The Royal Bank of Canada updated its mobile application for Android users earlier this month. Like many banking apps, the RBC version allows users to view account balances, pay bills, and find bank branches from their smartphone. Yet when users tried to install the app, they were advised that the bank would gain access to a wide range of personal data.
The long list of personal data -- far longer than that found in comparable applications from banks such as TD Canada Trust or Bank of Montreal -- included permission to use the device's camera, to read the user's call history, to access the user's Internet browsing habits, and to even check out their browser bookmarks. After users took to Twitter and the Google app review section to complain, RBC advised that it would update the app and that users should "stay tuned" about the permission requirements.
My weekly technology law column (Toronto Star version, homepage version) notes that RBC is not alone in requiring users to disclose more personal information in order to access services. Aeroplan, the loyalty program linked to Air Canada, sent an email last week to hundreds of thousands of Canadians notifying them that it too was changing its data collection practices.
The company disclosed that holders of its popular financial credit cards (which can be used to earn Aeroplan points based on total spending) will soon be required to grant it access to detailed financial activity. Starting next year, Aeroplan will be privy to all cardholder transactions, including merchant names, transaction amounts, and dates of the transactions.
The personal data grab from two of Canada's best-known companies is part of a disturbing privacy trend involving a seemingly insatiable desire for customer information. These demands stretch Canadian privacy law to its limits and run the risk of placing user data at risk for security breaches.
Canadian privacy law requires organizations to obtain consent for the collection, use, and disclosure of personal information. The basic premise is that privacy is a negotiated bargain in which companies can ask for permission to do virtually anything with the personal information they collect so long as users grant their consent.
The law does contain an important limitation, however, stating that "an organization shall not, as a condition of the supply of a product or service, require an individual to consent to the collection, use, or disclosure of information beyond that required to fulfil the explicitly specified, and legitimate purposes." In other words, companies can ask for whatever information they believe is reasonable under the circumstances, but they cannot mandate the disclosure if it is not strictly necessary to supply the good or service.
Despite the legal limitations, the RBC and Aeroplan policies illustrate how companies have become increasingly aggressive in their personal information collection practices. Companies use data mining technologies (the same ones used by intelligence agencies to comb through the meta data of billions of telephone calls) to analyze customer habits and inform a wide range of business decisions.
Some uses may seem relatively innocuous, yet the practice of collecting as much data as possible raises serious concerns. The risk of a security breach increases as companies capture and retain more and more information. This is particularly true for sensitive financial data, which is now accessed by more than just a regulated financial institution.
Moreover, the collection practices push the legal envelope by requiring disclosures that are not strictly necessary to maintain a loyalty program or offer a mobile app. There have been relatively few complaints to the Privacy Commissioner of Canada on these issues, which may be a product of a public that has become increasingly cynical about the potential for privacy laws to stop invasive practices from both government and the private sector. Yet as companies seek mountains of customer data, it may be time for consumers to start saying "no."
Sen. Dianne Feinstein (D-Calif.) said the court order for telephone records was part of a three-month renewal of an ongoing practice, <a href="http://www.huffingtonpost.com/huff-wires/20130606/us-nsa-phone-records-feinstein/" target="_blank">the Associated Press reported</a>. "It’s called protecting America," Feinstein said at a Capitol Hill news conference.
Sen. Mark Udall (D-Colo.) <a href="http://www.huffingtonpost.com/2013/06/06/verizon-phone-records-nsa_n_3397058.html?utm_hp_ref=politics" target="_blank">said</a> "the administration owes the American public an explanation of what authorities it thinks it has."
Senate Majority Leader Harry Reid (D-Nev.) thought everyone "should just calm down." "Right now I think everyone should just calm down and understand this isn't anything that's brand new," Reid <a href="http://www.huffingtonpost.com/2013/06/06/verizon-phone-records-nsa_n_3397058.html?utm_hp_ref=politics" target="_blank">said</a>.
Sen. Jeff Merkley (D-Ore.) said in a statement: "This type of secret bulk data collection is an outrageous breach of Americans’ privacy."
Sen. Lindsey Graham (R-S.C.) said he was <a href="http://www.huffingtonpost.com/2013/06/06/lindsey-graham-nsa_n_3396223.html?1370532449" target="_blank">"glad" the NSA was collecting phone records. </a> "I don’t mind Verizon turning over records to the government if the government is going to make sure that they try to match up a known terrorist phone with somebody in the United States," Graham said in an interview on "Fox and Friends."
Sen. Saxby Chambliss (R-Ga.) also claimed that reports of the NSA collecting phone records was "nothing particularly new." "Every member of the United States Senate has been advised of this," Chambliss<a href="http://www.huffingtonpost.com/2013/06/06/verizon-phone-records-nsa_n_3397058.html?utm_hp_ref=politics" target="_blank"> said</a>. "And to my knowledge we have not had any citizen who has registered a complaint relative to the gathering of this information."
Sen. Bob Corker (R-Tenn.) found the NSA collecting phone records <a href="http://www.huffingtonpost.com/2013/06/06/verizon-phone-records-nsa_n_3397058.html?utm_hp_ref=politics" target="_blank">"troubling."</a> "The fact that all of our calls are being gathered in that way -- ordinary citizens throughout America -- to me is troubling and there may be some explanation, but certainly we all as citizens are owed that, and we're going to be demanding that," Corker <a href="http://www.huffingtonpost.com/2013/06/06/verizon-phone-records-nsa_n_3397058.html?utm_hp_ref=politics" target="_blank">said</a>.
Follow Michael Geist on Twitter: www.twitter.com/mgeist