A Warning From Those Who Have Gone Before Us In “Transforming” Their Services…
From Database State: A Report Commissioned by the Joseph Rowntree Reforms Trust Ltd.

“… the Transformation Government programme [of the UK] is unapologetic about minimizing unnecessary personal contact… [i]f citizens end up having to “feed the beast” by supplying ever-more information through automated channels, will the interface end up as call-centre hell but with ID cards?” 

Some in government argue that citizens cannot get the services they require in an efficient way because the system does not have a secure electronic way of proving that the individual is who she says she is, and information about them cannot be shared between ministries and departments securely and electronically. As part of these projects, the government asserts that privacy will be protected through comprehensive safeguards. 

But actually protecting individual privacy is extremely challenging when systems are being built for the primary purpose of sharing, and there is not enough assessment of privacy requirements even while the systems are being built.

There are blatant privacy risks posed by these projects, and privacy advocates are concerned that privacy is not being sufficiently addressed in this drive toward efficiency.  

When more people have access to a computer database or whole system, there are more opportunities for privacy breaches, information loss and misuse. 

And because the purpose of these projects are to enable information to be easily shared across ministries, governments and with outside contractors and service delivery providers, more people will potentially have access to an individual’s information than would ever have access today. 

This means that our personal information, which was protected from widespread access because the systems were inaccessible, will lose that protection. While reliance on outmoded technology is not a substitute for effective privacy protections, the very fact that so many government systems were outmoded hid the reality that government privacy practices, and privacy policy development and training, was inadequate. 

Now, when electronic systems are being developed for the purpose of sharing data, the inadequacies in the privacy protections available to BC and Canadian citizens has become much clearer. The fact is, the systems and databases are being built before the policies and rules have been developed to ensure the protection of personal information. This is a recipe for privacy breaches, information misuse and the growth of a surveillance society.

Further, these projects create very real new threats to individual privacy rights because the very purpose of them is to permit the exchange of information about citizens between and among government departments and ministries which may have had no pre-existing reason to share the information. This can lead to "function creep." Function creep occurs when new purposes or functions for information are found after it is collected. There is a tendency to realise how useful information can be, for purposes we never thought of before, once we have it in our possession. This risk increases when new technologies are developed that did not exist at the time the information was collected. These projects pose a very real risk of “function creep.” 

It is very difficult to adequately address the risk of “function creep” after the fact. That is why if citizens are to be sure that their privacy rights will be respected, privacy rules must be established before the information is collected