Date: March 2018
Program manager: Director, Administrative Data Division
Reference to Personal Information Bank
In accordance with the Privacy Act, Statistics Canada is developing a new institutional personal information bank (PIB) to describe the personal credit and financial information Statistics Canada has obtained from public and private sector sources for the purposes of the Statistics Act, including but not limited to the following programs: Financial and Wealth Accounts, Distributed Household Economic Accounts, Canadian Housing, and Income Statistics Programs. Amongst other sources of administrative data, Statistics Canada is obtaining from Trans Union of Canada, Inc. ("TransUnion") fifteen years' worth of current and historical data variables containing personal and credit information that TransUnion has collected in Canada, with the possibility of collection of data in additional years.
Description of statistical activity
Statistics Canada obtains personal information from surveys and various administrative sources under the authority of the Statistics Act. More specifically, under Section 13 of the Statistics Act Statistics Canada can require from third party organizations the disclosure of information that would assist Statistics Canada in fulfilling its mandate or that would aid in the completion or correction of that information. To that end, Statistics Canada will be acquiring personal and credit information from TransUnion. The acquisition of personal credit and financial information from credit and financial institutions, such as TransUnion, will reduce the burden of statistical enquiries on respondents and provide a lower-cost, higher frequency and comprehensive alternative to the more traditional survey-taking approach.
The acquisition of this data necessarily requires the collection and use of personal information. However, Statistics Canada will use the information for statistical purposes only, in support of its mandate, as required by the Statistics Act. Under no circumstances will the personal information obtained from credit and financial institutions be used to produce a credit registry or personal credit scores, to review the credit history of individual Canadians or to perform credit checks on individuals Canadians. The personal identifiers obtained from TransUnion will be used to generate a statistical identifier for linkage purposes, and to correct or complete personal information that Statistics Canada has collected in the ordinary course of its operations, and will then be deleted.
The credit and financial information collected from organizations like TransUnion will be used to create a statistical database in support of various statistical programs in the economic and socio-economic fields, including but not limited to the Canadian Housing program, National Economic Accounts and Income Statistics Divisions. To achieve its statistical objectives, Statistics Canada will integrate these data with other sources of information held by Statistics Canada once approval has been obtained in accordance with the Directive on Microdata Linkage. Statistics Canada will only make anonymized, aggregated statistical information on Canadian households publically available and as such, individuals will not be identifiable in any product disseminated to the public.
Reason for supplement
While the Generic Privacy Impact Assessment (PIA) addresses most of the privacy and security risks related to this statistical activity, this supplement describes the additional safeguards being implemented for collection, processing and use of the credit and financial information due to the highly sensitive nature of this data, the breadth and depth of the data set and the possible concerns of Canadians about the intrusiveness of the collection.
The Generic PIA also presents and addresses the privacy principles and levels of potential risk, which apply to the collection and use of the credit and financial information.
Necessity and Proportionality
The collection of personal credit and financial information from TransUnion can be justified against the four-part test proposed by the Office of the Privacy Commissioner of Canada:
- Necessity: In order to meet its statutory mandate, Statistics Canada may collect data directly from records created by other organizations for their own business uses. The TransUnion data files would allow Statistics Canada to create more granular and comprehensive statistical aggregates about household credit and the housing market than it is capable of creating with its current data sources.
- Effectiveness: The collection and use of the TransUnion data will be effective in meeting Statistics Canada's objectives because it is comprehensive and current. It will reduce administrative burden on the collection of the data from Canadian and will likely result in a higher degree of accuracy in responses than standard Statistics Canada collection through surveys.
- Proportionality: Although a significant amount of personal information will be received by Statistics Canada, it will used primarily for linkage purposes and secondarily to enhance missing or outdated information in its Statistical Registers. Once the primary and secondary uses are fulfilled, the personal identifiers will be deleted or destroyed from the files obtained from TransUnion.
- Alternatives: Although alternative data is available, it does not provide data at a level of granularity that supports Statistics Canada's mandate. The collection and use of the personal and credit information is being designed in such a way to minimize the collection and use of individualized data.
Mitigation factors
This section defines the specific safeguards put in place for this activity at the various stages of the statistical business process including collection, processing, analysis and dissemination, in addition to the standard security measures, which apply to all confidential information collected by Statistics Canada. While regular procedures are already described in the Generic PIA, they are included here for a comprehensive record.
Collection
The information will be transmitted electronically to Statistics Canada using a secure file transfer protocol.
Consent/Notification
In keeping with the requirements of consumer reporting legislation and in furtherance of transparency, when Statistics Canada acquires administrative data from TransUnion, the individual consumer will see a notation in (also called an inquiry) their credit file. However, that record has no impact on the individual consumer's credit rating.
Limiting Collection
The personal information disclosed in the list of current and historical data variables has been reviewed by Statistics Canada to ensure that it is only requesting the variables required to meet the stated objectives. It will be reviewed periodically to ensure the list remains valid.
Limiting Use, Disclosure and Retention
Statistics Canada will receive personal and credit information from TransUnion and will use that personal information to process and integrate the data with data received from other external and internal data sources and to enhance missing or outdated information. Following integration, Statistics Canada will destroy the personal identifiers on the files received from TransUnion and retain only depersonalized credit attributes. Depersonalized credit attributes will be retained and used while they remain relevant for the stated statistical purposes.
Storage
All Systems with access to any confidential information employs logical access controls at the device and network level. All Systems must have functional and current antivirus software. Network firewall and access rules are in place to prevent access by an employee who does not have work-related need to know. Network firewall rules are also in place such that no system processing any confidential information can be accessed at the network layer by a system outside of the secure area.
Processing
The identifiers and data files will be stored on its own unique, secure servers. The servers that will host that information will be housed in a secure location with access restricted to the designated individuals from the aforementioned programs as per each program's operational requirements provided they provide the necessary justification and obtain the approval from the director of Administrative Data Division. Furthermore, all access permissions are only applicable for a set duration of time and must be regularly renewed including justification and re-approval.
After initial processing, a statistical identifier will be generated by Statistics Canada to facilitate data integration. As per standard practice, following linkages with other sources of information, data will be stripped of identifiers such as name and address, to help to protect confidentiality.
Access
Access to any confidential data held by Statistics Canada is closely monitored. Financial information will be provided in separate files from the personal identifiers, further reducing any risk of breach of identifiable personal information. For information with personal identifiers, only a limited number of employees with work-related need will be allowed access. For example, only 2 Statistics Canada employees from the National Economic Accounts Division will be permitted access to the files containing personal identifiers.
Dissemination
The Statistics Act provides the legal basis for maintaining the confidentiality of personal and business information that Statistics Canada collects. Statistics Canada will not disclose confidential information to any third party, other than with the permission of the original data provider and the authorization from the Chief Statistician, as required by the Statistics Act.
Statistics Canada will publish only anonymized, aggregated statistical information as part of its general dissemination strategy. For example, the outstanding balances of a consolidated set of credit card and other loan types aggregated by province and territory would be made available as part of the estimates contained in the Distributed Household Economic Accounts, which publishes the income, consumption, savings and net worth of households by various groupings such as age, sex, geographical region, and income quintile.
Openness
A summary of the supplemental PIA will be publicly available on the Statistics Canada website as an addendum to the Generic PIA. In addition, when consumers refer to their TransUnion credit report, they will see a 1-800 number to which they can direct their inquiries. That number provides a recorded message to explain the collection and use of the administrative data for statistical, not credit-related, purposes. In the event the consumer requires additional information, the consumer is directed to the pages of the Statistics Canada website that deal with administrative data. In addition, Statistics Canada has prepared FAQs and speaking points to assist its internal staff to deal with inquiries from the public. TransUnion and Statistics Canada will collaborate on additional communication materials, if needed.
Conclusion
This assessment concludes that, with the existing Statistics Canada safeguards and additional safeguards that have been put in place, any remaining risks are such that Statistics Canada is prepared to accept and manage the risk.