The Competition Bureau announced earlier this week its participation in Fraud Prevention Month, which this year focuses on the growing problem of online fraud. Fraud Prevention Month is an annual education and awareness campaign held in Canada and around the world. The Competition Bureau’s website provides some great education and prevention information including a new interactive quiz designed to test consumers’ and businesses’ fraud awareness. I’d encourage you to take the quiz!
Does your office have a copy machine? If so, then this post is worth reading. CBC news has just released the results of an investigation that exposes the security risks associated with modern copy machines, specifically, the ease at which information scanned into certain copiers can be tapped. Just think about the information that gets scanned into your office copier. Personal information. Confidential corporate information such as client data. Even intellectual property. It’s a scary thought if you haven’t done your due diligence, especially considering that privacy laws can apply to certain data undoubtedly scanned into your copy machine. Check out CBC’s online story here or TV segment here. And if you’d like to learn more, you may also want to read my post from earlier this year which provided a link to a similar CBS news story.
CBC News is reporting that ”[g]arbage bags filled with confidential financial information were found blowing around in a [Winnipeg] North End back lane Tuesday, and people living in the area say they’re furious because of it. The bags contain tax return documents that include people’s names, social insurance numbers and in many cases, addresses and other sensitive financial information.”
This and other similar news stories should serve as a reminder that PIPEDA requires organizations to exercise care in the disposal or destruction of personal information to prevent unauthorized parties from gaining access to the information (for example, don’t dispose of sensitive tax information records in a back lane). Other provincial laws, such as Alberta’s PIPA and B.C.’s PIPA, have similar requirements. Disposal or destruction policies and procedures should focus on physical, organizational and technological measures.
The federal government introduced legislation today to amend PIPEDA and re-introduce the Anti-Spam Bill. I’ve previously posted here regarding the anticipated changes to PIPEDA and here about the Anti-Spam Bill.
From today’s news release:
The Honourable Tony Clement, Minister of Industry, and the Honourable Denis Lebel, Minister of State (Economic Development Agency of Canada for the Regions of Quebec), today announced two steps that the Government of Canada is taking to enhance the safety and security of the online marketplace. Together, the tabling of amendments to the legislation protecting the personal information of Canadians (Personal Information Protection and Electronic Documents Act, or PIPEDA) and the reintroduction of anti-spam legislation in the House of Commons (the proposed Fighting Internet and Wireless Spam Act, or FISA) are important steps towards positioning Canada as a leader in the digital economy.
Here’s the full Industry Canada news release.
(Hat tip to David Fraser’s Canadian Privacy Law Blog )
CBS News has an excellent investigative report here (on YouTube) about the security risks associated with copy machines. Members of the Privacy Forum will already know about this issue because we’ve previously highlighted it and relevant risk mitigation steps in the Canadian privacy law context. However, if you’re not aware of the issue then this report is a “must-see”.
This really is the kind of personal information that identity thieves love so the OPC article is a useful read. In fact, businesses whose employees create accounts on their behalf would be well-advised to have employees read the OPC article.
It’s safe to say that the Alberta provincial government is regarded as being right wing. But Manitoba’s? Not at all. So why then is Alberta light years ahead of Manitoba at protecting workers’ privacy?
The above link takes you to the Winnipeg Sun. I’m delighted to have been asked by Sun Media Corp. to provide Comment columns like today’s on a monthly basis. I hope you find them of interest!
Continuing a series of blog posts that I’m calling “A Conversation with…” (the first being A Conversation with Jennifer Stoddart, Privacy Commissioner of Canada), I’m delighted to post the following conversation with Frank Work.
Commissioner Work is as personable as he is professional. I’ve had the pleasure to speak at privacy conferences with Commissioner Work and let’s just say that I’m glad I presented first! As privacy professionals will know, he’s a plain spoken, intelligent speaker and so his sessions are always a “must attend”.
Thanks to Commissioner Work for agreeing to engage in this online Q & A conversation. If you’d like to learn more about Frank Work, the Office of the Information and Privacy Commissioner of Alberta (the “Alberta OIPC”) or the issues raised in this conversation, I’d encourage you to visit the Alberta OIPC’s website.
Q. Your office has investigated identity theft arising from crystal meth abuse. What’s the link between the two?
A. A couple of years ago the Edmonton police raided a hang out for meth users. They found a lot of papers from businesses in the area, which they gave to us. Cell phone contracts, credit bureau checks, credit card information and so on. The police told me that meth users, unlike some other substance abusers, are pretty alert when they are high. They don’t sleep. They have lots of time to do the kind of detailed work necessary to engineer credit card fraud and identity theft.
Q. So what can the public do to protect itself from that kind of identity theft?
A. Individuals should shred bank and credit card statements. They shouldn’t carry certain ID, like birth certificates, on them. These kinds of foundation documents are very useful for identity theft. Always report lost or stolen credit cards, but also lost or stolen driver’s licences, birth certificates, and passports. Check your bank and credit card statements to make sure someone else isn’t using them. Do a credit bureau reference on yourself maybe once a year. If your score is lower than you think, find out why. If your score changes from one year to the next, find out why. Sometimes it can be identity theft (someone using your good name). Sometimes it can be an error on the part of the credit bureau.
The other side of the problem is organizations that have peoples’ info. They must take proper care of it. As I said, we have been given credit reports, draft mortgages, cell phone contracts, purchase of goods contracts and bookkeepers files, all thrown away. These papers all have potential for fraudulent use. Businesses need to shred this stuff. Furthermore, for businesses that have customer databases, how well secured is it? Who on their staff has access to it? We have had cases where someone in the business is taking the info and using or selling it for fraud and identity theft.
Q. Alberta’s private sector privacy legislation was recently amended to include mandatory breach notification. How will this impact privacy regulation in, and outside of, Alberta?
A. It is early days yet. Hopefully it will make organizations extra careful with personal information. Will that raise the bar for organizations in other provinces? Maybe. If you are going to change your practices here, you might as well change them everywhere. Possibly more provinces will legislate. A big piece of the picture will be when the Federal government amends PIPEDA in this regard. Maybe this will increase pressure to do so. It will be a challenge to figure out what “a real risk of significant harm” is. It will be a challenge to figure out in which cases there should be notice given and what kind of notice.
Q. You’ve worked as a lawyer in different countries around the world. How does Canada’s approach to privacy compare to your experience in other places?
A. We aren’t perfect but we are way ahead of most other jurisdictions. The “commissioner” system of enforcement has served us well because we do not have the kind of well funded civil society organizations which can advocate for privacy. Commissioners can and do advocate. I mean, I would love to have an ACLU, or and EPIC or an EFF in Canada. Our civil liberties people, like FIPA in BC do great work with the resources they have but resources are scarce. We need some rich people to endow some of these groups. The other thing is that I think, relative to other societies, Canadians have a disposition towards privacy. We get it to some extent. I like to think it is because we are, yes, polite, and respectful of other people. That makes us respect each other’s space. We must not lose that as the world becomes one big facebook/google culture. Teach your children well.
Q. Looking forward, what kind of privacy developments should we watch for in 2010?
A. Cyber attacks, hacks and other losses will continue. Governments will continue to bring surveillance technologies to bear every time anything bad happens. I will continue to get judicially reviewed. I would like to think people will start resisting surveillance and other intrusions into their lives but I don’t see it happening. Governments like surveillance. Heck, the public likes surveillance because we are just so bad at risk assessment. We are scared of everything it seems and we want someone to keep an eye on everything for us. It will be interesting to see if technology begins to fail us. For example, what if there is another airplane bombing attempt and the technology doesn’t prevent it? They bring in new technology. And that doesn’t prevent the next one (God forbid). Maybe they run out of technology, although, for the money involved I don’t see that happening. Someone will come up with a new toy. Will someone ever say “this technology isn’t doing what we want it to and it is costing us a bundle?” I think that will be a social shock.
You may know someone who has been a victim of identity theft. What you may not know is that, before today, police couldn’t charge fraudsters with “identity theft”. That changed when Bill S-4 was given Royal Assent by Parliament earlier today.
Thanks to the bill, titled An Act to amend the Criminal Code (identity theft and related misconduct), there are now three new Criminal Code offences related to identity theft:
- Obtaining and possessing identity information with the intent to use the information deceptively, dishonestly or fraudulently in the commission of a crime;
- Trafficking in identity information, an offence that targets those who transfer or sell information to another person with knowledge of, or recklessness as to, the possible criminal use of the information; and
- Unlawfully possessing or trafficking in government-issued identity documents that contain information of another person.
Before Bill S-4 came into effect, police had to use other Criminal Code provisions to target identity theft. Today’s development should help law enforcement officials attack a growing problem: the Canadian Council of Better Business Bureaus has estimated that identity theft may cost Canadians more than $2 billion annually.
Phishing involves identity thieves attempting to obtain personal information, such as user names, passwords and financial information, by pretending to be trustworthy organizations in need of such data.
Coincidentally, the Privacy Commissioner of Canada released her annual report today, which stresses the importance of making informed choices when sharing personal information online. The Privacy Commissioner reminds Canadians that there is a risk that unguarded personal information could be exploited by identity thieves. The Hotmail phishing attack, as well as the Privacy Commissioner’s annual report, should also remind businesses to remain vigilant in protecting their brands – or online reputations – from being damaged by identity thieves that use phishing attacks to exploit the well-earned trust that such businesses have built with their customers.