:
Thank you very much, Mr. Chairman.
Good morning to you, and good morning to all members of the committee. Thank you for allowing me to appear before you today on my private member's bill, . This is with respect to the general issue of protection of personal information.
I want to acknowledge the work of some members on this committee, both in the debate in Parliament—I appreciate that—and also in helping me to move this bill forward.
The purpose of this bill, , is to protect individuals against the collection of personal information through fraud and impersonation. This practice is often known as “pretexting” and is a widespread problem in the growing market for personal information.
This bill aims to close some of the loopholes in Canada's data protection law that allow data brokers to exploit people's personal information for commercial gain.
Specifically, this bill seeks to do three things. First of all, it seeks to make the practice of pretexting illegal through changes to the Criminal Code and to the Competition Act. Second, it seeks to provide a remedy for victims of this kind of invasion of privacy through legal recourse in the courts and compensation. Third, it seeks to tackle the cross-border aspect of pretexting by holding the Canadian affiliates of foreign companies liable for invasions of privacy committed against Canadians.
Mr. Chairman, information is one of the most valuable commodities in the new economy typified by the growing data brokerage industry. Data brokers buy and sell information, usually for commercial or marketing purposes. Sometimes this information is personal. Some of this industry is legal and consensual; however, there is mounting evidence to suggest that many aspects of the data brokerage industry are poorly regulated and that pretexting is a recurring problem.
Broadly speaking, there are two kinds of data brokers with the potential to invade people's privacy. First, there are the larger companies that trade in data, often for commercial or marketing purposes. Much of this is aggregated and not particular to individuals; however, individual information may sometimes be extracted from these databases. Second, a range of smaller companies offer to target individuals for a fee. These companies may simply sell personal information, or they may offer more invasive services, such as private investigation.
At the federal level, as you know, data protection falls under the Personal Information Protection and Electronic Documents Act, known as PIPEDA.
Privacy Commissioner Stoddart submitted a report in May 2006 to the privacy and ethics committee detailing possible improvements to this act. Notwithstanding possible changes to PIPEDA—and I welcome those—there are three major loopholes in Canada's data protection framework.
First, though fraud and impersonation are crimes under the Criminal Code, they do not apply to personal information such as phone records, consumer preferences, or purchases. This bill includes this type of information.
Second, while these actions violate PIPEDA insofar as it says that information cannot be disclosed without express consent of the consumer or a court order, this does not guarantee a remedy. For instance, the commissioner's rulings are not legally binding without a federal court order, and the transgressors are not named. would change that by making it a crime under the Criminal Code to collect, or to counsel to collect, personal information through fraud, impersonation, or deception.
Third, the Privacy Commissioner has no jurisdiction to pursue complaints outside of Canada. This was a problem in Ms. Stoddart's own case, the case in which her own phone records were obtained by Macleans magazine from a data broker in the United States. This bill would allow Canadian victims of privacy invasion to seek compensation from Canadian affiliates of foreign companies that had invaded their privacy.
Mr. Chairman, I know this bill passed second reading with the support of a majority of the members of the House of Commons, but members at that time raised with me, in a very responsible way, the fact that amendments were needed to this legislation in order to pass it through three readings and through committee stage. I have discussed this with some of you here and I want to indicate that I am very open to amendments, as I was at second reading. I understand there are many concerns regarding elements of this particular bill and that some of you will not support the bill as drafted.
That being said, I believe in the need for this bill to address this issue—one part of privacy, one part of identity theft--and I have undertaken, with members of Parliament and with the offices of both the justice minister and the industry minister, to seek amending advice to improve the bill's effectiveness while alleviating many of your concerns.
So what has been proposed, which I would support as a two-pronged approach, is that this committee entertain significant amendments to tighten the scope of the legislation; and secondly, that a motion be passed referring certain clauses of this bill to the Standing Committee on Access to Information, Privacy and Ethics for consideration under the current legislative review of PIPEDA.
If it is the will of this committee to entertain significant amendments within the scope of the bill, I am informed that the government is prepared to bring forward amendments seeking to, first of all, delete the clauses seeking to amend the Competition Act and the Canada Evidence Act; and secondly, tighten the Criminal Code amendments to criminalize the collection of personal information with the intent of committing fraud or impersonation; the use of deception to obtain personal information from a third party for the purposes of committing fraud or impersonation; and the passing on of personal information of a third party to be used to commit fraud or impersonation.
I certainly welcome comments from the members, but my understanding is that these amendments will address most of the practices currently utilized to obtain, circulate, and execute identity theft and fraud. These amendments, the departments believe, are necessary, as the Criminal Code provisions as currently drafted in this bill might not pass a charter challenge and could also jeopardize current investigative practices used by some of our law enforcement agencies.
I strongly believe in the amendments I have proposed for the Competition Act, Mr. Chairman, but I understand that there are some serious concerns about these. Therefore, I would respectfully ask that the committee refer these to the Standing Committee on Access to Information, Privacy and Ethics, to be studied as part of the PIPEDA legislative review. I have the assurance from both the chair and the vice-chair of that committee that the referral would be welcomed by them.
Mr. Chair, in conclusion, I do want to say that the issue of identity theft is a serious and growing problem in Canada. This bill attempts to deal with one small part of that. I understand that the justice department has been looking at this issue for some time. I welcome that.
I look forward to a more comprehensive piece of legislation to deal with the issue of identity theft in general, but I believe it's important to move forward on this issue in terms of protection of personal information at this time. I would welcome this committee to study this bill and to amend the bill in the fashion I outlined, or I'm certainly willing to entertain any other reasonable amendments.
At this point, Mr. Chairman, I'd like to conclude. I look forward to your comments and the comments from other members of this committee. Thank you.
:
To talk to you about the CBA brief, frankly I found it very helpful in terms of guidance. The Chamber of Commerce also had some very helpful comments about both the Competition Act and the amendments.
With respect to the bill, my specific direction to the Private Members' Business Office in drafting this was not to impede any law enforcement agencies in any appropriate measures that they may take in their duties. With respect to private investigators, it is a vested interest. Obviously it's their employment; it's what they do. So they're concerned about it from that point of view.
Frankly, I'm unsure as to whether their arguments are valid or not. I've read through the information they sent to me, and perhaps it will be clarified further in committee. But the brief from the Canadian Bar Association, for instance, was very specific about what it found objectionable in the bill and what recourse it wanted changed.
In terms of the private investigators, it seems that some of their changes would almost gut the bill entirely in terms of impersonation or false impersonation. So I am a little concerned about adopting their brief entirely, but I look forward to their being more specific in what they would actually change in the legislation.
They didn't talk much about the Competition Act; it was more about the Criminal Code. But I look forward to their bringing forward specific amendments to the first three clauses of the bill.
:
Thank you very much, Mr. Moore.
You are correct in the sense that identity theft is a serious and growing problem. You have the most basic form in which people steal people's credit cards or other information and actually actively try to impersonate them.
I am coming back to it over and over, but I cannot think of a better illustration than what happened to the Privacy Commissioner. Her own personal information was obtained by someone who impersonated someone else. That's the kind of thing this bill is specifically trying to address.
Some people may ask why we are being so narrow in our focus. It's to address the issue. Obviously with a private member's bill, if you are focused, you have a better chance of moving the bill forward and moving the issue forward and perhaps putting some friendly pressure on the government to move forward in a more comprehensive way on the issue.
Coming back to that, I can't think of a better example than that of someone presenting themselves as part of an institution like a bank or an insurance company, or presenting themselves as someone else and obtaining that information. That is one issue.
The other issue is obviously that of taking that information, collecting it, and selling it. That is the typical situation I am trying to prevent with this bill.
Thank you very much for your presentation.
[English]
My colleague Mr. Murphy, in his questions, began questioning a number of things. My question is this. A number of the briefs we've received—and we'll be hearing from them, I assume, at some course—like the one from the Canadian Bar Association, have suggested that to amend the code piecemeal—that's the word I'm looking for--is not in fact the best way to do so. They noted that there are serious issues with regard to the efficacy of the Criminal Code in a number of clauses, as it now stands, given the new technologies, etc. And when Justice Canada in 2004 conducted consultations on the issue of identity theft, one of the recommendations that were made by CBA to Justice Canada was that the government should in fact conduct a vast consultation on overhauling the Criminal Code in its entirety, rather than going piecemeal, whether by the government itself or through private members' bills.
So my question to you is, one, given that your bill only addresses one very narrow issue within the vast issue of identity theft, because it does not cover everything to do with identity theft, with the legal obtainment of personal information but then the illicit use and possibly criminalization of that illicit use, do you agree with CBA that in fact there should be a general consultation and an overall reform to address all of the issues and to ensure that through a piecemeal approach we're not creating unintended consequences and continuing to leave open significant loopholes? And this piecemeal approach would give a false sense of security to members of the public that because we fixed this one thing, everything is fine and dandy.
:
That's an excellent question. I do absolutely agree that to address the entire problem of identity theft, we need a much more comprehensive piece of legislation, or pieces of legislation, to deal with the issue. Frankly, I look forward to that. You mentioned the Justice Canada initiative in 2004, and they've continued their work on that. In fact, the department's been keeping me up to date on that, and I appreciate it. The last document was produced in June 2006.
My frustration, though, is that we need these laws in place now in Canada, because we have increasing and growing problems in this area, so anything I can do to move this issue along generally, anything I can do to address any part of the problem of identity theft, to me is a good thing.
I think you're correct in saying the bill addresses a narrow issue; it addresses a narrow issue by design. My focus obviously is to focus on a certain area and try to address the problem there as a way of dealing with part of the problem of identity theft. But while it's a narrow issue, it's an important one. I feel that if this bill were passed, it would obviously address part of the issue of identify theft, it would improve the laws of Canada in dealing with part of this problem, and I think, frankly, it would encourage the government to move to bring forward a more comprehensive package. If the government, in its wisdom at that time, felt that they could bring forward a comprehensive package and at that time all of my concerns were addressed in that package, obviously I would support it. If this bill does become law, and amends the law, I would certainly welcome that.
My concern is that if I were to withdraw the bill and back off, I'm not sure exactly when we would have the comprehensive pieces of legislation come forward to truly address the whole problem. I see this as a way to instigate it to address the entire problem.
First, I want to thank Mr. Rajotte for this bill. As short as it is, I think it's excellent.
I'd like to tell you about a problem we're dealing with. In Quebec, private companies gather personal information. After obtaining it, those companies transfer it to other companies, to companies in Ontario, among others. In the case I'm going to discuss, the information was forwarded to Houston, Texas, where there's a major information centre.
If I file a credit application, for example, I realize that my personal information, obtained from a third party, is in the hands of a company that is not under the jurisdiction of my province. In Houston, American laws are in effect.
The Ontario company that issues my credit card, MBNA, for example, which many of us are familiar with, obtains information from Houston. I can't solve the problem at the provincial level. However, the amendment that you want to make to the Criminal Code would enable me to file a complaint in the event my personal information was stolen or someone obtained that information through a third party and that caused me harm. From what I've understood, this amendment, as minor as it is, would mean that, under the Criminal Code, it would be possible to seek this remedy in the 10 provinces and three territories of Canada.
Paul Szabo talked about the people who were the victims of an identity theft on October 25, 2006. I was the victim of that kind of theft, and I can tell you that it's hard to recover from even 10 years later. Personal information associated with my name went to Houston. In Houston, it was transferred to credit companies. Even today, when I want to get a credit card, it states that Daniel Petit went bankrupt. However, I'm a lawyer and I can't go bankrupt. False information was forwarded. My identity was stolen. Process servers even came to my home to serve me with documents concerning civil proceedings with which I had nothing to do.
I lived through that situation, and it's really sad. Ten years later, I'm still on file at Air Canada. There are problems with a certain Daniel Petit, but it isn't me. It's a dangerous situation. As short as it is, this bill is excellent. If it had been in effect at the time, I could have instituted criminal proceedings against the companies and had my identity restored, which I was unable to do.
I've told you about my case. When you thought of this bill, did you think of that? All the provinces are separate from on another, and the Criminal Code is the only act that applies from east to west, across the country. Did you think about the fact that, for me, the Criminal Code would have been the best tool?
:
Thank you very much, Mr. Petit.
Clearly it is a situation. There's a situation very similar to yours in my riding with a gentleman who 10 years later is still having trouble boarding Air Canada flights. When he and his wife board to go somewhere on a holiday, he still phones me and says he has a problem. It's a situation that needs to be resolved.
One of the things the third point of the bill was trying to address was the cross-border aspect of pretexting, of sharing this information, by holding the Canadian affiliates of foreign companies liable for invasions of privacy and identify theft committed against Canadians. The challenge here—and obviously this partly explains the amendments to the Competition Act—is that the Privacy Commissioner, Jennifer Stoddart, has no mandate to pursue investigations outside Canada. Perhaps, as Mr. Comartin mentioned, it might be better addressed by broadening her mandate, or broadening her powers in some way, through the PIPEDA review.
With the Internet and with wires going across borders and not respecting borders, we have to find a way to deal with exactly the kind of situation you describe--a company in Quebec that transfers information with the click of a finger down to a company in Texas, and 10 years later you're still dealing with this problem. That obviously has to be addressed. I think you mentioned it was 10 years ago; this is a problem that needs to be addressed now.