On October 26, 2018, Andrew Russell and David Akin of Global News broke the story that Statistics Canada planned to collect the banking data of half a million Canadians without their knowledge and consent. The data seizure would include bill payments, cash withdrawals from ATMs, credit card payments, electronic money transfers, account balances and social insurance numbers from nine financial institutions to develop a “new institutional personal information bank”.

The media storm that erupted, accompanied by daily uproar in the House of Commons, continued through October 31, 2018, when the Privacy Commissioner of Canada, Daniel Therrien, announced that his office had opened an investigation. On November 8, 2018, testifying before the Standing Senate Committee on Banking, Trade and Commerce, Mr Therrien said the investigation was the result of fifty-two complaints received by his office and was “not an invitation from Statistics Canada”. In his opening statement to the committee, Mr Therrien characterized the issue this way:

“I have often spoken publicly about the need to modernize our privacy laws, in both the private and public sectors. One of my recommendations, first made in March 2016, is particularly relevant in this instance: that the Privacy Act be amended to require that the collection of data by public sector organizations be authorized not when relevant or useful to government programs, but only where necessary and when the scope and breadth of the data collected is proportional to the public policy goals the data is intended to serve.”

Mr Terrien was reported as testifying that StatsCan failed to disclose details of the proposed collection to his office and had fallen “way short” if its objective to be transparent. “The measures that Statistics Canada took,” he said, “were deficient on the issue of transparency for sure.” Caught in the cross hairs, Canada’s Chief Statistician, Anil Arora, announced that the agency’s proposed launch in January 2019 was being delayed because the public outrage was “not the kind of reaction that we were hoping for”. (See: Andrew Russell and David Akin. Stats Canada requesting banking information of 500,000 Canadians without their knowledge. Global News. October 26, 2018; and, Bill Curry. Statscan willing to delay launch of plan to obtain personal banking records but insists it’s ultimately necessary. The Globe and Mail. November 2, 2018)

What, then, is the legal regime under which StatsCan purports to act? The question raises a constitutional one that implicates ss 7 and 8 of the Charter of Rights that will be my focus here.

Statistics Canada is a “statistics bureau” created by the Statistics Act, RSC 1985, c S-19. StatsCan’s duties are enumerated in s 3 which includes the collection of statistical information relating to “the commercial, industrial, financial, social, economic and general activities and condition of the people”. When the bureau acts to compel access to records, it does so under s 13. I will set out the section in full because it is at the heart of this controversy:

“13   A person having the custody or charge of any documents or records that are maintained in any department or in any municipal office, corporation, business or organization, from which information sought in respect of the objects of this Act can be obtained or that would aid in the completion or correction of that information, shall grant access thereto for those purposes to a person authorized by the Chief Statistician to obtain that information or aid in the completion or correction of that information.”

Two things are immediately striking about the section. It is mandatory and virtually limitless in scope. Can it, therefore, survive scrutiny under the Charter? I have concluded that the seizure power conferred by the statute may not be unreasonable under s. 8 because it is administrative in nature. But it is nonetheless overly broad and thus violates s 7. Here’s why.

The enduring tension in the law of search and seizure is between the right of the individual to be left alone and the right of the state to intrude on the individual’s privacy in furtherance of its legitimate goals. That tension was recognized in the early Charter cases, particularly in Hunter v Southam Inc, [1984] 2 SCR 145, where the Supreme Court of Canada held that the standard of prior judicial authorization based on probable cause was applicable to the reasonableness of a search or seizure in a criminal investigation. The seizure of records or data such as banking information is now often done in criminal investigations by way of a production order issued by a judge under s 487.014 of the Criminal Code.

But StatsCan is not an investigative police agency. According to sub-sec 3(e) of the statute, its general duty is “to promote and develop integrated social and economic statistics” pertaining to Canada and the provinces and “to co-ordinate plans for the integration of those statistics”. The seizure power contained in s 13 is therefore not investigative but administrative or regulatory in nature. In Johnson v Ontario (1990), 75 OR (2d) 558 (Ont CA) Justice Louise Arbour held, at para 14, that the Hunter standard of reasonableness will not apply “to every search and seizure authorized by legislation” and departures from it have been upheld in the regulatory context. And, in Dalrymple v Halifax, 2017 NSCA 6 Justice Peter Bryson held, at para 37, that “constitutional scrutiny of regulatory legislation may be diminished owing to the salutary effects of the social purposes addressed and the modest intrusions upon privacy and penalties involved”. (See also: R v McKinlay Transport Ltd, [1990] 1 SCR 627 per Wilson J, at para 21)

Irrespective of whether the statute may be construed as regulatory or administrative in nature, it is clear what it is not. It is not criminal or quasi-criminal legislation regardless of the maximum monetary penalty of $1,000 that may be imposed for non-compliance under s 32. While regulatory statutes incidentally create offences, such offences are primarily enacted to encourage compliance. They do not alter the underlying purpose behind the exercise of the powers conferred by the statutes themselves. Although the seizure power under s 13 is highly intrusive, and although Canadians have a high expectation of privacy in their banking information, the weight of judicial authority favours reasonableness under Charter s 8 scrutiny. (See: Comite paritaire de l’industrie de la chemise v Potash, [1994] 2 SCR 406 per La Forest J, at para 13)

That, then, takes me to the core of the constitutional issue. Does s 13 of the statute violate s 7 of the Charter which protects the right to security of the person? Does the section put Canadians’ banking data at increased risk of privacy breaches given the abysmal record of government departments in protecting digital information? Is s 13 overly broad in scope?

Professor Teresa Scassa, of the University of Ottawa, Faculty of Law, in a post to her blog titled Statistics Canada faces backlash over collection of personal financial information (or: Teaching an old law new tricks) dated October 31, 2018, made the point that the Statistics Act was drafted in a “pre-digital, pre-big data era”. It is yet another example of the disfunction of an analogue law in the digital world. “[T]he original drafters,” wrote Professor Scassa, “no doubt contemplated a collection activity on a much more modest scale”. The section, of course, speaks about “documents or records” and not “data”. The data dump StatsCan is after is hardly a modest intrusion on the privacy interests of the half million Canadians whose financial lives will fall into its clutches. As Professor Scassa went on to say, “[t]ransparency requires an amendment to the legislation that would specifically enable the collection and use of digital and big data from the private sector for statistical purposes”. An amendment would also allow for the “shaping of limits and conditions” governing the acquisition of this form of data collection.

Any amendment must address concerns that arise from the overbreadth of the section and the absence of a mechanism for independent oversight. The statute does not contain a requirement that data be anonymized at source before it is transferred to StatsCan. Data is simply harvested by an agent of the state that says: “Trust me.” For the section to be transparent for constitutional purposes the Chief Statistician must also be accountable. Reporting to the Minister each fiscal year under sub-sec 4(6) is inadequate in the digital world.

The gathering of statistical data regarding “the condition of the people” may be of pressing and substantial concern to the social and economic fabric of Canada although the Prime Minister did not make much of a case for that during the debate in the House. The reason may be succinctly put. And this is my point here. The section is not rationally connected to the objectives of the statute when anonymized data is adequate for statistical purposes. The section is thus overly broad and cannot be demonstrably justified in a free and democratic society.

An overbreadth analysis must take account of the means chosen by the state in relation to its purpose. As Justice Peter Cory held in R v Heywood, [1994] 3 SCR 761, at para 49: “If the state, in pursuing a legitimate objective, uses means which are broader than is necessary to accomplish that objective, the principles of fundamental justice will be violated because the individual’s rights will have been limited for no reason.” The effect of the overly broad reach of s 13 is that it is disproportionate to the legislative objective and therefore violates s 7 of the Charter. And that mirrors the position advocated by Mr Therrien in his opening statement to the Senate committee – the collection of data by state agencies should only be authorized when “the scope and breadth of the data collected is proportional to the public policy goals the data is intended to serve”.

The bulk collection of non-anonymized data compromises the privacy and security of the individual by exposing personal information to the prying eyes of the state. It enables the state to construct mosaics of the targeted individuals – their political affiliations, religious beliefs, sexual behaviour, their health and personal interests – by using electronic financial transactions as the gateway. These kinds of transactions allow inferences to be drawn about the people behind them. An activist makes electronic purchases at a book store in Vancouver that specializes in antifa literature. A high school student in Toronto charges a visit to an abortion clinic on a Visa card. A music enthusiast regularly makes charges on a MasterCard at an after-hours club in Montreal that is frequented by sex workers. The bulk collection of this kind of data by an agent of the state without consent and without independent oversight has a chilling effect on freedom of expression and association protected by s 2 of the Charter.

The public has not been caught snoozing on this one. According to a Nanos Research survey, Mr Trudeau’s government is on the wrong side of the debate. In an article titled Canadians strongly oppose StatsCan’s plan to obtain the banking records of 500,000 households: poll published in the November 13, 2018, edition of The Globe and Mail, Bill Curry reported that seventy-four per cent of the respondents oppose StatsCan accessing the records without their consent.

And the banks? Well, do you think they’ve been napping? The Canadian Bankers Association is considering legal options.