A report from Canada’s privacy commissioner is calling for an overhaul of the country’s privacy laws following several data privacy investigations, including two on projects from Statistics Canada to collect financial and credit information from millions of Canadians.
Privacy commissioner Daniel Therrien is urging lawmakers to adopt rights-based privacy laws to better protect Canadians amid an increase in data-driven technologies that pose serious privacy risks.
WATCH: Statistics Canada hits pause on plan to obtain banking records, halts TransUnion credit requests
Global News first reported in October 2018 on the StatCan program to collect detailed financial transaction information of 500,000 Canadians from banks without their consent or knowledge. Global also first reported on the data agency scooping up 15 years’ worth of credit rating information from a major international credit bureau, which could include millions of Canadians.
News stories about the data collection projects generated more than 100 complaints, according to the privacy commissioner.
“Canadians were deeply troubled by these initiatives,” Therrien said in a statement. “This concern was clearly justified given the scale of the proposed collection, the highly sensitive nature of the information and the fact that the information in question would paint an intrusively detailed portrait of a person’s lifestyle, consumer choices and private interests.”
The commissioner also highlighted the need for change following investigations into Facebook and Equifax that revealed serious weaknesses with current legislation.
“Close to every Canadian has been subject to a data breach,” Therrien said during a news conference in Ottawa. “We often see inadequate corporate practices in terms of corporate safeguards.”
Therrien said that new, modernized privacy laws should have a “rights-based foundation” that protects privacy as a human right in and of itself and as an essential element to the realization and protection of other human rights. He also called for an end to self-regulation in private-sector privacy law.
“Canadians want to enjoy the benefits of digital technologies, but they want to do it safely,” Therrien said. “Legislation should recognize and protect their freedom to live and develop independently as persons, away from the watchful eye and unconscious influence of a surveillance state or commercial enterprises.”
READ MORE: Canadians have little ability to determine if StatCan has their personal banking info
The report said the Office of the Privacy Commissioner should be given the power to imposes significant penalties for not complying with privacy laws and should be able to carry out proactive inspections to ensure companies are accountable for how they handle personal data and privacy.
“Without that trust, innovation, growth and social acceptance of government programs can be severely affected,” Therrien said.
The commissioner’s report found that although Statistics Canada didn’t break any current laws, it did raise significant privacy concerns about the design of the programs and highlighted the inadequacy of existing legislation.
“Statistics Canada officials spoke about their objectives, but did not demonstrate the necessity of collecting so much highly sensitive information about millions of Canadians,” the report said.
READ MORE: Statistics Canada failed to disclose key info about project to harvest bank data
The report included recommendations not to go through with the Credit Information Project and the Financial Transactions Project, and to work with the privacy commissioner to redesign the projects.
StatCan ultimately abandoned the data-gathering project on banking information but maintained that it had the authority to collect personal information without consent for both projects under the Statistics Act and Section 4 of the Privacy Act. Under the Statistics Act, the agency has the power to demand third-party organizations to disclose information that would “assist Statistics Canada in fulfilling its mandate.”
StatCan said in a statement posted to the agency’s website that it was committed to working with the privacy commissioner of Canada to develop new statistical collection methods that respect privacy.
“We want to be clear that as we evolve and modernize the ways we collect data, respecting and protecting the rightful privacy of Canadians will always sit at the heart of everything we do,” the agency said.
“Canadians have sent a clear signal that they expect more transparency about why and how we collect and protect their information. Statistics Canada will be more transparent about our programs and the ways in which we collect, process and store data.”