A small step towards open and transparent government
Vancouver, February 5, 2019 – The B.C. Freedom of Information and Privacy Association is pleased with the recommendations made by the province’s top watchdogs to bring the Legislative Assembly of B.C. under the Freedom of Information and Protection of Privacy Act(FIPPA).
Signed by Information
and Privacy Commissioner Michael McEvoy, Merit Commissioner Fiona Spencer, and
Ombudsperson Jay Chalke, the recommendations called for the Legislature to
“meet the same standards” that 2,900 other provincial public bodies are subject
the Legislature to freedom of information rules is a welcome sight, the move is
ultimately just one of the steps to a full reform that FIPA has been calling
for in the past two decades. “This is just one little piece of the puzzle and
there’s a whole lot of reform that we’re trying to get,” says Executive
Director Sara Neuert. “We continue to be in reactionary mode and we need to
move a step further and be proactive.”
recommendations will only act to prevent the exact same scandal from repeating
itself, more effective change would address a broader scale of freedom of
He then put forward two concepts he deemed to be main pillars of the current state of privacy: Surveillance Capitalism as discussed in Shoshana Zuboff’s new book and Bernard E. Harcourt’s study on the Expository Society.
“Privacy is a collective good. Thinking about the perils that privacy faces right now requires us to think about privacy as a democratic good.”
– Mike Larsen
The two ideas were both entirely unsurprising, yet undeniably unsettling. While the monetization of data has become fairly well-known (and seemingly accepted), Larsen disputed the belief that the collection of our digital footprint is dedicated solely to economic means like marketing and advertising. I heard noticeable gasps from around the audience when he delved into the other side of surveillance, the one we don’t talk about enough: prediction of behaviour, political sentiment, and voting practices – and information such as these can open the possibility for the steering and manipulation of the public.
discussion on the Expository Society veered towards a more academic vernacular,
the subject in its most basic nutshell did hit close to home. It is essentially
a critique on how the digital age and the dawn of social media have changed our
habits, how we have become more incentivized and inclined to share personal
information in public spaces, which in turn builds copious amounts of
about the safety of our data was a sentiment that Vonn echoed in her
discussion, stating that we create more data than most places, but
unfortunately, “we can’t really protect it.” Vonn also delved into sovereignty
and transparency, citing the lack of ability to hold government bodies
accountable, relative to the amount of access government has to our personal
information. As for tips and solutions, Vonn proposed a tactic she admittedly
described as unpopular – go analog. A self-confessed Luddite, Vonn spoke of the
security measures created by simply leaving devices like laptops (and yes, even
phones) at home when travelling or crossing the US-Canada border.
only celebrate Data Privacy Day once a year, the discussion it generates allow
for issues surrounding data, surveillance, and privacy to permeate our general
discourse. And while the meaningful action that we seek can come so few and far
between, these discussions do represent a small victory. At the end of the day,
we want as many people talking and caring about these issues. After all,
privacy is a collective good.
at Legislative Assembly demonstrates need for Law Reform
Vancouver, January 24,
2019 – The need for
reforming British Columbia’s outdated Freedom
of Information and Protection of Privacy Act (FIPPA) is evidenced by the
recent scandal concerning misconduct and lack of oversight at B.C.’s
made by house speaker Darryl Plecas reflect the ‘black holes’ that exist in the
transparency of government bodies, such as the legislature and office of the
Legislative Assembly is outside the jurisdiction of freedom of information
requests,” says Sara Neuert, executive director of BC Freedom of Information
and Privacy Association. “It’s a shortcoming of government transparency and
accountability. We would have learned of this sooner had we been able to place
legislature offices under scrutiny.”
amendments to the FIPPA have been repeatedly put forward by FIPA over the past
15-years. Recommendations for change were also presented in the last Special
Legislative Committee report published in May 2016 – echoing the calls for
additions such as mandating a ‘duty to document’ and administering real
repercussions to government officials who impede the FOI process. So far, the
current government has made several commitments to advancing reform, though steps
leading towards actual change have yet to arrive.
legislature offices under the dominion of FOI laws is not an impossibility and
can be enacted rather swiftly. While doing so would be a welcome step towards modernizing
the province’s FOI laws, it would ultimately be just a step. What the province
truly needs – and has needed for years – are comprehensive reforms, only then
can the government be held accountable by the taxpaying public.
As of December 3rd, 2018, one week following the publication of this blog post, and a couple of weeks after more than 400 Canadians exercised their privacy rights and requested their personal information through an OpenMedia campaign that FIPA assisted with, Statistics Canada has announced that they are suspending their practice of obtaining personal credit records from TransUnion and are delaying their plans to access the banking details of 500,000 Canadians.
When I heard that Statistics Canada had been accessing the credit scores of Canadians, I wanted to find out if I was affected. I filed a request under the Privacy Act for “any records or data related to me that was received by Statistics Canada from TransUnion,” which is one of Canada’s two credit bureaus.
As someone interested in privacy and privacy rights, I was curious as to why Statistics Canada would be interested in my personal financial information and how they would safeguard it.
The letter I received confirmed that Statistics Canada had, in fact, accessed my complete credit history. It was apparently protected though; the letter went on to explain that any personal information that could identify me had been scraped from my financial information. They had only recombined the information and re-identified me in order to fulfill my request (Click on the image to the below right to read the full letter).
Then they tucked these sensitive records, which contain my complete credit profile, into an envelope, attempted to close it with two pieces of scotch tape, and sent it to me in the mail.
Two pieces of scotch tape.
Forget for the moment that I had asked for electronic copies of my records and that Statistics Canada made a choice to print this sensitive financial information and send it through the mail.
Please also forget that the envelope was addressed to the wrong person.
Because I’m able to open the package, read the letter from Statistics Canada detailing the importance of safeguarding my personal financial information, flip through several pages that contain my Social Insurance Number, birth date, address, contact information, all of my banking information, including available credit, debts, accounts, balances, and more—and then I’m able to seal the envelope closed again with those same two pieces of scotch tape.
I would never know if this envelope had been opened prior to arriving at my residence.
If Statistics Canada does, in fact, take privacy seriously and does believe that it can responsibly hold the detailed and sensitive financial records of Canadians, then it needs to be able to comply with the Privacy Act in a way that doesn’t mean sacrificing privacy. That is the tragically ironic position that Statistics Canada finds itself in.
Here is one possible solution that Statistics Canada could consider employing as an additional “essential security measure”: Send an encrypted CD-ROM through the mail and provide a password in a separate letter or through email. This two-step authentication method means that anyone who interrupts the original package won’t have access to the sensitive records that Statistics Canada holds.
It would also mean providing access to the records through the means that I had initially requested.
But Statistics Canada made a choice about how they were going to respond to the request that I made through the Privacy Act. In doing so, they both fulfilled my request and put my privacy at tremendous risk. Perhaps, they were trying to send a message: Don’t bother us about our security measures if you want your data to be kept safe.
But alas, there is a saying that goes something like, “Attribute not to malice what can be attributed to incompetence.” This example illustrates why Statistics Canada shouldn’t have access to the sensitive financial information of 500,000 Canadians.
In era where trust in public bodies is eroding, and progressive technologists look towards adopting decentralized models like block chain, our government needs to be rebuilding trust. For Statistics Canada, that starts with taking decisive steps towards protecting the privacy of Canadians, of doing the fundamental work to earn the trust of its stakeholders.
And, quite frankly, two pieces of scotch tape won’t cut it.
Bryan Short is the Program Director at BC FIPA. He holds a master’s degree in Journalism and a bachelor’s degree in English Literature from the University of British Columbia.