ANALYSIS: StatCan’s push to scoop payment data on 500,000 Canadians deserves scrutiny
Maxime Bernier celebrated his appointment as Stephen Harper’s industry minister at a swanky bar just off Parliament Hill in the early spring of 2006.
As his supporters toasted him with wine and spritzers, a reporter asked about his priorities.
Bernier, with a big grin on his face, promised he would gut Statistics Canada, one of the federal agencies reporting to the industry minister. When asked why, he said it was Statistics Canada that kept on coming up with new ways to find problems, and whenever it presented evidence of a new problem, government was then forced to spend money to fix those problems.
Shutting down some of StatCan’s research programs would mean, therefore, fewer problems would be found, and government would not have to spend so much on what Bernier clearly viewed as wasteful social programs.
So began an era that was, for Statistics Canada, a decade of darkness under the Harper government. It was a decade that saw the resignation of the country’s chief statistician, who realized he could not protect the agency’s independence from meddling politicians like Bernier and his successors in the Harper cabinet who, with some glee, oversaw what many social scientists viewed as the defenestration of one of the country’s most valuable data collection projects: the mandatory, long-form census.
The Harper government always viewed Statistics Canada with suspicion, believing it could often be more of a liability than an asset to policy-makers.
Then, in 2015, Justin Trudeau came to power. He promised, among other many other things, to set science free within government. The statisticians and researchers at Statistics Canada were not a liability to Liberals but a wonderful asset.
Let us get out of their way, the newly minted Liberal government said to itself, and see what wonders the truth-seekers and discoverers on the public payroll might come up with.
Well, as Global News reported Friday, one of the things they’ve come up with is among the most ambitious — and potentially the most controversial — data collection ideas since the long-form census was made mandatory. StatCan’s latest plan aims to harvest the most private, detailed and sensitive financial data of hundreds of thousands of Canadians — all of which is to be collected without their knowledge or consent.
To date, only the chief statistician has signed off on the plan, which Statistics Canada hopes to implement early in the new year. Sources have told Global News that neither Navdeep Bains, the Liberal minister now in charge of Statistics Canada, nor his political staff have been fully briefed on just what StatCan wants to do with its so-called “Personal Information Bank.”
WATCH: Federal Privacy Commissioner Daniel Therrien tables findings in light of major data breaches
The plan was described in correspondence recently sent to Canada’s nine largest financial institutions, whose “co-operation” StatCan expects in handing over millions and millions of detailed payment transactions for hundreds of thousands of unsuspecting Canadians.
Global News obtained a copy of this correspondence, and Statistics Canada confirmed the contents of that correspondence.
In an interview on Friday, one of the leaders of the project, director general of StatCan’s macroeconomics accounts division Jim Tebrake, explained the scope and rationale of the project.
It’s important to note that Statistics Canada already knows a great deal about Canadians — it almost certainly has my social insurance number and knows where I live as well as my age, income, level of education and the fact that I have a wife, two kids and a cat.
But if StatCan wanted to know what the average 50-year-old male with a cat living in suburban Ottawa spends in music downloads from Apple’s iTunes Store every month, it would have to convince me and other men with those characteristics to participate in a survey — a survey that might be done by phone, by mail or online.
Indeed, Statistics Canada employs the equivalent of nearly 1,000 people as “interviewers,” who spend all day asking everyday Canadians and businesses about their activities so everything we do can be counted up.
For much of the important data about our economy and household spending — upon which many important decisions, such as interest rates and taxation levels, are based — Statistics Canada relies heavily on surveys.
But surveys have an accuracy issue. Do you remember how much you spent on groceries last April? Last month? How much butter did you consume? How many times did you fill up at the gas pump? You might have roughly accurate answers to these questions, but they are probably not as precise as a data scientist would like.
On top of that, StatCan has the same problem that pollsters have: people these days just don’t want to answer the phone or go online for a lengthy survey.
As a result, researchers at StatCan came up with another idea: to feed a computer program to the agency’s massive database of 20 million or more “households.” That database will spit out a list of 500,000 “household” members, who together create a representative sample of the entire country. The list would have the same ratios of men to women, French speakers to English speakers and Calgarians to Haligonians that actually exist in the country.
The representative sample would also be chosen randomly, and on that list would be the name of each person, their social insurance number, date of birth, home address and gender. You would have a one-in-20 chance of being on this list.
But then, next year and the year after that, a new list would be drawn up. Eventually, the odds of making it onto the list would drastically improve for millions of Canadians.
Once the list has been generated, those 500,000 names would be given, under strict privacy controls, to each of Canada’s nine largest banks and credit card companies. Because your bank or credit card company also likely knows your name, SIN, date of birth and so on, each financial institution would be able to draw up its own list of customers that are also on the StatCan list.
For a period of time, the bank would transmit to StatCan each and every financial transaction for each and every one of its customers on that list. The banks would not be allowed to ask their customers for consent to do so, nor would they be allowed to inform affected customers that their data — everything from mortgage payments to online purchases to ATM withdrawals — has been handed over to the government agency.
StatCan maintains that this is all perfectly legal. By law, StatCan may not share this data with anyone, including other government departments like the Canada Revenue Agency, Department of Justice or the RCMP.
However, Canada’s big banks are nervous that many of their customers will take their business to small financial institutions — co-ops, perhaps — or move to alternative payment methods such as cryptocurrencies to protect their privacy.
WATCH: Apple CEO Tim Cook endorsed tougher privacy laws for both Europe and the U.S. at an international conference on data privacy on Wednesday and warned data is being “weaponized” against users.
When all these transactions come back to StatCan, each with a name on it, StatCan aggregates and summarizes what it has before “anonymizing” the data. Instead of knowing exactly how much I spend on iTunes every month, for example, the agency would know how much all middle-aged suburban Ottawa men who own a cat spend on iTunes every month.
That’s what the agency is really after: spending patterns from different kinds of households in different geographies. StatCan is not, believe it or not, much interested in my particular music purchases.
The process of anonymizing data — a long-established data science technique — involves essentially stripping out SIN numbers and other personal identifiers once all the middle-aged suburban Ottawa men with cats — myself included — are grouped together.
Not only will this data be much more accurate and much more timely than the current survey-based information about household spending habits, it will help Statistics Canada fill in what it calls “data gaps” about our society.
For example, it is very hard for Statistics Canada to get an accurate picture of the so-called gig economy. Some experts believe that as much as 40 per cent of the workforce participates in some kind of short-term, temporary, work-for-hire arrangement.
StatCan also has trouble tracking information about what Canadians purchase online from foreign retailers.
By dipping into the stream of daily financial transactions made by hundreds of thousands of individuals, StatCan researchers will be able to present better, more comprehensive and more timely data which, in theory, will help improve decisions taken by policy-makers.
For all data projects, Statistics Canada typically does a “generic privacy impact assessment,” but because of the scale and nature of this project, it took extra steps.
“Additional safeguards (are) being implemented for the collection, processing and use of payment and income industry information due to the highly sensitive nature of this data,” the agency said.
READ: Global News obtained this “privacy impact assessment” prepared on Oct. 22 by Statistics Canada in support of its new “institutional personal information bank”.
This extra, supplemental privacy assessment was approved on Oct. 22 by Anil Arora, Canada’s chief statistician.
Statistics Canada has a very good record of protecting the privacy of Canadians — but not a perfect one. In 2016, for example, it lost the long-form census records of hundreds of Canadians and failed to disclose this loss to the federal privacy commissioner in a timely manner.
The data scientists at Statistics Canada are doing what their political masters have asked them to do: be great data scientists and discover new ways to describe the activities of Canadians accurately, in a timely manner and with due regard to privacy and security.
But the politicians to whom the agency answers may wish to consider the broader context against which this massive personal information bank project may be considered.
WATCH: Former Ontario Privacy Commissioner Anne Cavoukian discusses what governments ought to be doing to protect their personal data.
Parliamentarians, right now, are calling witness after witness in front of the House of Commons committee to investigate the implications of the Facebook/Cambridge Analytica data leak. That same committee is also considering the broader issue of the privacy of digital government services.
Apple CEO Tim Cook warned last week that big data is being “‘weaponized against us by the data-industrial complex.” In Toronto last week, a Google-backed project to rebuild the city’s waterfront lost a key advisory board member, former Ontario privacy commissioner Ann Cavoukian, over concerns that the project was not sufficiently protecting the privacy of project participants.
The public is justifiably worried about the so-called “surveillance state.” Private actors and commercial data brokers are one thing, but Statistics Canada is the government. It has broad, sweeping powers to compel private sector players like banks to produce data even if, as we’ve learned, those banks are reluctant and nervous to do so. That makes StatCan’s personal information bank project a perfectly appropriate topic for parliamentary oversight and scrutiny.
© 2018 Global News, a division of Corus Entertainment Inc.