Millions of Canadians’ personal data could be at risk through municipalities’ use of an online municipal budget simulator, records released under freedom of information law show.
Fifty or more cities have been using the OpenNorth’s Citizen Budget tool. The application allows users to prioritize spending on city services based on their home’s assessed value.
While allowing local budget input, the tool collects personal information such as names, email addresses, gender, income and postal codes — information that privacy officials say could identify people. That, said B.C.’s Office of the Information and Privacy Commissioner (OIPC), doesn’t meet provincial privacy protection standards.
The website for Montreal-based OpenNorth, a not-for-profit open-data advocacy group, said the tool is used by more than 50 Canadian cities, reaching six million citizens coast-to-coast.
Recently released records show Kamloops took action to protect citizens’ personal information when the city realized there was a legal problem.
“The problem is that the City of Kamloops is violating the Privacy Act of B.C. by collecting personally identifiable information… without required security or protection,” a Feb. 5 memo from city database and security manager Piotr Baltakis said.
Kamloops’ use of the tool began in early February. By mid-month, the site received 963 visitors and 330 responses. The whole issue was rectified within 48 hours.
Baltakis said the transmission of that data was neither secure nor encrypted, violations of privacy legislation. He said OpenNorth quickly switched the transmissions to a secure status when Kamloops complained.
OIPC spokeswoman Michelle Mitchell said names and email address are considered personal information.
“Combining name or email address with additional information such as gender, age, or postal code would make that additional information personal information as well.”
The more information collected increases the risk of the data being used to identify specific individuals. That, Mitchell said, is a problem under B.C. privacy law.
Other cities using the software include Victoria, Edmonton, Saskatoon and London, and Markham, Ont., the tool’s site said.
Requests for comment from OpenNorth, which is partially funded through the federal government, were not returned.
Online searches found the application’s use in West Vancouver, Prince George, Victoria, Delta, Langley Township, Smithers, Courtenay, Creston, Castlegar and Vernon.
Edmonton has conferred with Kamloops on the issue but has yet to experience problems, spokesperson Gayleen Froese said.
Prince George’s Citizen Budget site collected the same information as Kamloops, as well as length of residency, homeownership and household income. Mitchell couldn’t comment on the Prince George situation, though, “as we could see a complaint come through our office.”
She said B.C. law requires public bodies to notify individuals of the purpose for which the personal information is being collected, used, or disclosed, and of the legal authority for the collection.
In the case of local governments, personal information collected must be necessary for a program or activity, she said.
“If we were to receive a complaint about something like this, the local government would have to demonstrate that it meets these requirements,” Mitchell said.” It should also be able to explain this to any individual whose personal information it collected.”
Prince George spokesman Rob Van Adrichem said the tool’s use was to provide high-level data for city council for budget preparation. Personal data collection wasn’t identified as a concern, he said.
Other communities contacted had not identified any problems.
– Jeremy Hainsworth, Glacier Media
