For its 2016 census, the country’s national statistical agency announced changes that would impact citizens’ privacy. For the first time ever, census respondents’ personal information would be retained and linked with other administrative and survey data the agency has access to.
The national media quickly jumped on the story. The country’s public broadcaster wrote “If you’re worried about privacy, you should worry about the 2016 census”. The country’s premiere technology publication wrote “Lost our Census: Why the biggest hit to privacy this year is all about you”.
Once aware of the changes, the public was outraged. Calls for a nationwide census boycott erupted. Academics and former top bureaucrats – including a former federal privacy commissioner and a former chief statistician – publicly voiced their concerns.
No, this isn’t a Bizarro universe scenario of what didn’t happen in Canada following the referenced changes to the 2016 census implemented by Statistics Canada. This is what’s actually happening in Australia, where the Australian Bureau of Statistics has implemented similar changes for its upcoming 2016 census, set to take place next month.
Thanks to the diligence of Australian journalists, academics and former public officials, the Australian public was well informed not only about the significant changes to the 2016 census, but also the potential privacy implications of those changes.
As the actual changes to the Canadian census and questionable rationale behind them have previously been discussed (here, here, and here), it’s worth focusing now on why census privacy matters and why Canada needs a new Chief Statistician and new Privacy Commissioner, as well as more diligent journalists.
Why census privacy matters
Much of the following is based on former Privacy Commissioner Bruce Phillips’ comments regarding the Longitudinal Labour Force File (LLFF), his comments during the debate over consent to release personal census records after 92 years, as well as comments from former Chief Statistician Ivan Fellegi regarding privacy.
It’s worth pointing out that, as a result of Mr. Phillips’ efforts to protect Canadians’ privacy, the LLFF was dismantled and the requirement for consent to release personal records upheld.
For those unaware, Mr. Phillips was a prominent Canadian journalist before he was appointed Privacy Commissioner in 1991. His opinion regarding changes to the 2016 census would have been invaluable; unfortunately, he passed away in December 2014. Given his opinions on the privacy issues just mentioned, the following could be considered speculation as to what Mr. Phillips may have had to say regarding the referenced changes to the 2016 census.
The first justification offered by Statistics Canada for compiling “citizen profile(s) in all but name” – the term used by Mr. Phillips in condemning creation of the much less expansive LLFF by Human Resource Development Canada (HRDC) – is that its Social Data Linkage Environment (SDLE) is only intended for “statistical and research purposes”.
Mr. Phillips’ had a simple response to the same defense then offered by HRDC to justify compiling the LLFF, summarised in the Privacy Commissioner’s 1999-2000 Annual Report to Parliament:
Compiling such comprehensive longitudinal records by record linkage or matching is a hazard to informational privacy because of the temptation for government to use the information for data mining and individual profiling. A so-called “research database” may soon lend itself to other purposes, raising fears that data could be used to make decisions or predictions about individuals, or could be retrieved in unforeseen ways—by disabilities or ethnic origin, for example—to the detriment of individual rights.
That ‘slippery slope’ caution is especially relevant today. Canada’s current Prime Minister, while running as the candidate for his party, supported and voted for draconian security Bill C-51, which was subsequently passed into law last year with his party’s support.
When asked to justify his support of the proposed legislation, then-candidate Trudeau indicated there were three elements of the legislation he supported, but could only name one when asked to elaborate (see attached video): Preventative arrests.
Implicit in such a gross violation of civil liberties is that the government would “make decisions and predictions about individuals” that it otherwise has no actual evidence against nor justifiable basis to detain.
Among other legislative changes, Bill C-51 enacted the Security of Canada Information Sharing Act, as well as amended the Canadian Security Intelligence Service Act (the CSIS Act).
CSIS is an interesting jump-off point for discussing the only other justification offered by Statistics Canada for the SDLE: The information it gathers on Canadians is “collected under the authority of the Statistics Act and will be kept strictly confidential“.
Implicit in Mr. Philips’ reference to “temptation for government” is the temptation to change, creatively interpret or ignore legislation to suit its whims. What may be illegal information sharing today may not be illegal tomorrow.
There’s an interesting history between CSIS and Statscan that predates the World Wide Web (hence the dearth of web info available): The initial proposed legislation to create CSIS was draconian security Bill C-157, introduced in 1983 by a government then led by another Prime Minister also named Trudeau.
Among other things, the proposed legislation would have given CSIS access to any data held by any government institution, including Statistics Canada.
The controversial legislation was subsequently sent to a special committee of the Senate for review. Among other changes, the committee recommended Statscan data be exempted. The significantly amended legislation was subsequently re-introduced in 1984 as Bill C-9, and eventually passed into law as the Act to establish the Canadian Security Intelligence Service.
While not proposed under Bill C-51, all that a current or future government would need do to gain access to Statscan’s SDLE super database is either remove six words from the CSIS Act or slightly amend or otherwise creatively interpret the Statistics Act. ‘Tempting’, indeed.
As suggested, the law doesn’t even need to change for the government to violate the letter and/or spirit of legal privacy provisions.
In an op-ed by Mr. Phillips (Globe and Mail, November 11, 1999), during the debate over whether Canadians’ consent was required to share their personal information after 92 years, he underscored this point:
A case in point: The U.S. government used its 1941 census returns to identify and round up Japanese Americans during the Second World War. While the current proposal… may not be for nefarious purposes, the U.S. example illustrates dramatically how government is willing to consider changing the rules when under public pressure.
Had he written this a couple of years later, it likely would have referenced the U.S. government arbitrarily detaining Arab Americans following the tragic events of September 11, 2001. The U.S. government subsequently suspended many civil liberties and passed draconian security, data collection and data sharing legislation, cynically dubbed the Patriot Act.
In the same write-up, Mr. Phillips also noted:
For future censuses, Statistics Canada need look no further than respecting that most fundamental of privacy principles – consent. Adding one more question to the scores already asked adds no paperwork, and removing those who refuse is a small price to pay for their willing participation in the core exercise, which is gathering national statistics.
No doubt if Mr. Phillips was alive today he would have scoffed at Statistics Canada’s suggestion that it did away with asking Canadians for consent to access and link their personal information to other survey and administrative records “to reduce the burden on Canadians”. That’s the explanation Statscan provided in a message from the Chief Statistician included in 2016 census letters and forms.
He also wisely foresaw the potential risk in disregarding Canadians’ privacy concerns:
Another compelling argument… is the risk it courts for damaging the accuracy of the data and thus its utility for government planning and policy-making… who knows how many will fudge the answers, or simply refuse and damn the consequences?
No doubt Mr. Phillips had the CSIS Act in mind when he went on to write:
And, if this promise is broken, how long will it be before Statistics Canada is pressured to begin sharing current census data with Revenue Canada and other government and law-enforcement agencies? Why not? Many would argue that disclosure would serve the greater good.
In an op-ed by former Chief Statistician Ivan Fellegi (The Ottawa Citizen, June 5, 2000), intended to reassure the public following Mr. Phillips’ report on HRDC and the LLFF, he explained the strict conditions under which Statscan would undertake data record linkages as well as safeguards in place to prevent abuse:
…we are fully aware that linkage of records is, by its nature privacy intrusive… record linkage should not be done unless… all of the following conditions are satisfied:
The linkage is to… provide insights about a specific issue… No fishing expeditions;
We will undertake no linkage on an indefinite basis;
The size of files involved in linkage must be as small as possible, consistent with the objective;
Every new kind of major linkage project is discussed with the office of the privacy commissioner. We try to accommodate his concerns and comments.
The limited publicly available information on Statscan’s SDLE suggests it does not meet any of these conditions.
No “specific issue”. Statscan doesn’t even know what it will use the super database for yet. As it notes: “Research projects will be approved on a study-by-study basis. These may be carried out as part of a research agenda initiated by Statistics Canada or in response to client requests.” Indeed, the SDLE appears to be the mother of all “fishing expeditions” by design.
There is no defined end date to the massive data record linkage: “Statistics Canada will retain the DRD and Key Registry files until it is determined that there is no further need for them.” That is, Statscan will retain SDLE data linkage(s) “on an indefinite basis”.
Since the SDLE is the largest (publicly acknowledged) Canadian social data linkage project to date, created without any specific objective in mind, it obviously is not “as small as possible, consistent with the objective”.
The “discussed with the privacy commissioner” bit is rather amusing. According to Marc Hamel, Director General of Census Management at Statscan, the planned changes were mentioned in a 2014 Privacy Impact Assessment submitted to the Office of the Privacy Commissioner. In Mr. Hamel’s words, the “OPC did not have any comments on the proposed approach…” To Statscam, no feedback is apparently positive feedback.
To date, the OPC has refused to provide any information or records regarding direct communication or consultation with Statscan on the referenced changes to the 2016 census. Since Statscan has already confirmed it didn’t receive any feedback, and the Privacy Commissioner’s 2014-2015 Annual Report to Parliament neither mentions the removal of consent nor data linkage plans for the 2016 census, it’s safe to conclude the OPC didn’t even bother to review the changes.
Why Canada needs a new Chief Statistician, Privacy Commissioner and more diligent journalists
The current Chief Statistician has approved changes to the census that clearly disregard privacy concerns expressed by former Privacy Commissioner Bruce Phillips as well as conditions and safeguards set out by former Chief Statistician Ivan Fellegi. Clearly Canada needs a new Chief Statistician.
The current Privacy Commissioner is either oblivious to what’s going on or unwilling to review potentially the greatest government intrusion on Canadians’ personal privacy in the last two decades. Since concerns about his qualifications and independence were expressed by civil liberties groups, a former Privacy Commissioner as well as the leader of the opposition in the House of Commons even before his official 2014 appointment, clearly Canada needs a new Privacy Commissioner.
That the Canadian press has not even bothered to look into any of this is simply a sad testament to the state of Canadian journalism. Instead of going on at length about it, this anecdote should serve to explain just how bad it’s gotten:
As regular readers (or new visitors who visit the ‘About’ page) may be aware, information from this site is sometimes shared with Canadian journalists – in this instance, six journalists from Canada’s two most widely read daily newspapers. Of the six, not one had bothered to read the note from the Chief Statistician on their 2016 census correspondence, which cryptically spelled out the changes discussed above.
Not one of the six was aware of the changes. Once informed, each responded with some variation of, “Well, that will probably result in better data, right?”
As mentioned in its 2016 Census Program Content Test report, Statistics Canada didn’t even bother to ask income-related questions, let alone test any data. The only published research on the subject casts doubt on the need to do away with informed consent to obtain ‘better data’. And as previously discussed (see Pyrrhic victory), and underscored by Mr. Phillips’ comments, needlessly compromising Canadians’ privacy actually compromises socioeconomic data quality in the long run.
You know what happens when you assume. Except when the Canadian press does it, the potential repercussions – in this instance to Canadians’ privacy, civil liberties and future data reliability – are no laughing matter.
To new Australian readers, welcome. While you may not be happy with how changes to your 2016 census will compromise your right to privacy, be grateful that you were at least kept well informed of what was going on. Your Canadian counterparts haven’t been as fortunate.