The decision by Statistics Canada to start scooping up personal financial data on Canadians might not break the law here.
But one expert says the demands it is forcing on Canadian private sector businesses could end up jeopardizing their trade opportunities in Europe.
EXCLUSIVE: StatCan requesting banking information of 500,000 Canadians without their knowledge
In an interview with the West Block’s Mercedes Stephenson, Scott Smith, a privacy expert with the Canadian Chamber of Commerce, warned businesses are concerned that the requirement to hand over consumer data to the federal statistics agency will highlight the differences between Canadian privacy laws and a tough new law in Europe — and put trade at risk.
“We’re concerned about adequacy and adequacy simply means the legislation in Canada is substantially similar to that in Europe,” said Smith, citing the decision by the European Union to rate Canada’s private sector privacy law, PIPEDA, as adequate.
WATCH BELOW: Chief Statistician of Canada Anil Arora sits down for an exclusive interview with Global News
That decision allows businesses here to continue doing business with European companies under the new privacy regulations there.
But the public sector is not subject to PIPEDA, a major concern that has been raised repeatedly in recent years by the federal privacy commissioner.
“The problem is our public sector privacy laws are not substantially similar and by amplifying this element of the distinction, it may threaten that future relationship,” Smith said.
WATCH BELOW: Privacy commissioner launches probe into StatsCan
At issue is what is known as the General Data Protection Regulation.
It replaced the existing patchwork of privacy laws implemented by European Union member states with one cohesive policy.
READ MORE: Canadians have little ability to determine if StatCan has their personal banking info: experts
The new rule gives European regulators the power to impose crippling fines on businesses and require companies to obtain explicit consent for the collection and use of personal information relating to European residents.
It does not only apply to European businesses but rather any company that wants to offer goods or services, or monitor the behaviour of individuals in the European Union.
WATCH BELOW: Why you’re getting all those privacy-update GDPR emails and what they mean
And with the Canada-European Union Comprehensive and Economic Trade Agreement (CETA) expected to boost bilateral trade by 20 per cent and inject an extra $12 billion each year into the Canadian economy, making sure Canadian companies’ access to that market remains in place is vital.
“What StatsCanada is doing is basically amplifying that distinction and we’re concerned that that has unintended consequences,” Smith said.
Global News broke the story last week that Statistics Canada has been asking banks across the country for the personal financial information of 500,000 Canadians.
“Statistics Canada will be acquiring individual payments and income history information from financial institutions,” reads a document from Statistics Canada, which recognizes the “highly sensitive nature” of the data.
It also notes that information includes “individual-level financial transactions data” and sensitive information, like social insurance numbers (SIN).
READ MORE: Privacy Commissioner of Canada launches investigation into StatCan over controversial data project
Its goal is to develop a “new institutional personal information bank.”
And there is next to no way to find out whose information StatCan is scooping up.
Smith said that is not acceptable and that the time has long since come for the government to update the rules around how the public sector can use personal information.
“Our public sector laws have not been updated since 1983 and what would have been fine in 1983 for collecting information on files and filing cabinets is no longer relevant in the digital age,” he said.
“The government has an obligation to do what they preach in terms of expectation of the private sector and be transparent in the information that they want to collect, be judicial in how much information they collect, and they should be obligated to have some form of consent.”
WATCH: StatsCan made $140 million selling data to businesses