived from the data.
What’s your perspective on who owns the information derived from synthesizing customer-owned data?
Mr. Geist: Professor Scassa gave an excellent presentation. She was very insightful during the question-and-answer that followed.
I’ve seen this as part of some of your discussions. The issue for me at this stage is less about who owns it, but about who has control or some means of control over how it’s used and where it goes. In fact, in a sense, that’s what the Privacy Commissioner might be trying to do now on cross-border data transfers, which is to suggest that the previous view that an organization was accountable for that information, no matter where it went and no matter who had it, didn’t provide a sufficient level of control, or we need to buttress that with stronger levels of concepts.
I think it largely comes down to control.
There are lots of players that will look to monetize or benefit from the prospect of data. There are clear benefits for consumers along the way. It’s a mistake to take a look at this and think that companies using this information to generate returns are necessarily doing a bad thing. Frankly, they are bringing potential innovations, new products and services, and new levels of choice for consumers. So long as consumers have both an adequate level of information and disclosure about how their information is being used and genuinely understand what is taking place, they are able to proactively offer up consent such that it’s not implied in a way that someone assumes they have the time to read the fine print — rather, make it explicitly clear about what is taking place. Then there is a prospect that consumers will enjoy real benefits in terms of being aware of alternatives, more competition and new opportunities in the marketplace.
Senator Klyne: So by taking customer data and synthesizing it or manipulating it for some reason, that doesn’t mean they’ve lost control of it; it’s just been reshaped or reformed.
Mr. Geist: Admittedly, it can get messy quickly. I’m the chair of Waterfront Toronto’s Digital Strategy Advisory Committee, where we’re charged with examining the so-called Smart City project involving Sidewalk Labs, which is Google. You get into some interesting and thorny questions around the data collected. Which data is personally identifiable information such that it falls within our current law? Which is outside of it but might still raise certain kinds of concerns? How might that data be used?
It would be naive to think that it’s simply a matter that someone is taking the data and scrolling through, say, my banking statement, and that’s the end of the story. It’s quite clear that, as we move into using artificial intelligence and other sorts of tools, that data might find itself used in different kinds of ways.
Fundamentally, we need to ensure there are appropriate levels of information and that safeguards are there to ensure that where there is potential misuse, that gets addressed as well.
I’d also note that we also need to be careful about ensuring that other existing laws — human rights laws and laws against engaging in certain kinds of bias — are actively applied. You see that coming up in the context of some online advertising-related issues, where we’ve seen some of the online advertising raising issues of targeting or de-targeting certain kinds of communities, which may raise various human rights or discrimination issues. Those same kinds of questions may come into play here as well.
Senator Klyne: Thank you.
The Deputy Chair: I was very remiss. I didn’t have senators introduce themselves, so we will do that.
Senator C. Deacon: Colin Deacon from Nova Scotia.
Senator Klyne: Marty Klyne, Saskatchewan.
[Translation]
Senator Moncion: Lucie Moncion from Ontario.
[English]
Senator Wetston: Howard Wetston, Ontario.
Senator Duncan: Pat Duncan, Yukon.
Senator Marshall: Elizabeth Marshall, Newfoundland and Labrador.
[Translation]
Senator Verner: Josée Verner from Quebec.
[English]
The Deputy Chair: Thank you. We will now continue with questions.
Senator C. Deacon: Thank you very much, Dr. Geist, for the clarity of your presentation. It’s especially helpful at this point in our investigations to be looking for very precise recommendations.
I want to dig in a bit. I share your sense of urgency here that the horse has already bolted. Canadians are at increasing risk, and I think our financial institutions are at an increasing risk, of being disrupted by third parties from other countries, taking away their product lines if we don’t start to deal with this within Canada. So I share that concern about the risk of inaction.
I want to focus on the consumer data rights approach taken in Australia, because it really has resonated with me. I like it for a lot of reasons, but one of them is that it doesn’t focus specifically on open banking; it has transferability across a lot of areas where our services and activities are being digitized. I think about government. We are at the time of the year where millions of Canadians are giving a lot of very personal information into it, and that’s transferred to the CRA through TurboTax and other tools like that. There are our health data. So the consumer data right opportunity is significant, from what I’m hearing.
I would like you to give us your feedback on that line of thinking and the recommendations we’ve seen along those lines.
Mr. Geist: I would say a couple of things. First, I’ll speak to the open banking experiences the committee has spent a lot of time hearing about from both the U.K. and Australia, and then I’ll get into the specific issue around data rights.
I’m fortunate enough to get to appear before a lot of committees, and very often, the question is — and it’s true with policy-makers, as well — what are other people doing? In a sense, we want to beta test our proposals based on what we’re seeing elsewhere. While I recognize it provides a certain amount of comfort — it can be challenging and a little uncomfortable, perhaps, to adopt sui generis approaches, or approaches specific to Canada, particularly in this area where the kinds of approaches we’re seeing, let’s say, in both Australia and the U.K. They are so new and, in certain respects, not even fully baked yet, and we’re still seeing them rolled out.
I candidly think they offer limited value in terms of a Canadian comparison. In other words, we should not be shy to say that, in terms of what our banking infrastructure looks like, where our priorities lie, our proximity to the United States, what our privacy law looks like and a myriad other considerations that come into play, may mean that the experience in other jurisdictions is very interesting, but the idea that we, at this stage, need to model ourselves on another jurisdiction that has only begun to really explore some of these issues is a mistake. I’d actually like to see Canada be a bit more ambitious in the sense of saying that we can set what we think is the appropriate standard on some of these issues, and we need not rely directly on the experience elsewhere.
As for the specific question of data rights, I referenced a moment ago the experience I’m having right now with the Waterfront Toronto initiative. The government launched its own national data strategy consultation. There is a reasonable expectation that, certainly before the summer, we will see at least the results, as the government saw it, around what they heard in that regard. There is no question that the public debate and the policy investigation into questions around how we govern data is going to be one of our issues we see looking ahead into the fall.
Presumably another government, whoever happens to form that government, will understand that this is one of the important issues they will need to address. Not only in terms of our recognition that this has significant economic import, but also from a consumer perspective and also with the pressure we face, say from an adequacy finding perspective with the GDPR in Europe and the like.
There are a lot of things coalescing around this issue.
For the moment, hearkening back to the discussion we just had, given the experience with how long it has taken to find ways to come up with even basic updates to PIPEDA, I am somewhat less optimistic about the notion that we will get to this quickly.
I’m more comfortable saying let’s fix PIPEDA first just because it strikes me as an easier thing to do than develop a full, national data strategy that includes a brand new approach to how we govern data.
That said, the notion that we ought to be thinking about these kinds of issues not solely through the prism of banking information, which I think was an important part of what you just raised, is a really important observation and one that we ought to recognize as the right way to go.
PIPEDA was adopted with a view that you needed a broad-based privacy law that would be equally applicable across all the economic sectors. When we start thinking about data, I think it would be a mistake to adopt an approach that is specific solely to the financial industry.
Senator C. Deacon: Just to summarize, if we were to be putting forward short- and long-term recommendations, your short-term recommendation is to move swiftly to bring some updates to PIPEDA, but to consider a longer-term strategy around consumer data rights?
Mr. Geist: Absolutely. A national data strategy that does not include the consumer side of the equation is, from my perspective, faulty to begin with. I’m not saying that’s what I think the government is trying to do with respect to its current national data strategy.
The issues that arise in this context have significant implications from an economic and business perspective. It has sovereignty-related perspectives in terms of where that data goes and it has consumer rights-related perspectives, and we need a robust strategy, potentially including new legislation, that addresses all of those issues.
Senator C. Deacon: Focusing back on what Senator Klyne was just questioning you about. The opportunities to find a line around anonymized data once there is personal data shared with an organization and then their use of those data in an anonymized form — is there an opportunity to find a line there somewhere? The waters get murky, I know. One of the companies I’ve helped to build has had to deal with this issue with its customers.
Mr. Geist: Yes, I think it gets blurry over time. It partly involves considering where the collection takes place and under what circumstances. Again, because I’ve been living this Toronto waterfront stuff for so long now, to contrast the distinction between data that is not personally identifiable, yet involves, for lack of a better word, some type of a creep factor.
Senator C. Deacon: A signature is that it can be found.
Mr. Geist: It’s not just a signature. I’m thinking of data that involves monitoring how many people are crossing a street and other sorts of data that may not be personally identifiable. We’re in a new Senate building and people who park at the Rideau Centre have to go through that underpass, so trying to track how many people are using that as the mechanism to come through here is something someone might want to do as part of a city planning exercise. It may not be personally identifiable, but sticking up cameras and engaging in that kind of surveillance raises questions for a lot of people.
That is somewhat different, in my view, from someone who decides they want this service that holds the promise of using their data to provide very specific kinds of recommendations, and recognizing that data may then be used in some other ways, and they’re comfortable with the trade-off. I think it’s fair to say that, very often, our experience over the last number of years is that people aren’t always fully aware of the kinds of trade-offs that get made and we don’t have the sorts of protections in place to make sure they have enforceable remedies where those are abused or misused. That’s, to me, is kind of where some of those dividing line issues fall.
Senator Wetston: Welcome, once again.
I’d like to ask you some questions about sidewalks, since I live in Toronto, but I’m not going to do that. I don’t think the chair would permit me to do that.
I must say that I think your call to action is purposeful and important. I will give you some examples of calls to action that took quite a bit of time. The financial crisis was one. We were well aware, prior to the financial crisis, that the interconnection of over-the-counter derivatives was going to create a huge crisis globally. It took us a long time to act on it.
We were well aware that digital currency was going to create problems and needed to be regulated. We still haven’t done anything, though there is some activity.
The only reason I’m mentioning your call to action here is we had better get on with it and do something here because we’re going to face another challenge somewhere. Where might that be? This committee has heard a lot about privacy and data and the importance of it, and we’ve heard before requests for updating PIPEDA and giving the Privacy Commissioner more authority.
I think where I’m going with this is you have been involved in this area of privacy and PIPEDA for a number of years and I’m familiar with your work. Do you have any views on why it is we’ve not been able to amend PIPEDA or the privacy laws in the way that you suggest? We’ve heard witnesses this year from ISED and others. Do you have thoughts about that?
Mr. Geist: Sure, I have several. Up until the last, let’s say, 12 to 18 months, post-Cambridge Analytica-Facebook, it has been difficult to get the public’s attention in a really significant way. There are a lot of people who are worried about their privacy, but having it rise to the level of what is seen as a true policy priority, it’s tended to come further down the list for successive governments. I don’t think it is a partisan issue in any real way. We’ve seen this both under Conservative governments and Liberal governments. It’s something that people talk about, but it doesn’t rise to the level of a top priority.
I was talking to one government official recently who was lamenting that, having been new to government several years ago, they didn’t quite appreciate that the dye is essentially cast from a legislative perspective in the first 12 to 18 months, and it becomes increasingly difficult to get stuff done brand new if they’re going to be consulting much after that.
Part of it has to be with our legislative calendar and the challenge with getting legislation through. Part of it is the issues associated with recognizing it as an issue the public deeply cares about, and part of it, frankly, if we take a look at even some of the initiatives, is that this becomes a very heavily lobbied area where, on the one hand, it’s comfortable to sit and talk about needing stronger privacy protections, and everyone will say that.
Then you get into the details — and, with all respect to the Canadian Bankers Association, who have now decided they are okay with opening banking, even though about 18 months ago they thought the sky was falling — and there is no doubt that whatever comes through, they, and similar kinds of groups, will slow walk whatever proposed changes come forward and then try to slow walk or delay the regulatory side of the process or seek exemptions.
If you look at some of the specific privacy laws that we have around do-not-call legislation and anti-spam legislation, we have exceptions for newspapers because they try to make the case that freedom of speech and the freedom of the press was at stake if the Ottawa Sun couldn’t call you at seven o’clock at night.
We make exceptions for all of the political parties, even though it’s widely recognized that there are real issues with respect to how that information gets used. We have an exception for businesses that have had any business contact with a customer for a period of time. Those get heavily lobbied and we still get further delays. Even when we get things enacted, such as in the anti-spam legislation with the private right of action, we have now effectively seen that delayed permanently.
So if there is frustration with our inability to move forward on this, it is that once it gets into the sausage-making part of making the legislation, the number of public and consumer voices sometimes get drowned out by some of the large lobby groups who insist they need an exception or further review or further delay.
Senator Wetston: I think Senator Deacon was heading in this direction. We do have to prepare a report. I think having these meetings is very helpful in trying to understand these issues. When we get to the report stage, obviously privacy is a very important part that this committee has been talking about. Maybe this is just a question of my observation, but Canada really likes to be second. We really enjoy watching somebody else do it and then observing it and saying we are going to adopt our policy framework, we have observed what’s been done and we have learned the mistakes. Now we can put ours in place. Maybe that’s my experience in the securities industry, madam chair, because that’s certainly the case in Canada in that area.
If that’s the culture of the way in which we are going to proceed — because you reference the protocols and standards need to be developed — do you seriously think, given your experience that our governments would consider doing something on screen scraping and privacy without having a good sense of what the framework would look like with respect to the standards and protocols that need to be put in place to ensure not just interoperability, but to ensure privacy protections are in place? Just asking for your opinion.
Mr. Geist: I think it’s often the case. You are right that we have a tendency to look elsewhere first for proof of concept or for some assurance that we are not making a mistake with the approach we take. I don’t think we are unusual in that regard. I think that’s true for a lot of middle power countries that sometimes struggle to become the global standard on issues. You become a bit of a regulation taker as opposed to a regulation maker.
It isn’t always the case though. Copyright would be a good example. Senator !Verner was actively involved in the copyright file a number of years ago. If we take a look at some of the reforms we enacted in 2012, they were the first of their kind on some of those issues. I don’t think we are wholly unable to take the lead here, but I think you are right that we instinctively move more cautiously. I think that is likely to be the case in a banking sector where the view is that the stability of the system is the best feature we have. That we didn’t have the meltdown that we saw in other countries is somehow seen as preferable to an innovative sector with more choice. If that is the view we take, then you are quite right, it’s unlikely we are going to move rapidly here because ensuring stability ends up being the policy priority ahead of the consumer and innovative benefits that might come from a bit of disruption.
Senator Wetston: Thank you.
Senator Marshall: Thank you for being here this morning. I thought that the most interesting part of your opening remarks focused on the CBC report yesterday and the changes that were made to the draft report. We have been focusing a lot on privacy and security. Some people have a lot of confidence that the government is going to look after our security and privacy and I’m sure some people probably think that the banks will do the same. How confident are you? The Department of Finance is now embarking on this open banking review consultation. How confident are you that we can rely on the government and the big banks to look after us when you look at how they are making changes to the report and it seems like they are not that interested in consumer protection. Could you address that?
Mr. Geist: That CBC was a deeply troubling report. That’s why I raised it in my opening remarks. I think there is cause for concern that the consumer perspective on these issues gets lost, not just in the example that comes out of the CBC report.
If we take a look at the committee, the Department of Finance established for open banking — and by the look of it, there are some exceptional people there — for me, it is stunning that we talk about a consumer-centric approach on these issues and there is not a single consumer advocate on that committee. I struggle to understand how the government can maintain or the department can suggest that the concern of putting the consumer first or at the centre of their data and banking services, and then establish a committee in which there are no consumer representatives. That suggests to me that I’m not wholly confident we can rely exclusively on the large banks and governments to ensure those consumer interests are represented.
In this country we have some really good consumer groups, including the Public Interest Advocacy Centre, who you are going to hear from in the next panel. They are woefully underfunded. We don’t have the structure that ensures the groups that would address these issues have the resources to go up against the major banks in this country. It’s not even close.
Senator Marshall: Our previous witnesses I have always been unconvinced that the government and the banks are going to look after us. When you see a report like the one on CBC, it is sort of shaky at the beginning, but now that makes it even worse. We are going to proceed to open banking. We are going down that road. There is going to be legislation, rules and policies, and it’s going to require certain things. Who is going to police it? You put in these rules on destruction of data, for example. You say you can only use the data for certain purposes. How do we know that organization is going to destroy that data? Who is going to police it? Who is going to monitor it?
Mr. Geist: PIPEDA establishes a framework for enforcement, but as I mentioned, it’s pretty weak. We have, in theory, a Privacy Commissioner who has audit powers, who has the ability to go into organizations and ensure they are compliant with the law, and the ability to respond to complaints. That said, complaints are dependent on consumers knowing that there has been wrongdoing, and often they are sheltered from that and unaware of what is actually taking place.
Further, the commissioner does not have order-making power, so the ability to actually enforce this is dependent not on a commissioner’s order, but rather on the commissioner issuing a finding and then later, if there is non-compliance going to a federal court, seeking a court order to ensure it gets enforced. That is not a very strong system. Even the provinces have order-making power. If you look at other jurisdictions there is clear order-making power there.
This doesn’t take into account this next issue, where many of the providers in this space will not be Canadian. If we say we are only comfortable with Canadian-based innovation for open banking, it’s not going to be all that open. We are just erecting another wall around the sector. Assuming that some of the players will be foreign players, that raises questions around the ability of Canadian authorities to enforce as against those players. The approach has long been that if you collect that data, you are accountable for it no matter where it goes. Now we seem to have the Privacy Commissioner hinting that perhaps it isn’t all it’s cracked up to be.
Senator Marshall: I know open banking is coming, but I do think consumers are vulnerable. Nobody has yet provided any assurance that all of these safeguards are going to be in place.
Mr. Geist: That’s true. Let me reiterate the core point I wanted to make earlier: Open banking isn’t coming, it’s here. Consumers are vulnerable because many of them are already using these services and are using a riskier system to be able to participate in those services, because banks have been creating friction in terms of the ability to try to take that data and ensure it gets used in a more secure manner.
Senator Marshall: And the consumer is looking for the services and they are vulnerable.
Senator Moncion: My question is about enabling or looking at bank mergers. Because it’s always been that it was attempted at some point and then it was blocked by the government.
How would bank mergers help the process of creating open banking or enable bringing open banking to the country?
Mr. Geist: We are heading more and more into an area that I wouldn’t feel expert in. The competitiveness of the banking sector, mergers and acquisitions is not an area I focus on. However, we should recognize that at the heart of open banking — and the reason, in 2017, that the Canadian Bankers Association was seeking to sow some amount of fear about the process — is that it is inherently disruptive. I think this came up a bit in our discussion a few moments ago. Ultimately, there is a policy choice, between do we prioritize stability in the banking sector, which means we are reliant on these handful or slightly more than a handful of large banks for the majority of Canadians’ banking activities — although there are some other players in the marketplace. Or have we reached the point where we favour more disruption, recognizing that if we can find ways to create some appropriate safeguards the benefits that come from that disruptive environment may mean more consumer choice, more competition and a better experience for all, including small business.
We have experienced that same debate in other sectors. I’m more familiar with the telecommunications sector where, if we were to go back a number of decades, the telecom sector would have told you that you don’t want to make these changes in terms of who controls the long distance charges, or later, the ability of new providers to come into the space. We are reliant on a nice, stable reliable service. Canadians want to ensure that when they pick up the phone, they are able to reach out and call someone. Yes, there is a price to be paid, but that’s a price worth paying. In fact, we still hear those same arguments right now when we hear large telecom provider’s warning against the entry of new foreign competition, or efforts to allow software-based or third-party independent providers to come into the marketplace. They say you really need facilities-based competition. In other words, you need us as the basis for your competition.
I think the consumer experience to date in the telecom sector is instructive for what it means when you bring in new disruption. It means far more choice, far more consumer benefits and better consumer welfare. We need to have the courage of our convictions to say that we can have a banking sector that we can rely upon. Many Canadians will continue to look to their major banks as both their primary and their exclusive bank. It should be clear that nobody should be forced to use open banking solutions. This is all about consumer choice. Once we open the door to that kind of choice, disruption, by its very nature, is somewhat messy. In many respects, I think that’s a feature, not a bug.
Senator Moncion: There is always the question of the protection of the data by the financial institution not wanting to provide it to others because of the risk of losing major depositors. I think open banking is more directed at high earners and people who understand the financial system. I think we are talking about maybe 10 per cent of the population who would be using open banking as opposed to maybe 90 per cent who won’t even go there because of lack of knowledge — that is, not having the information, not knowing how it works and not having enough money to even go into open banking.
Mr. Geist: The banks will say they’re concerned about their customers’ data and the security associated with it. At the end of the day, it is the customers’ data. That’s where much of this debate lies. If you take a look at the early PIPEDA complaints and findings, from 2001 to 2004 only applied to federally regulated entities and it was primarily telecommunications companies and banks that were the target of those complaints. Notwithstanding their professed concern for privacy, they were often the target of various complaints associated with misuse.
I must admit I’m not convinced that when we talk about open banking we’re talking about the wealthy or the top 10 per cent. I actually think that in many respects, solutions may provide better benefits for low-income Canadians and others.
Senator Moncion: But they have to understand how it works.
Mr. Geist: Of course they have to understand how it works. I think that we will find a younger generation who have grown accustomed to software-based, cloud-type solutions for any number of activities in their lives, including payment transactions. I always look to my kids for examples: two in university, one in high school. They have barely ever been in a bank branch. Quite frankly, their only interaction is for e-Interac payments or to take a picture of a cheque they may have received in order to upload it. They are often more comfortable with Venmo, or with PayPal, or with a range of other payment providers that have nothing to do with those banks. That generation, which I don’t think will start off in the top 10 per cent of earners — although I would be happy if my kids did well — will gravitate quickly because they will be much more comfortable with those kinds of services and don’t necessarily have the positive association that some Canadians might with the stability issue of the banks. They just won’t see that as a compelling enough reason to stay with the banks.
I actually think that we are trying to create competition here that will benefit a far broader range of society than just the upper echelon who may find better ways to generate higher returns off their investments.
The Deputy Chair: We’ll go to second round now.
Senator C. Deacon: This has been fascinating and very helpful for us right now. I want to keep building off of Senator Moncion’s point because I think there is an opportunity for Canadians who are not currently served through traditional services to get tailor-made products that could really help them a lot in their lives. That changes how we look at this and the types of protections that need to be in place because in many cases they could be vulnerable Canadians, or in rural and remote communities where they currently don’t have access to traditional services.
Is there any specific guidance in that regard? Again, we are trying to find those recommendations that we can make in the short term and the longer term because, as you have very well said, this is already happening. Canadians are unprotected. So we need something that we consider. Something needs to be done now, immediately and over the longer term, to make sure we are clearly protecting those Canadians who may not be as sophisticated in terms of their financial literacy and privacy awareness. I think that privacy awareness could preclude a whole generation.
Do you have any advice specifically around that? That’s the tremendous opportunity of open banking or consumer-directed banking, but there are also consumer risks there.
Mr. Geist: First, I believe the committee recognizes this, but I think it’s important to recognize that open banking is a consumer choice, not a requirement.
Senator C. Deacon: Exactly.
Mr. Geist: If there is a caution, it’s that as we move more and more towards these kinds of solutions, there is a concern that you may find that using some of these kinds of services, even the ones offered by the large banks, becomes a mandated process. Think of e-billing as a good example of that. Prior to that legislation, we’ve seen some businesses effectively require e-billing. Whether or not that’s fair in an environment where we still don’t have universal access; or where some people feel more at ease dealing with paper-based bills, strikes me as a cautionary tale for what starts out as an option can ultimately become a requirement.
I was at first surprised to see the CRTC appear before this committee but the issue around universal access is an important one, especially when it comes to rural Canadians and their use of these services. I think that was an important piece to build into this and highlights again why our failure to ensure universal affordable access to communications services is a monumental one that we are paying the price for now and will continue to pay until we get this solved, which now we are told will be 2030, but it has taken way too long.
Basically it starts with access and no firm requirement to use any of these things. In terms of further recommendations, it was Wealthsimple that talked about some of their services. One of the providers talked about the small rounding up as a mechanism to bring people in, which is a really nice example of how we are not talking about the rich. We are talking about people who may be introduced to these services. That requires education, plain language disclosures and a positive opt in to these systems. It’s not one based on we are going to presume that based on the fact you did this or that that you are comfortable with these different uses of your information. We need to be much more upfront about these things and to ensure people are clear about it.
Education programs either coming directly from the regulator or government is part of this, but also from the sector itself. One of the values of these providers — this is the glass-half-full view — is that for many people you have to convince them to take a pretty big leap. There are millions of Canadians who have decided they are willing to give their login information to their bank. I’m personally surprised people are willing to do that.
Clearly people are desperate for some of these services. That speaks, at least in part, to services that have had to explain the value proposition they bring to the table. No one is just saying, “Sure, I’ll give my login information to my bank.”
Companies have taken the time to say here are the things we are able to provide to you that you are not getting right now. In fact, it’s so worthwhile we even think you ought to provide us with your personal banking information, but here is what we are going to do to safeguard it. I would feel better if we had clear safeguards around that and laws that would enforce against misuse of that.
The innovation and new competition that comes into the marketplace also bring new levels of education and benefits associated with financial literacy. Because those businesses don’t come with a baked-in century or more of name, existing on just about every street corner in the country, at least in urban areas. New entrants have to introduce themselves to the marketplace, demonstrate their value proposition, and educate a whole populace about why someone should entrust them and the benefits they provide.
Opening the door to this innovation holds the promise of better financial literacy and awareness in the marketplace, in part because the market requires it in order for any level of success for these services.
Senator Duncan: Thank you very much for your presentation this morning. My question follows up on Senator Deacon, and I thank my colleagues at the table for their assistance. You have talked about competition, and other services being offered. You have talked about the need for change with the privacy legislation. What about the regulatory framework for the financial institutions? Is that something we could also approach? What would it look like? I’m thinking of two things — the requirement to provide services and, as you framed it, education and services itself. Also, as per the U.K. example, where the funding for these developments is provided by the financial institutions as opposed to the taxpayer.
Mr. Geist: The issue of funding for potentially new enforcement or education programs, some kind of a user-pay system in terms of — not user as a consumer, but user in terms of the institutions makes sense. We see that in other spaces as well. Telecommunications is a good example where at times we see telecommunication contributions or participation of civil society groups in hearings to ensure those perspectives are brought to bear. They are ultimately the beneficiaries of a well-run system and so are asked to pay. The argument goes that consumers ultimately pay, whether through taxes or seemingly ever-increasing banking fees, sooner or later we are all going to pay for these services.
One of the advantages of a more competitive environment is it holds the promise of saying that it’s not so easy for you to keep ratcheting up the costs because at some point in time, although it’s hard for consumers to leave banks — it’s a very sticky relationship that consumers have, of course — but there may be a breaking point in many instances where you feel you are paying the bank a whole lot for not very much. When there is more choice, consumers may well be more willing to go elsewhere. That speaks to some of the user-pay side.
In terms of the regulatory environment I mentioned off the top. This speaks to a regulatory mechanism that mandates an open data approach without the friction we see now that presumably comes through the regulation we see at the moment. Coming back to the earlier discussion around the CBC report, and my comments off the top, when we think about consumer-related protections and the safeguards we need in this space it is a mistake to look at this in a siloed way; saying this is what we need to do for these third-party open-banking providers and this is what we need to do for the financial institutions. The right approach is to look at data from a broader perspective than just financial institutions.
Assuming this continues to happen, and given the numbers that exist without a framework, there is every reason to think we will continue to see growth in this space as AI and other technologies and new providers come in and offer better value propositions that they feel Canadians are not being well serviced with.
The distinction between these different players will be increasingly blurry. The consumer protections we need involve banking and financial services, not open banking.
Senator Wetston: I’m a consumer. I’m not dealing with a consent issue; I agree to allow someone to use my data. That data, as we know, is sold because there is a lot of commercial viability in using my data or your data. What benefit should I get as a result of Google or another company using my data and selling that data for commercial value?
Mr. Geist: The starting point response has been that you get free use of services that you value. We can debate whether or not that’s a good trade-off or not. I use Google maps every day, I use Gmail pretty much every minute, and I run searches using Google multiple times over the course of a day. There is some amount of value there. Although, yes, in a sense, a transaction taking place even if it isn’t well recognized.
There are instances where we would benefit from a more explicit transactional approach. For example, Bell has a relevant advertising program where they will track your various usages for many of their different services and in return give you more relevant ads. That doesn’t strike me as a great trade-off in terms of my personal information. In fact, their starting point a number of years ago was they were going to do this without your explicit permission but you could opt out if you didn’t want it. That led to complaints. The Privacy Commissioner ruled that was a violation of the law. They now have an opt-in approach. If I contrast with some providers in the United States who have actually put a dollar value on that willingness to have myself surveilled by my telecom. Companies have said that they will give you $5 off if you agree to this. Some might say, “Is my privacy really worth five bucks?”
Senator Wetston: That sounds like a benefit.
Mr. Geist: But some might say, “Hey, you are recognizing that I am giving you something of value and, in fairness, I ought to get something back.” At the moment, we get it in services from many of these companies, and it’s open debate as to whether or not at this stage it’s a fair exchange.
The Deputy Chair: Mr. Geist, thank you so much for appearing here. You have made a lot of things very clear.
This committee is focused on the protection of consumers. I thank you for raising the troubling issue of the CBC article on the altering of a report. It’s helpful when our witnesses do that for us. Thank you again.
Welcome back, senators and guests, to the meeting of the Standing Senate Committee on Banking, Trade and Commerce. We are continuing the study of the potential benefits and challenges of open banking for Canadian financial service consumers, with specific focus on the federal government’s regulatory role.
I am pleased to welcome in this second segment of our meeting John Lawford, Executive Director and General Counsel of the Public Interest Advocacy Centre.
Mr. Lawford, welcome, and thank you for being with us today. Please proceed with your opening remarks and then we will go to questions and answers.
John Lawford, Executive Director and General Counsel, Public Interest Advocacy Centre: Thank you, Madam Chair and honourable senators. My name is John Lawford. I am the Executive Director and General Counsel for the Public Interest Advocacy Centre here in Ottawa, or PIAC. PIAC has been active in consumer protection and retail banking for some years now, but open banking is a difficult subject for consumer advocates.
Open banking, on the one hand, promises new freedom for consumers to possibly switch from financial institution to financial institution more easily, or at least use their own personal financial information, at present largely locked in propriety bank records, for new innovative financial services. On the other hand, open banking risks privacy invasions, fraud and financial loss, and loss of control of Canadians’ financial information.
The Minister of Finance’s consultation paper on open banking has been released and largely says the same thing, that there are good and bad sides. It appears to suggest, however, that moving forward, open banking is inevitable, as was said in the previous panel, and on balance is a good thing to do both for consumers and, ultimately, for banks. For several reasons, however, we’re not quite so optimistic, nor is this vision necessarily inevitable in that form.
First, the underlying foundation of consumer protection in banking in Canada is still very underdeveloped, and we believe it’s not adequate to provide baseline rights for retail bank customers. Although Bill C-86 moves us closer to a consumer protective state, there is still considerable work to do that should be done to support innovations such as open banking.
Let me give you some specifics. There is no legislated liability protection for consumers in payment systems or in general banking in Canada. By contrast, the European Union’s Payment Service Directive 2, which was put in place prior to open banking being opened in the U.K., limits liabilities of consumers, except in cases of their gross negligence, to €50. Canadians must be protected from liability at approximately this level with open banking participants if they are to embrace the technology.
Canadians also have no right to banking services. There is no obligation to serve them, so customers can be “fired” by their bank at any time. Any open banking initiative should protect consumers who are availing themselves of the new non-bank applications from retaliation by their bank, from tied selling by their bank or others, and other coercive measures.
Second, more important perhaps in the long term, there are significant and far-reaching security and privacy implications of embracing open banking. It is PIAC’s view that much of the value of open banking from app providers is derived by engaging in behavioural tracking, targeted advertising and, eventually perhaps, behavioural manipulation of consumers.
Financial services are one of the most important areas that have not yet been fully integrated into online platforms and big data operations of companies such as Google, Microsoft, Amazon and Facebook. Using open banking apps will most likely expose Canadian consumers to terms of services that assume their use of the app is consent to track their financial activities: when, where and how Canadians access their money, which data companies will eventually use to try to influence their spending and other behaviours.
Such a surveillance capitalism, to use the words of Shoshana Zuboff, who is an American academic, has “. . . economic imperatives that will produce the relentless drive to extract and retain information.”
This economic imperative means Canadians’ privacy and autonomy should be safeguarded in the domain of very sensitive financial information by special privacy rules beyond what the Office of the Privacy Commissioner has already said is required by law.
Yes, open banking will require explicit consent. However, it should also require algorithmic transparency so that Canadians can see how their finances are being judged.
Second, data tracking so Canadians can see where their financial data is being sent, ideally in near real time.
Lastly, deletion rights for financial data once consent to use it is withdrawn or when the data are old or misleading.
I would add that these should be bank-specific rules or financial sector-specific rules, not necessarily in PIPEDA.
Other countries like the U.K. have promised registers of authorized applications to address security concerns. Given the value of financial data, we doubt this will be foolproof without more study and assurances.
One final matter: The issue of consumer redress in open banking. Who will do it: The FCAC? Payments Canada? The OBSI/ADRBO ombudsman? Will it depend on what my open banking provider is “really” selling me whether that’s robo-investing, pure banking products or payment products?
These are very early days for open banking, but we need not slide inevitably into new problems.
I thank you for the opportunity to present today and I am pleased to answer any questions you might have.
The Deputy Chair: Thank you, Mr. Lawford.
Senator C. Deacon: Thank you, Mr. Lawford. A really important conversation and I’m glad about the specificity you’ve brought to the points you’re making.
Where my head is focused is on steps that reasonably can be taken in Canada to address the fact that the horse has already bolted, that we’ve got global competition coming into Canada at an increasing rate as well as Canadian companies in this space, and it does represent a risk that needs to be managed today.
What I was hearing when you were speaking is sort of immediate, medium, longer term sequencing of recommendations. I’d like you to be as specific as you could be in terms of what you would like to see us be considering in the sequencing of recommendations.
Mr. Lawford: I take Professor Geist’s point in the early part of his submission that many Canadians are already using something that looks like open banking.
Senator C. Deacon: I think we have been told somewhere around 3.5 million Canadians currently today.
Mr. Lawford: What’s going on now is utter madness, that you have to give your password for your banking. It’s a huge security risk, and that should be replaced by what I think the Finance Department is trying to do here, which is requiring the banks to have an open application stack that other providers can access with appropriate consent so that they don’t have to give their banking credentials to third parties.
Senator C. Deacon: Is that an API agreement?
Mr. Lawford: That is an API agreement. That’s something I would think Finance would have to negotiate with the banks and get the technical work done pretty quickly. That should provide a structure where you don’t have to give your banking credentials. Now we’re doing it. Now we’re doing open banking if we make that first step. I think you’re right; we have to because it’s happening anyway, and it’s very insecure at the moment.
Banks don’t like open banking. I think it’s a little unfair what Professor Geist said because the banks don’t like open banking because the companies that are asking for your financial information, although they’re asking the consumer, the banks have a duty of confidentiality, and their agreements say don’t give it out, because they have that duty.
It’s an awkward situation right now where the consumer is saying, “Yes, I want to use it for another purpose,” but the banks say, “Our role in your financial life is to protect the confidentiality of your financial information.” There is a disconnect there so we have to fix that up.
It would require pretty quick rules and a system to, if you will, bring those 4 million people under a new system. But now once we’ve done that, we’re into the problems I’ve mentioned, which are what will be the level of privacy accorded to the information? What will you have to consent to? How much will you have to know about the secondary uses of your information before you can agree?
Senator C. Deacon: How do you get actual informed consent?
Mr. Lawford: How do you get informed consent? You see the Privacy Commissioner struggling with that. They tried to add a new section in PIPEDA a few years ago, 6.1, that is really a description of what informed consent is to try to hammer home that you have to explain all the consequences to customers of what will happen.
The trouble with all of the app-based programs that I have seen in other sectors is the value is not so much even in what the app is providing to you. The value to the app provider is in then getting behavioural tendencies out of the data and secondary analysis that I think Professor Scassa talked about, and then selling that off to Google or other environments where they can make behavioural predictions.
That’s kind of a bigger question, maybe a little beyond where we need to go with this, but that’s what the next question is out of this. So I’m rambling a bit but I wanted to answer your question fully.
So the mid and longer term is the consumer data rights and control systems we need to have in place. The medium part is if you are going to roll out open banking to consumers in the very short term, you have some banking-specific sector rules for privacy because the Privacy Commissioner stuff won’t get done fast enough. Michael is right. It will take forever.
Put some controls within the Bank Act or that structure. So I would disagree with them and say it has to be within that structure of the medium term, and then longer term we have to solve it for the rest of the economy.
Senator C. Deacon: Specifically the notion of consumer data rights is definitely something that has to wait a little longer.
Mr. Lawford: Yes, because it’s so complicated to line up things like all the other general data protection regulations from Europe with our law, with coming up with principles that are applicable across lots of sectors, not just banking. Yes, that is a harder job, and we need to put a little more work on that than we have been. But I think short-term there is nothing wrong with having rules specific to the banking industry that say here is what personal information rules are for financial information, because we need to do open banking right now.
Senator C. Deacon: Thank you, Mr. Lawford.
Senator Klyne: Thank you, Mr. Lawford. This is good information and somewhat — I wouldn’t call it academic but very fundamental to the point of, yes. In terms of your advocacy role, is this message getting to government and other people that should be interested in the consumers’ rights, and are they considering some of these things, some of the observations you’ve made should require these things? I ticked off the last three because I think you’re absolutely right.
Apart from talking to us, who else have you been talking to, and are they listening, and are you knitting your way into these things?
Mr. Lawford: It’s great to be here, so thank you for being able to say it out loud here. I haven’t had that much opportunity with other policy-makers. As Professor Geist pointed out, there was no consumer person on the advisory committee for Finance.
We were asked to come and give our views on the paper by the department, which I did approximately a month ago. He’s also quite right that resource constraints means groups like ours and like CCC in Toronto and the Union des consommateurs in Quebec are very stretched. It’s hard to find time for this, which is unfunded work.
To be quite honest, we had to take our general understanding of consumer issues in electronic commerce and our general understanding of banking and roll them together in a hurry to be able to come up with ideas about this.
There’s also not good consumer research on this. I saw an Accenture poll and there are a lot of consumer concerns with the downside of open banking, I believe. I don’t know if it’s been released but I certainly saw a reference to it on an Accenture blog. I have seen polls from the U.K. where prior to open banking being launched there was a lot of consumer concern about privacy and security.
I still think that’s the same. To be honest, for the majority of banking customers I don’t think they’re breaking down the door wanting this. There may be value that is hidden that would really help them but it’s how it’s rolled out and whether it will be helpful to them. But they’re not clamouring for it and therefore there is not much research from the consumer side, and there is no money to help us just generate that. So it’s a bit of a chicken and egg for us.
I’m doing my best with what we have. I don’t think there are a lot of groups engaged on this issue, either. I think a little more push is needed to be. So, if the government has any ability to fund research in this area or there is a way to organize consumer thoughts, that would be useful. I think we need to go back to consumers a bit more on this.
Senator Klyne: I wouldn’t be presumptive, but I’m going to be, that I’m sure some of this will find its way into some of our report.
The banks spend a lot of money to get a customer, and they know that once you have a customer, you probably should do everything you can to keep them. So they must be quite torn on this whole process of giving up data. They may hide behind the idea of, “No, we’re supposed to protect this data.”
Mr. Lawford: Absolutely.
Senator Klyne: I think consumers will benefit one way or the other, because banks will do whatever they can to hang on to existing customers, and that probably will include being very competitive. At the same time, if they do have to give it up, you can bet there will be a “save call centre,” and they will do whatever they can to save that customer for later.
That was a segue to my thought and question here. I’m thinking back to the old banking days and lost it. I’m going to have to come back to that. Sorry.
Mr. Lawford: Are you wondering how the banks are going to deal with this from an economic point of view, how they’re going to get into the game, and what effect that will have on consumers?
Senator Klyne: I was going to this whole idea of information they’re getting, which you referenced as behavioural tracking and target advertising and eventually behavioural manipulation, which I see as psycho-demographics, and they will understand a person’s likes, dislikes and behaviours.
Mr. Lawford: Sure.
Senator Klyne: If people think about that in the midterm of what they are building up for someone, they will know the personality of someone in terms of their likes, dislikes and behaviours, and they will be able to spin that off and monetize that to other non-banking opportunities.
Mr. Lawford: Absolutely.
Senator Klyne: So if you like Chivas and you drive a BMW, you know where those messages will go.
Mr. Lawford: Absolutely. Then you will get Chivas and BMW driver-specific ads and that lifestyle or tendency. That’s the long-term problem.
The long-term problem is everyone coming in saying, “I have a great app. It will simplify your life. It will do this one function.” And you think, “I don’t see the value proposition in this, but sure, I will give my information.” Once you’ve given consent, and it can be very specific, and you can say, “I’ll explicitly agree to everything in your privacy policy.” Then that allows them to get into the Google or Microsoft or Facebook systems where, let’s face it, there is a lot of that work being done to bring specific marketing to people.
Will consumers really understand that’s what they’re doing when they just want to get — I don’t know to pick on any particular robot - a robo-adviser, for example?
Senator Klyne: Some people might say that’s here already, but this is going to put this on steroids.
Senator Marshall: Thank you very much and thank you for your presentation. I found your presentation a bit different from the other presentations we’ve had. I personally have some hesitancy with it, but most of the witnesses seem to be saying, “It’s either here or it’s coming,” one or the other, but I get the feeling you’re saying, “Don’t do it.” Am I misinterpreting your presentation? You’re saying, “Don’t do it, but if you are going to go ahead, here is what you need.”
Mr. Lawford: I guess I’m not under any illusion that it won’t get done, and it’s not necessarily a bad thing. It depends on the kind of world we want at the other end.
I don’t want legislators to give up on the prospect of putting some sensible rules in place just because somebody says it’s inevitable and it’s coming, and you’ve got to hurry because we’re in a hurry here. All I see is a bunch of consultancies trying to make a quick buck here, and a bunch of new app providers are going to funnel data out to third-party processors as the ultimate goal.
Yes, I think there is a prospect for helping consumers get out of their bank because, as you pointed out, we don’t churn much between providers, but I don’t see much talk in open banking about me switching from the Bank of Nova Scotia to CIBC quickly and easily. I see a lot of talk about glomming on 10 new services to my CIBC that I’ll never switch from. So I thought that was the first thing open banking would be about, but when I started looking into it, it’s more about entrusting my banking with a bunch of extra services.
Is that to consumers’ benefit? Yes, for some of them, but the main issue, the competition amongst banks, it doesn’t seem to be the focus of what we’re talking about.
Senator Marshall: The train is coming. I don’t know what the train looks like or what’s on board, but there is something coming.
This is a question I asked the previous witness. How confident are you? You’re talking about the rules, and you made reference to destruction of data when it’s no longer required or useful. How confident are you that the rules are going to be in place? Witnesses are saying this is coming, but I’m not getting a whole lot of confidence that the rules are going to be in place or, if the rules are in place, that they’re going to be strong enough to do what they should be doing.
Mr. Lawford: Right. I think we need to concentrate on the essential rules to ward off the worst harm and do that first. I think you have to start sector-specific. I think it’s perfectly reasonable for the Banking Committee to say they know there is a privacy law, but this technology raises issues in the banking sector which are specific, and we need to act in a quick manner. We can do it more quickly in this sector. The challenges are more about banking than they are about privacy at the end of the day.
Senator Marshall: So who is looking after the consumer?
Mr. Lawford: The Department of Finance, presumably, but in consultation with us. There is not much of that going on.
Senator Marshall: The previous witness mentioned the article on CBC last night, and it ran several times this morning, about the report that had been changed. It seemed like the banks and the Department of Finance were behind the changes. What they didn’t like, apparently, is they weren’t really looking after the consumer. So you’re left, at the end of the day, with this big change is coming, and we can’t stop it. Consumers need to be protected, and the organizations that we think should be looking after the consumer seem to be letting us down. So there’s a big problem now, but it seems like there’s going to be a bigger problem down the road.
Mr. Lawford: Some of the agencies in the space could do a better job of going out to the public and seeing what they think. The FCAC’s role is to do financial literacy, but it could be a good agency to be polling Canadians and figuring out what their needs are. What do they need in open banking, and what could it help with?
There have been some references in the committee to whether open banking would help low-income consumers get more “banked” or have more services. That’s the kind of thing they should be asking about, because I don’t know how that would work. They might have more of a reach, budget and be able to do that, and be able to bring that back to Finance and say, “Listen, if we’re going to do open banking and we want to help disadvantaged Canadians, here is a couple of ways it would help.” Otherwise what we’re going to get for low-income banking customers is an app or two that’s semi-functional that gets some people into the banking system, but maybe we will get other apps that just try to mine their data and offer them payday loans.
Senator Wetston: I’m going to date myself. In 1982, I worked for the Consumer Association of Canada. You may know that, Mr. Lawford. It was a time of very active consumer activity, in which it was funded and supported, and an important part of dealing with issues of privatization, deregulation, new services in telecom, energy markets becoming competitive. It was a very interesting time, from my perspective.
The point I’m trying to make here — and I wonder whether we might consider this as we move forward — is we were a funded organization. We had a core funding of $1 million from the government to support our activity, which I thought allowed us to engage in a number of areas of important activity, but we also received money from the public, not corporations.
Senator Duncan was getting at this, more or less, in the sense of how aspects of the British system was being funded, perhaps focusing a little less on the consumer side but perhaps you were getting at this as well. What is your view about where we are at today when it comes to funding consumer activity in important areas like open banking? And I should say that I’m a great supporter of innovation, competitive services and the opportunity to grow and provide those services to the public, but an important voice may be missing.
How do we get that voice heard by governments and large organizations? Because open banking is not just about banking, and I feel we are falling into the trap of considering it just banking and it’s not just that. Do you have any thoughts on that?
Mr. Lawford: It’s desperate times for consumer groups. Our organization is on the edge of bankruptcy. A number of other groups have reduced staff. We are all sticking to activities that are the ones we can scrape a little money out of. There is no core funding, as you point out, and there hasn’t been since 1989 at the federal level. Some provinces have a little, notably Quebec.
For the most part, everyone works with the money is, which isn’t very obvious. There are some regulatory boards we can work in. But areas like financial services, privacy, competition law, all unfunded for consumer groups, which means that we dabble when we can. We do what we can. It’s not easy to be fair-minded because people will tempt you, as you say, for corporate donations or to take a position. And often the work that we do is not as in depth as we’d like. So it’s a pretty desperate situation at the moment.
It would be sensible to me to have some minimal government funding to bring competence level to this area, to focus consumer thoughts. Because just asking consumers to comment on a public consultation, it’s pretty diverse. You will get a few comments. Their comments need to be focused and argued, and that’s what we do. That’s missing in Canada and unfortunately, culturally, it’s not supported in other ways from foundations. It is totally appropriate for government to reconsider core funding for consumer groups and it would help us to help you because the industries have their consultants and there is no counterweight to them.
Senator Wetston: If I may pick up on Senator Marshall’s point, I think — without putting words in your mouth — you have an anxiety about how government will be able to protect consumers. Given what is occurring today and what you have indicated — and a lot of witnesses come here and expound on the value and merit of it. I’m not suggesting there may not be, and I think we need to support much of that. We cannot stop technology. We cannot stop advancement.
I could take this a step further, if that is what we are hearing and the consumer voice is just not heard and cannot be well represented because it’s underfunded — I don’t know if you heard Senator Duncan’s question or not about what’s occurring in the U.K. and how that is being developed with respect to the trustee for open banking. And we have heard from that gentleman here at the committee. Do you think there is a way in which this voice could be heard and funded so you could adequately represent the kinds of issues you are discussing here today? And it may not necessarily be the government that funds it, but it might be participants that fund the opportunity for the consumers’ voice in this very important area.
Mr. Lawford: Yes. There are a few models where on the redress side, the industry pays for the redress, like the OBSI and the telecom ombudsman. In terms of industry funding, in a sense for advocates who are going to argue against them, there is never much appetite. It would require at least government saying, “Let’s do this because we are only hearing one side of the story and you will put into the pot to do it,” rather than taxpayers.
Senator Wetston: But it is not just about being against them; it is about ensuring that we have a framework that recognizes all of the issues and they are well represented in the framework we adopt.
Mr. Lawford: I agree but I would say, senator, they will view it that way so that’s always the friction we find. But I agree with you; the more voices, the better. The one you are missing is often the consumer side.
Senator Duncan: Thank you very much for your presentation. I was heartened by your comment about banking services and the lack of an obligation to serve on the part of the banks. And following up on what Senator Deacon was getting, my concern is about the relationship between the consumer and the banks. Open banking is already here in that gold mine of data on my Visa statement, which CIBC has and tells every purchase made by our family, exactly how much we spend on what. So the bank, to me, is sitting on a gold mine of information. And there is no obligation in their ability to have that gold mine of information for them to provide services to rural Canada, for example.
We see in the telecoms where Canada is putting a great deal of money into ensuring that services in telecommunications are made available to rural Canada. We are wiring North of 60 so we can have Internet access. I don’t see as many dollars put in by the telecom industry.
My question was more focused on that general comment but would you see addressing this issue to serve through the regulatory framework and what would that look like for the new entrants into the financial services industry? What would be the interoperability of the regulatory framework?
Mr. Lawford: I think you could require those who are regulated under the Bank Act to have an obligation to serve. It has never been asked for and there is no reason why we couldn’t ask for it. There is a bank review every five years. It could be asked for as a quid pro quo to the information that they hold that is now more valuable. And that could be your justification for it, or just for having that special licences to be a bank. Because for the third party players, I don’t think we need to say there is an obligation for them to serve you.
My comment was two-sided. On the one hand, the bank might say you are using an open banking app and taking all that value away and we have a similar product where we partner with somebody and because you are using a competitor, we don’t want you as a client anymore. That could happen. Or on the other hand, you could be forced by the bank to take their own version as a tied selling kind of thing, this comes with your program. We don’t know how this is going to roll out. It all depends on whether the banks are going to get into the game, welcome this and partner with those providers to get something out of open banking.
I’m not sure how going to try to monetize it, whether they will get into this behavioural game or not and who they are going to partner with. But it’s absolutely appropriate for the legislators and the regulators to say whatever you do, you are in a privileged spot, you have a banking charter, and with that comes responsibilities.
One that has always been a complaint source for me from consumers is that they get into a dispute with their bank and their bank fires them. Then they have even more trouble trying to resolve their problem because they are no longer a client. The opposite of that is it’s very hard to switch from Royal to TD because it’s difficult. If there were an open banking aspect that just let you flip overnight, all your accounts and everything — and it’s potentially possible with this thing — that would be great.
The obligation to serve would help there because the second bank couldn’t blackball you and say that you could not have service with any of the banks because you were switching. I’m rambling a little bit, but I get your point.
There is certainly authority to say this is a requirement or that we have community reinvestment, as they have in the United States, for lower income individuals who need loans and who feel that they have not been given them because where they live or their ethnic background or whatever. We don’t have those requirements in Canada, but we could.
Senator Moncion: I see open banking as having benefits for consumers and for financial institutions, and for the government also. When you look at the aggregation of financial information, I think open banking will be provided that information. The concern is how we are going to build the framework.
I have seen a little bit of open banking or data information provided by customers to, let’s say, their financial planner. So that the financial planner can give you a better outlook of the possibilities that you have. One of the concerns that the federal government has — and it’s why I think they are looking at the aggregation of financial information — is also being able to look at household debt. Right now when we look at the customer’s information, even as a banker, you will look at the investment, you will look at the borrowing, but you don’t know what’s going on with the loan you have at the Brick, or at this place or that place.
I see open banking as an aggregation of all that financial information where you get a better picture of the financial information of the customer. I’d like to hear your comments on that. I am concerned about how we build a framework around this but I’d like to hear your comments about what I’m bringing forward.
Mr. Lawford: It’s an interesting question because, again, with everything in open banking, I get pulled in two directions. One direction is if behavioural data and fine-grained financial detail can be culled from millions of consumers easily and then used for forward-thinking policy development by the government, because then they know better what their citizens are doing financially — how they are doing and where the money is flowing. That is potentially good information that could lead to better legislation.
Senator Moncion: As long as consent is provided by the person who wants to use the platform.
Mr. Lawford: That would be the trick. The question would be, would someone agreeing to open banking also agree to have government policy makers use an aggregated version of that for policy making? If they say yes, that could be used.
Senator Moncion: The government already has that information for a lot of Canadians because they can provide information on household debt. It is the data that we hear about. The portion we don’t hear about is the one outside of the regular monitored system right now — the third parties that are lending money. So that’s the part that the government doesn’t get information from.
Mr. Lawford: So the question then would be: Would the third party nonbank providers have to give relevant information to the government at a certain level to help them understand?
Senator Moncion: I think open banking would have to be open to all companies who provide lending or investment to Canadians. It would not be just for the banks.
Mr. Lawford: No. I agree with you. It shouldn’t be. I don’t want to mislead the committee in saying that although there is a lot of potential downfalls to open banking, there isn’t a lot of potential competition and benefits to consumers if it has protections and it is done correctly. Maybe I’m speaking one way, but I’m trying to imply both are possible. In other areas I see there is not much public involvement in how companies are structuring the data flows. That is why this committee is very interesting to me, because it’s a regulated area where you have the hook that we are talking banking here, so let’s hear what you are going to do with the data companies. In a lot of other sectors — fitness trackers, home automation systems — there is no oversight committee looking at this.
Senator Moncion: No. That’s why it goes back to what Senator Deacon was asking you earlier.
The other question I have is something that you said in your statement. Let me give you some specifics. There is no legislated liability protection for consumers in payment systems or general banking in Canada. Could you explain that, please?
Mr. Lawford: If there is a dispute you have with a payment you have made through credit cards, debit cards, pre-authorized payments, there is a mishmash of rules at Payments Canada and in the credit card policies, but none of that is in the Bank Act or in the Canadian Payments Act. There are these voluntary rules and they are, to a greater or lesser extent, enforceable by consumers. They haven’t risen to the level of legislated protection like in Europe where they say if you are using a payment system it’s 50 euros to the consumer as long as they are not fraudulent or grossly negligent with it. That’s the limit of how much money they can lose. In Canada that’s not the limit, you can use a lot more.
Senator Moncion: I think it is on credit cards but not on debit cards.
Mr. Lawford: Yes, I agree with you, but you are protected as long as Visa wants to protect you. When they decide you’re not a good client anymore, they will not cover you the next time. It’s all voluntary. It’s not legislated. If we want consumers to always be protected, it would help to have it in the Bank Act. Open banking is a good opportunity to introduce that because we are widening the scope of who touches it.
Senator Moncion: Thank you.
Senator C. Deacon: I am firmly looking at open banking or consumer-directed banking as an opportunity for us to get a lot of things right. I look at Air Miles, and the amount of data we share. Two thirds of Canadian households use Air Miles. Air Miles knows everything about what they do. Not just about part of their life, but how much they drink, everything. I don’t have Air Miles. I have one or two secrets left.
Screen scraping is happening now with 10 per cent of Canadians. I understand it’s expected this year that 90 per cent of Canadians will e-file their tax returns or use an online cloud-based system. We are there now, 100 per cent. I’m hearing the points you are making through that lens. I feel we have to make recommendations about how to move forward here.
I have heard a lot of cautionary notes that I think are really important, but I want to look at the ones you have just started to touch on where we can make life a lot better for Canadians if we move down this road. There are ways we can create some significant opportunities for consumers.
I would really like you to give us a list, from your standpoint, about what those might be. We have heard your cautionary tones, and I think those are important, but I want to hear the cup half full side now.
Mr. Lawford: I’m a cup half empty kind of guy, but I’ll try.
Senator C. Deacon: I picked that up.
Mr. Lawford: I’m probably not much fun to listen to.
The first one for open banking has to be that you can move amongst Canadian banks in a frictionless manner. I should be able to switch banks five days a week if I want to. It would be disruptive, but it should be possible. Moving on from there are other things that are obvious consumer benefits. I think you have heard about robo-advisers already, these are electronic-based programs that try to replicate financial advice without a financial adviser at a certain level. I think because human advisers are trapped in a system where there are a lot of trailing fees that robo-advisers can be cheaper for consumers. That’s a good thing.
After that it starts to get murky, because most of the other advancements are just starting. The U.K. is just getting into this and Australia is coming on board and we don’t know what they will be yet. My suspicion is that a lot of the apps will tackle a specific part of your financial needs, but will largely be linked to other information and that will be their real purpose. Maybe I’m missing your question.
Senator C. Deacon: Let me be clearer. This gives us an opportunity to bring in protections for consumers. Can you give us a list of protections that you think might naturally fit with a move towards open banking that would address these concerns you have? I’m not in any way trying to negate your concerns. I’m trying to say there’s an opportunity here for us to start to get a lot of things right, looking into the future.
This is happening with or without government involvement, regulated or unregulated. Given that, let’s focus on the list of items that we need to make sure we have touched on so that we have taken advantage of this as an opportunity to better protect Canadian consumers.
Mr. Lawford: I think the principle I would base it on is consumer autonomy and control. If you keep that in mind, then the specifics follow out of that, like liability control so things don’t get out of control financially. We are talking about financial stuff, at the end of the day, with this. Canadians want to make sure they don’t lose their entire life savings through some app. That is one, and then there is the power to choose which provider you have and not to be stuck with one or penalized for using a particular provider so that you actually have choice in the market and you have the autonomy to switch.
Senator C. Deacon: Power to forget would be forgotten.
Mr. Lawford: Yes. One of the things I didn’t mention was deletion, meaning that there has to be some data control here above what we presently have. Europe is struggling with it and we are all struggling with it. I heard the committee ask about data ownership earlier on in the hearings. There is no ownership of data. It’s only control. You have to give consumers more right to say, “Okay, bank or third-party open banking provider, you can no longer use my data and I want assurances you won’t.”
The only way to vindicate that would have to be fines on the corporation if they use it. It would have to be that specific, and maybe even fines to the executives of the company if they don’t follow. I don’t know if you need that kind of extra protection or not.
Again, regarding transparency and where the data is flowing, you can write to the Privacy Commissioner now and ask the company where your data went, and they have to respond to you, but it’s a one-off. You could have a transparent tool where you can see it makes three hops.
Senator C. Deacon: And who is looking at it.
Mr. Lawford: If you can do open banking, why can’t you do that?
Senator C. Deacon: Thank you. I just think it was an important point. If we get to that point and if we start to listen and see action around those areas, do you believe this would then be a net positive?
Mr. Lawford: Yes. Technology is neutral. It can be positive if we ask to have certain things required so that it’s positive for consumers and we keep in mind whom this is being done for.
Senator C. Deacon: Thank you.
The Deputy Chair: Thank you very much, Mr. Lawford. You have added to our knowledge base on this. As I said, our focus is consumer protection and you have contributed a lot to that. Thank you so much.
(The committee adjourned.)