Information & Ethics Committee on May 8th, 2007

[Pat Martin, NDP, Winnipeg Centre, MB]

I see.

The last thing I would raise is that the numbers you cited at the start of your presentation seem very low to me, although you do make the point that it's difficult to actually measure the depth and breadth of the problem. But 7,500 identity theft victims reporting $16 million in losses seem like a mere fraction of what's probably going on out there. Would you agree with that?

We were using an American figure of 30 million incidents per year and extrapolating 10% of that for Canada's population. Would that be reasonable?

[Jennifer Stoddart]

Yes, it's possible that it's much larger.

Could I ask the director general of investigations, who has worked in this area with the RCMP, to give you his opinion of what's really happening out there?

[Wayne Watson, Director General, Investigation and Inquiries Branch, Office of the Privacy Commissioner of Canada]

You're right; it is much larger, and the problem we're having in being able to get proper statistics is the fact, as Lisa said, that there's no law in Canada against identity theft. So it's very difficult, because identity theft being used for approximately 12 to 40 different offences renders it difficult to put together some statistics. If they're used for forgery, is it because of identity theft or not? That's why it's difficult.

However, going back to what you're saying about the United States, I think in February the data clearing house stated that there were 104 million records. The total number of records that were compromised in the U.S. between January 2005 and February 2007 was 104 million. So that will give you an idea. It was 586 publicized breaches, and we have had some breaches here in Canada. Obviously we've all heard it in the news. Our offices, I think, have been notified of close to 100 cases in the last four or five years, and every one has the potential for identity theft.

[Pat Martin, NDP, Winnipeg Centre, MB]

Thank you.

[The Vice-Chair, Conservative, David Tilson]

Thank you, Mr. Martin.

Mr. Van Kesteren.

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

Thank you, Mr. Chair.

Thank you, Madam Commissioner, for coming. Thank you for this great presentation. It's a serious problem we all know about. We all want to do something about it.

I want to address Bill C-299, a bill which I am familiar with. I'm going to speak on it, as a matter of fact, tonight, and I am the seconder of that bill.

There were some concerns, the concerns being that within the bill's writing, as it was originally drafted, Bill C-299 would have created offences that criminalized the very act of obtaining personal information by deception. The thought behind that was that legitimate circumstances for deception were used. They were talking about police possibly trapping criminals, or possibly even within a family. There are times when lying takes place and they didn't want to criminalize that. On the broader act, I guess the problem that cropped up was something that nobody really anticipated, and it underlines just how difficult legislation like this is.

Should we move forward and make recommendation for a broader act? Can you tell us of other areas possibly you see in the distance that could really create some problems, as what happened with Bill C-299?

[Jennifer Stoddart]

Can I ask Lisa Campbell to speak to that? Yes, there are issues of Criminal Code drafting and the issue of intent, particularly.

[Lisa Campbell]

Thanks very much. You raise a good point.

There are two things we would point out with this bill and with any legislation that you put in the Criminal Code. First, you need to prove criminal mens rea with every criminal offence, which is to say criminal intent. That's an essential element of every offence.

Second, there is prosecutorial discretion. There are many offences in the Criminal Code—I think Mr. Martin mentioned one of them—in which crown prosecutors have discretion whether or not to lay a charge and they work with the police to do that. The issues you've raised are why we're recommending a range of measures: public education; some regulations, which our office is already involved in enforcing with PIPEDA and the Privacy Act, and higher standards for organizations; and then civil remedies, which are probably what you would use the most, reserving Criminal Code offences as a necessary but probably rarer last resort.

Does that respond to your question?

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

Yes. Bill C-299 is a study on counterfeit and piracy. I think I can speak for the member who presented the bill, as he is the chairman of our industry committee, and we are studying a number of concerns that interconnect somewhat. I think even in our discussion this morning, one of the things that become obvious is that this isn't just a Canadian problem; this is a worldwide problem.

My question would be, are we at the stage where we should possibly be looking at international laws and—this might sound a little extreme—possibly even an international court to deal with some of these issues? Because it's not just happening here; it seems to spread right across this globe.

[Jennifer Stoddart]

Yes, you're absolutely right. Mr. Watson can talk to us about some of his experiences in cross-border fraud. This is one of the reasons I'm active in the OECD on cross-border enforcement of personal information protection rules. I don't think we need to think of going to an international court yet, but if we have rules that are recognized in other jurisdictions that have similar legislation to ours and we can probably help each other through either foreign courts or our own, I think that would go a long way.

Can I ask Mr. Watson?

[Wayne Watson]

The problem is definitely international in scope. The problem we have right now is that I think we're the only G8 country that does not have a law against identity theft. If we're going to have any credibility in the world, if we are going to be a world leader to try to tackle this problem, we're going to have to have a law to start with.

I think a lot of ID theft is perpetrated by organized crime, and it goes around the planet in seconds sometimes. We need cooperation so law enforcement or any regulatory organization can tackle it. We need to have the necessary legislation to be able to work cross-border. Perhaps we could do the same thing as we have with money laundering. I think the way we're working at it is a success across the planet, and I think identity theft is another issue we should look at it in the same manner as money laundering.

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

I want to talk about national ID cards and biometric ID and RFID, something that I pulled up on your web page.

Madam Commissioner, you and I have had some discussion about how the world is moving so rapidly. Things we would never have thought about ten, let alone five, years ago are approaching us so quickly. I wonder if you want to tell us about these new security devices and these tracking devices and what kinds of privacy problems they will create.

[Jennifer Stoddart]

Can I refer that to our technological specialist, Mr. Chairman?

[Steve Johnston, Senior Security and Technology Advisor, Office of the Privacy Commissioner of Canada]

Thank you.

The major problem that seems to crop up in any discussion of national identity cards is proving the identity initially. For example, when you go to get a passport you produce a birth certificate, a driver's licence, a health card, what we refer to as foundational documents. These can be forged, and unless you have some very high degree of confidence that the individual who is presenting these documents has proof of identity—

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

I'm sorry to interrupt. What about RFID?

[Steve Johnston]

I'll get to that. Unless you have a very high degree of assurance that the individual presenting the credentials is entitled to do that, what you end up doing is issuing a very secure document obtained under false pretences.

In terms of RFID, there are efforts in several countries to embed these in various forms of identity documents—driver's licences, health cards, etc., the notion being that it will make the particular transaction that the card is designed for quicker, more efficient. For example, you don't need to swipe the passport. You just need to wave it by the reader. The problem with that is that until fairly recently that communication was not protected in any way. So anybody who had access to the radio frequency spectrum could read that information.

[The Vice-Chair, Conservative, David Tilson]

We have to move on, I'm sorry. Maybe somebody else can ask another question to get into that, but I'm trying to follow the rules.

We'll go to Mr. Dhaliwal.

[Sukh Dhaliwal, Liberal, Newton—North Delta, BC]

Thank you, Mr. Chair.

Madam Commissioner and your talented team, welcome. That was very well presented.

This is the type of stuff that will help us to make up our minds. Now it becomes a question of leadership. Who is going to provide the leadership to deal with this situation of identity theft? Mr. Van Kesteren mentioned the international courts, and Mr. Watson was mentioning the money laundering situation.

On that same theme, the Canada Revenue Agency continues to report that Canada is losing a lot of money through grey and black transactions. And they have been far ahead dealing with that situation internationally and tracking down that money. In your opinion, would they be better positioned to take a lead than the Department of Justice, or to coordinate with the Department of Justice?

[Jennifer Stoddart]

Is your question whether FINTRAC could coordinate with the Department of Justice?

[Sukh Dhaliwal, Liberal, Newton—North Delta, BC]

Like with Canada Revenue Agency, right?

[Jennifer Stoddart]

First of all, I think it's up to the Government of Canada to decide how best it should deal with this. But I would say that it's a natural role for the Department of Justice. This is a law legitimacy issue. But there are many agencies, ranging from FINTRAC on one hand, to the RCMP, to the Competition Bureau, to Industry Canada, that doubtless have a wealth of knowledge about the different forms of circulation of information and information technology and so on.

I don't know if that answers your question.

[Sukh Dhaliwal, Liberal, Newton—North Delta, BC]

Probably not.

To deal with this situation now, because there are hundreds of agencies involved, we have to have a clear department or clear leadership to deal with this situation. Who, in your opinion, would be the best person to deal with this?

[Jennifer Stoddart]

Well, I think this should be considered carefully. I don't know if it is. I would think that in order to consider it, the Department of Justice should look at this and ask what the structure is. Is it a permanent or a temporary structure? How do we set it up? How do we set it up within the Government of Canada, and then how do we cooperate with the provinces? The municipalities may have a role. The private sector has a huge role if you think of the banking and financial interests, plus internationally. There is also Industry Canada, which originated PIPEDA, so Industry Canada is another possible leader in this field.

[Sukh Dhaliwal, Liberal, Newton—North Delta, BC]

Does the U.S. have a central agency that deals with this situation?

[Jennifer Stoddart]

The U.S. has the Federal Trade Commission, which enforces consumer protection laws. They don't have a national privacy act, and one of the things that hamper their fight against ID theft is that there are no national standards for personal information protection. But they do have a very efficient agency, the Federal Trade Commission, that has set up a clearing house for ID theft. I think it has been quite successful in gathering statistics and, to some extent, in educating the public and prosecuting, but not completely, which is why the President called for a special report on it.