Media Centre

Statistics in the Age of Google

Statistics Canada in 2015: The future is here, are we ready?

January 31, 2006
Ottawa, Ontario

Address by Jennifer Stoddart
Privacy Commissioner of Canada

(CHECK AGAINST DELIVERY)

I am pleased to speak to you today, particularly as we all work to address the privacy implications of the 2006 Census.

Privacy and confidentiality issues are of necessity important components of your thinking about the 2006 Census. A paper prepared for a 2003 Statistics Canada symposium acknowledged this when it spoke of increased privacy concerns expressed by Canadians about the Census. Privacy awareness was no longer limited to a few, the paper observed, and assurances by Statistics Canada of privacy protection did not appease every Canadian household. Perhaps of greatest significance was the comment in the paper that "inaction in addressing privacy concerns would lead to a negative impact on data quality, response rates and potentially cost millions of dollars to conduct follow-up activities." In short, you recognize that public confidence in the integrity of Statistics Canada is the sine qua non of your ability to collect and analyze the information that is so vital to governments, businesses and individuals in Canada.

Like the rest of us who deal with privacy issues, those working at Statistics Canada face a different world, a world characterized by sophisticated search engines like Google, and by powerful commercial and governmental interests that salivate over new ways to connect disparate pieces of information in their quest to profile humankind. Some of that information comes from Statistics Canada’s work. The Department must address the privacy issues in the context of this different world if it is to retain its international pre-eminence in the field of statistics, and if it is to retain the trust of Canadians. Even the strength of the confidentiality protections offered by the Statistics Act does not prevent privacy concerns from arising about the activities of Statistics Canada, particularly as your research is paired with new technologies. In a world characterized by so much unregulated information gathering by the public and private sectors, we need to re-examine Statistics Canada’s role.

Even though Statistics Canada has an admirable record for protecting confidentiality, it cannot help but be affected by public concern about the misuse of personal information by other government institutions in Canada and abroad. I suspect that many of you roll your eyes when you hear of a slipup elsewhere in government in the handling of personal information, because you know that the public often perceives government as a monolith. Statistics Canada ends up tarred with the same brush.

My Office has had many interactions with Statistics Canada. I am pleased to say that these interactions have been both respectful and constructive.

Over the years, we have identified a range of privacy issues. Our 2000-2001 annual report raised concerns about the need for Statistics Canada to be cautious when releasing information about identifiable groups. Such disclosures may not identify any specific individual, but they can still have an impact on individual privacy because information about the group can diminish the individual privacy of every member of that group. This may not contravene the Privacy Act, but it does have important implications for privacy in general.

This is not just a matter of inconvenience for individual members of that group. There could be substantial implications – for example, resulting from a study of mental illness in a small neighbourhood, or a study of an identifiable group with a high rate of HIV infection.

Five years later, we face additional challenges. Google Earth gives us all ready access to satellite imagery – we can now peer down into our own back yards, or those of our neighbours. Marketing databases, public online directories and powerful search engines, when used in combination, produce increasingly fine details about us. Left unchecked, these technologies can produce a privacy nightmare. But technologies should not be unchecked. Technology should not dictate the limits of our human rights. And technology should not be allowed to set the boundaries of our informational rights. Just because technology allows someone, or some organization, to produce a highly detailed profile of your activities, does not mean that this should be allowed to happen. Privacy should impose limits on the uses of technology. Technology should not dictate the extent of our privacy. Otherwise, we might as well throw in the towel in trying to defend this fundamental human right, because we know that technology will continue to provide new and more efficient means to intrude.

And we must be careful about putting too much faith in the Statistics Act. The Act provides strong confidentiality safeguards, it is true, but it is simply a piece of ordinary legislation. The Act’s confidentiality safeguards can be amended in the blink of a parliamentary eye with provisions that make the information garnered by Statistics Canada part of an excessive national security apparatus of the Government.

In case you think this scenario is far-fetched, let me remind you of the program that was proposed in the United States a few years back under the acronym "TIA". TIA originally stood for Total Information Awareness, a proposed project that would vacuum up information held in both private sector and public sector databases with the goal of identifying suspicious patterns of behaviour. In a bid to appease those who were – rightfully, I might add – concerned about the potential for massive intrusions into the lives of individuals, the project name was changed from "Total Information Awareness" to "Terrorism Information Awareness" – a change that brought little comfort to anyone concerned about safeguarding privacy.

Fortunately, the US Congress did not fund the TIA program, although some observers suggest that "mini-TIA" programs will spring up in their place. Just days ago, the BBC reported that the US Justice Department had requested the Internet search engine Google to hand over a week’s worth of search data. The report claimed that Google handles between 500 million and a billion searches each week. This request of Google did not involve handing over any information about the search habits of individual users. However, one day it might, and technology can easily help government if it does. This is reminiscent of the Hollywood movie, "Field of Dreams," where one of the characters encouraged building a baseball diamond. "Build it and they will come," he famously said. In our context, that advice it is more like a warning: "Collect it, and organizations will come looking for it."

What is the message in this for Statistics Canada? Simple. Despite your best intentions, despite the confidentiality protections in current law that have allowed Statistics Canada to gain the trust of Canadians and work so effectively over the years, those protections can vanish very quickly. We therefore all have a vested interest in seeing governments explore means other than ever-increasing surveillance when they confront the very real problems of our world, including terrorism and other forms of crime. Otherwise, overwhelming surveillance may be the response, and still it will not solve the problem. That in turn will lead to calls for even greater levels of surveillance which still will not prevent harm as long as the issues underlying the violence remain unaddressed.

Let me turn to just of few of my current concerns with Statistics Canada. A major issue is the partnership between Statistics Canada and Health Canada for the Canadian Health Measures Survey (CHMS). This survey will directly measure physical indicators of chronic diseases, infection diseases, environmental toxin exposure, and physical activity and fitness levels from a nationally representative sample of 5,000 Canadians aged from 6 to 70.

More than 350 respondents participated in a pilot study for this survey in Calgary in 2004. The study involved in-home interviews conducted by trained Statistics Canada interviewers. Respondents were questioned on matters such as nutrition, smoking habits, alcohol use, medical history, current health status, sexual behaviour, lifestyle, physical activity, as well as demographic and socio-economic issues.

The study also involved trained health professionals taking physical measures of respondents in designated clinics. These included taking readings of the respondent’s height, weight, blood pressure, oral health, physical strength, among other indicators of health. The measures also included the taking and analysis of blood and urine samples to assess nutritional status, evidence of diabetes, cardiovascular diseases, exposure to environmental toxins, infectious diseases, and diseases affecting the kidney. Specimens would be destroyed following the operational phase of the pilot study.

My Office was consulted in the planning phase of this pilot study. We offered advice on the notice and consent forms, advice which was subsequently reflected in the questionnaire material. We made suggestions about the sharing of test results with respondents; these suggestions were also adopted for the pilot study. We raised concerns about the handling of reportable diseases, which might conflict with any promise of confidentiality, and with specimen storage and use.

The survey has now entered a second phase – that of the main survey. Last autumn, representatives from my Office received a presentation on this phase. The main survey differs in one very significant way from the pilot survey. In the main survey, blood and urine samples collected for immediate tests will also be stored for future as yet unspecified analysis, including DNA analysis, and for an indeterminate amount of time.

Statistics Canada has identified many reasons for retaining biological samples for an extended period of time. For example, it states that retaining the samples will allow scientists to identify gene-based vulnerabilities to certain diseases. This could be useful in developing cures. It also suggests that if new infectious diseases emerge, it would be possible to go back to the stored samples and examine the extent to which the disease was latent in the population.

Samples will be given a bar code label with no information that could identify an individual respondent. Although meaningless on its face, the bar code is necessary to link test results with respondent data. Only a small number of Statistics Canada employees will have access to the correspondence between the code and the identity of the respondent.

A further level of protection will be introduced for the stored samples after the initial tests on the samples. The initial bar code will be replaced by a second code by the data custodian. This double coding or encryption model requires that the data custodian be consulted before any data reconciling is done since they and they alone hold the link to the original bar code number which could be linked to respondent data. This system ensures that the data is anonymous not only to the data custodian, but also to researchers doing tests on the stored samples.

Finally, the release of samples for as yet unspecified research projects will be strictly controlled by a Research and Ethics Board (REB) which will almost certainly impose strict confidentiality conditions. Is the Board equipped to fully respond to the complex bio-ethical issues in the context of the privacy management framework that Statistics Canada has developed, over the years, to ensure the integrity and confidentiality of its information assets? The ethical issues cannot be divorced from the management issues and the board will need to be appropriately resourced to prevent the risks.

Before undertaking the survey, Statistics and Health Canada intend to consult with the Public Health Agency of Canada, the Canadian Institutes of Health Research and other stakeholders, including federal and provincial privacy commissioners and the general public, to ensure that the study fully addresses any privacy concerns that may emerge.

Notwithstanding these fairly robust privacy and security safeguards, the very nature of the proposal raises significant public policy and ethical questions regarding the collection, use, retention and disclosure of such information for research purposes. Statistics Canada has advised my Office that a Privacy Impact Assessment will be prepared for the survey.

We are awaiting receipt of the Privacy Impact Assessment. My Office does not want to impede important research, but it does have a responsibility to Canadians to review in some detail the collection and use of biological samples by government. And let me be clear that we will be looking at trends across large, interoperable systems that are being created in support of national public safety and public security imperatives.

The Lockheed Martin Canada outsourcing arrangement highlights another area of privacy concern. In November 2004, Statistics Canada advised us that they agreed to change the scope of 2006 Census work to be done by a group of private companies, including Lockheed Martin. This was due to public perception that the privacy and confidentiality of Canadians’ information might be compromised under the original outsourcing arrangement.

Under the original plan, Lockheed Martin Canada would process personal data about Canadians. There was real concern that this personal information would be accessible by the U.S. parent company. As my Office has witnessed with the debate over the USA PATRIOT Act, which expands access by the FBI to information held by companies in the United States, Canadians are concerned, and rightly so, about having their personal information leave Canada. Once outside Canada, that information could lose protections offered by Canadian law.

The contractual arrangement between Statistics Canada and Lockheed Martin Canada has since been substantially revised. Lockheed Martin is no longer responsible for processing census data. This will now be done exclusively by Statistics Canada personnel on Statistics Canada premises. Lockheed Martin will be restricted to providing hardware, software, printing and support services.

With these changes, many of the concerns about the possible transfer of confidential census data outside Canada have been addressed. However, some privacy issues remained. My Office was concerned about the company’s personnel having access to confidential census data in the course of providing system maintenance and support services. In response, Statistics Canada undertook to introduce several amendments to the contract with Lockheed Martin.

In short, Statistics Canada revised its agreement with Lockheed Martin Canada and its sub-contractors to provide a more robust framework for the protection of the personal information of Canadians collected through the census project. In addition to this, our Audit Team will be carrying out an on-site review of the processes in place at Statistics Canada for the 2006 census, including the Lockheed Martin arrangement in particular. The discussions between representatives from Statistics Canada have produced significant results, and I am taking this opportunity publicly to thanking Dr. Fellegi and his team, namely Pamela White and Anil Arora, for their cooperation in addressing potential privacy risks to Canadians associated with the Census.

On a more general note, let me suggest that Statistics Canada has an additional role to play in privacy matters. The world beyond your agency can learn from you. How can we take the confidentiality mechanisms in the Statistics Act and in departmental procedures and apply them to the world, both governmental and private sector, outside the Department? What lessons can the strong confidentiality protections in the Department give to those operating in the world of electronic health records and telephone records? What can you teach them?

Conclusion

Statistics Canada has an enviable record for preserving confidentiality. That is in part what allows it to do its internationally respected work. We recognize the value of so much of the work that is being done. We will continue to work with you to build privacy into the design of Statistics Canada projects. But we must remember that the social, economic and technological landscape is changing in a way that poses added risks to privacy. Statistics Canada must be able to adjust to those changes in a way that allows it to do its work, yet at the same time protect this fundamental human right. The cost of failing to do so, in this age of Google, is simply too high.