Stats Canada’s dramatic overreach
On October 26, 2018, news broke that Stats Canada is asking financial institutions across Canada for “individual-level financial transactions data” for 500,000 randomly selected Canadians.
The goal in collecting the information is to build a “new institutional personal information bank.”
They are requesting data which includes social insurance numbers, individual income history, including bill payments, cash withdrawals, credit card payments, money transfers, and account balances. Stats Canada wants the banks to give them all of this personally identifiable financial information, which Stats Canada then plans to anonymize.
not resourced to handle sensitive financial data
Canadian banks spend over half of a billion dollars per year to protect their patrons’ financial information.
That is more than Stats Canada’s entire annual budget.
Stats Canada is not resourced to handle the data they’re requesting and they will not be able to protect it appropriately. They’ve painted a target on their backs by announcing the project publicly; hackers who want to go after Canadians’ financial information now know that there is going to be that of 500,000 Canadians being transmitted from banks to a much less secure federal government department.
What should Stats Canada do instead?
There’s a way for Stats Canada to obtain the information they want without being able to trace how the financial data is associated with each person.
Banks could ask their patrons whether they want to provide anonymized aggregate data to Stats Canada with the purpose clearly stated. If the patron consents, the bank would anonymize and aggregate the data before sending it to Stats Canada.
This would provide Stats Canada the information they need to accomplish their goal, without putting citizens’ data at additional risk.
Government setting bad example for private sector
The Canadian government is sending a troubling message to private sector companies with this program – if the government is treating citizens’ personal data as if its theirs to take whenever they want, it has no moral authority to combat the overreach and abuse of citizens’ private information by private sector companies such as Google and Facebook.
A matter of consent and respect
In the end, you should get to choose who has access to your data, especially your personally identifiable financial data.
Stats Canada needs to respect Canadian citizens and obtain their individual consent for the collection and use of their personal data. They also need to acknowledge their limitations in protecting such information.