I have been working on so many other posts but the research they take is so demanding and I simply can’t dedicate the time i need but a story just crossed my desk that is so “right up my alley” that the research will be virtually nothing. I don’t get to write pure opinion pieces without research very often so this should be fun.

If you are not aware, I have dedicated a part of my life for the past few decades to protecting peoples’ personal information on the internet. If you have no interest in protecting your privacy then I don’t know why you are reading this far already.

The Big Story

A couple days ago Blacklock’s Reporter broke a story they have been working on for three years. Did you hear that? And they say that investigative journalism is dead. It isn’t dead, it is just drowned out by the fake news, hyperbolic opinions, and time-sensitive rushes to the press by the Main Stream Media (MSM).

I found out about this through the “On Point with Alex Pierson” podcast yesterday and it bothered me, but not as much as it has bothered a lot of other people. I will put the audio at the bottom of the post but feel free to check out her On Point podcast wherever you listen.

As Tom Korski reports, the CMHC (Canadian Mortgage & Housing Corporation) has been collecting mortgage information from the Office of the Superintendent of Financial Institutions, who collect the data as a routine regulatory matter. I do have a couple problems with this story and they start with…

1. The CMHC should not be collecting data from home owners without their consent
2. The CMHC has no business collecting data from non-CMHC customers

Let’s get back to this in a minute…

I immediately jumped online to see how many other media outlets had picked up the story now that at least two people are talking about it… with little surprise I found the Western Standard had picked it up. This was a nice bonus because I love their reporting, and they do something I cannot afford to do… pay for a $300+ per year subscription to Blacklock’s Reporter. I do however support the Western Standard with their $100 per year subscription.

This diversion needs a heading (sorry)

I am going to take a minute to tell you a little about me, partly because I think it’s useful, partly because of my ADHD.

Time is a strange thing… it took you mere seconds to read from the last line to here but believe it or not, I just spent 45 minutes researching whether that comma was in the correct place between “useful” and “partly” in the sentence above. Let me be clear that I spent 10 minutes looking for my e-reader (it is apparently MIA)… then I opened my Calibre app on my laptop… the app hadn’t been updated in 9 months (grrr)… I opened my Kobo app (which also needed an update) and downloaded the 62 books I bought in the past 8 months (WTF was I thinking?)… I went upstairs to fill up my popcorn bowl… I reopened Calibre and downloaded all my Kobo books from my laptop…

Then I spent 20 minutes re-reading chapter five of Jenny Baranick’s Kiss My Asterisk. I love Jenny Baranick, so this was not a pain, it was a nice reprieve from a very long day of typing. Sadly, the chapter did not help me… Soooo I decided that the sentence sounded good enough. Goodbye to 45 minutes of my life.

And that is why it takes me so damn long to write a blog post and why none of them are 1000 words or as easy to write as I think they will be when I start them.

Note to self: go to twitter and ask Jenny about that comma use.

So back to telling you about me. I love writing but I also love research. It is not a tough call as to which takes up more of my time… research kills me. Most things that you love will though.

I have been a professional geek since the 20th century. During the majority of that time I have been responsible for a ton of corporate data and a whole lot of personal data as well. As a writer who loves research though, I also pride myself on having an open mind. I love conspiracy theories but mostly from a scientific perspective as I love to rip them apart.

With my open mind in your mind, let’s get back to those two problems people have with the CMHC.

1. The CMHC should not be collecting data from home owners without their consent
2. The CMHC has no business collecting data from non-CMHC customers

If we are talking about a personal issue you have with the ethics of the business decision, we have to take into account that this is a crown corporation. It is a government entity run and managed by politicians and left-leaning (for the most part) public servants. Our measure of “ethical” will differ a little here but I will agree that most people will agree that the CMHC taking personal data from other sources is not ‘ethical’.

Now where did I put that open mind?

But before we go chastising the CMHC with the mob, let us look at what promises they have broken from their privacy policy.

Nobody believes that they “have adopted strong principles” with our personal information. Clearly they do NOT tell us why they use our data or Tom Korski would not have fought for three years to get the information.

The fact that they add “but is not limited to” basically covers their ass for anything they have on you. I can’t call them out for this. They were quite clear that they would track anything and everything they could find on you.

The “sources other than yourself” should raise a red flag… but “approved lenders” should be fine (though I have no idea why they are capitalized on their site). “From social media websites” makes me ask two questions… what are you paying for my information from Facebook and how on earth can that personal info help you?

So all in all, I haven’t seen anything that shocks me, nor have I convinced myself to light a torch and grab a pitchfork to join the mob.

Take off the rose-colored glasses

But let’s look at some green highlighting from that privacy policy…

“We limit how much personal information we collect, use, communicate and store to what is necessary for our purposes and permissible pursuant to the Privacy Act.”

This is clearly not true. The CMHC holds a ton of data that clearly is NOT ‘necessary’, or they would have had it from the CMHC applications. And how is the personal information of a mortgage holder who does NOT have MCHC insurance ‘necessary’?

“We may communicate your personal information to authorized parties without your consent where permitted…” What? Who “authorized” these parties? Clearly not me, or you would have had my permission. And who “permitted” you to share my personal info?

Oh the green text is starting to make my hair stand on end.

You are collecting data from the Office of the Superintendent of Financial Institutions on people who are not CMHC customers and you dare use the word “directly” under the heading, “when and how we collect your personal information”? That is a bold move even for a corrupt government with virtually no oversight.

Under the same heading they have the nerve to say that they collect our personal data from “our services providers for web analytics or ads”. Now I KNOW that you are paying for the information but you admit to buying it for advertising. How is this a necessary part of your business or our information?

“From third parties who have obtained the necessary consent”, I have to assume that you are referring to the Office of the Superintendent of Financial Institutions and I have to wonder, now that I am a little more aware of how your ‘ethics’ function, did you give them permission to share our data?

My Two Big Problems

So I have two problems and they are both from that last line…

Clearly there was no “necessary consent” because they were quoted as saying. “No we shouldn’t need a privacy impact assessment,” Canada Mortgage and Housing Corporation managers wrote in a 2018 staff email. “This information is for statistical or analytical purposes and therefore non-administrative. That’s where the privacy protocol comes in.”

But you have already made it clear that you have zero respect for any ‘privacy protocol’ by sending this in a March 29, 2018 notice to banks, “Data will be shared with the Department of Finance and Bank of Canada on a confidential basis” (from the Western Standard article).

Wait, nothing in your privacy policy gives you the right to share our information no matter where you get it.

Well, except for the part in section 6.2 that says, “some personal information may be stored by our service providers outside of Canada”. This is probably the smallest problem that you have but there are reasons that the Canadian government and most provinces require whole industries to ensure that the data of Canadians does not leave Canada for the sole purpose that once your data hits the USA, it is likely to be copied and tracked by the American government.

And in Canada, only the Canadian government is allowed to violate our laws.

(On Point with Alex Pierson audio clip)

P.S. It has now been four hours since I started typing this “quick” post… and I still haven’t sent Jenny that note and I need that screenshot for this post… I should have known that I would lose four hours of my life and end up reading the entire Privacy Act for this.

 

A couple people messaged me to ask what they could do… so here is a suggestion…

What can we do now?

If you would like the CMHC to remove your information from their database, except that which you specifically granted them access to, and if you would like to demand that they NOT share your personal info with anyone without a court order, send emails requesting so to the CMHC Privacy Office:

PrivacyOffice@cmhc-schl.gc.ca

And go to the Office of the Privacy Commissioner of Canada and file a formal complaint (or fill in their online form to file an informal complaint at very least) that the CMHC violates the Privacy Act of Canada on many fronts.

Section 4 states that “No personal information shall be collected by a government institution unless it relates directly to an operating program or activity of the institution” and in their own Privacy page they specify that your data will be used for advertising and in the letter to banks they made clear that they will be handing this information to other government agencies.

Section 5(1) specifies that no information can be gathered for anything other than administrative purposes “except where the individual authorizes” and section 5(2) states that they must “inform any individual from whom the institution collects personal information”. Did you get a letter about this in 2018?

Before you get uppity that I missed the green highlight that stated that “personal information may be disclosed to the institution under subsection 8(2)”, understand that the only subsection they could dream of qualifying under would be 8(2)(j)(i) that states they can use data if they cannot use the “the information is provided in a form that would identify the individual to whom it relates” unless they can’t do their job otherwise. The fact that the CMHC operated fine before 2018 proves this false.

Section 8(2)(j)(ii) also states that the head of the government institution (this would be Peter Routledge though he just took over the role in April of 2021) “obtains from the person or body a written undertaking that no subsequent disclosure of the information will be made in a form that could reasonably be expected to identify the individual”.

Please send the Access to Information and Privacy Coordinator and email here: atip.aiprp@osfi-bsif.gc.ca

Tell them that the Western Standard reported that they shared your personal data with the CMHC in 2018 where the CMHC made it clear that “data will be shared with the Department of Finance and Bank of Canada on a confidential basis” which violates the privacy act and nullifies their authority under section 8(2)(j)(ii). Tell them that you would like to be informed if your data is ever shared again without your permission.

Good luck and let me know how good it feels to hold your government accountable for their criminal activities.