Identity Theft: Bill would enhance privacy

November 19, 2006

This Editorial Appeared in the Edmonton Journal
(Page A19) November 19, 2006

Last November, a journalist from Maclean's magazine hired an illicit American data broker to purchase information on Canada's privacy commissioner, Jennifer Stoddart. Within a few hours and for less than $200, he had her detailed cellphone records as well as information on members of her family.

According to Maclean's, the information was obtained relatively easily through "pretexting," or impersonating the victim. One can mask phone lines so that the call appears to come from a valid account, and even hack into private accounts using passwords, birthdays, and other personal information. Often the victim's name and postal address are all that it takes.

This case is not so unusual, yet in Canada it is sometimes legal to obtain personal information by fraud and use it for commercial purposes.

As chair of the House of Commons Standing Committee on Industry, Science, and Technology, I have seen the issue of fraud raised again and again by various industry leaders and my fellow MPs. Many companies that have a billing or data exchange relationship with customers -- such as financial institutions, communications companies and public utilities -- have urged our government to act on this issue.

This is also an issue that resonates with ordinary Canadians. Surveys suggest that 77 per cent of Canadians are concerned or very concerned about theft of their private information; 9,000 people have fallen prey to identity theft in the last 10 months; and the financial damages caused by these crimes amounted to $7.2 million.

While privately owned companies have an obligation to safeguard the personal information of their customers, the fact is that the data brokers themselves must be held legally responsible.

That is why I have introduced Private Members' Bill C-299 in Parliament. This bill seeks to provide greater protection of personal information by closing loopholes in our current laws.

First, it will amend the Criminal Code to make it illegal for an individual or company to collect personal information through fraud or impersonation. Though fraud and personation are crimes under the Criminal Code, they do not apply to personal information such as phone records, consumer preferences, or purchases. Impersonating someone fraudulently in order to obtain their personal information will become illegal in all of these cases.

Second, it will make it easier for the victims of such crimes to seek legal recourse through the courts and through compensation. Under the current rules, the privacy commissioner's rulings are not legally binding without a federal court order, and the transgressors are not named. Through an amendment to the Canada Evidence Act, it will also ensure that fraudulently obtained personal information cannot be used as evidence in the courts.

Third, it seeks to tackle the cross-border aspect of data-stealing by amending the Competition Act and holding the Canadian affiliates of foreign companies financially liable for invasions of privacy committed against Canadians. As it stands now, the privacy commissioner has no jurisdiction to pursue complaints outside of Canada. However, Canadians can easily be targeted by data thieves in other countries such as the United States, and going abroad to get injunctions is both expensive and yields unpredictable results in different jurisdictions. Though this amendment is not a perfect solution, it will allow Canadians some legal recourse.

The growth of the Internet has revolutionized the way we live our lives and conduct our business in very positive ways. However, it has also spawned a number of unethical and even criminal activities.

This has made the protection of personal privacy more urgent.

Through the Internet and other technologies, data brokers are increasingly able to obtain a host of financial, health, property, education, and criminal records for a fee. And the Internet also provides an anonymous venue for those who wish to purchase such information.

Bill C-299 assures Canadians that their right to privacy is recognized, gives them the ability to seek compensation for damages, and catches invasions of privacy before they lead to more serious criminal activity.

This bill has passed second reading in the House of Commons and I hope that it will be passed by both the House and Senate to help strengthen legal safeguards for the protection of all Canadians.

James Rajotte is member of Parliament for Edmonton-Leduc and chair of the House of Commons Standing Committee on Industry, Science, and Technology.