Skip to main content

If you were surprised Statistics Canada asked for your social insurance number and your bank balance, you might be interested to know they can, by law, demand any of your data from your internet service provider, bank, pharmacy, city hall or community group.

That has been true for decades – at least since the Statistics Act was passed 48 years ago.

But there’s a brave new world of Big Data out there, with high-speed processing and artificial intelligence. Somehow, our national data agency failed to stop to think about what that means. Government dropped the ball, too: Statistics Canada is governed by an out-of-date law.

So the statistical agency stumbled into controversy by asking credit agencies and banks to send along data on millions of people – SINs, names, addresses, bank balances – without telling people about it.

The agency seems to have reasoned it needs more data, from richer sources, to keep up with the modern world, and it had the legal power to demand more. Statscan handles private info all the time. What’s the problem?

The problem, of course, is the shrieking howl from folks who a) didn’t know it was happening, b) don’t want bureaucrats peeking at their bank balances and c) worry about what creepy thing they’ll do next.

The good news is the earnest nerds at Statistics Canada are not trying to compare your credit-card bills with your internet browsing. And the law prohibits the agency from disclosing personal information.

The bad news is Statistics Canada moved into the Big Data age with a governance regime designed for the days when data were stored in a filing cabinet. That is a big problem.

The Statistics Act gives the agency sweeping powers to demand “any documents or records” from virtually anyone – “in any department or in any municipal office, corporation, business, or organization.”

“The scope is absolutely astonishing,” said Teresa Scassa, the Canada Research Chair in Information Law and Policy at the University of Ottawa.

Decades ago, those powers were subject to the practical limits of the analog age, Dr. Scassa notes. Data were bulky and hard to analyze. Companies kept less. If Statscan asked for everyone’s bank records then, they’d have had trucks delivering bankers’ boxes of files and not enough people to read them.

Now, data storage is cheap. It is easy to transfer and malleable, so one set can be matched with another, and processed by algorithms at high speed.

Stats agencies around the world are dealing with the new Big Data era. The United Nations even keeps a database on Big Data projects by agencies around the world.

Those agencies have seen data analytics and internet data-scraping become big business. Uber data are a treasure trove for economists. Statistics Canada wants data on online purchases to study the modern economy. The agency moans it can’t use outdated tools “while rich sources of information continue to grow.”

It would be folly to shut all of that down. But Statistics Canada can’t do whatever it wants. The implications now are too vast.

The agency doesn’t even inform the public when scooping up data from private corporations. That’s an anachronism. Statscan is required to publish a request 30 days in advance if it wanted, for example, to make a survey on household spending mandatory. But it can collect everyone’s credit-card bills with no public notice.

With every request for a copy of such records, the risk of a breach is greater. Privacy Commissioner Daniel Therrien suggested Statistics Canada should get “anonymized” data from private corporations, although presumably the agency would have to pay companies, such as banks, to do that.

In theory, datasets that include SINs can be matched with each other to yield new data. It’s also possible anonymized results could be specific enough to identify some individuals. If there are massive databases on Canadians in the hands of government, the potential for abuse, official or rogue, increases in the future.

The problem isn’t that Statistics Canada is trying to become Big Brother. It’s that there are a lot of risks in unlimited Big Data. And they can’t be controlled by the rules from another era.

Follow related authors and topics

Authors and topics you follow will be added to your personal news feed in Following.

Interact with The Globe