Statistics Canada is asking banks across the country for financial transaction data and personal information of 500,000 Canadians without their knowledge, Global News has learned.
Documents obtained by Global News show the national statistical agency plans to collect “individual-level financial transactions data” and sensitive information, like social insurance numbers (SIN), from Canadian financial institutions to develop a “new institutional personal information bank.”
“Statistics Canada will be acquiring individual payments and income history information from financial institutions,” reads a document from Statistics Canada, which recognizes the “highly sensitive nature” of the data.
READ MORE: More than 1 in 5 Canadian companies hit by cyberattack in 2017, says StatsCan
The personal banking and financial transactions being requested include bill payments, cash withdrawals from ATMs, credit card payments, electronic money transfers and even account balances of Canadians across the country.
James Tebrake, director general of macroeconomics at Statistics Canada, told Global News that beginning in January, the agency will ask nine banks for the financial transaction information from a representative sample of 500,000 randomly chosen Canadians or a 1 in 20 chance of being selected.
“Canadians should know we are not accessing all of the payments data for all Canadians. It’s a small sample relative to the total number of households,” he said. “Our access to this data is permitted through both the Privacy Act and the Statistics Act.”
However, Canada’s biggest banks have not yet fully agreed to the project.
WATCH: Statistics Canada numbers show sexual assault reports up more than 50 per cent in Kingston
“Banks believed this proposed data acquisition project was still in the exploratory stages and were not aware that Statistics Canada was moving to compel disclosure of this information. No customer transaction data or other personal information has been transferred to Statistics Canada under this request,” Canadian Bankers Association spokesman Aaron Boles said an e-mailed statement. “The CBA is working with members to understand the nature of this request and next steps.”
READ MORE: Ottawa to pay $17.5M to settle student loan privacy breach lawsuit
Ontario’s former privacy commissioner, Ann Cavoukian, said she was shocked by the initiative and said the ability for a government agency to build a massive database of personal banking information raises serious privacy concerns.
“Most people would be surprised and devastated if they thought all of their financial information and bills and activity were being accessed in identifiable form by Statistics Canada or any branch of government,” she said. “Medical and financial records are the most sensitive personal data that exists.”
A letter from the agency to a Canadian bank says the “individual-level financial transactions data” will be “used for statistical purposes only.”
“Section 13 of the Statistics Act authorizes the Chief Statistician to compel the disclosure of, and obtain, any documents or records that are maintained in any department of in any municipal office, corporation, business or organization, from which information is sought in respect of the objects of the Statistics Act,” the agency said.
The letter also indicates that Statistics Canada has informed the Office of the Privacy Commissioner of Canada of its “intention to start collecting, on a limited basis, financial transactions data of individuals from banks, as well as other organizations that may process financial transaction data.”
READ MORE: Hundreds of federal civil servants lose personal information in data breach
Tebrake said one reason for the new data collection method is the agency has found that responses to surveys are low. The data gathered will be used to track household spending and consumer trends, like how often Canadians spend money outside the country.
Once the data is compiled by Stats Canada it will be made anonymous in order to remove personal identifiers, according to Tebrake.
However, as a new sample of Canadians will be chosen each year, StatsCan’s personal information bank could grow into the millions.
A spokesperson for the Privacy Commissioner of Canada, Daniel Therrien, confirmed it’s been provided information about the Stats Canada initiative and discussions are ongoing.
WATCH: Suicide rates in Nova Scotia continuing to rise: statistics show
“We spoke with the agency about this again in the past year, after a number of companies contacted us with concerns about StatsCan requests for customer data,” said Corey Larocque in a statement.
“We were told that this kind of information is used to gain insight into various consumer trends, such as tourism and travel. It also helps in validating other necessary information such as household addresses and residential occupancy,” he added.
Larocque said the Commisioner’s officer has recommended the agency consider whether it could achieve its same objectives by collecting customer information that has been de-identified before it is disclosed to the agency and suggested it limit collection of administrative data.
“To ensure transparency, we recommended StatsCan let the Canadian public know how and why it is increasing its collection of data from administrative and other non-traditional sources,” he said.
READ MORE: 3 steps to take if your credit information is stolen in a data breach
Statistics Canada also cites a section of the Personal Information Protection and Electronic Documents Act (PIPEDA), which authorizes an organization to disclose personal information “without the knowledge or consent of the individual to a government institution that has identified its lawful authority to obtain personal information.”
PIPEDA is the federal privacy law for private-sector organizations, which lays out ground rules for how businesses must handle personal information in the course of commercial activity.
Teresa Scassa, a professor at the University of Ottawa who specializes in information law, said while this might be legal it’s never been tested or publicly debated.
“The law has never really contemplated anything on this scale,” Scassa said.
There have been several instances of federal agencies losing or mishandling data. A CBC News report from earlier this year revealed the federal agency lost nearly 600 sensitive files during the 2016 census process. The CBC said confidential documents were left on a subway or sent to the wrong home, and in one case, hundreds were lost after an employee’s car was stolen.
“What would prevent that from happening again in some form or another?” Cavoukian said.
Stats Canada says the data will be transmitted using a secure file transfer protocol and will be held on its own unique servers protected by a network firewall.
“Under no circumstances will the personal information obtained from financial institutions be used to perform credit, expenditure or income check on individual Canadians,” the agency said.
Comments