moved that Bill C-299, An Act to amend the Criminal Code, the Canada Evidence Act and the Competition Act (personal information obtained by fraud), be read the second time and referred to a committee.
Mr. Speaker, it is my pleasure today to rise to speak to my own private member's bill, my first that has been debated in the House, Bill C-299, an act to amend the Criminal Code, the Canada Evidence Act and the Competition Act, personal information obtained by fraud.
The purpose of the bill is to protect individuals against the collection of their personal information through fraud and impersonation. This practice is often known as “pretexting” and is a widespread problem in the growing market for personal information.
The bill aims to close some of the loopholes in Canada's data protection law that allow data brokers to exploit people's personal information for commercial gain. As a legislator, I believe this is an area where the House, Parliament, can truly make a difference and needs to step up to the challenge.
The bill seeks to do three things in particular. First, it seeks to make the practice of pretexting illegal through changes to the Criminal Code and the Competition Act. Second, it seeks to provide a remedy for victims of this kind of invasion of privacy through legal recourse in the courts and compensation. Third, it seeks to tackle the cross-border aspect of pretexting, by holding the Canadian affiliates of foreign companies liable for invasions of privacy committed against Canadians.
By introducing the bill, I hope, above all, to open the debate on how our laws can keep pace with changing technology to meet the needs of Canadians. In doing so and in asking members to support the bill, I would like to discuss three things: first, the need for the bill in the new information economy; second, the loopholes that currently exist in Canada's data protection framework; and third, what the bill means for Canadians.
First is the need for the bill. It is our job as legislators to ensure that the law can keep up with the evolution of technology. The communication revolution of the last decade and the growing information economy have accelerated the exchange of information around the world. All kinds of data circulate around the globe and across borders at the click of a button in ways never before imagined. Furthermore, more data is being created, stored and traded than ever before. As with any new evolution, new possibilities breed new relationships and new patterns of transgression.
To evoke a cliché, knowledge is power and this has never been truer than it is now. Information is one of the most valuable commodities in the new economy, typified by the growing data brokerage industry. Data brokers buy and sell information, sometimes personal, usually for commercial or marketing purposes.
Some of this industry is legal and consensual, however, there is mounting evidence to suggest that many aspects of the data brokerage industry are poorly regulated and that pretexting is a recurring problem.
In a free and democratic society, individuals should be able to control how information about them is used and accessed. Personal information should not be treated as a saleable commodity like any other. We see that in a networked economy, where innocuous details about people's personal lives and transactions can be transformed into a complete profile of the person with a variety of serious implications.
Simple details like a birthday, postal code or graduation date can be used to obtain credit card records and can track an individual's location, activities and purchases without their knowledge. The possibility to track people without their knowledge, aided by data brokering and pretexting, ultimately undermines the inherent autonomy and independence of the individual and leaves him or her vulnerable to numerous abuses.
An individual's data profile can be used for a wide range of purposes, from unsolicited marketing to fraud, identity theft or intimidation of the individual and his or her family. Apart from the economic and security risks attached to invasions of privacy, there is a significant psychological dimension. Do we really want to live in a society where we know that our actions can be traced without our knowledge for commercial or other purposes?
We have to think about how this will change the way individuals think about themselves and society. As Canada is a society that has adopted many of the values of the Enlightenment, I think it is appropriate to quote one of my favourite philosophers, John Stuart Mill, from his treatise On Liberty. He states:
The only part of the conduct of any one, for which he is amenable to society, is that which concerns others. In the part which merely concerns himself, his independence is, of right, absolute. Over himself, over his own body and mind, the individual is sovereign.
These are important issues and questions to look at in our changing technological environment.
The second issue is the loopholes in Canada's data protection framework.
First, it is important to remember that as a democracy, the police and judiciary require a warrant in order to access people's personal information. The bill in no way changes the powers or information available for the purposes of law enforcement.
Now let us consider the following. The very same personal information that police officers require a warrant for could very well be purchased online for a few hundred dollars in a matter of hours.
This is exactly what happened to federal Privacy Commissioner Jennifer Stoddart in an investigative report done by Macleans magazine in November 2005. In the report, journalists were able to purchase Ms. Stoddart's cell phone records and access conversations between the commissioner and members of her family. The purchase was done through one of at least 40 online services that offered to track down significant personal information using just a name and postal address. This was possible despite the fact that the Privacy Commissioner was obviously more savvy about protecting her personal information than the average Canadian.
The journalists reported that pretexting was a major factor in obtaining the Privacy Commissioner's records. Common practices include masking phone lines so that the call appears to come from the account in question and hacking into accounts using passwords, birthdays and other personal information. Frequently, however, pretexters are able to simply ask for the information from service providers by impersonating the victim with the use of other personal information.
Broadly speaking, there are two kinds of data brokers with the potential to invade people's privacy.
First, there are the larger companies which trade in data, often for commercial or marketing purposes. Much of this is aggregated and not particular to individuals; however individual information may sometimes be extracted from these databases.
Second, a range of smaller companies offer to target individuals for a fee, as in Ms. Stoddart's case. These companies may simply sell personal information or they may offer more invasive services such as private investigation.
At the federal level, data protection falls under the Personal Information Protection and Electronic Documents act, known as PIPEDA. Commissioner Stoddart has already submitted a report to the privacy and ethics committee detailing possible improvements to the act in May of this year.
Notwithstanding possible changes to PIPEDA, there are three major loopholes in Canada's data protection framework.
First, though fraud and personation are crimes under the Criminal Code, they do not apply to personal information such as phone records, consumer preferences or purchases.
Second, while these actions violate PIPEDA insofar as it says that information cannot be disclosed without the expressed consent of the consumer or court order, this does not guarantee a remedy. The commissioner's rulings are not legally binding without a federal court order and the transgressors are not named.
Bill C-299 would change that by making it a crime under the Criminal Code to collect or counsel to collect personal information through fraud, personation or deception. Bill C-299 would also change the Competition Act to make it an illegal trade practice to obtain personal information through fraud, deception or personation. It would also characterize the promotion of a product that is provided by means of fraud, false pretense or fraudulent personation as a false or misleading representation to the public.
Third, the Privacy Commissioner has no jurisdiction to pursue complaints outside of Canada. However, as in Ms. Stoddart's case, Canadians can easily be targeted by data brokers in other countries, particularly the United States. In Ms. Stoddart's case, the Canadian phone service providers had to seek an injunction against the offending data brokers in a Florida court. Going abroad to get injunctions is both expensive and yields unpredictable results in different jurisdictions.
Bill C-299 would allow victims of privacy invasion to seek compensation from Canadian affiliates of foreign companies that invade their privacy. This is not a perfect solution, but it helps to deal with the problem of extraterritoriality.
Third, what does the bill mean for Canadians? If the bill is implemented, it would help preserve the trust and individual autonomy in a society that Canadians enjoy today. The legal remedy for invasions of privacy in Bill C-299 does two things. First, it assures Canadians that their right to privacy is recognized and seeks to compensate them for damages caused. Second, it seeks to catch invasions of privacy before it leads to more serious criminal activity.
In seeking criminal sanctions for intentional invasion of privacy for commercial purposes, it weakens the invasive parts of the data brokerage industry as a whole. For example, if the practice of pretexting is criminalized it will cut down on the instruments of identity theft. Charges can be brought for the invasion of privacy before they have to be brought for more large scale financial fraud and theft of identity. Moreover, cutting down on identity theft is in and of itself an important aspect in the fight against organized crime and international terrorism.
Furthermore, the bill recognizes the economic, social and psychological harm caused by the systemic invasion of privacy. It seeks to stem the fraudulent and invasive aspects of the data brokering industry, particularly, the practice of pretext.
If a law-abiding citizen has undergone the anxiety and inconvenience of being traced or interfered with for commercial gain, the bill would provide for recourse, through the courts, for a recovery of damages. In the event that the perpetrator is a foreign company with a Canadian affiliate, that Canadian affiliate may be held accountable.
Bill C-299 seeks to respond to the new challenges of information technology and close some of the gaps in our legal system. Invasion of privacy, through pretexting and data brokering, is a growing area and we need to open a debate on how to enforce meaningful protections.
Therefore, I ask all members to consider this legislation very seriously. It is a serious issue, which is growing, and it needs to be addressed. I am putting forward the bill to obviously address the protection of personal information. We also need to address, however, the whole issue of identity theft as well.
I believe the bill is the first step to do that. I look forward to the comments of other members. I note one of the Liberal members opposite has offered some helpful comments, as has the parliamentary secretary to the justice minister.
I would ask members to discuss the bill in principle at second reading, to move it forward to committee. If amendments are needed in terms of the bill itself, I would look forward to those. I am willing to work with all members in the House to improve the bill to address this important issue.