Tag Archives: consultation

DIACC’s Submission to the 2026 Review of the Privacy Act

Filed with the Treasury Board of Canada Secretariat, July 2026

The Privacy Act came into force in 1983 and has never been substantially updated. In April 2026, the Treasury Board of Canada Secretariat launched the first comprehensive review of it, outlining 23 policy proposals across 6 themes and asking two questions: Do you agree with the approach, and is anything missing?

DIACC filed its submission ahead of the July 10 deadline. This page sets out what we said, and why.

The submission is offered as analysis informed by member experience. It is not a position adopted on behalf of any individual member or government, and it does not advocate for any particular vendor or technology.

What we said, by theme

Theme 1: Enabling integrated services

Proposal 1 (sharing and reuse of personal data across programs, without consent, where a public interest or benefit to individuals is served). We support the direction. Replacing the default of repeated direct collection with a purpose-based approach is consistent with international practice and with the authoritative-source model that underpins modern digital service delivery. The four conditions attached to it are well calibrated: the reuse must be necessary, minimally intrusive, strongly safeguarded, and transparent.

Removing consent from the equation places considerable weight on those four conditions. They are the whole of the protection. Our submission’s position is that the conditions must be demonstrable in practice, not merely stated in statute, and that implementation guidance carries the load.

Proposal 2 (designated official sources of government digital data). This is the proposal we would most want to see survive the drafting process.

It would name certain institutions as the official source for specific types of personal data, and require other programs to obtain that data from the designated source rather than collect it again. The paper is candid that the driver is accuracy as much as convenience: under the current siloed model, a person who updates their information with one program and not with four others leaves the government holding several versions of the same person.

Provinces have been operating versions of this model for years. The BC Services Card serves more than 4.6 million British Columbians.[4] Quebec’s Government Authentication Service supports over 3.5 million accounts.[5] Alberta launched Canada’s first mobile health card in August 2025.[6] In the private sector, Interac’s sign-in service already carries more than 141 million federal government interactions annually.[8]

The consultation paper says designation would be guided by clear criteria and overseen by TBS, and that TBS could maintain a registry of official sources. We asked for three things in that work.

Auditable assurance frameworks should inform designation criteria, so that designation means an institution is held to a consistent and verifiable standard rather than simply named to a list.

The registry should be public and written in plain language, so that a Canadian can find out which institution is the official source of their data. A registry that exists only as an internal administrative instrument does less to build trust than one that people can actually read.

The model should be built for federal-provincial interoperability from the outset. Health, benefits and employment data cross that boundary constantly, and the paper itself allows that the approach could be extended across levels of government. Designing for that later is harder than designing for it now.

Theme 2: Enhancing accountability and transparency

We support all four proposals in this theme.

Elevating Privacy Impact Assessments to a legal requirement (Proposal 3) and publishing plain-language summaries of them strengthens accountability without imposing an unreasonable burden. Replacing the fragmented Personal Information Bank regime with a single centralized registry of personal data holdings (Proposal 4) is a straightforward improvement in service design and in transparency.

Regarding the automated decision proposals (Proposals 5 and 6), we support the direction but think something is missing from them.

The proposals would require institutions to notify individuals when an automated decision system is used and, upon request, explain how a decision was made and what data informed it. As those systems take on more consequential decisions, an institution’s ability to establish who the data subject actually is, and on what basis their consent was captured, does more work than it used to. Identity and consent assurance should be addressed in the Act’s automated decision provisions themselves, working alongside the Directive on Automated Decision-Making rather than being left entirely to it.

Theme 3: Advancing safeguards across the spectrum of data sensitivity

We support all five proposals in this theme.

Recognizing a spectrum of data sensitivity and identifiability in law (Proposal 7) is overdue, and the proposed categories align with international standards and provincial regimes. Creating legal requirements for breach management, notification, and reporting (Proposal 8) brings the Privacy Act into line with PIPEDA and international peers and is foundational.

Requiring safeguards proportionate to sensitivity (Proposal 9) is appropriate. We note that auditable assurance frameworks provide institutions with a demonstrable means of evidencing that physical, technical and administrative safeguards meet the legal requirement, rather than merely asserting that they do.

The necessity test for collection (Proposal 10) and the retention and disposal requirements (Proposal 11) are well calibrated. Institutions applying them will need to document, on a defensible basis, the authority and the retention rule applicable to each category of data they hold.

Theme 4: Modernizing the foundation for privacy and trust

We support all four proposals in this theme.

Recognizing privacy as a fundamental right while also naming service delivery as an objective (Proposal 12) resolves a tension that has never existed. Privacy protection and modern digital service are not competing goods, and a statute that says so plainly permits institutions to pursue both.

Listing privacy principles in the Act (Proposal 13) and aligning them with PIPEDA, the GDPR, and OECD guidelines reduce the interpretive burden for organizations working across federal, provincial, and private-sector regimes at once. We put particular weight on privacy by design, necessity, proportionality, effectiveness, and minimal intrusiveness.

Consistent definitions (Proposal 14) and a harmonized request regime (Proposal 15) are practical improvements that will be felt by anyone who has tried to request the current framework.

Theme 5: Indigenous Peoples’ access to, and protection of, their data

Our answer here was mostly deference.

Provisions governing Indigenous data must be developed in direct partnership with Indigenous governments and organizations, recognizing their distinct rights, perspectives, and priorities. We support the directional intent to recognize Indigenous data sovereignty and enable Indigenous governments to access their citizens’ data through formal agreements. On the substance of how those provisions should be drafted, and on the terminology the Act should adopt, we defer to Indigenous partners.

DIACC is engaged in exploratory dialogue with Indigenous organizations on co-design opportunities in digital trust. DIACC and its members can help build what those partners design. We are not the right authors of it.

Theme 6: Updating the compliance framework

We support the proposals in this theme.

We give particular weight to Proposal 20, which would authorize the Privacy Commissioner to share information with other oversight bodies. Canadians’ data moves among federal, provincial, and international regimes, and coordinated oversight across those regimes is a precondition for trusting that it is consistently protected as it travels.

We also support binding order-making powers and published corrective action plans (Proposal 19), offences for unauthorized re-identification (Proposal 21), expanded Federal Court authority (Proposal 22), and a mandatory five-year review (Proposal 23). Together these move the Act from a framework that describes obligations to one that can enforce them.

What we said was missing

The consultation’s second question is the more interesting one. Our answer had four parts.

The proposals stop short of the proof. A statute sets obligations. It does not settle how an institution demonstrates it has met them; that gets worked out afterwards in Treasury Board policy, in implementation guidance, and in whatever frameworks institutions end up using to evidence compliance. The consultation paper is detailed on the obligations and thin on the proof. More than 250 federal institutions will have to supply it.[10]

Auditable, technology-neutral assurance frameworks are one available means of closing that distance, across identity verification, consent management, automated decision-making, designated official sources, and inter-institutional sharing. They can be certified by independent third-party audit. Canadian industry and several provincial governments already operate on them. The Pan-Canadian Trust Framework is one such example, and Appendix B below shows how its components align with individual proposals. We offer that as information as an educational and operational example..

Independent certification is a recognized means of evidencing assurance. Where an institution needs to show that a service meets defined privacy and verification criteria, including in procurement, third-party certification against a published, technology-neutral framework is one auditable means of doing so.

Alignment with provincial regimes should happen at the principles and assurance layer. Canadians do not experience federal, provincial and municipal services as separate jurisdictions. Aligning at the level of principles and assurance, rather than attempting to align the legislative text, would allow a modernized Act to sit alongside BC’s FIPPA, Alberta’s FOIP, Quebec’s Law 25 and Bill 82, and Ontario’s regime without asking any jurisdiction to give up its authority.

Privacy reform is also service reform, and it bears on fraud. Canadians reported more than $704 million in fraud losses in 2025.[1] Synthetic identity fraud has climbed sharply as a share of credit applications.[2] Canada’s suspected digital fraud rate reached 4.4% of attempted transactions in 2025, above the global average of 3.8%.[3] The assurance sitting underneath federal identity and verification affects people’s money as well as their privacy. A modernized Act that supports auditable, interoperable assurance strengthens public trust and bolsters the digital economy, which depends on trusted federal data.

Appendix A: About DIACC and the Pan-Canadian Trust Framework

DIACC is Canada’s non-profit public-private forum on digital trust and verification, established in 2012 following the recommendations of Finance Canada’s Electronic Task Force for the Payments System Review. Our membership includes federal institutions, provincial and municipal governments, and the financial, telecommunications and technology partners that build and operate digital services with them.

The Pan-Canadian Trust Framework (PCTF) is an auditable conformance framework for identity, authentication and verification services. It is technology-neutral, built around privacy-by-design principles, and structured to support interoperability across federal, provincial and private-sector regimes.

DIACC’s PCTF Trustmark program certifies services against PCTF criteria through an independent third-party audit. Certified services are listed publicly on the DIACC Trusted List.

DIACC’s strategic priorities for 2026 to 2031 are AI trust and resilience, economic sector acceleration, regulatory alignment and compliance, and inclusive digital sovereignty.

Appendix B: How PCTF components align with the proposals

The PCTF was built around principles consistent with the policy approaches in the consultation paper. The following is offered for the reference of anyone interested in how an existing auditable framework maps to the proposals. It is not a recommendation that TBS adopt the PCTF, and DIACC does not advocate for any vendor or technology.

Proposal 1 (responsible sharing and reuse). PCTF identity verification and authentication profiles support the conditions attached to responsible sharing: necessity, minimal intrusiveness, and strong safeguards. The criteria are auditable, providing institutions with a defensible basis for inter-institutional sharing.

Proposal 2 (designated official sources). PCTF provides certifiable assurance criteria for institutions seeking designation, supporting consistent trust standards across designated sources.

Proposal 3 (mandatory PIAs). PCTF profiles include privacy-by-design criteria that map to PIA requirements.

Proposal 5 (transparency for AI and automated decision systems). DIACC’s AI verification and Verified Agent (Know Your Agent) criteria, currently in development, are designed to support transparency and explainability requirements for AI-supported decision systems.

Proposal 6 (strengthened privacy notices). PCTF consent criteria support plain-language notice requirements.

Proposal 7 (sensitivity spectrum). PCTF assurance levels apply proportionate safeguards based on the sensitivity and identifiability of the data being verified or authenticated.

Proposal 8 (breach management and notification). PCTF certification requirements include breach response and notification protocols.

Proposal 9 (legal safeguard requirements). PCTF certification provides auditable evidence that physical, technical and administrative safeguards meet defined criteria.

Proposal 12 (privacy as a fundamental right; service delivery as an objective). The PCTF was designed to support both privacy protection and modern digital service delivery.

Proposal 13 (principles aligned with private sector and international standards). PCTF principles align with PIPEDA, the GDPR and OECD guidelines.

Appendix C: Provincial and industry implementations

These implementations show how the policy approaches in the consultation paper can work in practice, and where the interoperability opportunity lies for a modernized federal Privacy Act. They are offered as illustrations. DIACC does not speak on behalf of any province or company.

British Columbia. The BC Services Card has been operational since 2013 and now serves more than 4.6 million British Columbians, over 90% of the province.[4] It supports federal interactions, including StudentAid BC and the Canada Revenue Agency. OrgBook BC, launched in January 2019, was the first implementation in North America to use verifiable credentials for organizational identity, and now covers over 1.4 million active legal entities. BC demonstrates the designated-official-source model at provincial scale, including federal-provincial interoperability.

Quebec. The Government Authentication Service, which replaced clicSÉQUR, supports more than 3.5 million accounts. Bill 82, passed on October 28, 2025, establishes the legal framework for a comprehensive digital identity and wallet capability by 2028.[5] Quebec shows that a legal framework for digital identity can be designed to sit comfortably inside a strict privacy regime.

Alberta. Alberta launched Canada’s first mobile health card on August 29, 2025, through the Alberta Wallet app.[6] Parents can hold their children’s cards, and paper alternatives remain available. Alberta shows how sensitive personal data can be made available digitally while upholding privacy-by-design principles and preserving non-digital alternatives.

Industry. Interac’s sign-in service supports more than 141 million federal government interactions annually,[8] and Interac Verified, launched in May 2025, implements a verify-once model that stores data locally on the user’s device.[7] Canadian-controlled assurance infrastructure is operational and already working at federal scale.

International context. The EU Digital Identity Wallet is in active rollout. Commission Implementing Regulation (EU) 2026/798 on wallet enrolment was published on April 8, 2026, and all member states must make at least one compliant wallet available by December 24, 2026.[9] Privacy and digital identity infrastructure are increasingly being designed to interoperate across jurisdictions.

Related DIACC resources

Citations

[1] Competition Bureau Canada, “Fraud Prevention Month to bring hidden crime into the spotlight” (March 6, 2026), citing data from the Canadian Anti-Fraud Centre.

[2] Equifax Canada, “Equifax Canada Reports Rise in Automotive Fraud” (September 24, 2024). Synthetic identity fraud rose from 2.8% of credit applications in Q2 2023 to 8% in Q2 2024.

[3] TransUnion, “H1 2026 Update to the Top Fraud Trends Report” (May 13, 2026).

[4] DIACC, “Identity in Action Case Study: BC Services Card” (March 2019); Government of British Columbia, OrgBook BC.

[5] Government of Québec, “About the Government Authentication Service”; ID Tech, “Quebec Passes Landmark Digital ID Law” (October 2025).

[6] ID Tech, “Alberta Launches Canada’s First Mobile Health Card Through Alberta Wallet” (September 2025).

[7] Interac, “Interac launches the Interac Verified credential service” (May 2025).

[8] Interac, “Secure. Trusted. Helping Canada navigate a digital future” (October 2025).

[9] European Commission, Commission Implementing Regulation (EU) 2026/798 on wallet enrolment (published April 8, 2026).

[10] Treasury Board of Canada Secretariat, “2026 Review of the Privacy Act: Policy Approaches” (April 2026).

DIACC AI Consultation Submission to the Federal Government

October 31, 2025 – Canada has the opportunity not only to develop world-class AI capabilities, but also to build an ecosystem where AI innovation and responsible deployment are enabled by a strong foundation of digital trust, identity, authentication, and interoperability. DIACC’s mission is to accelerate the adoption of digital trust by enabling privacy-respecting, secure, interoperable digital trust and identity verification services through the DIACC Pan-Canadian Trust Framework (PCTF).

In this submission, we outline how investments in trust infrastructure, standards and verification can help deliver four key outcomes: scale Canadian AI champions, attract investment, support adoption and foster responsible, efficient deployment of AI systems.

About DIACC

The Digital ID and Authentication Council of Canada (DIACC) is a non-profit public–private coalition created following the federal Task Force for the Payments System Review. DIACC’s mission is to accelerate the adoption of digital trust by enabling privacy-respecting, secure, and interoperable identity systems.

DIACC is the steward of the Pan-Canadian Trust Framework (PCTF)™ — a public and private sector, industry-developed, standards-based, technology-neutral framework designed to enable scalable, certifiable digital trust infrastructure that meets the needs of governments, businesses, and individuals.

The DIACC PCTF has been developed in collaboration with experts from federal, provincial, and territorial governments as well as industry and civil society. It supports verifiable credentials, authentication services, fraud prevention, and information integrity across the Canadian digital economy.

Scaling Canadian AI champions and attracting investment

A major barrier for Canadian AI firms is not solely algorithmic innovation, but the ability to build scalable, trusted solutions that can be easily integrated with government and industry systems — particularly in regulated sectors. To scale, Canadian AI companies must demonstrate trustworthiness, security, privacy compliance, identity/credential verification, and interoperability — all of which raise costs and complexity when the underlying infrastructure is fragmented or weak.

Further, investors increasingly look for ventures that not only have technical sophistication but also strong risk management, data provenance, identity assurance and governance frameworks;   Canada can differentiate itself by emphasizing trusted AI ecosystems.

Recommendations:

  • Recognize identity, authentication, verification and trust-framework services (e.g., the DIACC PCTF) as critical infrastructure to underpin secure and trustworthy AI ecosystem scaling — and include funding streams, procurement support and regulatory recognition accordingly.
  • Introduce targeted incentives (grants/tax credits) for Canadian AI firms that embed standards-based verifiable credentials, identity proofing and interoperability from day one — thereby lowering investor risk and improving export readiness.
  • Foster public-private collaborations where government platforms adopt standards-based digital credentials (for authentication, identity verification, data-sharing) and invite Canadian AI firms to build on those platforms — this creates domestic anchor opportunities and global reference cases.
  • Promote and fund initiatives that allow Canadian AI firms to export trust by aligning Canada’s trust-framework credentials with international equivalents (e.g. UK identity frameworks) so that Canadian-built AI solutions come with built-in identity/credential assurance for global markets.

Enabling adoption of AI across industry and government

Adoption by industry and government is facilitated when the infrastructure for authenticating, verifying identity, sharing data, and managing credentials is streamlined and standards-based. AI solutions deployed in real-world workflows often hinge on knowing who is interacting, what credentials they hold, which data sources are valid — not just the AI model itself.

Fragmentation in identity verification, digital credentials and interoperability across jurisdictions (federal/provincial/territorial) also increases friction, slows procurement and reduces the number of “ready” integration points for AI vendors.

Recommendations:

  • Deploy a reusable digital credential/single sign-on system for government services (federal, provincial, municipal) modelled on widely used private-sector login tools. This makes it easier for government agencies and vendors (including Canadian AI firms) to plug in.
  • Encourage government procurement frameworks to demand standards-based trust services (identity proofing, verifiable credentials) as part of AI solutions — thereby embedding adoption readiness from the procurement side.
  • Provide and consume standardized capability services offered by the public and private sectors (identity/credential verification, verifiable data sources, API hubs) that AI firms can access respecting privacy, leveraging a consent-based framework,  rather than each reinventing, reducing cost and time-to-market.
  • Support industry-government collaborations in regulated sectors (e.g. health and finance) where trust and identity verification matter first — by creating pilot environments that leverage trustworthy identity and credentials as the foundation for AI deployment.

Building safe, reliable and trustworthy AI systems, and strengthening public trust

Public trust in AI is undermined when the authenticity of interactions, data and verified identities cannot be reliably determined — for example, synthetic identities, manipulated documents, fraud-enabled onboarding, and unverified credentials all impact trust and impede safe AI deployment.

Identity assurance, verifiable credentials and trustworthy provenance of data and interactions are vital to enable AI in environments where safety, ethics, regulation, and accountability matter (e.g. financial decisions, cross-border labour credentials).

A standards-based trust framework such as DIACC’s PCTF can support traceability, transparency and audit capability in AI workflows, making systems safer, more explainable, and more investable.

Recommendations:

  • Fund the adoption and certification of privacy-respecting, standards-based identity, verification and credential-issuance systems (e.g. the DIACC PCTF) across sectors that will use AI.
  • Recognize identity verification, credentialing and data provenance as core components of AI governance frameworks (not just “nice to have” add-ons), and include them in AI risk-assessment, certification and procurement guidance.
  • Invest in research and development of identity and credentialing tools that are specifically tailored for AI use-cases (e.g. verifying data source authenticity).

Building enabling infrastructure, including data, connectivity and skills

While data and connectivity are widely recognized as AI-enablers, equally critical is the infrastructure of trust, including identity frameworks, verifiable credentials, authentication services, and certification of trust services — without which data sharing, inter-jurisdictional collaboration, and large-scale deployment face bottlenecks.

Digital sovereignty is also critical. Canada must ensure that infrastructure (cloud, data centres, identity/trust services) aligns with domestic values, jurisdictional control and regulatory frameworks in order to attract both domestic and foreign investment that values provenance and security.

Recommendations:

  • Invest in Canadian-based trust infrastructure, including domestic cloud and data centres, specifically for identity/credential/trust-services, to support AI readiness, digital sovereignty and economic resilience (as previously recommended by DIACC).
  • Ensure that interoperability standards for identity, credentials and trust-services are integrated into AI infrastructure planning — enabling cross-sector and cross-jurisdiction data flows, credentials reuse, and reduced duplication of onboarding/verification.
  • Support development of shared digital identity and credential hubs, which can serve as infrastructure building blocks for AI-enabled systems, enabling smaller firms or remote/Indigenous communities to access AI infrastructure.
  • Link infrastructure investment to skills and operational readiness, and include training programs for identity/trust-service management, credential issuance and verification, and interoperable system design, ensuring the human infrastructure is aligned with the technical.

Conclusion

Scaling Canada’s AI champions, attracting investment, accelerating adoption, and building safe and trusted AI systems all rest on a foundation of digital trust, verifiable identity, credentialing and interoperability. By recognizing and investing in trust infrastructure as a core enabler alongside data and connectivity, Canada can create a differentiated and competitive AI ecosystem.

DIACC welcomes further collaboration with federal partners and key stakeholders to implement standards-based trust frameworks, support interoperable credentialing and enable Canada’s AI ecosystem to flourish on the global stage.

Thank you once again for the opportunity to provide this input.

Joni Brennan
President, DIACC

2022 Pre-Budget Submission

DIACC’s Written Submission for the Pre-Budget Consultations in Advance of the 2022 Budget

Ahead of the 2022 federal budget, the House of Commons Standing Committee on Finance has asked Canadians to share their input. 
DIACC is pleased to have submitted a brief, calling on the Federal Government to implement the following recommendations: 

  1. That the government secure adoption of the Pan-Canadian Trust Framework by businesses and governments.
  2. That the government act on the Finance Committee’s 2021 Pre-Budget Consultation Recommendations 128, Implement a digital identity system that empowers Canadians to control their data that is held by the federal government, and 129, Create a national data strategy.
  3. That the government work with provincial and territorial partners and Immigration, Refugees and Citizenship Canada to ensure that all Canadians have access to an ISO-compliant government-issued digital ID credential with economy-wide utility by December 2022.
  4. That the government make digital identity-enabled services available to all Canadians by December 2022.
  5. That the government prioritizes funding and integration of digital ID as part of the Digital Technology Supercluster Initiative.

The Key to Unlocking an Inclusive Digital Economy: Investing in Digital ID

To re-start the economy and deliver inclusive services to all Canadians, governments must invest in unlocking digital. Digital ID empowers Canadians with the choice to safely share their existing credentials (eg: passports, driver’s licenses, health cards) for digital transactions.

Investing in digital ID offers economic benefits to citizens, businesses, and governments and also establishes digital tools to support societal trust, security, privacy, and fraud mitigation. This is a win for all.

Few budget items have the potential to impact every government initiative – digital ID is one such investment with broad impacts and encompassing benefits. Digital ID offers service improvements across all government services and priority areas. This initiative has the potential to empower individuals, increase government efficiency, strengthen companies, and unite communities across the country with secure access to resources, economic development, trust, and support. 

Canadians understand the potential. The pandemic has been an intense and polarizing experience, leading many Canadians to lose faith in institutions. The Edelman Trust Barometer reports that 46% believe that government leaders purposely misled them. At the same time, Canadians are relying more on technology, with the digital sector growing 3.5 percent in 2020, while the economy as a whole shrunk by 5 percent. With digital transformation happening across the country, Canadians are aware that online privacy is crucial. A recent poll from The Office of the Privacy Commissioner of Canada reports that 89 percent of Canadians are concerned about people using information about them online to steal their identity. 

How can the government build trust, enhance privacy, and demonstrate that citizens’ rights are top priority? The answer is clear: 9 in 10 Canadians are supportive of digital ID. Citizen-centric, standards-aligned Digital ID offers an ecosystem that reopens doors closed by the pandemic and unlocks entirely new paths to economic resiliency, cohesion, and social trust.

🔑 Recommendation 1: Implement adoption of the Pan-Canadian Trust Framework by businesses and governments to ensure Canadians are empowered post-pandemic and have clarity in building a secure, interoperable, and privacy-respecting digital ID.

The Pan-Canadian Trust Framework™ (PCTF) is a co-created framework that any jurisdiction — federal, provincial, or international — and industry sector can work with to ensure business, legal, and technical interoperability to realize the full benefits of a digital ecosystem. Rather than seeking a single solution, the PCTF promotes choice and offers a shared hub and language that distinct solutions can interoperate through. Developed by public and private sector experts over a decade, the PCTF provides organizations of all sizes, across sectors, industries, and locations with shared principles and guidelines for a digital ID ecosystem. Built based on recommendations from the federal government’s Task Force for the Payments System Review in 2011, this work has been identified by the public and private sectors as key for Canada’s economic resilience but remains underfunded. 

While provinces, territories, and countries around the world set up COVID credentialing and proof of vaccination systems, the need for these systems is urgent. The credentials issued must be designed with common principles and security to enable acceptance across various jurisdictional and sector-specific solutions for their unique context. The PCTF makes this possible, working as a flexible foundation to connect systems without dictating a single technological architecture. 
The PCTF includes adaptable recommendations that are currently being tested in-market, including standards for Notice and Consent, Authentication, Privacy, Verified Person, Verified Organization, Credentials (Relationship and Attributes), Infrastructure (Technology and Operations) and Assessment. A Model, Overview, and Glossary have been published for ease of use across industries and sectors. Developed with Canadians in mind, the PCTF is technology-agnostic, encouraging innovation while prioritizing privacy, safety and security, and supporting digital economic growth on a global scale.

🔑  Recommendation 2: Put citizens first and integrate cross-government priorities. Act on the Finance Committee’s 2021 Pre-Budget Consultation Recommendations 128, Implement a digital identity system that empowers Canadians to control their data that is held by the federal government, and 129, Create a national data strategy.

Empowering individuals to control their data, understand available services, and have more convenient and secure access to government services offers a direct path to rebuild trust. A recent Leger survey commissioned by Postmedia reports that the pandemic has eroded trust in the federal government, either a little or a lot, for 63% of Canadians. After a challenging year, it is critical that the budget puts citizens first. Digital ID is a proactive initiative that offers immediate and long-term benefits. It has the potential to restore confidence, act on Canadian values, and empower citizens.

Providing Canadians with the digital ID credentials necessary to access, manage, and share their own data ensures citizens have control over the important information they need to manage their health, business(es), and digital services. A national data strategy ensures all Canadians benefit from these advances. It also clarifies accountability for those who seek to use technology and personal information with malicious intent. A pan-Canadian strategy evens the playing field for businesses looking to operate digitally across provincial, territorial, and global borders. This approach also enhances Canadians’ ability to compete economically on a global scale, travel, and seek care with the virtual mobility afforded by a secure, verifiable digital ID. 

🔑 Recommendation 3: Ensure all Canadians benefit from digital connections, opportunity, and the right to be recognized with digital ID. Work with provincial and territorial partners and Immigration, Refugees and Citizenship Canada to ensure that all Canadians have access to an ISO-compliant government-issued digital ID credential with economy-wide utility by December 31, 2022.

Digital ID is the key, as the pandemic has built and opened new doors for Canadians navigating their safety, financial security, health and relationships. According to a study by Brookfield Institute, 9 percent of Canadian businesses made 60 percent or more of their total sales online, up from 6 percent in 2019 — but this digital success has been difficult for small to medium enterprises to adopt. As digital service adoption grows, citizen and employee expectations have also shifted to demand more reliable and secure digital alternatives. Digital ID can encourage sustainable, long-term adoption of digital platforms and help organizations of all sizes to benefit from these systems. It also presents a more flexible and streamlined strategy for pan-Canadian notification systems, service delivery, and community safety initiatives.

Provinces and territories are establishing their own digital ID initiatives. Alberta and British Columbia have launched digital IDs, with BC including a mobile card and a Verify by Video option. Significant investments have been made in Ontario and Québec, where proof of vaccination credentials have been launched. Saskatchewan, Yukon, Nova Scotia, Newfoundland, Prince Edward Island, and New Brunswick are launching pilots, proof of concepts and digital ID components. 

This prioritization demonstrates demand for this enabling capability across the country — but unequal funding and approaches developed in departmental silos pose a risk. Without cohesive federal leadership, these systems will be disjointed and miss the opportunity to be truly interoperable, efficient, and useful for all Canadians. Unlocking these opportunities in a synchronized and equitable manner will ensure Canadians can all access economic opportunities, required public services, and the chance to manage their own personal information.

🔑  Recommendation 4: Collaborate for the highest and most equitable impact. Make digital identity-enabled services available to all Canadians by December 2022.

As the provincial and territorial governments take action to simplify and secure digital identities, private companies are also taking note of this massive market opportunity. Notably, Apple is teaming up with the TSA to be a trusted source of ID for Americans and Stripe is pursuing digital ID services partnering with other apps, including Discord, for user verification. Many more companies are entering the digital ID space in hopes of earning users’ trust and capturing market share. As the issuer of identity in Canada, the public sector is uniquely positioned to empower Canadians and enable the private sector — but the government needs to act now. 

While offering numerous economic and social benefits locally and globally, a Canadian digital ID builds citizen trust and mitigates risk. As the Canadian Centre for Cyber Security noted, “the number of cyber threat actors is increasing, and… Cybercrime will almost certainly continue to be the cyber threat most likely to affect Canadians.” This vulnerability means that Canadians urgently require an encompassing, policy- and leadership-driven approach to implementing and enforcing Privacy by Design principles. A McKinsey report confirms this, suggesting that, for national governments to address the heightened risks presented by cyber threats, “organizations can move from a ‘trust but verify’ mindset to a ‘verify first’ approach.” Pressures and requirements for proof of vaccination, contact tracing, and social distancing are also made possible, digitally secure, and more user-friendly through universal data minimization standards. 

Digital ID offers the key to unlocking secure digital services and pathways. With opportunities to boost job creation, economic growth, citizen wellbeing, COVID-19 planning, support, and mitigation, and reconciliation efforts, digital ID is a budget line that prioritizes and directly benefits all Canadians. Digital ID offers Canadians more personalized control over personal information and convenient access to services. It can increase mobility and connect intra-provincial and territorial systems. It offers an opportunity to strengthen innovation and establish a secure foundation for international collaboration.

🔑  Recommendation 5: Embed within existing ecosystems. Prioritize the funding and integration of digital ID as part of the Digital Technology Supercluster Initiative. Digital ID supports and intersects its areas of focus including health, sustainable natural resource applications, and digital training.

Strides are already being made by Canadians. Purpose-built solutions, like the COVID Alert App, demonstrate that Canada has the talent and innovation to adapt and develop market-leading solutions. Unfortunately, the $20 million price tag and reactive nature of these innovations could be improved. The app has also not been approved by data authorities in Alberta, British Columbia, Nunavut, and Yukon, making it an incomplete solution that doesn’t account for different provincial regulations. Due to the nature of the pandemic, a pan-Canadian solution isn’t a nice to have — it’s a must. Digital ID is a proactive investment that could provide similar benefits in contact tracing and offer lasting impacts on service delivery. 

Digital ID has the potential to add $4.5 billion of added value to SMEs and reinvestments in the economy. It also directly meets the needs and preferences of consumers, with Signicat reporting that 68 percent of consumers expect 100 percent digital onboarding in the wake of COVID-19 and 60 percent would value digital identities to access services internationally. Canada has an opportunity to lead, recover, and take a future-focused position by making an investment in digital ID. 

Prioritizing digital ID is putting Canadians today and in the future first, and reflects responsible investment that offers benefits across departments. Its utility and impact apply during and beyond health or environmental crises. Digital ID delivers an adaptable foundation to deliver new services, security, citizen engagement opportunities, and economic growth.

DIACC members work in partnership with the Government of Canada and all levels of government and welcome further conversations and collaboration.

All sources may be referenced within the PDF version, accessible here or below.

DIACC_Pre-Budget-Consultations_August_2021

2021 Pre-Budget Submission

DIACC’s Written Submission for the Pre-Budget Consultations in Advance of the 2021 Budget

Ahead of the 2021 federal budget, the House of Commons Standing Committee on Finance has asked Canadians to share their input. 

DIACC is pleased to have submitted a brief, calling on the Federal Government to implement the following recommendations: 

  1. Secure adoption of the Pan-Canadian Trust Framework by businesses and governments to ensure Canadians are well-protected and supported post-pandemic.
  2. Work with provincial and territorial partners along with Citizenship and Immigration Canada to ensure that all Canadians have access to an ISO compliant government-issued digital ID credential with economy-wide utility by December 31, 2021.
  3. Have digital identity and authentication efforts co-led by the Minister of Digital Government and the Minister of Innovation, Science, and Industry to ensure that both government service delivery and economic prosperity requirements are met.
  4. Prioritize the funding and integration of digital ID as part of the Digital Technology Supercluster Initiative. 
  5. Champion and educate on the crucial role of digital identity for businesses, health care centres, academic institutions, civil society, and all Canadians.

Read DIACC’s full Pre-Budget Consultation Submission below or download directly.