Information & Ethics Committee on Feb. 20th, 2007

[Robert Vincent, Bloc, Shefford, QC]

Yes?

[A/Commr Bruce Rogerson]

Absolutely.

[Robert Vincent, Bloc, Shefford, QC]

Can you tell us the approximate number of identity thefts that can be handled, of cases where someone used another person's identity to rob, obtain a line of credit at a bank or anything else? Do you regularly investigate those kinds of cases?

[A/Commr Bruce Rogerson]

Yes.

[Robert Vincent, Bloc, Shefford, QC]

So you're aware that it's appropriate to give certain persons more independence. We've also observed that the insurance companies want a power to investigate other insurance companies to check whether there has been an accident or a car theft involving another insurance company.

Everyone who comes here wants an expanded power of investigation to obtain personal information on everyone. The problem is that, if you telephone a given person to obtain information in the course of an investigation, how can that person at the other end of the line know who he's giving that information to? Even if you are a police officer! How can that person determine that?

For example, you introduce yourself as Officer Crockett, and you say you'd like to have some information on a particular person. You demand that information because the act permits you to obtain it. Is that how you proceed?

[A/Commr Bruce Rogerson]

By telephone?

[Robert Vincent, Bloc, Shefford, QC]

Yes.

[Bruce Rogerson]

I don't think so.

[Robert Vincent, Bloc, Shefford, QC]

Earlier, in response to a question, you said that you made telephone calls, that you gathered information by telephone and that you conducted your investigation by telephone. That's what you said earlier in response to Mr. Dhaliwal.

[Supt Art Crockett]

It's very difficult for us to speak about a specific investigation if we have not done the background to determine exactly what phone calls were made.

Mr. Dhaliwal initially provided a set of circumstances, which we are trying to interpret, but it would be a lot easier for us to be able to fully respond were we to know the investigation.

To answer your question, sir, in generality—

[Robert Vincent, Bloc, Shefford, QC]

Let's take the example of what happened in St. Thomas, Ontario, and of the investigation conducted over the Internet. Do you call the distributor to determine which people subscribe to Internet service?

[Supt Art Crockett]

If you're seeking information specifically with individuals, we will do that in a face-to-face.

If you have a rapport with the company, they know who you are, and they recognize your voice, it may be possible to do that by telephone.

Yes, I would expect the company would ask how they know it is us—i.e., how do I know you are police; can I call you back at the police station and receive you on the other end? There are always ways to be able to do it.

We as an organization and as a law enforcement community are the last line of defence for the privacy of individuals. We guard that information closely. It is never our intention to harm someone by going through that. But we appreciate your point.

[Robert Vincent, Bloc, Shefford, QC]

I can understand. I don't doubt your integrity, but criminals don't have any integrity. They can impersonate you three and obtain personal information from anyone simply because the act enables them to do so.

Tomorrow morning, I could get a card from the RCMP with my name on it. I could then go and see someone and tell him that, under section 7 of the act, I'm entitled to ask him for this information. Then I would have information on Mr. Rogerson in hand. I could know how much money he has in his bank account. If that amount were in six figures, I'd only have to go to another bank to apply for a line of credit, and that would be it! I would have withdrawn $25,000 or $50,000 from the bank after stealing his identity thanks to a business card, all in the space of an hour.

I could take one of your business cards and go to any merchant and tell him that the act allows the identities of these people to be revealed.

What do you do in those cases?

[Supt Art Crockett]

Clearly, they—

[Bruce Rogerson]

Relations between police officers and the institution are often good.

[Robert Vincent, Bloc, Shefford, QC]

What happens if no one in that institution knows you? I could go to the corner convenience store and ask for a copy of all the transactions conducted between the convenience store and that man because he uses his credit card or debit card every day. Today I'm targeting him. I know his address, and I want to get more information on him. I have his business card and I ask for personal information about him. The act permits that. I take a copy of section 7, and I tell them that, under that section, they have to give me that information. The person there trusts in the business card.

[Supt Earla-Kim McColl]

I've think you've hit on the important portion we're trying to remedy today, and that is the question of lawful authority.

When we deal with companies, we provide them with a facsimile with our letterhead on it and a supervisor's name. Or we have a personal relationship with them so that I can phone and say, “Hi, it's Earla-Kim.” However, we encourage people when dealing with law enforcement officers to be sure of who they're talking to. People will impersonate us. Certainly we ask them to check identity and be certain about who they're speaking with.

[Robert Vincent, Bloc, Shefford, QC]

You understand that I can obtain a letter like that in two minutes. I only have to go to the RCMP Web site, copy the logo, print it, write what I want in the letter, sign using any name or that of an RCMP commissioner, and that's it. I only need two seconds. Section 7 makes it possible to tell people that the act provides authorization to give out personal information.

[Supt Earla-Kim McColl]

Again, the distinction is important. What we're asking for is not considered protected or personal information. It's tombstone data. These are things like a name or an address, which I can get by talking to your neighbours. I can drive by your house and then go to city hall and find out your name and address, how much you paid for it, and how much you owe on it.

What we're looking for from our partners, in our effort to keep our community safe, is minimal information, which we've always been able to get just by talking to people. PIPEDA has made that more complicated for us. We're trying to get back to that level playing ground. If the information is considered personal or protected or in any way confidential, then we're governed by the charter. We're governed by all the checks and balances that the courts give us.

This is not about giving us new powers. This is about getting us back to where we were.

[The Chair, Liberal, Tom Wappel]

Thank you.

I gave you seven minutes, Monsieur Vincent.

I have nobody else on my list. If nobody wants to ask anything, then we'll go back to Mr. Vincent.

Mr. Martin.

[Pat Martin, NDP, Winnipeg Centre, MB]

Thank you for the opportunity.

I hope you don't feel that we're deviating wildly from the reason you came here. I think we do accept the legitimate points you've made in your brief about section 7 and section 9. But having officials from the RCMP here, and given the nature of the material we're dealing with, we can't help but explore other issues.

One issue is that tomorrow we will vote on a new bill that we argue creates an identity theft kit for all Canadians to use. The Government of Canada will now put your date of birth on the permanent voters list. You will have name, address, telephone number, and date of birth.

Does this raise any concerns for you? Do you share our concern that the date of birth is a piece of personal information, which is sometimes used as a PIN? It's your identity. We think this is a formula for identity theft that could exacerbate the existing problem.

[Supt Earla-Kim McColl]

The courts don't generally consider that type of information as personal, and we certainly discourage people from using a DOB as a PIN number. DOBs are not considered personal, private, confidential pieces of information. Those are things that are available.

PIPEDA isn't about protecting information. It's about how we use it and disclose it. I know I applied for a credit card, and I now get a raft of stuff in the mail. Somebody is certainly disclosing that, but I trust that it's being disclosed in accordance with those guidelines.

[Pat Martin, NDP, Winnipeg Centre, MB]

But when you phone up that credit card company to say you'd like to activate this credit card they so generously sent you in the mail, quite often they'll say that to make sure it's you, they need your date of birth. You say, December 13, 1955, and then they know it's really Pat Martin.

We're very concerned that this is going to be abused. At least in the short term, it's going to create a rash of activity in this regard with this new information that's now in the hands—

We're just about to go into a federal election, so we now have this new law, with a new voters list. I had 250-some—

[The Chair, Liberal, Tom Wappel]

Mr. Martin, I'm sorry to interrupt you, but can we make this relevant to PIPEDA? This is a review of PIPEDA. This isn't estimates or anything like that. We're reviewing PIPEDA, and I can't see how this new act that we're about to vote on, about elections, has anything to do with PIPEDA.

[Pat Martin, NDP, Winnipeg Centre, MB]

Let me explain.

Actually, PIPEDA is about protecting personal information. It's right in the name of the act. Every riding association is now going to set up a campaign office for every political party, and they're going to have the permanent voters list laying around. Under PIPEDA, there's an obligation that any institution, agency, or organization under federal jurisdiction has to abide by PIPEDA to protect your personal information.

Is it your feeling that your date of birth is not personal information that warrants protection in light of this widespread electronic identity theft that we're facing?