moved that Bill C-27, An Act to amend the Criminal Code (identity theft and related misconduct), be read the second time and referred to a committee.
Mr. Speaker, I am pleased to rise today to speak to Bill C-27, an act to amend the Criminal Code on the subject of identity theft.
This bill follows through on the promise made by the government in the Speech from the Throne to fight identity theft.
It also furthers the government's larger agenda of tackling crime and making our communities safer.
There is no universally accepted definition of “identity theft”, but it is generally understood to refer to either or both the acquisition or the use of identifying information of another person to perpetrate fraud or another related crime.
In most cases, the impersonation of someone else to obtain something of value is the goal of identity theft, as in the case of credit card fraud when someone pretends to be the cardholder in a transaction. In more serious cases, a criminal impersonates someone else to accomplish a more sophisticated fraud, such as real estate title fraud or mortgage fraud. We have seen this very recently in the province of Ontario, where by impersonating a property owner, a criminal sells or takes out a mortgage on a property and then disappears with the proceeds. The true owner then is left to struggle to retain title and perhaps also to fight with the mortgage lender to avoid the liability of that debt.
Sometimes impersonation is not committed for the purpose of using someone else's identity to obtain something of value, but rather to conceal the criminal's own identity. For instance, some criminals maintain and use the identities of others for run-of-the-mill transactions that are themselves part of a larger criminal scheme. For instance, they may use an innocent person's identity to rent an apartment in which they plan to manufacture drugs or from which they intend to sell illegal contraband. When the crime is detected, the trail can lead back to the innocent person who was unlucky enough to have his or her personal information stolen and used to protect the guilty. There may be little in the way of a trail leading to the guilty persons themselves.
Identity theft is not new, but it has certainly mushroomed in modern society. Our world is different in ways not imagined by earlier generations. Information itself has become a commodity. It opens the door to goods, services and places. In this new world, people are mobile and commercial transactions can happen across borders via technological means rather than direct human verification in near instantaneous timeframes.
New technologies have complicated the task of authenticating identities in yet an additional way. The very same technological innovations that have increased the speed, efficiency and convenience of our transactions with governments and the private sector have simultaneously created new opportunities for fraudsters and other criminals. This is because massive amounts of information are now stored in computer systems. Unless appropriate precautions are taken, the information stored in this way is vulnerable to being accessed and copied and effortlessly transferred in many cases across the border for criminal purposes.
We also know that identity theft has been linked to organized crime and also to terrorism. Identity theft is useful in both of these contexts as a method of revenue generation. It is also a method of identity concealment, which I also spoke about, that allows organized criminals and terrorists to avoid raising suspicion or being detected by authorities, especially in cases where their true identities are already known to law enforcement and other agencies.
While we do not have complete statistics on the cost of identity theft, it has been reasonably estimated that this costs Canadians approximately $2 billion a year. The cost of credit card fraud alone for the year 2006 was estimated by the Canadian Bankers Association to be close to $300 million and debit card losses were close to $100 million in that same year. These numbers have been going up incrementally over the last decade or so.
It is unmistakable. Identity theft hurts businesses, governments and individuals. Aside from the financial repercussions, individuals whose identities have been stolen report, not surprisingly, distress, anxiety and depression in terms of the effort involved in rehabilitating their reputations and credit histories and recovering lost property. They also report a significant emotional impact of having had their identities used by another person.
In the rare cases where the identities of innocent people are used to shield a criminal's identity, the victims must also struggle to demonstrate their lack of involvement in the criminal's scheme in order to protect themselves from suspicion of criminal responsibility.
In short, identity theft is both a crime in itself and a tool for the facilitation of other crimes. For offenders, it offers the potential for high financial risk coupled with a low risk of detection. Over the last 15 years, it has grown in frequency and seriousness and the criminal law has not kept up with these changes.
When I first announced that we intended to make these changes in Montreal, a reporter asked me if this was my attempt to stay one step ahead of the bad guys. I said that we just wanted to catch up with the bad guys. This is the challenge that we have in the Criminal Code as technology continues to change. The time has arrived for the government to improve the Criminal Code and to ensure that it fully meets the needs of Canadians today.
Let me focus on those particular problems that we have identified.
First, members would understand that there are obviously some significant challenges vis-à-vis terminology in this area. The terms “identity theft”, “identity fraud” and “identity related crime” are bandied about regularly, yet none of these terms have a precise or universally understood meaning. They are no terms that are currently defined in the Criminal Code and so the phrase “crime of identity theft” can immediately generate uncertainty as to exactly what is meant. One of the objectives of the bill is to bring some clarity to these terms in the context of the criminal law.
It may be helpful to first appreciate that there are two phases of an identity crime. The first is the collection of information and the second is the actual use of that information in connection with a crime.
Our criminal law addresses many of the situations where people actually use the identity of other people or some of their identity information in the commission of an offence. It is helpful to characterize this form of conduct as identity fraud, the focus being on the actual fraudulent use of an identity.
The crime of personation, for instance, directly targets the fraudulent impersonation of someone under certain circumstances. Specifically, a person commits the crime of personation when he or she personate someone else with intent to obtain property, another type of economic benefit, or even with intent to gain an advantage that is not economic in nature, or with intent to cause a disadvantage to any person. The Criminal Code also contains offences which prohibit the making of false documents and the use of those documents to deceive someone.
There are also offences in relation to the misuse or misappropriation of credit or debit cards and even the unlawful possession of certain types of credit or debit card data. All of these offences are punishable, as they should be, by up to 10 years imprisonment.
Another crime that frequently applies to an identity theft situation is the offence of fraud. Where the value of the fraud is over $5,000, the offence carries a maximum term of 14 years.
There are already strong sanctions in the Criminal Code for the actual use of another person's identity, but there are limitations. Most important, our Criminal Code does not currently criminalize the early phases of identity crime operations which involve the acquisition and transfer of the identity information for a later fraudulent use.
Unless people commit some other existing crime in the course of acquiring the information, such as the theft of a wallet or misuse of a computer system, they cannot be stopped when they gather or trade sensitive, personal information that subsequently gets used in crimes. This means that where the police find people in possession of comprehensive dossiers on individuals, including all manner of identifying information, they may be unable to lay a charge or even to seize the data. Likewise, where people set up shop of acquiring that information and then selling it for a profit, knowing that it might be used in the commission of a crime, there may be no chargeable offence.
We can group together various aspects of this early stage of an operation under the term “identity theft” as contrasted with “identity fraud”, which refers to the actual subsequent use of the information.
It is time for our criminal law to catch up with the criminals, and this is what Bill C-27 does.
First, it would create three new offences that would be directly target the identity theft stage of a criminal operation. All of these, I should point out, are punishable by up to five years in prison.
The first new offence would make it a crime to acquire, obtain or possess another person's identity information in circumstances giving rise to a reasonable inference that the information was intended to be used deceptively or fraudulently in the commission of a crime.
This offence directly attacks those people who, as a first step to a later crime, hack into a large corporation's computer systems to obtain customer information, or who send phony emails out tricking people into providing their personal information to them, or who dive through, incredibly enough, people's garbage cans looking for discarded credit card information or utility bill information. It would also make a criminal out of the person who receives identity information from someone else for later use to commit a crime.
A complementary offence would be created for those people who set up business as information traffickers. These people are not involved in the ultimate criminal use of the information, yet they provide the tools necessary for the criminals to engage in their crimes. The bill would therefore make it a crime to transfer or otherwise provide to another person the identity information of a third person, where the trafficker would know or would be reckless about the future criminal use of that information.
For both these offences, the legislation would create a broad definition of identity information which covers all types of information that could be used for criminal purposes. The definition includes name, date of birth, address, biometric information, various forms of alphanumeric identifiers, such as driver's licence numbers, passport numbers and financial account numbers, and any other information capable of being used in that way.
An important feature that members should notice here is that these offences are directed at the mishandling of information. This means it will not matter whether the information is contained in an official identification document, or it is copied or stored in some other form.
Another situation that the police are concerned about is the situation where they find people in possession of numerous cards or documents, which are commonly used for identification purposes, such as driver's licences, health cards and social insurance cards. It may be obvious that these documents were intended for criminal use, but there may be no chargeable offence.
To remedy this situation, the bill would create a new offence for unlawfully procuring, possessing and trafficking in specified government issued identification numbers belong to or containing information of other people or containing fictitious information. These documents are crucial tools for authenticating identity in the course of a wide range of interactions between citizens, the government and the private sector and for obtaining additional documents. They are easily misused by criminals and they must be better protected.
The bill would also amend existing provisions in the Criminal Code to create a complete package of criminal laws addressing identity theft.
First, the bill would complement the existing set of forgery offences by adding new offences of trafficking in forged documents and possessing forged documents with intent to use them or traffic in them.
It would also add new offences for fraudulently redirecting or causing the redirection of a person's mail. This one I like as well. We can see how easy that may be to start to redirect somebody else's mail to another place so that information can then be gathered up and used improperly. We make it a crime to possess a counterfeit Canada Post mail key.
In addition, the bill would make clear that the offence of fraudulently acquiring, possessing, trafficking and using debit card data includes the debit card PIN number, or the personal identification number.
The law also would be clarified to ensure that it would be an offence to possess instruments for copying debit card data, which are known as skimming devices, in addition to the existing offence of possessing instruments for forged credit cards. Again, this is an attempt to update the Criminal Code.
The offence of personation will be amended to make it clear that it is a crime to use another person's identity to evade arrest or prosecution.
Another clarification will help courts understand that personation can be an ongoing, multi-transaction occurrence, a true “identity takeover”, or a simple case of fraudulently using someone's information just one time, such as a single fraudulent credit card purchase.
Also, we are proposing to rename the offence from personation to “identity fraud” to better highlight its significance and to contrast it against the preparatory stages of identity theft.
We are concerned about the victims of identity theft. To help address the impact that identity theft has on victims, this bill would amend the restitution provisions of the Criminal Code to ensure that, as part of the sentence it imposes, a court can order the offender to pay the victim reasonable costs associated with the rehabilitation of that individual's credit rating and identity.
It is appropriate at this time to commend certain members of the House who have brought this matter forward. My colleague from Edmonton—Leduc has brought forward Bill C-299. It was originally drafted to address one aspect of identity theft, which is called pretexting. Bill C-299 passed third reading in the House on May 8, 2007 and is awaiting second reading consideration by the Senate.
In the world of identity theft, pretexting is the technique of using deception of one kind or another to get people to reveal personal information about themselves. Because Bill C-299 only deals with pretexting and not with other methods used by identity thieves to gather personal information, we are proposing that it be repealed, if it should be passed, when this legislation comes into force.
When Bill C-299 was before the justice committee, it was evident that all committee members were deeply concerned about the problem of identity theft and were motivated to act collectively to build consensus on an effective solution.
We all appreciate the efforts of the member for Edmonton—Leduc and I would like to take the opportunity as well to thank a couple of other members of the House. The member for Regina—Lumsden—Lake Centre and the member for Fleetwood—Port Kells have also previously tabled private members' bills in this area. Their combined efforts have helped educate all members of the House on the problem of identity theft.
I indicated there are limitations in the current criminal law. We intend to update and extend the use of the criminal law to keep up with the changes of technology that have taken place in this country. I urge all members to support this bill and get it enacted as quickly as possible.