Privacy Commissioner expresses concern that proposed Bank Act changes could open door to more data abuses

Open this photo in gallery:

Privacy Commissioner Daniel Therrien is expressing concern with new banking powers over customer data that are contained in the government’s latest budget bill, telling the Senate banking committee Tuesday that his office was never consulted on the Bank Act changes.

Senators have heard conflicting testimony as to what the Bank Act changes would allow in practice. The Finance Department and the banking sector say they are simply about modernizing language to reflect the growth of financial technology firms, or fintechs. However critics warn that the changes would give banks new powers to sell customer data to fintechs, which are in many cases not subject to federal financial regulation.

Canada’s privacy watchdog said more co-operation between banks and fintechs may be a good thing, but consumers should be able to approve how their data are used through a clear and understandable consent form. Mr. Therrien said there is nothing in the bill that would ensure that is the case.

“The main concern I have with this piece of legislation is that it is in my view one-sided. It only favours innovation and it forgets a little bit about privacy protection,” he said.

At the request of the committee, Mr. Therrien said he will prepare a draft amendment that could address some concerns. However, he said the larger issue is that Canada’s privacy regime has fallen behind that of other jurisdictions such as the European Union and his office does not have strong-enough enforcement powers.

The Senate banking committee is conducting a study of the banking-related provisions of C-74, a 556-page omnibus budget bill. The bill would add new language to the Bank Act’s financial technology section, allowing banks to engage in “collecting, manipulating and transmitting information … selling and otherwise dealing with technology if those activities relate to … the provision of financial services by another entity.”

The Canadian Bankers Association has said it is very pleased with the changes.

However, senators have also heard warnings from the Canadian Association of Mutual Insurance Companies that the changes would allow banks to sell the consumer data of their customers to fintechs that are not subject to regulation.

The Globe and Mail reported last week that the association said they received two “angry” phone calls from Finance Minister Bill Morneau’s office taking exception with their conclusions. The insurance group said the Minister’s office told them to stop meeting with MPs and senators and to not appear before Parliamentary committees.

Steve Masnyk, a consultant for the insurance group, said on Tuesday that the commissioner’s expression of concern vindicates what his association has been saying.

Conservative MP Pierre Poilievre intends to file a formal complaint against what he calls the “thuggish” behaviour of the minister’s office on Thursday in the form of a question of privilege in the House of Commons.

Also on Thursday, top information, data and privacy officials from Canada’s largest banks will appear before the Senate banking committee to answer questions about the Bank Act changes in the budget bill.

Independent Senator Howard Wetston, who is on the banking committee and is a former chairman of the Ontario Securities Commission, told The Globe on Tuesday that the commissioner raised important privacy issues that go beyond the specific matter in the bill.

“It’s very clear that what’s happening internationally with respect to privacy and data is a key issue and the government understands it’s a key issue,” he said, adding that he will wait and see what the commissioner proposes before deciding whether or not to support an amendment.

Conservative Senator Betty Unger said on Tuesday that she found it “incredulous” that the government did not consult the privacy commissioner on the change.

“I think if there’s some way that the bill can be made better, there should be an amendment,” she said.