Bill C-299 (Historical)

An Act to amend the Criminal Code (identification information obtained by fraud or false pretence)

This enactment amends the Criminal Code to create the following criminal offences:
(a) obtaining personal information from a third party by a false pretence or by fraud; and
(b) selling or otherwise disclosing personal information obtained from a third party by a false pretence or by fraud.

Criminal Code

[Mario Laframboise, Bloc, Argenteuil—Papineau—Mirabel, QC]

Mr. Speaker, I am pleased to speak on behalf of the Bloc Québécois about Bill C-299, An Act to amend the Criminal Code, the Canada Evidence Act and the Competition Act (personal information obtained by fraud).

I will try to summarize the content of Bill C-299 for the people who are watching. I will also try to explain the Bloc's position on this bill, which is at second reading. After the vote, we will decided whether or not the bill will go to committee.

The purpose of this bill is to amend the definition of “personal information”. The Personal Information Protection Act says:

“Personal information” means information about an identifiable individual, but does not include the name, title or business address or telephone number of an employee of an organization.

The bill will create three new criminal offences: obtaining personal information from a third party by a false pretence or by fraud, counselling a person to obtain personal information from a third party by a false pretence or by fraud, and selling or otherwise disclosing personal information obtained from a third party by a false pretence or by fraud.

Consequently, the bill really adds one new offence to the Criminal Code: obtaining personal information on a third party. In our view, at first blush, the Criminal Code already includes these types of offences. Once again, the Conservatives are trying to control the work of the judiciary, the work of judges, so that they have no leeway.

I will read section 403 of the Criminal Code, because it gives a good idea of the existing offences with regard to personal information. Section 403 of the Criminal Code says this:

Every one who fraudulently personates any person, living or dead,...is guilty of an indictable offence and liable to imprisonment for a term not exceeding ten years or an offence punishable on summary conviction.

Section 403 of the Criminal Code already provides that it is an offence to impersonate someone else. We feel it is pointless to add “personal information on a third party” because it is already included in the Criminal Code.

Section 403 says this:

Every one who fraudulently personates any person, living or dead: (a) with intent to gain advantage for himself or another person, (b) with intent to obtain any property or an interest in any property, or (c) with intent to cause disadvantage to the person whom he personates or another person ... is guilty of an indictable offence and liable to imprisonment for a term not exceeding ten years.

To add “with intent to obtain any record containing personal information about a third party” serves no purpose, in our opinion. Once again, this shows the Conservative tendency to try to restrict judges and lead them in a certain direction, although this is not the authority our society has given itself in the Criminal Code. The values defended by Quebeckers, and the values defended by the Bloc Québécois on behalf of Quebeckers, are very important to us. We support a society founded on a justice system that is balanced between the harm caused and the sentence that the courts may impose on a person who commits a crime.

We must always strive for balance. This is why our judicial system is based on an independent judiciary. For some time, we have been repeating in this House that we are anxious to see the day when patronage appointments no longer exist in the judiciary, and when we have independent committees to select our judges to ensure they are the most competent individuals for the role. I am not saying that the current judiciary is incompetent. What I am saying is that judges are often appointed on a partisan political basis. The press often criticizes this state of affairs, thus informing the general population.

Lastly, we hope to pass on to today's youth the values that we learned from our parents, grandparents and great-grandparents. This is the society that Quebeckers want, an equitable society based on a fair balance between the crime committed and the sentence imposed.

That is why we put our trust in the judiciary. Every time members introduce bills such as Bill C-299, the Conservative Party seeks to provide a framework for the work of the judiciary, that is, they try to package the work of the justices so that, in the end, all they have to do is read the text and apply the sentence. Quebeckers do not want this kind of society or these values. That is why the Bloc Québécois always challenges these bills.

In our opinion, the changes that Bill C-299 seeks to bring about are already found in the Criminal Code under section 403 and other sections that the bill would amend. Why try to add just a little bit more? This question comes up all the time. Our citizens are entitled to question the values of the Conservatives, these values that are often borrowed from the Republicans in the United States. That is why, although they only came into power nine months ago, the Conservatives already seem to be an old government. They clearly have a tendency, particularly as a minority government, of trying to pass on their values as quickly as possible.

When justice issues and amendments to the Criminal Code are at the fore, as in Bill C-299, we have an unfortunate tendency to try to control the judiciary's work and restrict judges' decision-making freedom. Obviously, this could be counter-productive and not in the best interest of the citizens we represent. We, the Bloc Québécois, are trying to maintain a balance here.

This is why, since 1993, a majority of Quebeckers have given Bloc Québécois members their vote of confidence: because the men and women of the Bloc Québécois know how to listen to what their constituents want. They did not make anything up. We trust the society our parents and grandparents left us. This is the very society we are fighting for today—a society seeking greater justice and equality. We hope it will be less controlling. It is this desire for control that leads to legislation like Bill C-299.

Since being elected, the Conservative government has been attempting to direct the decisions taken by the judiciary and judges. The fact is that no two crimes are committed under the same circumstances. That is why we as a society chose to have a judiciary system. Juries are sometimes brought into play. This is all pretty complex. An entire system is called upon in an effort to determine the appropriate sentence for the crime committed.

Of course, this unfortunate tendency to make penalties harsher or to take responsibilities away from the judges is reminiscent of the right-wing Republican tendency in that regard, and it is increasingly obvious from the actions of this Conservative government. Those are not values that Quebeckers defend or values that they want members of the Bloc Québécois to defend.

One might understand that, under the circumstances, we are not to eager to see Bill C-299 passed, especially since it concerns personal information about a third party. This could be interpreted quite broadly. We must bear in mind that there are certain realities in our society. I often think of our businesspeople trying to establish a client list who sometimes ask for information. We would not want matters of everyday life in our society to be misinterpreted. If the purpose of this bill is to prohibit the obtaining of any personal information, efforts should be made to strike a balance between the reality and business opportunities today.

Essentially, we have laws and amendment to the Criminal Code. There is no point adding in the Criminal Code that obtaining personal information about a third party constitutes a criminal offence. As I said, section 403 is already very clear:

403. Every one who fraudulently personates any person, living or dead,

(a) with intent to gain advantage for himself or another person,

( b) with intent to obtain any property or an interest in any property, or

(c) with intent to cause disadvantage to the person whom he impersonates or another person,

is guilty of an indictable offence and liable to imprisonment for a term not exceeding ten years or an offence punishable on summary conviction.

We believe obtaining personal information on a third party by fraud is already an offence that carries a maximum jail sentence of ten years, under section 403. Therefore, we see no reason to change that. However, the bill will probably be sent to committee and we will be open to debate the matter, and perhaps even to make amendments, in order to protect good citizens from bad ones.

Quebeckers were right again to put their trust in the men and women of the Bloc Québécois, because they will yet again protect their interests and make sure that the penalties imposed by the Conservative government strike a fair balance, given the offence committed.

[Paul Szabo, Liberal, Mississauga South, ON]

Mr. Speaker, a recent poll conducted by PhoneBusters of Canada has revealed that approximately 9,000 people have fallen prey to identity theft in the last 10 months. Almost 77% of them were concerned about it, but only a meagre 10% of us are aware of what we have to do to protect ourselves from identity theft.

The financial damages caused by this crime amount to $7.2 million.

Another shocking personal fact is that nearly 45% of Canadian adults do not monitor their credit card bills. This is part of the problem.

I looked at some of the statistics generally available and found that persons under 18 years of age represented only about 2% of the persons who fall victim to this crime of identity theft. Those from ages 18 to 29 were at about 25%, those 30 to 39 were at about 28%, those 40 to 49 were at about 20%, those 50 to 59 were at 12%, and those over 60 years of age were at a little less than 10%.

So it appears that working people between the ages of 18 and 50 account for about 75% of identity theft. These are the people who have assets and cash that it may be able to detect.

The reason I raise this is that Bill C-299, which is before us today, seeks to address the whole issue of identity theft. It is an act to amend the Criminal Code, the Canada Evidence Act and the Competition Act.

We have had some excellent speeches from the members who spoke during the first hour, including the mover, the member for Edmonton—Leduc, as well as the member for Hochelaga, and also the member for Moncton—Riverview—Dieppe, I believe.

I think that what was concluded by the speakers was that there is a general agreement that in principle this is a matter which has to be addressed from the standpoint that it is a function of the improvement in the technological tools available. It is a function of criminals becoming more sophisticated in what they are doing. It is a function of the need of Canada to continue to ensure that it keeps pace with the changing approaches that those who would perpetrate identity theft have evolved to.

I am not going to talk too much to the specificity of the bill, other than to suggest that hon. members already have raised some concerns about details within the bill, but we are at second reading, which asks hon. members to consider approving the bill in principle, this being that we should examine and identify ways in which we can mitigate the impact and consequences of identity theft.

I doubt very much that there are too many members in this place who are going to argue with the basic premise or the fundamental principle of this bill. Therefore, I will be supporting it at second reading to go to committee and I will be recommending that to my caucus colleagues.

Having said that, I note that committee is the best place to address some of the points that have been raised by hon. members in debate with regard to potential deficiencies or areas in which the approach may be augmented. I believe in having the experts come before committee to provide more detailed analysis and consideration of perhaps the deficiencies within Criminal Code amendments, or ways in which there may be enhancements, and also to deal with section 403 of the Criminal Code. On section 403, there seems to be some disagreement between the Bloc and the Liberal member who spoke.

Notwithstanding that, I believe these matters are reparable in committee or at report stage. I much suspect that they will be.

I thought it would be useful simply to use the rest of my time to advise Canadians on how they can protect themselves from identity theft.

There are government and general websites that include a substantial amount of information about consumer protection. Let me highlight a few suggestions.

The most important thing obviously is to prevent access to our personal information. It is recommended that people not release their social security or account numbers in response to email, phone or in person requests. Instead of using Internet links, type the full address. Keep all sensitive documents, cheque books and credit cards securely locked away at home and at work. Carry only those credit cards that one needs to have on one's person or in one's wallet.

All private documents should be shredded before discarding them. Retrieve paper mail promptly from the mailbox and place outgoing cheques or other sensitive documents in the postal box directly and do not keep them on one's person for any great period of time.

Signing up for automatic payroll deposits is another preventive approach. Replace paper bills, statements and cheques with on-line paperless versions. Keep passwords hidden even in one's own home and change them frequently. Use regularly updated firewall and anti-virus protection software on computers. The public should know that computer access is one of the growing areas in which identity theft is occurring.

Do not respond to suspicious emails. Delete them, and if there is any doubt, contact the company from which they were sent. Do not discard a computer without completely destroying the data on the hard drive. Even in the case of a severely damaged computer where the hard drive does not work, very important information still can be recouped from the hardware components.

Another aspect of taking regular general prevention measures is to detect unauthorized activity. That includes reviewing bank, credit card and bill statements weekly through on-line access accounts. Contact the financial provider if statements are not received in a timely manner. Often what happens is people will take mail out of someone's mailbox.

We should review our credit information regularly. Free annual credit check reports are available through the web. Use email based alerts to monitor transfers, payments, low balances, withdrawals, or to detect other irregular activity in an account. Visit banks, credit card and other bill statement websites frequently to monitor regular account activity.

After doing the prevention and following some good habits, if something should happen, it is absolutely vital that the conflict be resolved. Some members have already indicated that in some cases resolving a loss related to identity theft and sorting out all the problems with regard to the accounts can take weeks, months and maybe even years. It may be quite expensive and very disruptive.

This invasion of personal matters is very disruptive. With regard to resolving matters which come up, obviously we want to minimize losses and protect the credit record. Having one's credit record jaundiced is a problem.

The financial provider should be asked about zero liability guarantees. Victims of theft should notify the financial providers and begin monitoring the accounts more frequently in the event that there may be subsequent attempts. Federal and local enforcement authorities should be alerted if one suspects identity fraud.

These are just some examples of things that we can do. This is all because the member thought it important enough to bring to the House a bill that in principle says we need to be more vigilant to reduce the incidence of identity theft. It is a good bill in principle. In my view, any matters on which concerns have been raised would appear to be reparable at committee and report stage.

I congratulate the hon. member for bringing this bill forward.

The House resumed from June 13 consideration of the motion that Bill C-299, An Act to amend the Criminal Code, the Canada Evidence Act and the Competition Act (personal information obtained by fraud), be read the second time and referred to a committee.

[James Rajotte, Conservative, Edmonton—Leduc, AB]

moved that Bill C-299, An Act to amend the Criminal Code, the Canada Evidence Act and the Competition Act (personal information obtained by fraud), be read the second time and referred to a committee.

Mr. Speaker, it is my pleasure today to rise to speak to my own private member's bill, my first that has been debated in the House, Bill C-299, an act to amend the Criminal Code, the Canada Evidence Act and the Competition Act, personal information obtained by fraud.

The purpose of the bill is to protect individuals against the collection of their personal information through fraud and impersonation. This practice is often known as “pretexting” and is a widespread problem in the growing market for personal information.

The bill aims to close some of the loopholes in Canada's data protection law that allow data brokers to exploit people's personal information for commercial gain. As a legislator, I believe this is an area where the House, Parliament, can truly make a difference and needs to step up to the challenge.

The bill seeks to do three things in particular. First, it seeks to make the practice of pretexting illegal through changes to the Criminal Code and the Competition Act. Second, it seeks to provide a remedy for victims of this kind of invasion of privacy through legal recourse in the courts and compensation. Third, it seeks to tackle the cross-border aspect of pretexting, by holding the Canadian affiliates of foreign companies liable for invasions of privacy committed against Canadians.

By introducing the bill, I hope, above all, to open the debate on how our laws can keep pace with changing technology to meet the needs of Canadians. In doing so and in asking members to support the bill, I would like to discuss three things: first, the need for the bill in the new information economy; second, the loopholes that currently exist in Canada's data protection framework; and third, what the bill means for Canadians.

First is the need for the bill. It is our job as legislators to ensure that the law can keep up with the evolution of technology. The communication revolution of the last decade and the growing information economy have accelerated the exchange of information around the world. All kinds of data circulate around the globe and across borders at the click of a button in ways never before imagined. Furthermore, more data is being created, stored and traded than ever before. As with any new evolution, new possibilities breed new relationships and new patterns of transgression.

To evoke a cliché, knowledge is power and this has never been truer than it is now. Information is one of the most valuable commodities in the new economy, typified by the growing data brokerage industry. Data brokers buy and sell information, sometimes personal, usually for commercial or marketing purposes.

Some of this industry is legal and consensual, however, there is mounting evidence to suggest that many aspects of the data brokerage industry are poorly regulated and that pretexting is a recurring problem.

In a free and democratic society, individuals should be able to control how information about them is used and accessed. Personal information should not be treated as a saleable commodity like any other. We see that in a networked economy, where innocuous details about people's personal lives and transactions can be transformed into a complete profile of the person with a variety of serious implications.

Simple details like a birthday, postal code or graduation date can be used to obtain credit card records and can track an individual's location, activities and purchases without their knowledge. The possibility to track people without their knowledge, aided by data brokering and pretexting, ultimately undermines the inherent autonomy and independence of the individual and leaves him or her vulnerable to numerous abuses.

An individual's data profile can be used for a wide range of purposes, from unsolicited marketing to fraud, identity theft or intimidation of the individual and his or her family. Apart from the economic and security risks attached to invasions of privacy, there is a significant psychological dimension. Do we really want to live in a society where we know that our actions can be traced without our knowledge for commercial or other purposes?

We have to think about how this will change the way individuals think about themselves and society. As Canada is a society that has adopted many of the values of the Enlightenment, I think it is appropriate to quote one of my favourite philosophers, John Stuart Mill, from his treatise On Liberty. He states:

The only part of the conduct of any one, for which he is amenable to society, is that which concerns others. In the part which merely concerns himself, his independence is, of right, absolute. Over himself, over his own body and mind, the individual is sovereign.

These are important issues and questions to look at in our changing technological environment.

The second issue is the loopholes in Canada's data protection framework.

First, it is important to remember that as a democracy, the police and judiciary require a warrant in order to access people's personal information. The bill in no way changes the powers or information available for the purposes of law enforcement.

Now let us consider the following. The very same personal information that police officers require a warrant for could very well be purchased online for a few hundred dollars in a matter of hours.

This is exactly what happened to federal Privacy Commissioner Jennifer Stoddart in an investigative report done by Macleans magazine in November 2005. In the report, journalists were able to purchase Ms. Stoddart's cell phone records and access conversations between the commissioner and members of her family. The purchase was done through one of at least 40 online services that offered to track down significant personal information using just a name and postal address. This was possible despite the fact that the Privacy Commissioner was obviously more savvy about protecting her personal information than the average Canadian.

The journalists reported that pretexting was a major factor in obtaining the Privacy Commissioner's records. Common practices include masking phone lines so that the call appears to come from the account in question and hacking into accounts using passwords, birthdays and other personal information. Frequently, however, pretexters are able to simply ask for the information from service providers by impersonating the victim with the use of other personal information.

Broadly speaking, there are two kinds of data brokers with the potential to invade people's privacy.

First, there are the larger companies which trade in data, often for commercial or marketing purposes. Much of this is aggregated and not particular to individuals; however individual information may sometimes be extracted from these databases.

Second, a range of smaller companies offer to target individuals for a fee, as in Ms. Stoddart's case. These companies may simply sell personal information or they may offer more invasive services such as private investigation.

At the federal level, data protection falls under the Personal Information Protection and Electronic Documents act, known as PIPEDA. Commissioner Stoddart has already submitted a report to the privacy and ethics committee detailing possible improvements to the act in May of this year.

Notwithstanding possible changes to PIPEDA, there are three major loopholes in Canada's data protection framework.

First, though fraud and personation are crimes under the Criminal Code, they do not apply to personal information such as phone records, consumer preferences or purchases.

Second, while these actions violate PIPEDA insofar as it says that information cannot be disclosed without the expressed consent of the consumer or court order, this does not guarantee a remedy. The commissioner's rulings are not legally binding without a federal court order and the transgressors are not named.

Bill C-299 would change that by making it a crime under the Criminal Code to collect or counsel to collect personal information through fraud, personation or deception. Bill C-299 would also change the Competition Act to make it an illegal trade practice to obtain personal information through fraud, deception or personation. It would also characterize the promotion of a product that is provided by means of fraud, false pretense or fraudulent personation as a false or misleading representation to the public.

Third, the Privacy Commissioner has no jurisdiction to pursue complaints outside of Canada. However, as in Ms. Stoddart's case, Canadians can easily be targeted by data brokers in other countries, particularly the United States. In Ms. Stoddart's case, the Canadian phone service providers had to seek an injunction against the offending data brokers in a Florida court. Going abroad to get injunctions is both expensive and yields unpredictable results in different jurisdictions.

Bill C-299 would allow victims of privacy invasion to seek compensation from Canadian affiliates of foreign companies that invade their privacy. This is not a perfect solution, but it helps to deal with the problem of extraterritoriality.

Third, what does the bill mean for Canadians? If the bill is implemented, it would help preserve the trust and individual autonomy in a society that Canadians enjoy today. The legal remedy for invasions of privacy in Bill C-299 does two things. First, it assures Canadians that their right to privacy is recognized and seeks to compensate them for damages caused. Second, it seeks to catch invasions of privacy before it leads to more serious criminal activity.

In seeking criminal sanctions for intentional invasion of privacy for commercial purposes, it weakens the invasive parts of the data brokerage industry as a whole. For example, if the practice of pretexting is criminalized it will cut down on the instruments of identity theft. Charges can be brought for the invasion of privacy before they have to be brought for more large scale financial fraud and theft of identity. Moreover, cutting down on identity theft is in and of itself an important aspect in the fight against organized crime and international terrorism.

Furthermore, the bill recognizes the economic, social and psychological harm caused by the systemic invasion of privacy. It seeks to stem the fraudulent and invasive aspects of the data brokering industry, particularly, the practice of pretext.

If a law-abiding citizen has undergone the anxiety and inconvenience of being traced or interfered with for commercial gain, the bill would provide for recourse, through the courts, for a recovery of damages. In the event that the perpetrator is a foreign company with a Canadian affiliate, that Canadian affiliate may be held accountable.

Bill C-299 seeks to respond to the new challenges of information technology and close some of the gaps in our legal system. Invasion of privacy, through pretexting and data brokering, is a growing area and we need to open a debate on how to enforce meaningful protections.

Therefore, I ask all members to consider this legislation very seriously. It is a serious issue, which is growing, and it needs to be addressed. I am putting forward the bill to obviously address the protection of personal information. We also need to address, however, the whole issue of identity theft as well.

I believe the bill is the first step to do that. I look forward to the comments of other members. I note one of the Liberal members opposite has offered some helpful comments, as has the parliamentary secretary to the justice minister.

I would ask members to discuss the bill in principle at second reading, to move it forward to committee. If amendments are needed in terms of the bill itself, I would look forward to those. I am willing to work with all members in the House to improve the bill to address this important issue.

[James Rajotte, Conservative, Edmonton—Leduc, AB]

moved for leave to introduce Bill C-299, An Act to amend the Criminal Code, the Canada Evidence Act and the Competition Act (personal information obtained by fraud).

Mr. Speaker, the bill is intended to address some of the serious challenges related to the theft of personal information. The bill would amend the Criminal Code, the Canada Evidence Act and the Competition Act in order to protect individuals against the acquisition of their own personal information through fraud and impersonation. I encourage all members to examine and support the bill.

(Motions deemed adopted, bill read the first time and printed)