Evidence of meeting #81 for Access to Information, Privacy and Ethics in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was equifax.

A video is available from Parliament.

On the agenda

MPs speaking

Also speaking

Antonietta Di Napoli  Director, Global Operations, Equifax Canada Co.
John Russo  Chief Privacy Officer and Corporate Secretary, Equifax Canada Co.
Clerk of the Committee  Mr. Hugues La Rue

4:40 p.m.

Chief Privacy Officer and Corporate Secretary, Equifax Canada Co.

John Russo

That's correct, Mr. Weir. We wouldn't have those figures at this time.

4:40 p.m.

NDP

Erin Weir NDP Regina—Lewvan, SK

Okay.

Is it your sense that other credit bureaus are vulnerable to this type of security breach, or is it your sense that they have adequate safeguards in place?

4:40 p.m.

Chief Privacy Officer and Corporate Secretary, Equifax Canada Co.

John Russo

I couldn't speak to our competition and the procedures and practices they have in place. Again, I'm here as chief privacy officer on behalf of Equifax Canada. I know, working with our security department and our senior leadership team here in Canada, what we're doing and what we've done in terms of going from good to better, but I couldn't opine on TransUnion or any other credit bureau here in Canada.

4:40 p.m.

NDP

Erin Weir NDP Regina—Lewvan, SK

Have they ever had any significant breaches, not on this scale but on any kind of significant scale?

4:40 p.m.

Chief Privacy Officer and Corporate Secretary, Equifax Canada Co.

John Russo

Again, I wouldn't be in a position to opine on what's transpired besides what I've read in the media.

4:40 p.m.

NDP

Erin Weir NDP Regina—Lewvan, SK

Okay. In terms of what you've read in the media, do you know about any similar instances at other companies?

4:45 p.m.

Chief Privacy Officer and Corporate Secretary, Equifax Canada Co.

John Russo

In the U.S., there have been similar instances with some of our competitors over the years, with incidents of data breaches and incidents regarding their consumers and personal information.

4:45 p.m.

NDP

Erin Weir NDP Regina—Lewvan, SK

Thank you.

4:45 p.m.

Chief Privacy Officer and Corporate Secretary, Equifax Canada Co.

John Russo

You're welcome. Thank you for your questions.

4:45 p.m.

Conservative

The Chair Conservative Bob Zimmer

Thank you, Mr. Weir.

We're going to continue with questions from the committee.

Ms. Shanahan, you're up for the next seven minutes.

December 4th, 2017 / 4:45 p.m.

Liberal

Brenda Shanahan Liberal Châteauguay—Lacolle, QC

Thank you very much, Chair.

Thank you very much to the witnesses for being here today on an issue which, as somebody who has just heard and read about it, I also was deeply concerned to hear about.

In my former career as a banker, we relied on Equifax—this would have been in the eighties and nineties—for information. In fact, I recall at that time that the problem we had with Equifax was that the data on consumers was inaccurate. We regularly had to check up on it ourselves. We would receive the report on a customer, whether commercial or an individual, and we would follow up ourselves and do the checking. It came out not too long afterwards that consumers themselves were discovering that their records were inaccurate. Indeed—correct me if I'm wrong—there was a court judgment saying that consumers had the right to see their information.

I know that as a banker I was not allowed to provide customers with their information, because it was a service that was sold between Equifax and businesses, including the banks. At that time, it had nothing to do with the consideration of the consumer, which was nowhere to be found in the buying and selling of that information.

Fast-forward to today, and now I see on your website that you're selling consumers their own information. It's information that you are collecting and your business customers are paying you for, and you're selling back to customers the verification of that information for $20 a month. Could you please explain the business model behind this?

4:45 p.m.

Chief Privacy Officer and Corporate Secretary, Equifax Canada Co.

John Russo

Sure.

First, in regard to any inaccuracies or information that's lacking on the file, we welcome questions from consumers across Canada. Toni can speak to our consumer call centres. We want to make sure that information is fair and accurate. That's what our legislation says. That's how we operate our business. It's to be—

4:45 p.m.

Liberal

Brenda Shanahan Liberal Châteauguay—Lacolle, QC

In fact, it's because you're selling that information. It has to be accurate. That's your business model. It's up to you to make sure that the information is accurate, not the consumer. If there is suspicious activity on the consumer's account, you should be paying for that investigation. If the consumer wants to know what their credit score is, yes, they should have access to it immediately, for free, and that's what the court judgment in Canada said, that consumers have that access.

I seem to remember it being once a year that consumers had to go in and do it on a paper basis and provide all their information. I know, because I used to provide that education to consumers. It was very onerous and difficult to find the website. I will give you kudos today, because I see that it is actually accessible. You only have to go to the bottom of the Equifax consumer website page to find that access.

However, in terms of consumers having to pay for a restoration specialist to help them recover from ID theft, you should be paying for that if somebody is able to steal their ID.

It's $19.95 per month. I'd like to know what costing went in to discover that this was actually the cost of providing this service to customers. You say they can cancel at any time, but sorry, there are no partial month refunds.

4:45 p.m.

Chief Privacy Officer and Corporate Secretary, Equifax Canada Co.

John Russo

If you're one of the 19,000 Canadians impacted, we are paying for that service. We're affording all Canadians, and we've seen close to 2,000 Canadians, so far, subscribe to the service that we've offered for free to them.

4:45 p.m.

Liberal

Brenda Shanahan Liberal Châteauguay—Lacolle, QC

It is for 12 months. Am I correct on that?

4:45 p.m.

Chief Privacy Officer and Corporate Secretary, Equifax Canada Co.

John Russo

Yes, it's for 12 months.

4:45 p.m.

Liberal

Brenda Shanahan Liberal Châteauguay—Lacolle, QC

It should be for life, Mr. Russo—for life. Consumers have their social security number and their birthdate for life. They are potentially at risk for life. I would leave that for you to think about.

Do I still have time?

4:45 p.m.

Conservative

The Chair Conservative Bob Zimmer

You have another three minutes.

4:45 p.m.

Liberal

Brenda Shanahan Liberal Châteauguay—Lacolle, QC

Okay, please continue.

4:45 p.m.

Chief Privacy Officer and Corporate Secretary, Equifax Canada Co.

John Russo

I will turn to Ms. Di Napoli to outline some of the access to information we have that consumers generally can get in terms of monitoring their credit and fighting fraud, something as simple as a free credit report.

4:50 p.m.

Director, Global Operations, Equifax Canada Co.

Antonietta Di Napoli

As I have mentioned, there are free services that we have. Canadians do have unlimited access to their credit file throughout the year. Mr. Russo mentioned that we are looking at launching functionality where consumers will be able to lock and unlock their files for free. After the 12 months, impacted consumers from this breach will have the possibility to do so, therefore mitigating any fraudulent activity, or possibility of fraudulent activity, on their consumer file.

4:50 p.m.

Liberal

Brenda Shanahan Liberal Châteauguay—Lacolle, QC

I'm sorry, I didn't catch that. Does that have to do with the locking and unlocking?

I would like to learn more about that service that you're looking at providing to consumers free of charge. What does that mean, and how will that help people protect themselves?

4:50 p.m.

Chief Privacy Officer and Corporate Secretary, Equifax Canada Co.

John Russo

Similar to our U.S. consumer offering, as you heard from our interim CEO, Paulino Barros, by the end of January, with this service, consumers will have greater control of their information.

For example, if I have a mobile device and I want to lock my credit file, the functionality would be that until I unlock it, a bank, a car leasing company, or a landlord could not access that information. If I'm applying for credit, I can turn it back on at my fingertips, easily, in seconds, so a bank can access and adjudicate me for credit because I'm the individual who wants that credit.

4:50 p.m.

Liberal

Brenda Shanahan Liberal Châteauguay—Lacolle, QC

An example of how that would be used is if you lose your wallet. It's not so much that you want to stop your own landlord from accessing it, assuming that you actually want to take out that lease. It's not the people you want to access it that you want to stop from accessing it, it's the people you don't want accessing that account. Therefore, how does it protect?

4:50 p.m.

Chief Privacy Officer and Corporate Secretary, Equifax Canada Co.

John Russo

That functionality would allow you in the future to be at the bank, and at your fingertips, to unlock that functionality. You know that at this one instance you're going to unlock it for the bank to adjudicate you for your car lease or your loan.

At the same time, there are features, as you've heard, in the U.S. where they have a credit freeze, where it's frozen. That's not very consumer friendly in most instances, because to unfreeze it takes time and re-authentication.

What we're building is an easy-to-use service that consumers with an iPhone or a device are able to do instantaneously, within seconds, to allow themselves to be protected. Then at the time they're at the institution seeking credit, they unlock it for that one transaction, and then turn a switch back on to lock it. They'll have that control at their fingertips.