Public opinion survey

This page has been archived on the Web

Information identified as archived is provided for reference, research or recordkeeping purposes. It is not subject to the Government of Canada Web Standards and has not been altered or updated since it was archived. Please contact us to request a format other than those available.

Policy Scan Survey

Identification & Authentication issues in Canada

Summary Report

February 2005


Introduction

Identity Theft. Identity Cards. Biometric Identification. Radio Frequency IDentification (RFID) tags. Unique Identifiers. Identity Management. Identity-related issues are hot topics these days. There is every indication that identity and identification issues will be among the top political, economic, and technology news stories in the coming months and years.

Identification (and its close relative, authentication) is a concept so broad and so fundamental that it intersects with an extraordinarily wide spectrum of public policy, marketplace and social issues. Indeed, often we don't immediately recognize the identity issue because it is framed in terms of, for example, security, or convenience, or compliance with law and regulation.

Our lives are being profoundly affected by identity-related issues, policies and practices. Yet there seems to be no obvious focal point for people to understand causes and effects. There seems to be no "home" for the public to go to become engaged in identity-related matters.

Where do the Canadian privacy commissioners fit into this scenario? Despite having differing mandates and powers, all share common concerns about the creation, collection and use of personally-identifiable information. Identity and privacy are closely intertwined in many ways. Indeed, the more personally identifiable the data, or the more intensively that data is used, then the more likely it will be subject to privacy legislation (and to the "fair information principles" upon which that legislation is based) and therefore to the oversight and enforcement offices. What can we learn about identity and privacy issues from Canada's privacy commissioners?

"Policy Scan" Survey

Canadian privacy commissioners discussed the matter in 2004 and agreed to share their experiences and thoughts on the subject. In an effort to draw together the views of colleagues and to facilitate further discussion, the federal privacy commissioner prepared a survey on identification and authentication issues that was circulated at end-2004. The 17-question survey was organized into three main parts: (1) definitions; (2) facts, trends, opinions; and (3) recommendations and actions. A copy of the survey questions is attached as appendix "A".

This report summarizes the results of the survey responses. It also offers some possible questions that arise from those conclusions. The intent is to promote understanding, discussion and action about vital identity and privacy issues that affect all Canadians.

Executive Summary

From the commissioners' responses, the portrait that emerges is one of broad heterogeneity of interests, concerns and priorities. On many identification questions and issues, there is a lack of clear consensus. Engagement by commissioners has generally been ad hoc, reactive and episodic in nature. However, there is strong support for enhanced public education and discussion about certain privacy and identification matters, and much interest in a participatory role by commissioners' offices in shaping public understanding and debate.

Key Findings:

  1. No common definitions or vocabulary exist to address identity and authentication issues

    Legislated definitions are few; terms such as "identity"; "identification"; "authentication"; "verification"; "authorization", and "anonymity" are used frequently but in a somewhat ad hoc manner in a variety of working contexts. Most attention and work has focused on definitions of "personal information" and to some extent on "anonymous" or "de-identified" data (particularly in the health research sector).

  2. Guidance on definitions has been largely informal in nature, or ad hoc in response to specific issues or complaints

    Notable issues cited include: (a) national identity card proposal; (b) actual and proposed uses of unique identifiers by government agencies; (c) the reasonableness of identification requests; (d) the design and use of access controls and audit trails (especially in the health sector). Privacy impact assessments can provide useful a occasion for review and guidance.

  3. Requests for identification are becoming more widespread, frequent, mandatory and subject to stronger authentication — however this perception is anecdotal not empirical

    There was strong consensus on this question. The most frequent examples cited were new and mandatory ID requirements in the transportation sector, notably at airports and at border crossings. In general, governments are pursuing stronger ID methods as a condition of providing access to service or benefits. On the retail side, "Frequent shopper" cards are routinely requested at many stores "for the completion of even minor cash transactions". It is becoming more common to require two pieces of ID to open, or to access, client accounts. Some businesses are demanding more identity information in order to evaluate and screen clients. Authentication often takes place after the fact, for example, when confirming references and performing credit or background or criminal records checks.

  4. Few formal complaints have been received; more inquiries and expressions of concern

    Concerns often arise in response to media stories. Identification requests by the retail sector are a recurring issue (often in with complaints about poorly trained front-line staff).

  5. Commissioners issued policies, findings, opinions or guidance in diverse issues and areas; the most widely cited activities dealt with the unique identifiers, data matching activities, and identity theft risks posed by public sector initiatives

    Identity Cards — Many provided critical input into the federal government's national ID card consultations, to certain provincial "smart card" projects, and towards the tightening of procedures for issuing and using "breeder" documents.

    Identity Theft — Many are contributing to various government initiatives and multi-stakeholder groups dealing with identity theft. There have been several investigations into the "leakage" of confidential personal information.

    Unique Identifiers — Some were actively opposed to creating and using any globally-unique identifiers such as social insurance, health care or drivers' licence numbers. Work on the electronic health record (EHR) was mentioned as a current area of activity.

    Data Matching/Mining/Sharing — Responding to public concerns about the outsourcing of personal information storage and processing, one office published a detailed report and recommendations regarding data matching and mining. Others took actions to end illegal sharing of personal information by a provincial agency with federal authorities, and to end the wholesale bulk sharing of motor vehicle licence information.

    Data Retention / Backup Tapes — Cited as a "persistent issue" under provincial health privacy laws, ongoing work has been undertaken regarding design and operation of information and document management systems.

    Re-identification of data — of particular relevance for health research where anonymized or aggregated data is often used, and also for the Access to Information mandates, where personal information must be severed from records subject to FOIA requests.

  6. Commissioners expressed concerns about a wide range of trends and risks associated with requirements to identify or authenticate oneself, with no clear consensus

    Numerous trends were cited, including: (a) stronger online authentication; (b) instant or near real-time authentication; (c) excess collection of personal information; (d) data warehousing, matching, mining, and profiling; and (e) social sorting and discrimination.

    Major privacy risks cited included:

    • Unique Identifiers: (e.g., SIN): concerns were expressed about secondary uses without consent, function creep, and the potential for profiling and discrimination, especially where effective choice and autonomy of targeted individuals is diminished.
    • Public-Private Partnerships: some see risks in the trend towards greater sharing of personal data between the private sector and governments, such as passenger information, customer data, and Internet usage data.
    • Excess Collection and Use: Concerns were expressed about the growing collection, use, and the "ever-expanding retention" of personal data, leading to heightened risks of identity theft.
  7. Opinion surveys on identification and authentication have not been undertaken

    Respondents indicated they generally do not carry out surveys. However, at least one office has commissioned a survey, although not specifically targeting identification and authentication issues.

  8. Support for a formal "national identity policy" or framework is lacking. However, there is strong support for a more informed and engaged public in identity-related issues, and for commissioners playing an instrumental role

    Commissioners did not recognize a need for a formal identity policy or framework. The idea was roundly rejected as either too vague and too ambitious. However, there was strong consensus that the public needs to become better engaged on these issues: commissioners indicated an "emphatic yes" to greater public awareness and debate by Canadians. They also indicated that public policy makers and elected officials should properly lead the process and make final decisions, but that the commissioners can and should play a useful contributory role in any debate. For example, commissioners could help shape the debate by framing or defining key issues.

  9. Identity issues most likely to engage the public include: fighting ID theft, enhancing security, and improving access to systems and services

    Commissioners were divided on whether the scope of any public debate on identity issues should be broad or limited. The top three issues suggested were: fighting ID theft; enhancing security; and improving access to systems and services. Other issues included: appropriate roles of law enforcement and crime prevention activities; pros and cons of greater use of identity documents; the impacts of certain large-scale public sector IT projects; impacts of information and communications technologies; individual surveillance and profiling issues; and clarifying and confirming the privacy rights of individuals.

  10. Commissioners indicated awareness and participation in a variety of external initiatives dealing with identification and authentication

    Examples include:

    • e-government access and authentication;
    • enhancing the security of drivers licenses and other root documents
    • reforming health number identification procedures; and
    • developing tools to combat identity theft.

    Work undertaken by the National Health Infoway was specifically mentioned, as was the Federal/Provincial/Territorial Council on Identity - a consortium of vital statistics agencies working to improve identity documents and processes in Canada.

Discussion Questions

  • Are there definitions that can be commonly agreed and consistently used? Conversely, are there poor or misleading definitions in current use by others that should be opposed or rebutted?
  • Related to the above, are there guiding messages that can be consistently applied? (e.g., identity is highly context dependent), or rebutted (e.g., authentication can apply to attributes and privileges, not just physical identity)?
  • Where and how could perceptions of identification trends be validated through empirical research? Where could research be best applied? Who would do it?
  • Which identification and authentication trends are most troubling?
  • Is the low number of formal complaints explained by any of the following possibilities:
    (a) relative unconcern by the public about the issues?
    (b) inability of the public to articulate specific concerns?
    (c) low visibility and awareness of the commissioners' offices and means available?
    (d) poor perceptions about the efficacy of the formal complaint process?
  • Are there specific issue areas that may be "seized" or otherwise defined by commissioners through concerted action? Are there issue areas that invite greater collaboration or resource pooling? Are there central messages or principles that might be uniformly advocated?
  • Is there merit in carrying out any surveys of attitudes and experiences on identity-related topics? Would there be interest in the results of such surveys if they were carried out by other organizations? What sort of survey would be of most interest and use?
  • Is there a single issue, or cluster of issues, or theme that could engage individuals and the privacy community in public debate? What other conditions or factors, if any, might be necessary?

APPENDIX "A"

A) Definitions

"Identity", understood as both a sense of self and a set of attributes ascribed to us by others, is essential to the concept of privacy. Do you agree?

  A1) Does your office have, or use, any formal or working definitions of the following terms: "identity"; "identification"; "authentication"; "verification"; "authorization", "anonymity" and/or related terms? Please provide the definition and/or cite source(s).
  A2) Has your office provided guidance of any sort to individuals or organizations (please specify) regarding any of the terms or concepts mentioned above?

B) Facts, Trends, Opinions

In your opinion or experience...

  B1) Are requests for individual identification increasing in either frequency and/or in number of requesters? Please describe or provide details.
  B2) Are demands for individual identification becoming either less voluntary and/or subject to stronger or more stringent authentication requirements?
  B3) Are there any trends related to the two preceding question which represent a potential cause for concern or action by your office? Please provide details.
  B4) Has your office seen an increase in the number of complaints related to the requirement for individuals to produce identification and/or to verify identity?
  B5) Has your office issued policies, findings, opinions or guidance on any matter related to identity and identity authentication, whether online or off, including on any of the following related topics:
  • identity cards and "foundation" documents
  • identity theft
  • identity management systems (e.g., single sign-on, e-government)
  • biometrics use
  • anonymity and pseudonymity
  • the assignment and subsequent use of any unique identifier (such as the SIN, internet "cookie", or loyalty card token) especially when these identifiers are used for multiple purposes and by multiple actors.
  • data-matching, -linking and -mining activities
  • data retention, back up tapes and systems
  • re-identification of data thought to be aggregate or de-identified
  • radio frequency identification (RFID) tags
  B6) What, if any, are the primary risks and concerns your office has regarding the requirement to identify and authenticate oneself?
  B7) To follow-up the last question, what (if any) relevant distinctions might be drawn regarding the requirement to verify one's identity within and among the following contexts: (a) citizen to government relationships? (b) consumer to private sector or non-profit organizations? (c) employee-employer relationships? (d) the online environment?
  B8) In your opinion, which of the 10 privacy principles (See appendix for list) are most challenged by growing requirements to produce and verify one's identity across society?
  B9) Has your office carried out surveys or consultations intended to solicit or gauge the views and opinions of others within your respective jurisdictions on any matter related to identity and authentication?

C) Recommendations / Actions

  C1) A former Citizenship and Immigration Minister noted on several occasions that Canada lacks a "national identity policy" or framework, and that Canadians should engage in a national debate with a view to creating one. Do you agree?
  C2) If feasible, what might be the scope or form of such a "national identity policy"? Do you think that Canada's privacy and data protection officials should play a role in shaping such a debate and policy? If so, how?
  C3) What issues or areas are likely to interest and engage Canadians in a national debate on identification and authentication policy issues? Which areas might be fruitful areas for public education?
  C4) Does your office hold any specific view or position regarding proposals to criminalize the possession of multiple identities?
  C5) Is your office currently engaged in any ongoing project or initiative intended to create or coordinate objectives, policies, or guidelines related to identification or authentication issues? Please provide details or links to appropriate sources.
  C6) Is your office aware of any current projects or recent initiatives in Canada to research, develop or implement identity- or authentication-related projects affecting Canadians?
Date modified: