Fazila Nurani Click here to see full sized version.

Identity theft is currently not a crime in Canada, which has sparked numerous calls for government action.  Offences involving identity theft are prosecuted under several other Criminal Code sections, such as fraud, personation, theft and unauthorized use of a computer, but there is nothing that outlaws someone from possessing another person’s information.  Only when that information is used for fraudulent purposes has a crime been committed.

One of the ways in which individuals can obtain personal information about others is through “pretexting.” Pretexting is a form of social engineering in which an individual, armed with some information about a person, is able to obtain additional information about the person from an organization. This is typically accomplished by pretending to be the person whose information is being sought, by pretending to be a relative or agent of the person, or by pretending to be an employee or someone authorized to obtain the information. Pretexting is sometimes used to obtain the personal information, such as telephone records, of a specific individual, but it can also be used on a much larger scale.  Bill C-299, a private member’s bill sponsored by Edmonton-Leduc MP James Rajotte, is intended to address the practice of pretexting. The bill was passed by the House of Commons on May 8, and is now before the Senate.

As it stands right now, the two-line bill makes it an offence to obtain personal information by false pretence with the intent to use that information to commit the further offences of fraud or personation. In addition, the bill makes it illegal to sell or disclose information obtained by false pretenses when knowing that the information will be used to commit the offence of either fraud or personation.

As originally drafted, the bill proposed to criminalize the very practice of pretexting.  The bill was subsequently amended by adding a criminal intention to impersonate or defraud the person whose information is stolen. Thus, lying in order to obtain personal information about someone from a third party is not a criminal offence when the end purpose of the deception is not identity theft.  This amendment is critical for private investigators who employ deception to obtain information about individuals from third parties, but who are not motivated by fraudulent intent.

The impetus for the private member’s bill was a feature article in MacLean’s on how easy it is to purchase personal information over the Internet. In November of 2005, a MacLean’s journalist enlisted the services of an illicit U.S. data broker in order to purchase information about Canada’s privacy commissioner, Jennifer Stoddart.  In a matter of a few hours and at a fee of less than $200, the journalist was provided with detailed cell phone records and information on members of Stoddart’s  family. According to MacLean’s, the information was obtained through pretexting, and the only information that was required to obtain the phone records was the commissioner’s name and postal address.

Bill C-299 criminalizes deception as a tool for committing identity theft. While this is an important step in the fight against identity theft, it does not provide a comprehensive solution. There are other tactics that do not rely on deception that identity thieves use to obtain valuable personal information.  For example, a store clerk can “skim” a customer’s bank or credit card by running it through a hidden, illegal machine, enabling the data to be downloaded onto a fraudulent card.  “Dumpster divers” can rummage through trash looking for personal information or discarded credit card offers.  Then, there is computer hacking, and the data breach experienced by TJX, parent company of Canadian HomeSense and Winners immediately comes to mind.  That breach exposed the credit and debit card numbers of 45.7 million customers. The company faces 20 class action lawsuits originating in various countries including Canada, as well as U.S. state and federal investigations into the breach.

In early June, Justice Minister Rob Nicholson announced that the federal government is preparing a broader piece of legislation to update the Criminal Code that will aim to deal with identity theft in its various forms, including those that do not employ deception.  This move to criminalize theft of another person’s personal information comes amid widespread calls for a crackdown, most recently from the House of Commons finance committee, and Canada’s privacy commissioner.

In 2006, almost 7,800 victims reported  losses of $16 million to PhoneBusters, but the numbers fall significantly short of the suspected cases of identity theft in Canada.  In tackling identity theft using the Criminal Code, the first thing that the government must do is define identity theft, because it can range from credit card fraud to full-scale assumption of another person’s identity, depending on who you ask.  What is clear is that Criminal Code amendments to deal with this modern day offence, in some shape or form, are long overdue.

Fazila Nurani is a lawyer and the president and founder of PrivaTech Consulting.   PrivaTech specializes in advising organizations on compliance with Canadian privacy laws and working with the public and private sectors to proactively manage privacy risks.