Statistics Canada: Invasive data initiatives should be redesigned with privacy in mind
The Office of the Privacy Commissioner of Canada (OPC) investigated over a hundred complaints against Statistics Canada concerning its Credit Information Project and Financial Transactions Project. These initiatives involved collecting detailed personal information from a credit bureau (TransUnion) and financial institutions without individuals' direct knowledge or consent. The OPC found that Statistics Canada had the legal authority under section 13 of the Statistics Act to collect information for the Credit Information Project, as TransUnion provided existing records, thus deeming this aspect of the complaints not well-founded. However, the OPC had serious concerns that the Financial Transactions Project, as originally designed, would have exceeded this authority by requiring financial institutions to create new records; no formal finding was made as the project was halted. While no contravention of the Privacy Act was found, the OPC identified significant privacy concerns regarding the necessity and proportionality of both projects, Statistics Canada's lack of transparency, and deficiencies in internal monitoring safeguards. Statistics Canada committed to implementing all six OPC recommendations, including redesigning both projects with privacy principles in mind, increasing transparency, and enhancing internal security measures. The OPC also called for legislative reform of the Statistics Act and Privacy Act to address modern data collection practices.
- 1Whether Statistics Canada's collection of personal information for the Credit Information Project was within its legal authority under section 13 of the Statistics Act.
- 2Whether Statistics Canada's proposed collection of personal information for the Financial Transactions Project, as originally designed, would have been within its legal authority under section 13 of the Statistics Act.
- 3Whether the collection of personal information for the Credit Information Project related directly to an operating program or activity of Statistics Canada under section 4 of the Privacy Act.
- 4Whether the collection of personal information for the Financial Transactions Project related directly to an operating program or activity of Statistics Canada under section 4 of the Privacy Act.
- 5Whether the Credit Information Project, as originally designed, met the principles of necessity and proportionality.
- 6Whether the Financial Transactions Project, as originally designed, met the principles of necessity and proportionality.
- 7Whether Statistics Canada provided adequate transparency to individuals regarding the collection of their personal information for the Projects.
- 8Whether Statistics Canada had appropriate safeguards, specifically regarding logging and monitoring for internal unauthorized access, to protect personal information collected via the Projects.
- 9Whether Statistics Canada's de-identification and encryption safeguards were adequate.
- 10Whether Statistics Canada had proper procedures for individuals to access their personal information.
- 11Whether there was a risk of personal information collected via the Projects being disclosed for secondary purposes.
- 12Whether Statistics Canada's Directive on Discretionary Disclosures adequately considered individuals' privacy interests when making disclosures under section 17(2)(a) of the Statistics Act.
- Legal authority for Credit Information Project: Statistics Canada had legal authority
- Legal authority for Financial Transactions Project: Project as designed would have exceeded authority
- Privacy Act contravention: No contravention found
- Privacy concerns: Significant concerns identified
- OPC recommendations: Statistics Canada committed to implementing all recommendations
- Legislative reform: OPC called for legislative reform
Complaint not well-founded in part, but action warranted on systemic privacy concerns.
The OPC found Statistics Canada had legal authority for the Credit Information Project but had serious concerns about the Financial Transactions Project's legal authority. While no contravention of the Privacy Act was found, the OPC identified significant privacy concerns regarding necessity, proportionality, transparency, and internal safeguards for both projects, leading to recommendations that Statistics Canada committed to implement.
Statistics Canada agreed to implement all six recommendations, including redesigning both projects to respect necessity and proportionality, increasing transparency, and improving internal threat monitoring.
- s.4 Privacy Act
- s.13 Statistics Act
- s.17 Statistics Act
- s.17(2)(a) Statistics Act
- s.18 Statistics Act
This summary is informational only and not legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro