Information & Ethics Committee on May 27th, 2014

[Carol Gray]

I would say if it relates to credit, yes, but there are data breaches on data outside of credit where we wouldn't be the first line of defence. But if it is information that is contained on the consumer file, we are often seen as the first line of defence.

[Todd Skinner]

Prior to joining TransUnion—I've only been with TransUnion for 75 days—I spent most of my career in financial services. I think the front line of fraud prevention resides in the hands of the folks in the financial services sector, and the retail sector when they get that data. How do they store that data, how do they protect that data so that there isn't a breach and it doesn't get in the hands of fraudsters?

I think in terms of a second-line protection, when either Equifax's or TransUnion's credit bureaus are accessed, that's where the products that we have as Equifax to identify fraud, to create awareness of potential fraud, really kick in to help solve this problem. So the way I would characterize this is that if the front-line financial services and retail are one, we're probably one and a half, because there are ways that we can connect with consumers. But the typical fraud happens through those institutions first.

[Scott Andrews, Liberal, Avalon, NL]

I think what you just said is that in most of those institutions, fraud happens if there's a breach of data, if there's some sort of activity that would be, I guess, criminal in nature.

[Todd Skinner]

Yes.

[Scott Andrews, Liberal, Avalon, NL]

Okay.

[Tara Zecevic, Vice-President, Decision Solutions, Equifax Canada Co.]

I was going to add that it's not always a data breach. Sometimes it's rogue employees, or it could be dumpster diving. There could be less-sophisticated to the more-sophisticated data breaches. There are various ways that data could be compromised.

[Scott Andrews, Liberal, Avalon, NL]

Okay, on the costs for those alerts, the credit monitoring, the consumer has to bear that particular cost. Is there a way that we can change the legislation? You referred to the legislation's saying we have to provide a mailed copy. Should we look at changing the legislation to give the consumer more free credit monitoring, for example, if we took away some of the legislation restrictions on mailing and that sort of thing?

Have either one of you thought about what changes need to be made to the legislation so that you could do more on the free end of things that wouldn't cost you as much?

[Chantal Banfield]

I can tell you that every time there's been a reform in the consumer reporting acts in the various provinces, that is one of the things we've advocated for. Basically, in this day and age, do we really need to have an office outside of our core headquarters, because if we didn't have that infrastructure we could invest in other areas—being able to provide information electronically, for example. So we have tried that, but unfortunately we have not been successful. I think my colleague, Mr. Russo, will tell you the same thing, that we've tried that across the various provinces.

[Tara Zecevic]

I just want to add that we'd like to see some reform. It would also be in terms of the penalties to organized...and crimes. I know that these identity theft crimes oftentimes are viewed as white-collar crimes, and we'd very much like to see stiffer penalties to criminals in this sector or area.

[John Russo]

I agree with Ms. Banfield's statements in terms of not only provincial reform but also in terms of privacy reform. We have canvassed that, but not to much success.

[Scott Andrews, Liberal, Avalon, NL]

You mentioned these foot soldiers, Mr. Russo, taking people...from their employment. How big an issue is that? We had the RCMP in, and they didn't refer to that at all.

I'm wondering if you could just elaborate a little bit on that particular aspect. I think that was the first that we heard about it, and it's a real concern.

[John Russo]

Yes, and I heard the same things when we were working on the CBC investigative piece, that the Toronto Police Service saw it as a big issue, but for some reason the RCMP didn't see it being as big an issue. I'm not saying one is better than the other.

But what really interested me when I started seven years ago at Equifax was the synthetic identities and synthetic crimes, because we knew they were starting to blossom. I would look at the various reports, working with local law enforcement in the various provinces, even in terms of some of the fictitious names they would come up with, such as “Robert Consumer”. At that time there were 100 or 200 reports that we'd be able to identify, working jointly with police, as being fictitious. That was seven years ago. That's increased exponentially every year, and we're up to 1,300 or 1,400 files on average per month using fictitious identities for non-existent people. We see it on the file. This individual ends up busting out, and they think they can leave the country and not pay their bills, but really they just open up a new identity.

We've even seen it in our walk-in centre. We have a walk-in centre just below my office in Toronto. You'll get an individual coming in with a driver's licence, and on the front they're a male, 35 years old, and when they swipe their driver's licence, it's a female reader on the back. So of course we notify law enforcement of that.

To us it's a real problem, and it's a billion-dollar problem.

[Tara Zecevic]

The only thing I would add is that oftentimes it's very difficult to quantify the numbers, because, as John mentioned, with these fictitious identities they build up their credit profile over time. Then there's a term that industry uses called “they bust out” when they have an all-time high with their credit. Oftentimes it's very hard to measure that, and sometimes they'll get classified in collections. In that case it's really hard to measure when, in fact, it's not a collection issue; it's a fraud issue.

[Scott Andrews, Liberal, Avalon, NL]

Does the RCMP have enough resources? Are they really focusing in on that? Or are you somewhat frustrated with the police, that maybe they're not paying enough attention to this? Do you have any comments regarding the law enforcement side of the problem?

[The Chair, NDP, Pat Martin]

Could we have a very brief answer, please? Your time is actually up, Mr. Andrews.

[John Russo]

Jointly, we could always do more.

[The Chair, NDP, Pat Martin]

That's the kind of brevity we appreciate around here, thank you.

That concludes our first round of questioning.

No, it doesn't, actually. Mr. Calandra and Ms. Davidson will share a round.

Mr. Calandra.

[Paul Calandra, Conservative, Oak Ridges—Markham, ON]

Thank you, Chair. Thank you, witnesses.

Let me first state that I know that you do good work, so forgive me on some of my questioning.

Just to confirm, legislation forces you to mail a free credit report to people.

[Chantal Banfield]

No, what I was referring to is that the legislation requires us to have offices in some of the provinces, so we have to have a walk-in centre.

[Paul Calandra, Conservative, Oak Ridges—Markham, ON]

Okay, I get that. But what does that have to do with the fact that a consumer wants a credit report and doesn't necessarily want it mailed to them? How is that the consumer's problem that you have to maintain an office when we want access to our credit report, and we want it free, and we want it online? Why do I care that legislation forces you to have an office? That's just the cost of doing business for you.

Why is that my problem as a consumer?

[Chantal Banfield]

I think the issue we have there is that over time we've built an infrastructure that's already in place, so in order for us to change it and invest in other technologies, we still have to bear the burden of those costs. So, for example, we've invested in IVR technology—and I know that Equifax has invested in IVR technology—so you can get a copy of your report by phoning in the centre, authenticating online, and then getting a copy of it by mail. It's processed overnight and it's mailed the next day.

[Paul Calandra, Conservative, Oak Ridges—Markham, ON]

Yes. Again, it's always by mail. I can pay and have it immediately as a consumer, but I have to pay the $26. Somehow I have to wait for the mail because you guys have to have offices in different provinces. Well, boo hoo, too bad. Get out of the business if you don't like it, I guess is the reality.

The problem is that the consumers are having a difficult time. When you guys make a mistake, whether it's your own fault or not, or somehow a mistake is made, it impacts consumers, and it's not easy for a consumer then to fix a mistake that has happened—sometimes by no fault of their own, by somebody else's criminal negligence, or whatever—and the only way for us to do that for free is to wait for you to mail something out to us, or pay. That is obviously causing a big dilemma, because things have changed over the last 10 years, so your business model, presumably, should change to follow.

[Carol Gray]

Maybe I could also add that what we want to have is one channel that is universally acceptable and can be accessed, and that is the mail. Not everyone has access to a computer, and when you discover that you think you might be compromised, you probably have access to a phone. So notifying us immediately over the phone, and getting your report within 48 hours, is a very good solution because if we put everything on the Internet, what about the folks—and particularly those on reserves—who may not have access to the Internet? So really, the mail—that's the free one—does provide universal access. But I do hear what you're saying, and it's a matter of an evolving business model for us to add alternate channels in a cost-effective way.

[Paul Calandra, Conservative, Oak Ridges—Markham, ON]

I hear what you're saying, but it strikes me as a business that is just finding every excuse not to provide people with the information that they need. You're probably one of the only businesses ever to come before us and say they have to rely on the mail because more people have access to that.

Honestly, right here, I have access to this. Maybe I'm different, but most people have access to a cellphone. I'd hazard a guess that most people on reserve have access to a cellphone that can give them Internet access as well, and they can download the report for free if you would allow them to do it.

All I'm suggesting is that as things are changing, as identity theft has become more of a problem, there is nobody out there really to protect consumers. You work, obviously, for businesses and not necessarily for the consumer. When a consumer has a problem with what you have done, or the information that you have gathered, through no fault of your own, it is a hard job to change that and we have to pay if we want to change it immediately.

I would suggest that is one of the problems.

But is it another problem that more and more businesses are asking for credit reports? Part of your system of how you judge consumers is based on the number of reports that are being generated. If I want a cellphone, Rogers, Bell, or whatever, will pull a credit report on me, a soft inquiry or whatever they call it.

More and more businesses, for less and less significant matters, are asking you for your information, which impacts consumers in the sense that their credit scores are then impacted, and that's a score that you generate.

Would another answer not be, in order to avoid more people having access, to limit the amount of transactions businesses can ask you to pull a report for?

[Carol Gray]

Maybe I can clarify a few things.

First of all, a business needs to qualify to become a member of a bureau to access the report. They have to have a legitimate reason and the proper security protocols in order to access consumer reports. That's number one.

Number two, every time an inquiry is done on the consumer's report does not necessarily affect the consumer's credit score. The scores are calculated in different ways for different purposes . Each credit granting body will use scores in different ways. For example, not all the telecoms report all of their information to the credit bureaus.

Many of the lenders don't even use that information in their credit granting decision. So it's not—