Information & Ethics committee  There are two purposes, in our view, of security breach notification. One is to give individuals the ability to take precautionary measures if it's the kind of situation in which they can. But the second and equally, if not more, important reason is to provide these incentives that I keep talking about on organizations to take those security measures in advance in order to prevent the security breach in the first place.

Information & Ethics committee  Can I just add to that? The U.S. has a patchwork of sector-specific and issue-specific data protection laws. They do not have this nice, comprehensive law that we have. In fact, the biggest recommendation of consumer and privacy advocates in the United States is that the U.S. adopt a PIPEDA-like law.

Information & Ethics committee  It's coincidental to some extent. I worked as a lawyer for 12 years with the Public Interest Advocacy Centre. The last thing I did was the report on identity theft. When I left in August 2003, the report was almost, but not quite, complete. John took it over and finished it. In September 2003, I left the Public Interest Advocacy Centre and set up CIPPIC, Canadian Internet Policy and Public Interest Clinic at the University of Ottawa.

Information & Ethics committee  The Ontario Research Network for Electronic Commerce, ORNEC, which is a public-private partnership. Four of the major banks in Canada are funding it, and their funding is matched by the Ontario government.

Information & Ethics committee  I think you have to use the mass media to reach people. There are three things we've thought of: using the mass media; inserts in government cheque mailings, possibly, and putting up good posters and brochures in government storefront offices; and working with the banks. The banks are doing a reasonable job, and credit bureaus too have some good public education brochures and things on this issue.

Information & Ethics committee  It is an initiative.

Information & Ethics committee  The Competition Bureau is also involved with PhoneBusters.

Information & Ethics committee  Maybe it only works in English, I do not know, but there is a website where you can find information: www.phonebusters.com, I believe.

Information & Ethics committee  It is already against the law to use the social insurance number if there is no need to. The problem does not lie in that part of the act. The problems include enforcement—the lack of incentive and penalty for organizations that collect social insurance numbers when they shouldn't.

Information & Ethics committee  Could I just add one point to this? It could in fact make the problem worse, as John stated. Victims have trouble enough right now when their social insurance number has been compromised, for example, dealing with that. Imagine if your biometric identity is compromised, and I can guarantee you it will be.

Information & Ethics committee  I think it's usually large businesses that are implicated, or at least the cases we hear about. It's usually large databases, larger business, credit-granting institutions that run into trouble, so I'm not sure we're talking about a huge burden on small business. Again, what we're talking about when we're looking at data protection law enforcement is doing what's common sense anyway, what's good for the business and what's good for your customers.

Information & Ethics committee  I absolutely support that, but I think it's only one piece of the puzzle. It's certainly not the full solution on the criminal law side, and I understand that the Department of Justice is looking at all of the potential Criminal Code amendments that could give the police the tools they need to pursue identity thieves.

Information & Ethics committee  Sure. I can't explain why. I couldn't disagree with her more on this point.

Information & Ethics committee  Yes, I think the Consumer Measures Committee is doing great work on this, but it's not enough. It's not pulling in the law enforcement side of things. The police have a lot of information. There's a lot more that they can be doing, particularly once someone has been victimized. Victims are a great source of information about the nature of the problem, as well as the extent of it.

Information & Ethics committee  We have a number of class actions. Quebec is actually the jurisdiction in Canada that is the furthest ahead with class actions. A number of consumers have achieved remedies through that. Class actions are in fact specifically designed to empower consumers to make it easier for consumers to stop bad practices and get redress, first of all, by allowing them to obtain legal representation without cost and to be represented automatically as part of the class, even if they make no effort to initially obtain it.