Evidence of meeting #24 for Access to Information, Privacy and Ethics in the 41st Parliament, 2nd Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was fraud.
A recording is available from Parliament.
Conservative
Paul Calandra Conservative Oak Ridges—Markham, ON
Sorry, I know I was kind of hard on you, but I do appreciate the hard work you do. This is a bit of a challenge, for us and for you.
Mr. Skinner, you said that sharing information is important. You talked about it costing a lot of money, and said that governments and agencies should be sharing information more. But doesn't that cut both ways? When you make it difficult to share information, that's when fraud becomes more difficult for the consumer to catch.
President, TransUnion Canada
The intent of sharing information is to help us prevent as much fraud as possible. I think this would be the same for Equifax. We have multiple layers of fraud detection as it relates to financial services. Whether it's the device you're logging in to, the information you put on your application, or the authentication questions we ask you, the more information we have and store in our data warehouse, the better we're able to prevent the problem from happening.
In terms of sharing that information—this goes back to the point Carol raised—there are very strict requirements that we have in terms of who we share information with, and the background checks that we do on those organizations when we do share information. When we present the information to those institutions, it's not just a flat file of that credit bureau. It could be an answer of yes or no. So I understand the double-edged sword you're referring to.
We take data management very seriously, both organizations. So the question is, at what point do you stop sharing? The view, based on the amount of data we have and the amount of fraud that exists out there, is that there's still much more work for us to do, and access to that information to prevent fraud becomes incredibly important.
Vice-President, Legal Counsel and Chief Privacy Officer, Equifax Canada Co.
For example, one pertinent point is the amendments to PIPEDA, in terms of Bill S-4, doing away with the investigative bodies. That would help both organizations in terms of working with all members of the financial industry to prevent fraud. You wouldn't be limited to those who have subscribed and been approved as investigative bodies. That would be information sharing that could be shared amongst the bureaus and the financial credit granters.
Conservative
Paul Calandra Conservative Oak Ridges—Markham, ON
I'm more interested, though, in the sharing between the consumers and.... You earn money from the financial institutions because you help them protect their investments, you help them ensure that people who are borrowing money are a good risk. But it strikes me that as things have changed...and obviously, identify theft has become a really big problem in the last little while.
One of the big problems we see is that consumers, rightly or wrongly, whether they believe it or not, feel they have limited access to the reports you're keeping on them, and that this is actually helping to increase identity theft. It's not until someone gets rejected for something because of something on their report that they have knowledge of the fact that something has happened with their identity.
Wouldn't having easier access to the reports you're keeping on consumers...? I know that would be a change in your business model, but wouldn't our having easier access, quicker access, and more frequent access to the things you have on us also help you in your quest to stop identity theft?
President, Equifax Canada Co.
I think that if you come more to the root of it, it's—as we've all talked about—education and awareness.
The issue of access isn't really an issue in consumers' minds if they don't even think to access their consumer reports.
Conservative
Conservative
Conservative
Paul Calandra Conservative Oak Ridges—Markham, ON
By and large....
I just went on the Equifax website and looked at “free access to my credit”, and it was free for 30 days and then $14.95, no mention of anything.... That was just in the couple of seconds I was looking at it. It might be buried in your website somewhere else.
Isn't that also part of the problem? You're collecting information from individuals. The decisions that you're making are based on what people are giving you. I know it's not you out there saying that this guy's got bad credit. It's based on what the consumers do and we have a responsibility ourselves. I get that.
You're not making these decisions. This is the information that people have uploaded to you and you're putting that on a file, but then they don't have access to it. For some reason or another, consumers feel they don't have access to it, and when they want to access it they have to fill in a form and send it by mail, go to one of your offices that you don't like having, or call on the telephone and wait for it to come to mail, or pay $23 to make sure they're not getting screwed by somebody who stole their identity. Even then, they have to fill in a report, send it back to you, and you get to make the final decision.
How is that something that consumers look forward to?
NDP
The Chair NDP Pat Martin
Mr. Calandra, I think we'll have to leave that as more of a comment than a question because you're over time. Perhaps if there's a minute at the end there can be a closing comment to address that issue.
I'm afraid I'm going to have to go on to the next questioner now, and it's Scott Andrews for the Liberal Party.
Liberal
Scott Andrews Liberal Avalon, NL
Don't worry, Mr. Chair, I'm going to carry on in the same line of questioning, because I too can't get this in my head.
Mr. Russo, you say if you're a true fraud victim, it's free. Well, you're already a victim. Isn't this about trying to prevent becoming a victim? The part that I don't get, I think you said earlier...and I assume TransUnion, we're picking on you, but I think it cuts two ways here.
For credit monitoring services you said it's $5.
Vice-President, Legal Counsel and Chief Privacy Officer, Equifax Canada Co.
For an alert, it's $5.
Vice-President, Legal Counsel and Chief Privacy Officer, Equifax Canada Co.
It's for six years.
Liberal
Scott Andrews Liberal Avalon, NL
It's for six years.
So it's $5, less than a dollar a year. It takes a dollar to buy a stamp, for Christ's sake. Why couldn't...? I assume an alert is just some algorithm in the computer program that.... Hold on a second. Explain to me how an alert would be triggered, and why wouldn't you want to alert the consumer regardless?
Vice-President, Legal Counsel and Chief Privacy Officer, Equifax Canada Co.
There's a difference in alerting the consumer, which is credit monitoring, and there's an alert for the member who pulls the file.
The $5 alert is legislated in Manitoba and Ontario, and we offer it across the country. When an institution pulls that file they're mandated to receive it in an automated fashion. They would get an alert from Equifax that would read something like, “Please contact John Russo at this number before granting credit.”
Under the legislation, they then have to take reasonable steps to make sure they are dealing with John Russo and not John Fraudster, who is impersonating me. That's mandated by legislation.
Vice-President, Legal Counsel and Chief Privacy Officer, Equifax Canada Co.
That's an alert. That's not monitoring. That's the $5 alert.
The credit monitoring, which is for less than a cup of coffee a day, is a proactive, paid-for service. Unless they are a victim of a data breach and the corporation is paying for it, a consumer can pay for it on a monthly basis to make sure that anybody accessing their file—I always use the example that it's like a fingerprint, if I touch your file or I access your file it leaves a fingerprint. Soft and hard enquiries, you know if anybody has accessed your files. Because you get that real-time alert, you can say, “Wait a minute, I don't deal with this bank. What are they doing looking at my file”? You can call Equifax. You can call the bank. You can call whoever has been accessing your file.
Liberal
Scott Andrews Liberal Avalon, NL
I know you make people pay for that monthly fee. I think a lot of the members on this committee think you should be doing that at no cost to the consumer. I think that's where our frustration is coming from, because when you say, “Let the company pay for it if you're a victim of a data breach”, often we don't know we're a victim of a data breach until it's much too late.
President, Equifax Canada Co.
The monitoring service is a high-cost service to us. We're accessing millions of trade files that are downloaded to us every day. We have to load them, read through them, and identify if someone wants to be monitored. The computer cost charges are a high-cost service. That's why we charge for it.
President, TransUnion Canada
When you look at credit monitoring I would go back to the point I made earlier, that it's not just the monitoring aspect of it. The credit monitoring tool as it's sold has an education process to it, a management process. Again, I have my credit file. I get my email that says there's no news, but I still access it to see what's happening, if balances are changing, scores are changing—the things that make a difference from a credit monitoring perspective.
I would agree with Carol, that it seems because it's computerized and it's automated...but when you're processing hundreds of millions of transactions on a monthly basis it's not inexpensive. Then there's the call centre to support those customers. Often, when fraud alerts come in...and I know we talk about creating online access. The other thing I would emphasize is that when you have a customer call in about a fraud, all this information may be on the website, but they still need to talk to somebody. They want to talk to somebody on the other side to help them feel better about what's happened, as opposed to feeling they're in the dark.
There is a component of.... We're underwater on the fraud alerts. I know it's $5, but when you're talking to somebody and you're trying to walk them through what's happened and what they should be looking for, we lose money on that process.
NDP
The Chair NDP Pat Martin
Scott, I hope you weren't building up to some huge closer question there.
I'm afraid that concludes our time, and we've concluded the rounds as well. I'm glad everyone got two opportunities.
We are just going to thank our panel of witnesses from Equifax, Forrest Green, and TransUnion for making a very important contribution to our study on identity theft.
Thank you to all of you.
We should advise committee members that this Thursday is going to be a very interesting panel. We have representatives from the Toronto Dominion Bank, the Royal Bank, CIBC, BMO, and Scotiabank, without the Bankers Association. If you think these guys got a rough ride, you can anticipate what next Thursday will be like.
Anyway, thank you to everyone. That concludes our meeting.
The meeting is adjourned.