An Act to amend the Criminal Code (identity theft and related misconduct)

This bill was last introduced in the 39th Parliament, 2nd Session, which ended in September 2008.

Sponsor

Rob Nicholson  Conservative

Status

In committee (House), as of Jan. 30, 2008
(This bill did not become law.)

Summary

This is from the published bill. The Library of Parliament often publishes better independent summaries.

This enactment amends the Criminal Code to create a new offence of identity theft, of trafficking in identity information and of unlawful possession or trafficking in certain government-issued identity documents, to clarify and expand certain offences related to identity theft and identity fraud, to exempt certain persons from liability for certain forgery offences, and to allow for an order that the offender make restitution to a victim of identity theft or identity fraud for the expenses associated with rehabilitating their identity.

Elsewhere

All sorts of information on this bill is available at LEGISinfo, an excellent resource from the Library of Parliament. You can also read the full text of the bill.

Criminal CodeGovernment Orders

January 29th, 2008 / 11:40 a.m.
See context

Niagara Falls Ontario

Conservative

Rob Nicholson ConservativeMinister of Justice and Attorney General of Canada

moved that Bill C-27, An Act to amend the Criminal Code (identity theft and related misconduct), be read the second time and referred to a committee.

Mr. Speaker, I am pleased to rise today to speak to Bill C-27, an act to amend the Criminal Code on the subject of identity theft.

This bill follows through on the promise made by the government in the Speech from the Throne to fight identity theft.

It also furthers the government's larger agenda of tackling crime and making our communities safer.

There is no universally accepted definition of “identity theft”, but it is generally understood to refer to either or both the acquisition or the use of identifying information of another person to perpetrate fraud or another related crime.

In most cases, the impersonation of someone else to obtain something of value is the goal of identity theft, as in the case of credit card fraud when someone pretends to be the cardholder in a transaction. In more serious cases, a criminal impersonates someone else to accomplish a more sophisticated fraud, such as real estate title fraud or mortgage fraud. We have seen this very recently in the province of Ontario, where by impersonating a property owner, a criminal sells or takes out a mortgage on a property and then disappears with the proceeds. The true owner then is left to struggle to retain title and perhaps also to fight with the mortgage lender to avoid the liability of that debt.

Sometimes impersonation is not committed for the purpose of using someone else's identity to obtain something of value, but rather to conceal the criminal's own identity. For instance, some criminals maintain and use the identities of others for run-of-the-mill transactions that are themselves part of a larger criminal scheme. For instance, they may use an innocent person's identity to rent an apartment in which they plan to manufacture drugs or from which they intend to sell illegal contraband. When the crime is detected, the trail can lead back to the innocent person who was unlucky enough to have his or her personal information stolen and used to protect the guilty. There may be little in the way of a trail leading to the guilty persons themselves.

Identity theft is not new, but it has certainly mushroomed in modern society. Our world is different in ways not imagined by earlier generations. Information itself has become a commodity. It opens the door to goods, services and places. In this new world, people are mobile and commercial transactions can happen across borders via technological means rather than direct human verification in near instantaneous timeframes.

New technologies have complicated the task of authenticating identities in yet an additional way. The very same technological innovations that have increased the speed, efficiency and convenience of our transactions with governments and the private sector have simultaneously created new opportunities for fraudsters and other criminals. This is because massive amounts of information are now stored in computer systems. Unless appropriate precautions are taken, the information stored in this way is vulnerable to being accessed and copied and effortlessly transferred in many cases across the border for criminal purposes.

We also know that identity theft has been linked to organized crime and also to terrorism. Identity theft is useful in both of these contexts as a method of revenue generation. It is also a method of identity concealment, which I also spoke about, that allows organized criminals and terrorists to avoid raising suspicion or being detected by authorities, especially in cases where their true identities are already known to law enforcement and other agencies.

While we do not have complete statistics on the cost of identity theft, it has been reasonably estimated that this costs Canadians approximately $2 billion a year. The cost of credit card fraud alone for the year 2006 was estimated by the Canadian Bankers Association to be close to $300 million and debit card losses were close to $100 million in that same year. These numbers have been going up incrementally over the last decade or so.

It is unmistakable. Identity theft hurts businesses, governments and individuals. Aside from the financial repercussions, individuals whose identities have been stolen report, not surprisingly, distress, anxiety and depression in terms of the effort involved in rehabilitating their reputations and credit histories and recovering lost property. They also report a significant emotional impact of having had their identities used by another person.

In the rare cases where the identities of innocent people are used to shield a criminal's identity, the victims must also struggle to demonstrate their lack of involvement in the criminal's scheme in order to protect themselves from suspicion of criminal responsibility.

In short, identity theft is both a crime in itself and a tool for the facilitation of other crimes. For offenders, it offers the potential for high financial risk coupled with a low risk of detection. Over the last 15 years, it has grown in frequency and seriousness and the criminal law has not kept up with these changes.

When I first announced that we intended to make these changes in Montreal, a reporter asked me if this was my attempt to stay one step ahead of the bad guys. I said that we just wanted to catch up with the bad guys. This is the challenge that we have in the Criminal Code as technology continues to change. The time has arrived for the government to improve the Criminal Code and to ensure that it fully meets the needs of Canadians today.

Let me focus on those particular problems that we have identified.

First, members would understand that there are obviously some significant challenges vis-à-vis terminology in this area. The terms “identity theft”, “identity fraud” and “identity related crime” are bandied about regularly, yet none of these terms have a precise or universally understood meaning. They are no terms that are currently defined in the Criminal Code and so the phrase “crime of identity theft” can immediately generate uncertainty as to exactly what is meant. One of the objectives of the bill is to bring some clarity to these terms in the context of the criminal law.

It may be helpful to first appreciate that there are two phases of an identity crime. The first is the collection of information and the second is the actual use of that information in connection with a crime.

Our criminal law addresses many of the situations where people actually use the identity of other people or some of their identity information in the commission of an offence. It is helpful to characterize this form of conduct as identity fraud, the focus being on the actual fraudulent use of an identity.

The crime of personation, for instance, directly targets the fraudulent impersonation of someone under certain circumstances. Specifically, a person commits the crime of personation when he or she personate someone else with intent to obtain property, another type of economic benefit, or even with intent to gain an advantage that is not economic in nature, or with intent to cause a disadvantage to any person. The Criminal Code also contains offences which prohibit the making of false documents and the use of those documents to deceive someone.

There are also offences in relation to the misuse or misappropriation of credit or debit cards and even the unlawful possession of certain types of credit or debit card data. All of these offences are punishable, as they should be, by up to 10 years imprisonment.

Another crime that frequently applies to an identity theft situation is the offence of fraud. Where the value of the fraud is over $5,000, the offence carries a maximum term of 14 years.

There are already strong sanctions in the Criminal Code for the actual use of another person's identity, but there are limitations. Most important, our Criminal Code does not currently criminalize the early phases of identity crime operations which involve the acquisition and transfer of the identity information for a later fraudulent use.

Unless people commit some other existing crime in the course of acquiring the information, such as the theft of a wallet or misuse of a computer system, they cannot be stopped when they gather or trade sensitive, personal information that subsequently gets used in crimes. This means that where the police find people in possession of comprehensive dossiers on individuals, including all manner of identifying information, they may be unable to lay a charge or even to seize the data. Likewise, where people set up shop of acquiring that information and then selling it for a profit, knowing that it might be used in the commission of a crime, there may be no chargeable offence.

We can group together various aspects of this early stage of an operation under the term “identity theft” as contrasted with “identity fraud”, which refers to the actual subsequent use of the information.

It is time for our criminal law to catch up with the criminals, and this is what Bill C-27 does.

First, it would create three new offences that would be directly target the identity theft stage of a criminal operation. All of these, I should point out, are punishable by up to five years in prison.

The first new offence would make it a crime to acquire, obtain or possess another person's identity information in circumstances giving rise to a reasonable inference that the information was intended to be used deceptively or fraudulently in the commission of a crime.

This offence directly attacks those people who, as a first step to a later crime, hack into a large corporation's computer systems to obtain customer information, or who send phony emails out tricking people into providing their personal information to them, or who dive through, incredibly enough, people's garbage cans looking for discarded credit card information or utility bill information. It would also make a criminal out of the person who receives identity information from someone else for later use to commit a crime.

A complementary offence would be created for those people who set up business as information traffickers. These people are not involved in the ultimate criminal use of the information, yet they provide the tools necessary for the criminals to engage in their crimes. The bill would therefore make it a crime to transfer or otherwise provide to another person the identity information of a third person, where the trafficker would know or would be reckless about the future criminal use of that information.

For both these offences, the legislation would create a broad definition of identity information which covers all types of information that could be used for criminal purposes. The definition includes name, date of birth, address, biometric information, various forms of alphanumeric identifiers, such as driver's licence numbers, passport numbers and financial account numbers, and any other information capable of being used in that way.

An important feature that members should notice here is that these offences are directed at the mishandling of information. This means it will not matter whether the information is contained in an official identification document, or it is copied or stored in some other form.

Another situation that the police are concerned about is the situation where they find people in possession of numerous cards or documents, which are commonly used for identification purposes, such as driver's licences, health cards and social insurance cards. It may be obvious that these documents were intended for criminal use, but there may be no chargeable offence.

To remedy this situation, the bill would create a new offence for unlawfully procuring, possessing and trafficking in specified government issued identification numbers belong to or containing information of other people or containing fictitious information. These documents are crucial tools for authenticating identity in the course of a wide range of interactions between citizens, the government and the private sector and for obtaining additional documents. They are easily misused by criminals and they must be better protected.

The bill would also amend existing provisions in the Criminal Code to create a complete package of criminal laws addressing identity theft.

First, the bill would complement the existing set of forgery offences by adding new offences of trafficking in forged documents and possessing forged documents with intent to use them or traffic in them.

It would also add new offences for fraudulently redirecting or causing the redirection of a person's mail. This one I like as well. We can see how easy that may be to start to redirect somebody else's mail to another place so that information can then be gathered up and used improperly. We make it a crime to possess a counterfeit Canada Post mail key.

In addition, the bill would make clear that the offence of fraudulently acquiring, possessing, trafficking and using debit card data includes the debit card PIN number, or the personal identification number.

The law also would be clarified to ensure that it would be an offence to possess instruments for copying debit card data, which are known as skimming devices, in addition to the existing offence of possessing instruments for forged credit cards. Again, this is an attempt to update the Criminal Code.

The offence of personation will be amended to make it clear that it is a crime to use another person's identity to evade arrest or prosecution.

Another clarification will help courts understand that personation can be an ongoing, multi-transaction occurrence, a true “identity takeover”, or a simple case of fraudulently using someone's information just one time, such as a single fraudulent credit card purchase.

Also, we are proposing to rename the offence from personation to “identity fraud” to better highlight its significance and to contrast it against the preparatory stages of identity theft.

We are concerned about the victims of identity theft. To help address the impact that identity theft has on victims, this bill would amend the restitution provisions of the Criminal Code to ensure that, as part of the sentence it imposes, a court can order the offender to pay the victim reasonable costs associated with the rehabilitation of that individual's credit rating and identity.

It is appropriate at this time to commend certain members of the House who have brought this matter forward. My colleague from Edmonton—Leduc has brought forward Bill C-299. It was originally drafted to address one aspect of identity theft, which is called pretexting. Bill C-299 passed third reading in the House on May 8, 2007 and is awaiting second reading consideration by the Senate.

In the world of identity theft, pretexting is the technique of using deception of one kind or another to get people to reveal personal information about themselves. Because Bill C-299 only deals with pretexting and not with other methods used by identity thieves to gather personal information, we are proposing that it be repealed, if it should be passed, when this legislation comes into force.

When Bill C-299 was before the justice committee, it was evident that all committee members were deeply concerned about the problem of identity theft and were motivated to act collectively to build consensus on an effective solution.

We all appreciate the efforts of the member for Edmonton—Leduc and I would like to take the opportunity as well to thank a couple of other members of the House. The member for Regina—Lumsden—Lake Centre and the member for Fleetwood—Port Kells have also previously tabled private members' bills in this area. Their combined efforts have helped educate all members of the House on the problem of identity theft.

I indicated there are limitations in the current criminal law. We intend to update and extend the use of the criminal law to keep up with the changes of technology that have taken place in this country. I urge all members to support this bill and get it enacted as quickly as possible.

Criminal CodeGovernment Orders

January 29th, 2008 / noon
See context

NDP

Joe Comartin NDP Windsor—Tecumseh, ON

Mr. Speaker, in addition to the provisions of the bill, which I think are generally accepted and recognized by all parties in the House as being required, there have been other areas where we have sought government intervention, in particular in the control of databases that contain personal identification and greater regulation of the security around databases in the private sector, as well as the public sector, because there have been losses not only in this country but in any number of other countries of large databases that contain extensive personal identification.

The secondary area was the requirement, if a theft or loss occurs in some other fashion, of what the private or public sectors would be required to do to notify individuals who had been impacted. I wonder if the minister could comment as to whether the government has any intention of dealing with those two areas.

Criminal CodeGovernment Orders

January 29th, 2008 / noon
See context

Conservative

Rob Nicholson Conservative Niagara Falls, ON

Mr. Speaker, one of the things everyone can agree on in this government is that we have an extensive crime fighting agenda that is moving forward in a number of different areas.

I appreciate the member's concern for control of database information and all of us, of course, applaud and welcome every attempt by the private sector and others to disclose that information. As he quite correctly pointed out this is not just a Canadian problem. We see these gaps in other parts of the world.

However, I think the member will agree that this legislation is a significant step forward in cracking down on those individuals who exploit others and take advantage of them to make money at the expense of other people's identity.

I have spoken with a number of police agencies across this country which were the ones, among others, who pointed out the gaps that exist in the present legislation. The individual who is using a forged credit card obviously runs afoul of the law as it stands in this country. That person is charged for any number of offences that can apply to that individual. But these other groups of individuals who are trafficking and collecting personal information about others, there exists this gap within the Criminal Code.

We have been very careful to make this focused, to address the concerns of police agencies and others. They are quite concerned about a $2 billion a year loss. That is what we are talking about in this area and they want something done.

I appreciate suggestions, as I always do, from the hon. member. I have found him to be a thoughtful individual when it comes to these issues. As I have indicated to him before, I appreciate suggestions that he has made and I am sure will continue to make in the criminal law area.

However, with respect to this particular legislation, as he knows, it is more extensive and it goes beyond Bill C-299. So, in that sense, because it is expanded and is focused on what everyone would agree is a challenge for us in society today, I hope that it will get speedy passage from this House.

Criminal CodeGovernment Orders

January 29th, 2008 / 12:05 p.m.
See context

Liberal

Larry Bagnell Liberal Yukon, YT

Mr. Speaker, I have three questions, but I will ask one at a time in case other people have questions.

I do not disagree with anything the minister said. To strengthen our ability to achieve this objective, the member for Notre-Dame-de-Grâce—Lachine has a private member's Bill C-416 which provides for the modernization of investigative techniques for the police to be able to investigate crimes that could be prosecuted under this act. Would the minister support that bill as well?

Criminal CodeGovernment Orders

January 29th, 2008 / 12:05 p.m.
See context

Conservative

Rob Nicholson Conservative Niagara Falls, ON

Mr. Speaker, as we do with all privates members' bills, we look at them very carefully and we no doubt will very carefully look at that one. He says the bill would modernize investigative techniques for police officers. This is what we are doing.

The people, interestingly enough, who were the very first ones to come forward and to applaud this were the people in the credit card industry, bankers, et cetera, the people who sometimes end up getting burned on these things.

However, I can tell members that police agencies across this country welcomed this because, just as the hon. member raised the subject of investigative techniques, they were saying there is this huge gap, that by the time we have these criminals who are using this information stealing people's identity and information there is a whole slew of people who are part of this process leading up to the actual crime, and in many cases the hands of the police were tied in terms of doing something about that.

There are a number of things and I challenge and welcome people to have a close look at that. For instance, there are scanning machines that allow people to pick up other people's information. This is exactly the kind of thing that we want to pick up.

When the hon. member in the Speaker's Chair was first elected, some of these things did not even exist. If I had asked him what a scanning device would be, he might have had a completely different idea what this would have been 20 years ago when he was first elected to the House, but we now know that people are using these types of equipment and they are gathering up information.

The irony is these things are not just confined to Canada for our police to investigate. It underlines again how we have to cooperate with people outside of this country because this information does not just stay within Canada. It gets exported to the United States, Britain, Europe and other places where in some cases it gets used for criminal purposes.

So, yes, we have to be, as we try to be, very responsive to those concerns brought forward by investigating agencies. At the same time, of course, we have to balance the civil liberties of individuals. But we know that these gaps exist, and this is a terrific step forward.

I can tell the hon. member that I have had very positive feedback about this. Since the first day we announced that we were going forward on this, I have had good feedback.

My colleagues in my own party have been urging this. They know from constituents who sometimes get burned by identity theft and are taken advantage of, they welcome that. Even the provision I mentioned at the end about helping to compensate victims, I can tell members, has received widespread support among the colleagues within my own party.

Again, I commend this to the House and hope that members will have a look at that and at some of these provisions. I think they will agree with me that many of these things were long overdue and that they should have speedy passage.

Criminal CodeGovernment Orders

January 29th, 2008 / 12:10 p.m.
See context

Conservative

The Acting Speaker Conservative Royal Galipeau

The hon. member for Crowfoot should craft his question to last 40 seconds.

Criminal CodeGovernment Orders

January 29th, 2008 / 12:10 p.m.
See context

Conservative

Kevin Sorenson Conservative Crowfoot, AB

Mr. Speaker, I want to thank our minister for bringing forward this bill and for his hard work. I know he has just shepherded the tackling violent crime bill. I think it very clearly shows that the government, as he stated in his speech, is doing everything it can to toughen up on crime and to provide security to more Canadians.

My constituents understand exactly mandatory jail times for serious gun crimes, raising the age of consent, and all the different things regarding tackling violent crime. However, as far as identity theft is concerned, I have had the opportunity to sit down with individuals who have been scammed, where someone else has been using their credit card, and I know that is not in its entirety what identify theft is. I wonder if the minister could just talk a bit about how organized crime fundraises with efforts such as identity theft and these types of fraud schemes to help raise funds to continue to have resources to break the law.

Criminal CodeGovernment Orders

January 29th, 2008 / 12:10 p.m.
See context

Conservative

The Acting Speaker Conservative Royal Galipeau

The hon. minister should know that the questioner took four times as much time as he had been granted and that the clock has run out. However, I will allow a short time to respond, but this time I mean it.

Criminal CodeGovernment Orders

January 29th, 2008 / 12:10 p.m.
See context

Conservative

Rob Nicholson Conservative Niagara Falls, ON

All right, Mr. Speaker, but I cannot let the opportunity go without thanking the member for Crowfoot for all that he has done to fight criminal justice issues. He has made this a part in his career as a parliamentarian and so, I have to get that in.

I can tell members that with respect to organized crime, he has it exactly right. Organized crime uses schemes like this to steal other people's identity and their information and it uses that to raise the money for other illegal activities. I am very pleased that he brought that up.

Criminal CodeGovernment Orders

January 29th, 2008 / 12:10 p.m.
See context

Liberal

Larry Bagnell Liberal Yukon, YT

Mr. Speaker, I am delighted to speak today to Bill C-27, An Act to amend the Criminal Code (identity theft and related misconduct).

On March 14, 2007, the Liberal leader made a major speech in Toronto on fighting crime encouraging the government to bring forward legislation on identity theft and committing that a Liberal government would do that if the Conservative government did not.

It has long been a policy of the Liberal Party to strengthen provisions to prevent identity theft and we will be supporting any provisions that will do that. Hopefully, through that and with the debate today, we will make Canadians who are not aware, who are not part of the almost 10% who have already been victimized, of the jeopardy they are in and the protection they should take for themselves, and also the provisions companies, small and large businesses, should be taking to protect themselves and Canadians from identity theft.

If a criminal steals one piece of mail there can be enough information in it to have serious ramifications down the road for a Canadian citizen. Therefore, everyone needs to be more vigilant today than ever before because this new type of crime can affect people far worse than if someone were to steal all the money one happened to be carrying one day or to steal one's wallet.

Criminals need very little information to inflict tens of thousands of dollars of damage on a person. They basically need a name, address, maybe birthdate and sometimes a social insurance card. With those pieces of information, all sorts of damage can be inflicted upon people costing them thousands of dollars. People should be very vigilant because that is not very much information and criminals can get it easily.

Most Canadian citizens have given that information to dozens of other people for many reasons. The information is all over the place. People need to take care to protect their information because as soon as criminals have a little bit of information like that they use it to apply for bank accounts, credit cards, social insurance numbers and false drivers' licences. It can have terrible consequences for people. Perhaps 9% of Canadians, one in ten of our friends, have already had this occur to them in some way or another at great expense and inconvenience.

Sometimes it is even more sophisticated. Some criminals will impersonate people in order to use their medical plans to get medical benefits. Once again, that can amount to tens of thousands of dollars. Some criminals are using it to commit mortgage fraud. They will impersonate a person to get a mortgage for tens or hundreds of thousands of dollars for which the person being impersonated could be responsible. I had a constituent suggest that people applying for such a mortgage should have their picture taken. I would be curious as to the minister's response to that suggestion.

The theft may not be committed directly on the person who is victimized. It could come from one's workplace which has detailed information about its employees. The information could be taken from some other workplace where information was submitted for a good reason. It is very important to us that the information is protected by companies and that they are very careful about access to an employee's personal information.

Criminals are getting people's information off the computer through Internet hackers. They are getting it from mailboxes, garbage left outside, country mailboxes, dumpsters and from recycling bins.

Criminals can get even more sophisticated. If they cannot get the information in that way, they might send out a spam email that looks totally appropriate. They might tell the person that there is a problem with his or her bank account and ask the person to fill in a little bit of information. An unsuspecting person may fill in the information and then the criminals would have the person's bank account number and other personal information.

A sophisticated case happened here in Ottawa where people set up a phoney job ad. When people answered the ad they were asked for a resume which contains the birthdate, social insurance number and address. Instantaneously the criminals had all the information they needed to steal tens or hundreds of thousands dollars from Canadian citizens. They then used that information to apply for credit cards, drivers' licences or SIN numbers and could leave a person responsible for all sorts of damages for money and inconvenience.

If Canadians are not aware of this they should be. It is so prevalent that it now has an official name, “phishing”, where criminals will ask someone for his or her bank account number because of a problem with the person's account. This has been done to hundreds of Canadians.

The telemarketing PhoneBusters is an organization that deals with this problem because it is so big. It suggests that there has already been over 7,800 identity thefts in Canada costing $16 million. It estimates that is only 5% of what is actually happening.

As I said, 9% of Canadian have already been touched by this type of crime.

I ask Canadians to please protect themselves, to be very careful about protecting their birthdate and social insurance number . People do not need to carry their social insurance card with them everywhere they go. It is not needed that often. They should keep their SIN card and birth certificate locked up in a safe place. They should not give out their mothers' maiden name indiscriminately. They should know exactly to whom they are giving their information and for what reason. They should review their credit reports annually to ensure they have no outstanding bills that they did not know about because they did not incur them.

There was a case in England where there were people on the street being interviewed for some survey. People were asked for some personal information that a criminal would want and nine out of ten people provided that information. I would ask Canadians not to be naive about what can happen and to be very careful with their personal information.

Facebook contains a lot of information, and I hope everyone will join my Facebook account, but I would ask Canadians to be very careful not to give out personal information that criminals could use on areas like a Facebook account or a personal website.

When one is asked to go to a website for something, it might appear very legitimate, like a big bank or a major corporation that has a good name, but it could easily be a counterfeit website. Criminals make up counterfeit websites. They put in a company logo and when Canadians log on they get these pieces of information, which is all they need.

The minister was asked what effect this would have on companies that are not protecting people's information. I would implore Canadian companies, small and large businesses, to ensure they are taking the right provisions to protect Canadians. If nine out of every one hundred Canadians are being affected, those could be their employees. If the information comes from their company, they could be sued for thousands of dollars.

There was a study done that suggests that it costs businesses 15 times more to deal with the problems caused by information being stolen from them or having escaped from them inadvertently. That is 15 times more in costs to companies ultimately to deal with all those problems than had they encrypted the information in the first place.

Individuals managing companies or individuals at home must remember that information, such as their birthdate, social insurance number or address, is like cash. To criminals, this information is worth far more than the cash in their pocket. This information must be protected.

The thousands of individuals who have gone through those types of incidents can contact www.phonebusters.com or they can call the toll free number 1-888-495-8501 if they feel a criminal has taken their information. For a much more detailed outline of what steps individuals and businesses should take, they can go to the Privacy Commissioner's website.

Over and above individuals being more vigilant at home and businesses being more vigilant, we need tougher penalties to deal with the people who are stealing this kind of personal information for criminal purposes.

A December 2007Vancouver Sun article told the story of a woman who had her driver's licence and cheque stolen from her mail. The cheque was cashed in September 2006 but nothing else happened until April 2007 when another cheque went missing and was subsequently cashed. Bank accounts were opened in her name and charges were incurred. MoneyMart was after her for fraudulent cheques that had been cashed. More than $2,000 worth of Shopping Channel goods were purchased on her husband's credit card. This person spent countless hours dealing with credit bureaus and, to date, is still fighting charges on the Capital One card. She had to have all her mail forwarded to her work address which is not convenient because she will be starting maternity leave soon. After doing a lot of legwork, she obtained a photo of the thief but she and her husband are still having problems.

Not only does a person have to pay thousands of dollars of debt that was built up by the criminal but an incredible amount of time is involved in trying to clear his or her name.

At the airport I spoke with a person whose cheque had been misused and the person could not get on the plane. Once people get into these kinds of problems, they get blacklisted and are not allowed on planes. We all know how long it takes to solve those types of problems.

Some people can use another person's name to rent an apartment and then use the apartment for producing drugs or for hiding stolen goods. When the deception is discovered, the criminal vanishes and the innocent person becomes the criminal and becomes faced with huge complications trying to clear his or her name, which is an awful process.

As I said, we in the Liberal Party support the provisions of Bill C-27 because we want people who steal identities to be prosecuted to the fullest extent of the law. Suggestions have been made that more things need to be done and we will also be pursuing those.

I would like to quote from an editorial in The London Free Press on November 25, 2007:

'It's not enough to make these activities criminal,' Philippa Lawson, director of the Canadian Internet Policy and Public Interest Clinic at the University of Ottawa told CP.

'Criminals will always find ways to take advantage of innocent citizens,' Lawson said. 'We need to take other, equally important steps such as creating incentives for companies and governments to take appropriate security measures, empowering individuals so that they can more effectively protect themselves, enforcing data protection laws, and assisting victims recover their financial reputations'.

We will be pushing for even more strength in this legislation. As I said, close to a year ago our Liberal leader brought this forward and encouraged the government to act on it.

It has even occurred to a member of this House, the member for Saskatoon—Wanuskewin. There is an article in the paper. Again this is the reason we are pushing so hard for this. His identity was stolen last year and someone racked up more than $6,000 in charges before a collection agency came calling. It took months to clear his name and his credit card record, although he is expected to jump through hoops as the result of his social insurance number being red-flagged by the government.

One distressing thing that he suggested in the article was that the government would not be accepting much in the way of amendments to this law. It was a little distressing in that there have already been suggestions from police and other organizations of things that need to be done. It is distressing that we cannot strengthen the protection for Canadians regarding identity theft, if as members of the committee that is what we hear and there are suggestions. Hopefully, the member was not speaking for the minister, but I did not get a chance to ask that question.

I will quote from a speech given in Toronto on March 14, 2007 by the leader of the Liberal Party:

To protect Canadian seniors, we will act on the recommendations of the Privacy Commissioner to address the problem of identity theft. There were almost 8,000 reports of identity theft in the past year, resulting in more than $16 million being lost, much of it taken from vulnerable seniors. A lifetime of hard work and savings can vanish in an instant. We need tougher laws to prevent this type of crime.

Another recommendation is that we need laws implementing the recommendations of the federal Task Force on Spam—recommendations that have so far been ignored by the Conservatives. Spam is the weapon of choice for identity thieves, who use phony e-mails to trick people into revealing personal information. Canada is the only G-8 country without anti-spam legislation, and a Liberal government led by me will change that.

This bill would create three new offences, all subject to five year maximum sentences: obtaining and possessing identity information with the intent to use it to commit certain crimes; trafficking in identity information with the knowledge of, or recklessness as to its intended use in the commission of a certain crime; and unlawfully possessing and trafficking in government issued identity documents.

Also the Criminal Code amendments would create new offences of fraudulently redirecting or causing redirection of a person's mail; possessing a counterfeit Canada Post mail key; and possessing instruments for copying credit card information, which the minister mentioned in his speech, in addition to the existing offences of possessing instruments for forging credit cards.

We want to go even further to make sure that the police have the technical ability to investigate this type of crime with all the modern electronic means available to them. As the minister said, we want to catch up. I was glad the minister said he would look at the bill. I was sad that he did not say that he would endorse it right away to help the police, but hopefully that will be the conclusion he makes.

I would like to discuss further at committee whether the penalty should be stronger if the identity theft is related to organized crime or terrorism. It should be very significant.

In conclusion, it has been our policy for a long time to support stronger provisions in this area. At committee we want the police and other expert witnesses to provide evidence. If there is any way we can strengthen the bill, we will be looking at that too.

Criminal CodeGovernment Orders

January 29th, 2008 / 12:30 p.m.
See context

Bloc

Carole Freeman Bloc Châteauguay—Saint-Constant, QC

Mr. Speaker, I am pleased to speak at second reading of Bill C-27 , An Act to amend the Criminal Code (identity theft and related misconduct).

I believe it is important to debate this matter. With the development of new technologies, we are all confronted, at one point or another, with a situation where we have to identify ourselves by using personal information. For example, we use PINs when doing our banking at an ATM. Just imagine the amount of personal data and the number of financial transactions circulating on the Internet every day. Do we know how businesses and governments manage their immense data bases that contain our personal information? These issues affect everyone, without exception. Our personal information is recorded, catalogued and stored somewhere.

Attempted identity theft is a common occurrence. A thief could find a useful document in your mail. He could use it to pass for you and commit crimes in your name. Scam artists steal names, addresses, and birth dates that they use to apply for loans and credit cards or to open bank accounts in your name. Imagine the damage they could do using your name, not to mention the serious consequences for your reputation and self esteem.

That is why identity theft is a security issue that cannot be ignored. This type of fraud will only grow with the passing of time. Those watching us surely know someone who has been a victim of identity theft. It has disastrous consequences for the victim. It can even lead to misunderstandings with the law because fraudsters can commit crimes and use the identity of their victims. How does an individual whose identity has been stolen prove to the police or government organizations that they were not the one who committed the crime of which they are accused? It is an almost impossible task.

Bill C-27 would curb identify theft by cracking down on the unauthorized collection and use of personal information for illegal purposes. This includes the possession of several private identifiers, such as a name, address, social insurance number, or any personal number that could be used to obtain a service. Bill C-27 would create three new offences that could be punishable by a maximum of five years in prison.

The first offence deals with obtaining and possessing identity information to commit a crime. The second deals with trafficking this personal information and targets individuals who sell or deliberately hand over this information to a third party, knowing that it could be used illegally. The third deals with individuals possessing or trafficking another person's government-issued identity documents.

I remind members that thieves obtain personal information in different ways. Some use direct means, such as highly sophisticated phishing techniques. The RCMP says that criminals also use e-mails or websites that look official, but falsely represent legitimate businesses, financial institutions and government agencies. The goal is to obtain sensitive, personal financial information by phishing the person who receives the e-mail. The public must constantly be vigilant against this type of fraud. This is why people must always be careful when giving out their personal information. They should also find out how their information will be used, why it is being collected, who will view the information and how the information will be protected.

Getting back to Bill C-27, it makes several changes to the Criminal Code in order to curb identity theft. It also creates offences for redirecting mail, the possession of a counterfeit mail key, the possession of instruments for copying credit card data, and the possession of or trafficking in counterfeit documents. In addition, Bill C-27 clarifies the meaning of “personating a person” and renames the offence of “personation” to “identity theft”. It gives the courts a new power to order that, as part of the sentence, the offender make restitution to a victim of identity theft or identity fraud for the expenses associated with rehabilitating their identity.

Finally, the only people exempted are those who make false documents for covert government operations or who allow public officers to create and use covert identities in the exercise of their duties—meaning here law enforcement personnel.

Bill C-27 is intended to keep up with today’s realities because in the near future the identity theft problem is only going to get worse. It is imperative, therefore, to update the Criminal Code and adapt it to current realities as well as possible. According to the Department of Public Safety, identity theft has become one of the fastest growing kinds of crime in Canada and the United States.

I should emphasize, though, that we should be concerned not just about the increase in this kind of crime but also about the costs that we collectively incur as a direct result of this illicit activity.

The Canadian Council of Better Business Bureaus estimated that in 2002 alone, consumers, banks, credit card companies, stores and other businesses lost $2.5 billion as a result of identity theft. According to the RCMP, the total losses due just to credit card fraud in 2003 amounted to $200 million. The complaints filed with the Phone Busters program of the RCMP and the Competition Bureau provide a good example of the social cost of identity theft. Just in 2006, more than $16 million were stolen from Canadians by fraudsters. Phone Busters estimates, though, that this is still just a small percentage of the real losses due to fraud, perhaps about 5%.

Considering individual human beings, we must remember that victims of identity theft are often left with a compromised credit rating and a messy personal and financial situation. Everyone is affected, without exception.

I remember an Ipsos Reid poll in 2006 according to which one-quarter of Canadians or about 5.7 million people said that they had been victimized by identity theft or knew someone who had been. These figures are very telling and clearly demonstrate the need to update the Criminal Code.

However, we are faced with a fundamental problem: Criminal Code offences were defined at the time with the traditional notion of property. The big problem with identity theft is that personal information is not considered property. To apply the provisions of the Criminal Code, there needs to be a direct causal link with an economic loss or serious harm.

Unfortunately, it is very difficult to prove that a crime has been committed in the case of identity theft. Although some 40 provisions of the Criminal Code can apply to identity theft, the fact remains that the simple possession and collection of personal information does not constitute a crime. In this case, the Criminal Code becomes a cumbersome tool for fighting identity theft. Its evidence rules are quite strict as well.

On May 8, 2007, the Privacy Commissioner of Canada, Jennifer Stoddart, summed up the legal problem with identity theft quite well at the Standing Committee on Access to Information. She said:

I don't think it's just an issue of the Criminal Code. As you know, our law administrators hesitate to use the Criminal Code: the standards of proof are higher, and the charter may apply, and so very often you have to have a fairly clear-cut case to use the Criminal Code.

Bill C-27 is obviously a step in the right direction to updating the Criminal Code, but I want to reiterate that part of solution would definitely come from concerted action involving the different levels of government, private organizations and the public. Other measures will have to be implemented to effectively fight identity theft, since this is a broad issue that goes beyond the government's capabilities.

For example, the Privacy Commissioner suggested using civil sanctions instead of the Criminal Code for two main reasons: proof is easier to establish, and the procedures are easier for the public to understand.

Appropriately, the commissioner gave the example of small claims court, which could offer easily accessible ways to discourage the growing industry of identity theft.

However, the idea presupposes that the federal government will work closely with the provinces, because much of what is happening in the area of identity theft comes under provincial jurisdiction. I would remind this House that a number of solutions to the problem of identity theft are in the provinces' hands, because they have constitutional authority over property and civil rights, specifically under section 92, subsection 13, on property.

However, this minority government still has a long way to go in this area. True to form, this government, which should be working with the provinces to combat identity theft, preferred to make a few changes to the Criminal Code that do little to address the problem. Before giving the provinces new responsibilities for enforcing the Criminal Code, did the government make sure they had the resources to enforce the new provisions on identity theft?

The government should try leading by example when it comes to protecting and managing personal information. The federal government is proposing to penalize people who make fraudulent use of identity documents such as social insurance cards. Yet in June 2006, we learned that the Auditor General estimated there were 2.9 million more social insurance numbers in circulation than the estimated number of Canadians aged 30 and over. It makes you wonder.

What is more, in September 2003, six computers were stolen from the Laval offices of the Canada Customs and Revenue Agency, including a laptop containing personal information on 120,000 taxpayers and 600 federal taxation employees. I am dismayed by the government's behaviour, which tells me that a number of practices need to be reviewed.

Several federal departments and agencies are interested in identity theft, but these efforts do not seem to have produced a concerted strategy for dealing with this enormous problem. Nonetheless, identity theft is an issue that the federal government cannot tackle on its own, but this should not stop the federal government from developing a more focused strategy for channeling its efforts.

It would also be worth having better definitions of the concepts that identity theft involves. Although the subject has received a great deal of attention from the media, academics, enforcement agencies and government, there is still debate over the definition of identity theft. The term is used to include everything from simple cases of fraud when someone forges a cheque or uses a stolen credit card to purchase goods to very sophisticated cases of “synthetic identity theft” where the impostor creates a new identity using a combination of actual information and fabricated personal information.

Similarly, we do not have a clear idea of the sources of the personal information being used. Some studies have suggested that much of the information comes from within organizations; other studies claim that identity theft is usually perpetrated by people who are known to the victims. Media stories about large scale data breaches in which laptops have been lost or hackers have been able to gain access to credit card information have become commonplace, but we do not have a clear picture of how often these data breaches result in identity theft.

I would nonetheless point out that Canada has privacy legislation that places limits on the collection, use and disclosure of personal information by the private sector. It requires organizations to protect the information they collect. There are several provisions in the Personal Information Protection and Electronic Documents Act (PIPEDA) which, if the organizations covered by the Act respect those provisions, can significantly reduce the risk of identity theft.

That Act also imposes limits on how long organizations engaged in commercial activities should retain personal information. By getting rid of information they no longer need, organizations reduce the risk of identity theft. But the destruction process must involve more than throwing paper records or hard drives into the nearest dumpster, as we have seen happen.

I would conclude by saying that the Bloc Québécois will support Bill C-27 on second reading so that it can be sent to committee. Nonetheless, I, like my colleagues, strongly believe that merely amending the Criminal Code will not be sufficient to solve the identity theft problem.

Other measures will have to be developed by the various governments to combat this problem. One that we are proposing is that the public be educated in order to reduce victimization. Educating people about how to protect themselves against identity thieves is another key element to fighting this kind of fraud. As well, strengthening the regulations to provide more stringent oversight of how personal information is managed by businesses can only be a good thing.

As a final point, measures to promote greater uniformity and security in the process of issuing and verifying identification documents seem to be essential.

Criminal CodeGovernment Orders

January 29th, 2008 / 12:45 p.m.
See context

Liberal

Larry Bagnell Liberal Yukon, YT

Mr. Speaker, I thank the member for her support of the bill. I am delighted she agrees with the Liberals that more needs to be done.

Could she elaborate a bit on what more can be done by the government to support individuals who may encounter theft, or more support or regulations that can be established related to businesses and governments, as the member said, where there have been problems related to information leaking out?

Criminal CodeGovernment Orders

January 29th, 2008 / 12:50 p.m.
See context

Bloc

Carole Freeman Bloc Châteauguay—Saint-Constant, QC

Mr. Speaker, I want to thank my colleague for his question. As I said in my speech, the identity theft problem is huge and international. Incidentally, the steps that the minister announced today are a step in the right direction.

As well-intentioned as these measures might be, they are of only limited effectiveness. If we really want to get at the problem of identity theft, we will also have to work with all the representatives of organizations and provinces since many matters fall under provincial jurisdiction.

Moreover, there are different kinds of identity theft, such as petty theft and theft by organized crime, as the minister said. When tackling organized syndicates on the Internet, it will be necessary to have international regulations and a concerted international effort.

We will need a concerted effort because the identity theft problem is only going to increase. The rise of the Internet and new technologies means that the problem cannot be solved simply by adding sections to the Canadian Criminal Code. The problem is much bigger than that.

First there is the concerted effort needed on the federal level. Then there are a lot of regulations, although they are not necessarily protected or used enough.

We must first use and protect the data we have. In my speech I pointed out deficiencies within the federal government and the data losses we have seen. Concrete action is needed, specifically better management.

In addition, a concerted effort is needed from the federal and provincial governments and the governments of other countries in order to get a better handle on the problem of identity theft, which is often related to international organized crime.

Criminal CodeGovernment Orders

January 29th, 2008 / 12:50 p.m.
See context

Liberal

Derek Lee Liberal Scarborough—Rouge River, ON

Mr. Speaker, when the bill is studied by the committee or the House in some other way, does the member believe we should look more closely at the distinction between the need to protect personal information, and there is a whole body of legislation that does this, and what we do now, which is the criminalization of the taking or theft of personal information, personal identity or documents that contain personal information or personal identity?

I notice the debate sometimes slides around between criminalization issues involving the trafficking or theft of personal information and the concept of simply protecting through other laws, and not criminal laws, the containment and conveyance of personal information in records. Has she noted that as an issue and does she think that should be an appropriate focus for the committee in the event the House accepts the bill and forwards it on to committee for review?

Criminal CodeGovernment Orders

January 29th, 2008 / 12:50 p.m.
See context

Bloc

Carole Freeman Bloc Châteauguay—Saint-Constant, QC

Mr. Speaker, I want to thank my colleague for his question. He raised two interesting points.

There is a lot of talk these days about the criminalization of identity theft. My colleague emphasized this by asking whether there is already legislation to protect personal information. In my view, we should look instead at protecting databanks.

We should definitely crack down on the crimes that are committed, but most of all we need mechanisms to protect the data of agencies and businesses. There should be stricter protection of personal information in order to reduce the crime related to it.