Appeared in the Toronto Star on October 12, 2013 as The Great Canadian Personal Data Grab
The Royal Bank of Canada updated its mobile application for Android users earlier this month. Like many banking apps, the RBC version allows users to view account balances, pay bills, and find bank branches from their smartphone. Yet when users tried to install the app, they were advised that the bank would gain access to a wide range of personal data.
The long list of personal data – far longer than that found in comparable applications from banks such as TD Canada Trust or Bank of Montreal – included permission to use the device’s camera, to read the user’s call history, to access the user’s Internet browsing habits, and to even check out their browser bookmarks. After users took to Twitter and the Google app review section to complain, RBC advised that it would update the app and that users should “stay tuned” about the permission requirements.
RBC is not alone in requiring users to disclose more personal information in order to access services. Aeroplan, the loyalty program linked to Air Canada, sent an email last week to hundreds of thousands of Canadians notifying them that it too was changing its data collection practices.
The company disclosed that holders of its popular financial credit cards (which can be used to earn Aeroplan points based on total spending) will soon be required to grant it access to detailed financial activity. Starting next year, Aeroplan will be privy to all cardholder transactions, including merchant names, transaction amounts, and dates of the transactions.
The personal data grab from two of Canada’s best-known companies is part of a disturbing privacy trend involving a seemingly insatiable desire for customer information. These demands stretch Canadian privacy law to its limits and run the risk of placing user data at risk for security breaches.
Canadian privacy law requires organizations to obtain consent for the collection, use, and disclosure of personal information. The basic premise is that privacy is a negotiated bargain in which companies can ask for permission to do virtually anything with the personal information they collect so long as users grant their consent.
The law does contain an important limitation, however, stating that “an organization shall not, as a condition of the supply of a product or service, require an individual to consent to the collection, use, or disclosure of information beyond that required to fulfil the explicitly specified, and legitimate purposes.” In other words, companies can ask for whatever information they believe is reasonable under the circumstances, but they cannot mandate the disclosure if it is not strictly necessary to supply the good or service.
Despite the legal limitations, the RBC and Aeroplan policies illustrate how companies have become increasingly aggressive in their personal information collection practices. Companies use data mining technologies (the same ones used by intelligence agencies to comb through the meta data of billions of telephone calls) to analyze customer habits and inform a wide range of business decisions.
Some uses may seem relatively innocuous, yet the practice of collecting as much data as possible raises serious concerns. The risk of a security breach increases as companies capture and retain more and more information. This is particularly true for sensitive financial data, which is now accessed by more than just a regulated financial institution.
Moreover, the collection practices push the legal envelope by requiring disclosures that are not strictly necessary to maintain a loyalty program or offer a mobile app. There have been relatively few complaints to the Privacy Commissioner of Canada on these issues, which may be a product of a public that has become increasingly cynical about the potential for privacy laws to stop invasive practices from both government and the private sector. Yet as companies seek mountains of customer data, it may be time for consumers to start saying no.
Michael Geist holds the Canada Research Chair in Internet and E-commerce Law at the University of Ottawa, Faculty of Law. He can reached at mgeist@uottawa.ca or online at www.michaelgeist.ca.
