Information & Ethics Committee on May 27th, 2014

[John Russo]

Unfortunately, minors don't have credit reports in terms of protecting those.

For example, at Equifax, we have a stolen SIN database where we could enter minors' information, a SIN number, that has been compromised. When a fraudster tries to use your daughter or son's information, and they're under age, that would trigger the institution to say that this SIN number has been stolen or lost by an individual. Since children don't have a credit file, it's a lot tougher.

Building the identity—and Tara working with fraud and the associations who deal with fraud can elaborate—simply put, they start with the SIN, which gives a concrete basis to the identity or the fictitious identity. With that they apply, let's say, for a cellphone and they get the hardware. Then they post it on Kijiji or something and meet you near a subway to sell that hardware. They do that over and over again. These identities are faceless crimes and they don't exist. They start simple and build up that credit, perhaps go to a bank and get a small loan, or get credit cards. They work using one or two pieces of identity. When your child applies for their first credit facility years down the road, all of a sudden they find out that their SIN number has been compromised and used over and over again.

[Bob Zimmer, Conservative, Prince George—Peace River, BC]

Thank you.

[The Vice-Chair, Conservative, Patricia Davidson]

Thank you, Mr. Zimmer.

We'll now move on to Madam Borg, please, for five minutes.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you very much.

I would like to come back to Mr. Calandra's questions. It's a little difficult to understand. However, I understand that there are financial constraints.

I do not know if you can answer my question now or if you can write in your response later, but here is what I want to know. If I make a request to obtain my credit file, how much would that cost in terms of the resources for your respective organizations?

[John Russo]

We can get back to you with those numbers in terms of what it costs.

[A voice]

That would be the same for both of us.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

I do not know if we have a process by which you can transmit that information to the clerk, but if it were possible, it would be interesting. Thank you very much.

Another concern was raised by certain witnesses in academia. They stated that they had trouble getting data or information about certain things. I know that it's not necessarily in your mandate to document all this, but have you already participated in research projects? Can you share data with academics? I mean demographic data or data on recurring problems for example.

[Todd Skinner]

I think from TransUnion's perspective—and I suspect from Equifax's perspective as well—we'd be up for sharing the information with an individual body. The issue goes back to how do we prevent as much fraud as possible? We're trying to get to the government bodies that issue identification and have them share that information through us, as a conduit, to really try to prevent as much fraud as possible. I'm not sure what the conduit should be to deliver that information, whether it's this committee, or on a one-time basis, but what does that look like going forward? Sharing information to have a better understanding of how big the issue is.... We're very much supportive of that.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you. We were told that could be a potential solution. Obviously, if everybody involved worked together, the results would be better.

You said elsewhere that between 25% and 30% of Canadians requested access to their credit file. I think, for my part, that online access would be easier, but are you thinking of other ways by which to encourage consumers to request access to their credit report?

[John Russo]

As an example, we go out in terms of Junior Achievement and work with schools in educating young Canadians so that when they do turn of age and are able to access credit they're aware of what the report is, and they know how to read the report and what impacts their score. So we've been doing a lot of work in terms of Junior Achievement and laying the foundation for young Canadians.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Mr. Skinner or Ms. Banfield, would you like to add anything?

[Chantal Banfield]

We have a lot of information on our website. We have worked among others with police services as well as many agencies in order to publicize it. We also run campaigns in schools.

I think Canada's privacy commissioner could include more consumer-oriented information in her toolbox. I believe many consumers consult the commissioner's website particularly to get information when they have been the victim of fraud or another such problem.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you.

Ms. Zecevic, would you like to add something?

[Tara Zecevic]

I just wanted to add that I currently sit on the board as well for Credit Canada Debt Solutions, so we are working with consumers when they are in debt situations.... How do we help them consolidate? Education and financial literacy are big components of that.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you very much.

Do I still have time?

[The Vice-Chair, Conservative, Patricia Davidson]

You have two seconds so I think we'll call it.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you.

[The Vice-Chair, Conservative, Patricia Davidson]

The next is Ms. O'Neill Gordon, please.

[Tilly O'Neill-Gordon, Conservative, Miramichi, NB]

Thank you, Madam Chair.

I want to thank all of the witnesses for being with us today. You certainly have given us lots to think about.

My first question is to Mr. Russo. In your notes you write, “The fact of the matter is, criminals will not stop evolving, and our laws, our security and prevention tactics, must change with them”. Can you tell us here today what are some of the changes we need to make? What are some ways we need to help people out there have a better idea of what's going on around them?

It's not just really for Mr. Russo. Any of you can answer because you all have good ideas. But there have to be changes as this is evolving around and we need it.

[John Russo]

To start, Bill S-4 is a good initiative in terms of giving consumers a little more power proactively to know when their information's been compromised. So mandatory breach notification, something that many U.S. states have already.... Hopefully this bill does pass the third time around in terms of creating that notification so that when individuals have their information compromised, lost, or stolen at an organization they're aware of it. Most times institutions may bury their heads in the sand and not do anything, or if they're not subject to any fines or penalties, they're less likely to do anything. That's one key in terms of legislative changes.

Carol.

[Carol Gray]

Just building on what John was saying, the stiffer penalties, I think, are important because there is a perception that this is a faceless crime. It's benign. There are no real victims at the end of the chain. But there are, and as we've talked about, the costs are huge. The fines should bear, of course, correlation to what the costs are to society.

[Todd Skinner]

I think the last point I would make is that we talked about a lot of the breaches happening in small or medium-sized enterprises and they make up a large percentage. There really is assistance that should be offered there around the education of what happens and helping them understand from a security protocol what they need to do to ensure those breaches don't happen. I agree with John and Carol that there needs to be some legislative change and impact that goes with that.

[Murray Rowe]

I do a lot of work with police services and I find them very committed to solving these problems. But one of the things that might be helpful.... If you anemically fund a problem, you're going to get poor results. So, wouldn't it be interesting if you could actually track the number of officers and the actual funding that is provided to organizations like the RCMP? You can have people who are committed to making this work, but if you're cutting the department, you're going to have poor responses.

So instead of being prescriptive—asking detailed...and telling the investigators who are very professional already, “Why don't you look at some of the root issues?” I think funding is one of the key factors in this. If you have more crimes that are being investigated, then you're going to allow it to take place. In New York City when they talk about the broken windows theory that Giuliani and others have implemented on even some of the smaller crimes, it's amazing how the crime rate dropped. Maybe we could start implementing that on some of the lesser issues. But get empirical, measure the dollars that are actually spent instead of just asking, “Are you committed to making this work?”

[Todd Skinner]

Can I just add one more point? I think as you try to attack this problem there are really multiple solutions to get there. But I would just say that an ounce of prevention is worth a pound of cure. When you think of the number of breaches actually decreasing but the number of potential victims increasing. Technology is catching up. It's how we store information on data. That data is becoming cheaper. How many items we store on that technology is getting more expansive. So, instead of it being 100,000 records, it's a million records, then it will be 100 million records.

I just advocate that trying to solve this problem of identify theft on the front end saves a lot of time and effort on the back end, and allows us to take the funding and resources we have solving white-collar crimes to really get them focused on things that make a difference in our communities. So, try to move as much as we can to the front end to solve this problem.

[Tilly O'Neill-Gordon, Conservative, Miramichi, NB]

Another question I had was...and you have since then mentioned about education and how we can educate more people. I know you're going into the schools but right now we have a segment who did not get it when they were in school, and those people are very vulnerable too. I don't know how we can get the message out. I hear about two types of protection. I wonder how many.... Even my own family wouldn't know that this is even available. This is important news that should be out there. There's another thing about a certain amount to obtain a credit freeze. These are things that, I don't know.... That's where I'm coming from, from that end as to where we can help these people out.