Why We Should Resist a National ID Card for Canada

This page has been archived on the Web

Information identified as archived is provided for reference, research or recordkeeping purposes. It is not subject to the Government of Canada Web Standards and has not been altered or updated since it was archived. Please contact us to request a format other than those available.

Archived

This page has been archived on the Web.

Submission of the Office of the Privacy Commissioner of Canada to the Standing Committee on Citizenship and Immigration

September 18, 2003

Robert Marleau
Interim Privacy Commissioner of Canada

---

Executive Summary

The debate about the need for a national identification card may be the most significant privacy issue in Canadian society today. The development of a national identification card would require the collection, use and dissemination of the personal information of Canadians on a massive scale. Canadians and Parliamentarians need to consider carefully the privacy risks that this would entail and weigh them against the likely benefits of such a scheme.

The debate has to be about more than just cards. A national identification card would require an elaborate and complex national identity system, with a database, communications networks, card readers, millions of identification cards, and policies and procedures to address a myriad of security, privacy, manageability, and human factor considerations.

The costs associated with such a system would be enormous. Just creating it could cost between $3 billion and $5 billion, with substantial additional costs to actually operate it.

There would also be costs to Canadians' privacy rights, and to the relationship between Canadians and the state.

Identification cards allow us to be identified when we have every right to remain anonymous, reveal more information about us than is strictly required to establish our identity or authorization in a particular situation, and allow our various activities to be linked together in profiles of our lives.

The system would likely entail compulsory participation, massive databases of personal information, serious problems of inaccuracies, and significant disruption and inconvenience to individuals.

Are these financial and social costs justified by any significant benefit?

The claim is made that a national identification card would help to combat terrorism, curb identity theft, and facilitate travel to the United States.

Precisely how national identification cards would help to fight terrorism is not clear. Comparing our identification cards against "watch lists" of suspected or known terrorists would be of no use against unknown or first-time terrorists using legitimate identification documents. Feeding all our daily transactions into a massive database that could then be mined for signs of potential terrorist activity would be highly invasive and contrary to our common law traditions and long-established civil liberties protections.

A national identification system might simply lull us into a false sense of security. Terrorists are too resourceful and technologically sophisticated to be stopped by such a simple device as an identification card. And such a system, containing personal data on every Canadian, could itself be an attractive target for cyber-terrorists.

How an identification card would reduce identity theft is similarly unclear. In current practice, merchants rarely bother to check the signature on a credit card slip and have no way of verifying identity over the telephone and Internet. An identification card alone will not change that. A comprehensive nationwide infrastructure of electronic card readers and trained personnel would be technically very complex and highly costly to deploy. Nothing comparable is currently in active operation anywhere in the world.

Even if the requisite infrastructure could be developed, there would be nothing foolproof about it. Experts agree that any card can be duplicated or tricked. The perceived strength of a card would simply make it more valuable to criminals and terrorists.

A national identity system could actually aggravate the problem of identity theft. Criminals could apply for an identification card in someone else's name, using surreptitiously obtained foundation documents. It would be difficult for victims of such an identity theft to prove that they themselves were not the impostors.

As for crossing the US border, if US authorities are going to insist that we provide the type of information that is typically on a passport, it would be simpler just to use a passport. If US customs agents are targeting Canadian travellers on the basis of personal information contained in their passport or other identification documents, a national identification card will not stop this.

A number of essential questions need to be asked about a national identification system. Simply asking them highlights the far-reaching implications of such a system-the practical and technological challenges of creating and managing it, the need to develop comprehensive legal and policy frameworks, the implications for privacy. These questions include:

• Who would be issued an identification card? Everyone? Canadians at the age of majority only? If children are issued a card, at what age?
• Would participation in and identification by the system be voluntary or mandatory?
• What would be the scope of the data that would be gathered about individuals participating in the system?
• Who would be allowed to demand production of a card from card carriers for proof of identity?
• Who could contribute, view, or edit data in a national ID system?
• What types of uses of the card and its attendant system would be allowed?
• What legal structures would protect the system's integrity as well as the data subject's privacy and due process rights, and determine the government and other parties' liability for system misuse or failure?
• Who would bear the full weight of privacy rights accountability and responsibility for a national identity system?
• What are the alternatives to a national identity system?

The privacy risks associated with a national identification card are substantial. The challenges of putting in place a national identification system that is workable, affordable, and respectful of the privacy rights of Canadians are enormous. A strong case for the benefits has not been made; to the extent that benefits would exist, they would be marginal at best.

Accordingly, this Office urges Parliament to reject the proposal.

Introduction

Canadians are being asked to debate a proposal for a national identification card. Since the country has done well enough without one, one might be forgiven for wondering why this issue has arisen now. But the answer is in fact straightforward and evident: this debate flows from social, economic and political changes in Canada and abroad, and the growing emphasis on individuals identifying themselves.

Delivery of increasingly complex government programs and services has, over the last four decades or so, entailed more and better verification of the identities, entitlements and authorizations of individuals. Overall reductions in the levels of these programs and services have not diminished this; if anything, the need to control costs has exacerbated it. In commercial relations, cash-based transactions, where the identity of the buyer is mostly irrelevant, are giving way to the use of credit and debit cards, often without any face-to-face contact between buyer and seller. The identity of cardholders, or at least their authorization to use the card, has come to be considered a necessary protection against fraud. Moreover, changes in marketing and sales methods, and a shift to fragmented and customized markets and products, have made businesses eager to know more about their customers. Being able to identify customers is a means to collect and classify information about them.

These developments have tended to produce pressure for a reliable, consistent means of identifying people. But they have been around for a long time, and they alone would not have been enough to trigger this debate.

What has made the difference is the changed security situation, and the changes in our society's expectations and presumptions, since the September 2001 terrorist attacks on the US. The fact that many of the September 11 attackers lived and worked in the US without attracting the notice of law enforcement and security agencies has persuaded many people that the key to our security is identification of individuals.

It is easy to understand why there would be support for a national identification card. Asked whether they would like a national identity card to catch terrorists, many people would likely answer yes, for obvious enough reasons. And asked whether they would like a single national identity card to replace the driver's licence, health insurance card, library card, passport, and credit cards in their wallets, many people would also likely say yes.

If computer experts are asked about such a proposal, on the other hand, they might well answer no, because they know the technical challenges. If those with experience setting up large-scale national databases are asked, they also might answer no, because they know the financial implications. And if those with privacy expertise are asked, they will almost certainly answer no, because they know the privacy costs.

The Office of the Privacy Commissioner (OPC) is keenly interested in this debate, for obvious reasons. The establishment of a national ID system necessarily involves the collection, use and dissemination of the personal information of individual Canadians on a massive scale. The national ID card proposal may be the most significant privacy issue being debated in Canadian society today. Answering key questions such as how a national ID system would work, and more fundamentally whether such a system is even desirable or necessary, is core to protecting the privacy rights of Canadians.

Privacy is not an absolute right. As an important social value, it exists in a dynamic balance with other such values, not in isolation from them. We all have an interest in prevention of fraud and theft, and in interdiction of crime and terrorism, and the social value we accord to privacy rights has to accommodate those interests.

But to say that privacy must accommodate other social interests is not to say that it has to be sacrificed for them. This Office does not accept the simplistic arithmetic that says, for example, that less privacy equals more security against crime and terrorism. In fact, as we point out below in our discussions of terrorism and identity theft, less privacy can in fact mean less security. There is nothing contradictory about privacy and security, and it is imperative that public officials strive to maximize both.

Anyone arguing that privacy must be diminished in the interest of protecting against crime and terrorism or easing our passage across borders bears an extremely heavy burden of proof. It is the view of this Office that the proponents of a national ID card have failed to make their case.

Context: Minister Coderre's Proposal

Minister Coderre first called for a public debate on the merits of a national ID card for Canada in late 2002. Shortly thereafter, he asked the House of Commons Standing Committee on Citizenship and Immigration to formally study the matter and report back to the House. He appeared before the Committee in early February 2003 to more fully explain his position, and has also made a number of other public interventions on the matter since then.

In Minister Coderre's view, it is important for Canadians to engage in a debate on the merits of a national ID card, in large part due to new national security requirements that have emerged in the wake of the September 11 terrorist attacks:

"In the aftermath of the terrorist attacks in the United States on September 11, 2001, identity has taken on a new prominence in countries around the world. Canada has been no different. Canadians have come to see the ability to establish identity as an important element of personal and collective security."¹

The Minister argues, however, that while the focus on a positive proof of identity is "partially rooted" in the aftermath of the terrorist attacks, "other forces" are at play.² Specifically, Minister Coderre contends that a national ID card would:

• provide a more secure and reliable proof of identity;
• help combat identity theft and ID fraud;
• facilitate travel by Canadians abroad, notably in the United States; and
• prevent racial profiling at the border.

The Minister has even suggested that a national ID card could help secure the privacy of Canadians.³

Later in this submission, we analyze in detail the alleged benefits of a national ID card. What follows are simply our preliminary observations on the Minister's position.

The difficulty with Minister Coderre's position is that he presents little or no evidence for the arguments he advances. His department has made public no hard data, no substantive research or analysis to buttress any of the advantages that supposedly would flow from the Minister's scheme. As a result, it is impossible to ascertain whether the benefits of a national ID card are sufficient to outweigh the undoubted risks to privacy, human rights and our social values that the proposal entails. This Office believes it is incumbent upon government officials who initiate large scale public debates on significant public policy proposals to provide full and complete information on the benefits they believe would accrue from their proposals. By doing so, Canadians and Parliament may better judge for themselves the merits of these proposals.

The Minister's arguments, although interesting, are perhaps not as important to the unfolding of an informed debate as what he did not say about a national ID card for Canada. Specifically, the Minister has not provided any information on a number of key questions, which need to be addressed before the government forges ahead with implementation of a national ID card. These questions are⁴:

• Who would be issued an ID card? Everyone? Canadians at the age of majority only? If children are issued a card, at what age?
• Would participation in and/or identification by the system be voluntary or mandatory?
• What would be the scope of the data that would be gathered about individuals participating in the system?
• Who would be allowed to demand production of a card from card carriers for proof of identity?
• Who could contribute, view, and/or edit data in a national ID system?
• What types of uses of the card and its attendant system would be allowed?
• What legal structures would protect the system's integrity as well as the data subject's privacy and due process rights, and determine the government and other parties' liability for system misuse or failure?
• Who would bear the full weight of privacy rights accountability and responsibility for a national identity system?
• What are the alternatives to a national identity system?

The Minister is to be commended for calling for a public debate on this important issue, as opposed to presenting Canadians with a policy fait accompli. Parliament, and the Canadian people it represents, are best served when major government policy proposals are discussed openly and in full consideration of as many opinions as possible. However, this Office is disappointed that the Minister's proposal should contain so little detail on what he sees as a viable, workable national ID system for Canada. We believe that Parliament and the Canadian public would have been better served by a more comprehensive exposition by the Minister and his department of the purposes, scope, uses and potential users, structure and functioning of a national ID system. This is especially true given that in July, the media widely reported that the Minister had raised the possibility of having a biometrically enhanced national ID card in place for 2005.⁵ This timeframe gives precious little time for Canadians-and for Parliament in particular-to absorb the full implications of what is being proposed.

The Minister has stated emphatically that "what we need is objectivity, an open debate based on facts and reasons, not assumptions and myth."⁶ We could not agree with him more. Informed debate, like informed consent, requires complete and detailed information on the issues of necessity, purposes, uses, access and disclosure rights, sharing privileges, appeal mechanisms and oversight.

More Than Just a Card

Before asking ourselves whether Canada needs a national ID card, it is worthwhile to reflect on what a card is and, perhaps more fundamentally, what issuing one to every Canadian actually entails.

Creating a System

The creation of a national ID card involves more than merely distributing a physical card to every citizen, with "I am Canadian" written on it. It involves the creation of an elaborate and complex national identity system, with detailed rules and a large, multi-faceted yet integrated bureaucracy governing the system's operation. The fact that Canada is a constitutional federation only adds a further layer of complexity to such a proposal, as provincial and territorial governments would most certainly need to be involved in the system's design and operation.

As the United States National Research Council indicated recently, the term "ID system" suggests the complicated nature of what would be required in a way that the colloquial and simplistic expression "ID card" does not:

" 'System' may be the most important (and heretofore least discussed) aspect of the term 'nationwide identity system,' because it implies the linking together of many social, legal, and technological components in complex and interdependent ways.. The control of these interdependencies, and the mitigation of security vulnerabilities and their unintended consequences, would determine the effectiveness of the system."⁷

The Council goes on to argue that a national identity system would consist of more than simply a database, communications networks, card readers, and millions of ID cards. Such a system would also need to provide for detailed policies and procedures. It would need to account for a myriad of security and privacy considerations. Human factors and manageability considerations would also need to be taken into account. "The system might need to specify the participants who will be enrolled," the Council writes, "the users (individuals, organizations, governments) that would have access to the data, the permitted uses of the data, and the legal and operational policies and procedures within which the system would operate." Procedures would need to be established to register individuals, manipulate identity information about them (e.g. enter, store, update, search, and return data), issue credentials, and verify search requests, to name a few.⁸

Cost Implications

Creating such a system would be no easy task, and the costs associated with its creation, as well as its day-to-day operation, would undoubtedly be enormous. Minister Coderre has not put forward any estimates of how much it would cost to create and maintain a national ID system using machine-readable, biometric identifiers. Our Office has estimated that the potential cost for implementing a nationwide ID system using biometrics might be somewhere between $3 billion and $5 billion. This does not cover the estimated costs of actually running the system, which would likewise be considerable. We based this estimate in part on the cost of registries currently in place in Canada and also by reference to attempts abroad at putting in place national ID systems.

For instance, in 1999 Human Resources Development Canada (HRDC) submitted an estimate to Parliament on the cost of an ID card system based on the Social Insurance Number (SIN), and came up with a potential cost of up to $3.6 billion. This estimate did not include, however, what HRDC termed as several "incremental expenditures" and "additional substantial costs."⁹

In the United Kingdom-whose population is roughly twice the size of Canada's-recent government estimates for a similar national identity system there put the system's cost at over $7.2 billion (CAN). UK figures have been criticized, however, as far too low and unrealistic, in part because they exclude any costs of building and maintaining the national infrastructure needed to read "smart" cards, authenticate the card holder's biometric data, and communicate with a central database in real-time.¹⁰ The British press also reported last July on a leaked document authored by Home Secretary David Blunkett that revealed that the government was considering making everyone except retired people over 75 years of age and those on low incomes pay £39 ($85 CAN) for a mandatory card.¹¹ (Other, independent estimates have put the cost of a UK card to individual citizens nearer the £100 mark, or $218 CAN.¹²)

Finally, it has been estimated that establishing a national ID system in the United States could easily require up to $50 billion US, and $3 billion to $6 billion US a year to operate.¹³

Whatever the estimate, the history of government cost overruns associated with deploying and running national registries and IT networks-the SIN and the firearms registry, for instance-should serve as an additional warning of the potentially exorbitant cost of issuing a national ID card to every Canadian. The fact that Canada is a federal state should also be considered, in that the necessary ongoing federal-provincial-territorial linkages would undoubtedly raise considerably the costs of a national ID system.

Privacy Costs and Other Social Considerations

The "costs" of a national ID system involve more, however, than just dollars and cents. Creating and maintaining a nationwide identity system would also involve substantial social costs-costs to Canadians' privacy rights, and costs to the relationship between Canadians and the state.

In its essence, the privacy problem with national identification cards is that they allow us to be identified when we have every right to remain anonymous, reveal more information about us than is strictly required to establish our identity or authorization in a particular situation, and allow our various activities to be linked together to form patterns and profiles of our lives. Identity cards do not always do this, they do not have to, and it is conceivable that they could be carefully designed and structured so as to avoid it. But it is what they can do, and what they are likely to do.

In the absence of a detailed proposal for a national identification system, it is difficult to assess its privacy implications and other social costs. To do so properly, we would need to know such things as:

• what information would be contained on the card;
• whether the information would be stored on the card or in a central database;
• whether information on the card or in the database would be available to all users or, alternatively, "zoned" to limit users on a need-to-know basis;
• who would be allowed to ask for or require that the card be produced;
• what uses of the card would be allowed;
• whether transactions using the card would be recorded and linked to each other; and
• whether the proposed national identification card would be voluntary or mandatory.

Just posing these questions gives an indication of the scale of the potential privacy implications and larger social costs. The benefits that the Minister is claiming the system will bring us suggest that the answers are the ones we would least like to hear.

For example, on the critically important question of who would be able to ask for the card and for what purposes, we must assume that the intention is that it be used in commercial transactions in the private sector. Otherwise, it would be of limited value in preventing many forms of identity theft and fraud, something the Minister is claiming for it.

There are a number of reasons to be concerned about commercial access to the personal information contained in a national identification system. Based on what we have seen with other identifiers (such as the SIN), allowing businesses to demand to see an identification card would tend to lead to increasingly casual demands for it, even when no proof of identity is reasonably necessary. Depending on how the system and the card were structured, this could result in businesses having unnecessarily liberal access to an individual's personal information.

There is nothing intrinsically wrong with establishing our identity every time we make a credit card purchase, rent an apartment, board an aircraft, cross a border, pay our taxes, or negotiate a loan. Linking all those transactions, however, by use of the same card is an entirely different matter. Indeed, a national ID system raises the possibility that the state or private sector organizations may create or have access to massive databases on each and every one of us, detailing information on some of the most personal aspects of our lives, without even our knowledge or consent.

As for larger social costs, we cannot underestimate the impact of the creation of a mandatory nationwide identity system on relations between citizens and the state. It is true that proponents of the system are hedging on whether participation would be voluntary or mandatory. But for the system to do what is being claimed for it, it would have to be mandatory. A voluntary card would not be useful in fighting identity theft, if identity thieves were not compelled to present proof of identity when, for instance, fraudulently taking out a loan in someone else's name. Known terrorists could not be stopped from entering Canada, or from boarding an aircraft, if they could simply state "I'm not in the system" when asked to produce their national identification card. Complete and absolute authentication of identity would be impossible if only a segment of the Canadian population were to register with the national system.

So, if the national identification system is to have the advantages claimed for it, it would have to be mandatory. And many Canadians may not want to participate in the system, for any number of legitimate reasons. People with memories of oppressive regimes may be fearful of overly invasive government intrusion in their personal lives. People may have strong personal, cultural or religious objections to being required to submit to biometric sampling. For some people, it may simply be contrary to their values-including the belief in the sanctity of personal privacy. All of these individuals would need to be compelled by government authorities to register, or face the consequences of the law if they did not.

Even a voluntary system, assuming that it could be made to work, would have a significant coercive element. Millions of Canadians would, to varying degrees, feel compelled to participate. Those who refused to do so would likely find accessing government services and commercial transactions more difficult and frustrating-much like life now for those without credit cards, computers, or Internet access-leaving them with little choice but to register.

Establishing a national identity system would also likely involve significant disruptions and inconveniences. If participation in the system were mandatory, it would require each and every Canadian to physically go to a government office and prove his or her identity, have his or her picture taken, and perhaps his or her fingerprint taken and iris scanned. Furthermore, once created, a national ID registry would need to be updated and maintained. Each and every Canadian would be required to update their ID card on a regular basis, just as we do with our drivers' licences, simply to ensure that the information on the card is current and its security features up to date.

Under a national identity system, one would be presumed to be oneself only upon presentation of the ID card as proof of identity. Forgetting one's card might even lead to denial of service. People who lose their cards would need to register anew. Stolen cards would need to be reported and revoked. Not carrying one's ID card might even lead to legal complications, should law enforcement authorities come to rely on the card-as they most certainly would-for proof of identity.

Canadians would have to deal with new problems as a result of errors committed by the system. No information technology system, however sophisticated, is error free. Incorrect data in the national ID registry could be very costly and time consuming to correct. Government services or private sector transactions that were easily completed in the past would be slowed or complicated by errors generated by the national identity system.

The implications for Canadians of creating a national identity system would therefore be significant. A national ID card would change the way we live. The UK Information Commissioner, Richard Thomas, made a similar observation in his response to the British Government's consultation paper on the establishment of a national ID card in Britain. He noted insightfully that the creation of a national ID card in the UK-or what has been termed there as an entitlement card-touches on the very nature of society:

"We must recognise that we may risk turning our society from one where the need to prove identity is commensurate with the service on offer, with complete anonymity being a real option in many circumstances, to one where the highest level of identity validation becomes the norm for the most mundane of services, one where we run the risk of the unique personal number being used to track our various interactions with the state and others, and to have all this recorded on a central register under its control. Of course, nothing in the government's current proposals is so draconian. But we must appreciate that, whilst we may be reassured that benign administrations will li