"Policy Scan" Survey
Identification & Authentication
Issues in Canada

Summary Report

February 2005

Table of Contents

• Introduction
• "Policy Scan" Survey
• Executive Summary
• Key Findings
• Discussion Questions
• Appendix "A"

Introduction

Identity Theft. Identity Cards. Biometric Identification. Radio Frequency IDentification (RFID) tags. Unique Identifiers. Identity Management. Identity-related issues are hot topics these days. There is every indication that identity and identification issues will be among the top political, economic, and technology news stories in the coming months and years.

Identification (and its close relative, authentication) is a concept so broad and so fundamental that it intersects with an extraordinarily wide spectrum of public policy, marketplace and social issues. Indeed, often we don't immediately recognize the identity issue because it is framed in terms of, for example, security, or convenience, or compliance with law and regulation.

Our lives are being profoundly affected by identity-related issues, policies and practices. Yet there seems to be no obvious focal point for people to understand causes and effects. There seems to be no "home" for the public to go to become engaged in identity-related matters.

Where do the Canadian privacy commissioners fit into this scenario? Despite having differing mandates and powers, all share common concerns about the creation, collection and use of personally-identifiable information. Identity and privacy are closely intertwined in many ways. Indeed, the more personally identifiable the data, or the more intensively that data is used, then the more likely it will be subject to privacy legislation (and to the "fair information principles" upon which that legislation is based) and therefore to the oversight and enforcement offices. What can we learn about identity and privacy issues from Canada's privacy commissioners?

"Policy Scan" Survey

Canadian privacy commissioners discussed the matter in 2004 and agreed to share their experiences and thoughts on the subject. In an effort to draw together the views of colleagues and to facilitate further discussion, the federal privacy commissioner prepared a survey on identification and authentication issues that was circulated at end-2004. The 17-question survey was organized into three main parts: (1) definitions; (2) facts, trends, opinions; and (3) recommendations and actions. A copy of the survey questions is attached as appendix "A".

This report summarizes the results of the survey responses. It also offers some possible questions that arise from those conclusions. The intent is to promote understanding, discussion and action about vital identity and privacy issues that affect all Canadians.

Executive Summary

From the commissioners' responses, the portrait that emerges is one of broad heterogeneity of interests, concerns and priorities. On many identification questions and issues, there is a lack of clear consensus. Engagement by commissioners has generally been ad hoc, reactive and episodic in nature. However, there is strong support for enhanced public education and discussion about certain privacy and identification matters, and much interest in a participatory role by commissioners' offices in shaping public understanding and debate.

Key Findings:

1. No common definitions or vocabulary exist to address identity and authentication issues

   Legislated definitions are few; terms such as "identity"; "identification"; "authentication"; "verification"; "authorization", and "anonymity" are used frequently but in a somewhat ad hoc manner in a variety of working contexts. Most attention and work has focused on definitions of "personal information" and to some extent on "anonymous" or "de-identified" data (particularly in the health research sector).

2. Guidance on definitions has been largely informal in nature, or ad hoc in response to specific issues or complaints

   Notable issues cited include: (a) national identity card proposal; (b) actual and proposed uses of unique identifiers by government agencies; (c) the reasonableness of identification requests; (d) the design and use of access controls and audit trails (especially in the health sector). Privacy impact assessments can provide useful a occasion for review and guidance.

3. Requests for identification are becoming more widespread, frequent, mandatory and subject to stronger authentication — however this perception is anecdotal not empirical

   There was strong consensus on this question. The most frequent examples cited were new and mandatory ID requirements in the transportation sector, notably at airports and at border crossings. In general, governments are pursuing stronger ID methods as a condition of providing access to service or benefits. On the retail side, "Frequent shopper" cards are routinely requested at many stores "for the completion of even minor cash transactions". It is becoming more common to require two pieces of ID to open, or to access, client accounts. Some businesses are demanding more identity information in order to evaluate and screen clients. Authentication often takes place after the fact, for example, when confirming references and performing credit or background or criminal records checks.

4. Few formal complaints have been received; more inquiries and expressions of concern

   Concerns often arise in response to media stories. Identification requests by the retail sector are a recurring issue (often in with complaints about poorly trained front-line staff).

5. Commissioners issued policies, findings, opinions or guidance in diverse issues and areas; the most widely cited activities dealt with the unique identifiers, data matching activities, and identity theft risks posed by public sector initiatives

   Identity Cards — Many provided critical input into the federal government's national ID card consultations, to certain provincial "smart card" projects, and towards the tightening of procedures for issuing and using "breeder" documents.

   Identity Theft — Many are contributing to various government initiatives and multi-stakeholder groups dealing with identity theft. There have been several investigations into the "leakage" of confidential personal information.

   Unique Identifiers — Some were actively opposed to creating and using any globally-unique identifiers such as social insurance, health care or drivers' licence numbers. Work on the electronic health record (EHR) was mentioned as a current area of activity.

   Data Matching/Mining/Sharing — Responding to public concerns about the outsourcing of personal information storage and processing, one office published a detailed report and recommendations regarding data matching and mining. Others took actions to end illegal sharing of personal information by a provincial agency with federal authorities, and to end the wholesale bulk sharing of motor vehicle licence information.

   Data Retention / Backup Tapes — Cited as a "persistent issue" under provincial health privacy laws, ongoing work has been undertaken regarding design and operation of information and document management systems.

   Re-identification of data — of particular relevance for health research where anonymized or aggregated data is often used, and also for the Access to Information mandates, where personal information must be severed from records subject to FOIA requests.

6. Commissioners expressed concerns about a wide range of trends and risks associated with requirements to identify or authenticate oneself, with no clear consensus

   Numerous trends were cited, including: (a) stronger online authentication; (b) instant or near real-time authentication; (c) excess collection of personal information; (d) data warehousing, matching, mining, and profiling; and (e) social sorting and discrimination.

   Major privacy risks cited included:

   • Unique Identifiers: (e.g., SIN): concerns were expressed about secondary uses without consent, function creep, and the potential for profiling and discrimination, especially where effective choice and autonomy of targeted individuals is diminished.
   • Public-Private Partnerships: some see risks in the trend towards greater sharing of personal data between the private sector and governments, such as passenger information, customer data, and Internet usage data.
   • Excess Collection and Use: Concerns were expressed about the growing collection, use, and the "ever-expanding retention" of personal data, leading to heightened risks of identity theft.
7. Opinion surveys on identification and authentication have not been undertaken

   Respondents indicated they generally do not carry out surveys. However, at least one office has commissioned a survey, although not specifically targeting identification and authentication issues.

8. Support for a formal "national identity policy" or framework is lacking. However, there is strong support for a more informed and engaged public in identity-related issues, and for commissioners playing an instrumental role

   Commissioners did not recognize a need for a formal identity policy or framework. The idea was roundly rejected as either too vague and too ambitious. However, there was strong consensus that the public needs to become better engaged on these issues: commissioners indicated an "emphatic yes" to greater public awareness and debate by Canadians. They also indicated that public policy makers and elected officials should properly lead the process and make final decisions, but that the commissioners can and should play a useful contributory role in any debate. For example, commissioners could help shape the debate by framing or defining key issues.

9. Identity issues most likely to engage the public include: fighting ID theft, enhancing security, and improving access to systems and services

   Commissioners were divided on whether the scope of any public debate on identity issues should be broad or limited. The top three issues suggested were: fighting ID theft; enhancing security; and improving access to systems and services. Other issues included: appropriate roles of law enforcement and crime prevention activities; pros and cons of greater use of identity documents; the impacts of certain large-scale public sector IT projects; impacts of information and communications technologies; individual surveillance and profiling issues; and clarifying and confirming the privacy rights of individuals.

10. Commissioners indicated awareness and participation in a variety of external initiatives dealing with identification and authentication

    Examples include:

    • e-government access and authentication;
    • enhancing the security of drivers licenses and other root documents
    • reforming health number identification procedures; and
    • developing tools to combat identity theft.

    Work undertaken by the National Health Infoway was specifically mentioned, as was the Federal/Provincial/Territorial Council on Identity - a consortium of vital statistics agencies working to improve identity documents and processes in Canada.

Discussion Questions

• Are there definitions that can be commonly agreed and consistently used? Conversely, are there poor or misleading definitions in current use by others that should be opposed or rebutted?
• Related to the above, are there guiding messages that can be consistently applied? (e.g., identity is highly context dependent), or rebutted (e.g., authentication can apply to attributes and privileges, not just physical identity)?
• Where and how could perceptions of identification trends be validated through empirical research? Where could research be best applied? Who would do it?
• Which identification and authentication trends are most troubling?
• Is the low number of formal complaints explained by any of the following possibilities:
  (a) relative unconcern by the public about the issues?
  (b) inability of the public to articulate specific concerns?
  (c) low visibility and awareness of the commissioners' offices and means available?
  (d) poor perceptions about the efficacy of the formal complaint process?
  
• Are there specific issue areas that may be "seized" or otherwise defined by commissioners through concerted action? Are there issue areas that invite greater collaboration or resource pooling? Are there central messages or principles that might be uniformly advocated?
• Is there merit in carrying out any surveys of attitudes and experiences on identity-related topics? Would there be interest in the results of such surveys if they were carried out by other organizations? What sort of survey would be of most interest and use?
• Is there a single issue, or cluster of issues, or theme that could engage individuals and the privacy community in public debate? What other conditions or factors, if any, might be necessary?

APPENDIX "A"

A) Definitions

"Identity", understood as both a sense of self and a set of attributes ascribed to us by others, is essential to the concept of privacy. Do you agree?

B) Facts, Trends, Opinions

In your opinion or experience...

C) Recommendations / Actions