Thank you, and good morning, Mr. Chair and committee members.
Thank you for inviting me to address you today on the issue of identity theft. I have been studying and working on this issue from the consumer and victim perspective for over 10 years, first with the Public Interest Advocacy Centre, then with the Canadian Internet Policy and Public Interest Clinic or CIPPIC, the International Centre for Criminal Law Reform and Criminal Justice Policy; and most recently for the Canadian Identity Theft Support Centre.
l've provided a list of publications with my speaking notes today, and I hope that will be distributed to you. These publications include analyses of the range and types of identity-related crime, an international inventory of best practices for victim remediation in both public and private sectors, a gap analysis of legal rights and remedies for victims of identity crime in Canada compared to the United States, and self-help guides for Canadian victims of identity theft. These are all accessible online.
In my capacity as director of CIPPIC, I made submissions to this very committee when it was studying the issue of identity theft back in May 2007. Looking back on those submissions, they are, for the most part, as relevant now as they were then. There have been some developments in the last few years, notably amending the Criminal Code to make it easier for law enforcement to catch and convict identity thieves, which is an important step but only one of many tools needed to address the problem; and also establishing the Canadian Identity Theft Victim Support Centre, which can now be found online at www.idtheftsupportcentre.org, or via its 1-866 hotline. But much more can and should be done to prevent, detect, prosecute, and mitigate the effects of identity-related crime.
I understand that you are interested in the economic impact of identity theft in Canada and that your focus is on privacy or identity-related crime as opposed to mass market frauds generally, or cybercrime generally. I cannot give you any numbers. For the reasons my colleagues have stated, I doubt that it is possible to come up with a good estimate, given the dearth of data on identity-related crime in Canada. Instead, I'd like to use my time just to make five suggestions for policy and law reform in this area.
First, enact security breach notification laws. Individuals can take all the recommended precautions against identity theft, but they can't control what organizations do with their personal data in the custody of the organization. In this age of databases, strong corporate security safeguards are essential to protect against identity theft. Yet, under pressure to cut costs, many organizations are not taking the measures that they should to protect customer data.
A law requiring that organizations report security breaches to the Privacy Commissioner, as well as to affected individuals, would go a long way toward preventing the kinds of security breaches that feed identity criminals. It would also make potential victims aware of their vulnerability, allowing them to take preventative measures before the damage is done. I applaud the efforts of committee member Ms. Borg in this respect, and I encourage the government to consider the private member's bill she has put forward on this issue.
Bill S-4, the new digital privacy act, is a welcome government initiative as it would also require breach notification, but its proposed standard for reporting breaches to the Privacy Commissioner, as opposed to individuals, is inappropriately high, allowing corporations to avoid accountability for inadequate security measures. I know you'll be looking at this bill when it comes before you, and I hope you will look at this very closely.
Second, make data protection laws enforceable. We live in a world of huge and expanding databases of personal information. These are gold mines for identity criminals as well as for marketers, researchers, and even political parties. The Personal Information Protection and Electronic Documents Act, which I'll refer to as PIPEDA, is supposed to protect consumers from the kinds of practices that lead to identity theft and fraud, but practices that violate PIPEDA continue to be widespread in the marketplace. The problem is that PIPEDA lacks teeth. Corporations need not take it very seriously.
The digital privacy act, Bill S-4, would make it easier for the Privacy Commissioner to name and shame corporate offenders. It would also allow the Privacy Commissioner to take action against those who fail to adhere to compliance agreements. These are significant improvements that would make the bill more effective and would be used to hold non-compliant organizations accountable for the kinds of practices that facilitate identity theft, but more could be done to make the data protection laws effective. I hope you will look at all options when Bill S-4 comes before you.
Third, require that credit freezes be offered to Canadian consumers. The messiest form of identity theft is new-account fraud, that is, where criminals use stolen data to create new accounts or take out loans or mortgages in the name of the victim. It can be months before a victim becomes aware of the problem, during which time multiple accounts have been opened and unpaid bills have been run up in the victim's name. Even after the victim succeeds in closing the accounts and dealing with the debts—this is a nightmare in and of itself—the victim can end up paying higher interest rates for years because of their corrupted credit histories.
This may not happen often, but when it happens, it is at a high cost to the individual. By far the best protection against new-account fraud is a credit freeze. A credit freeze bars the credit bureaus from issuing your credit report—the summary of loans and payments that forms the basis of your credit score. Because few lenders will issue credit without first seeing a credit score, identity thieves can't use stolen data to open up new accounts where the credit report is frozen. Credit freezes are particularly helpful for elderly people or for those who don't need to borrow money.
The credit bureau industry has no interest in offering credit freezes for obvious reasons. Doing so would eat into the industry's core business of providing credit reports. However, despite strong industry resistance in the United States, almost all states in the U.S. now require that credit freezes be offered to consumers at no fee or at a very low fee. The reason is to prevent identity theft. There is no good reason why Canadians are not offered similar protection. This is an area of provincial responsibility, but in my view the federal government should be working with the provinces, through, for example, the Consumer Measures Committee to ensure that consumers across Canada have the tools they need to prevent, detect, and mitigate the effects of identity crime, including the ability to freeze their credit reports upon request.
Fourth, coordinate victim assistance initiatives. The Canadian Identity Theft Support Centre, which I'll refer to as the victims support centre, was established in early 2012 with funding from the federal government to provide victims of identity theft with information and support. It has a very specific mandate, and that's all it is. The victims support centre is taking about 10 calls per day now from victims and others inquiring about identity theft, more when there is publicity about the centre. It offers victims hand-holding through the coping and remediation process, which can be extensive.
I understand that the victims support centre provides data to the Canadian Anti-Fraud Centre, but strangely, the Anti-Fraud Centre does not even acknowledge the existence of the victims support centre. Needless to say, there needs to be some coordination and cooperation between these two government-funded agencies so that each can focus on its mandate rather than trying to compete with the other for funds and public profile.
Finally, I would suggest that Canada develop a national strategy for combatting identity-related crime. The four measures I've advocated are just a few of many that are needed to address the many angles of this problem. Canada needs a national strategy to understand and address the specific problem of identity-related crime, a strategy that should be driven by high-level officials and that should involve all key stakeholders. The RCMP's national strategy, which it issued in 2012, is a good start, but it needs a lot more work to get beyond broad generalities and to include the consumer protection angle.
The first pillar of a national strategy should be to develop mechanisms to gather reliable, reasonably comprehensive data on the incidence, types, and costs of identity crime in Canada. On this, I fully endorse the comments of my colleagues, Drs. Sproule and Dupont, on this critical first step in addressing the problem. We need to know the nature of the problem in order to address it effectively. We simply don't have the data in Canada yet.
Finally, sometimes we can learn from our neighbours to the south, and I would suggest that this is one of those times. In 2006, the U.S. President established a special task force to develop a comprehensive national strategy to combat identity theft. The President's task force was co-chaired by the U.S. Attorney General and the chairman of the Federal Trade Commission. It included high-level executives from all pertinent government agencies. Over the course of a year, they examined the problem from all angles and published a comprehensive strategic plan for combatting identity theft in the United States. The plan, which called for a coordinated national approach to policy and law reform, has been largely implemented. There is a lead agency—the Federal Trade Commission—and consumers and victims in the United States now have many more tools at their disposal to prevent and deal with identity theft than do Canadians.
Mr. Chair, and members of the committee, it's time, in my view, for Canada to seize this issue and develop a similar strategy that involves all stakeholders, including consumer protection agencies and privacy commissioners at both federal and provincial levels.
We can do better.
Thank you.