Bill C-299 (Historical)

An Act to amend the Criminal Code (identification information obtained by fraud or false pretence)

Criminal Code

[James Rajotte, Conservative, Edmonton—Leduc, AB]

moved that Bill C-299, An Act to amend the Criminal Code, the Canada Evidence Act and the Competition Act (personal information obtained by fraud), be read the second time and referred to a committee.

Mr. Speaker, it is my pleasure today to rise to speak to my own private member's bill, my first that has been debated in the House, Bill C-299, an act to amend the Criminal Code, the Canada Evidence Act and the Competition Act, personal information obtained by fraud.

The purpose of the bill is to protect individuals against the collection of their personal information through fraud and impersonation. This practice is often known as “pretexting” and is a widespread problem in the growing market for personal information.

The bill aims to close some of the loopholes in Canada's data protection law that allow data brokers to exploit people's personal information for commercial gain. As a legislator, I believe this is an area where the House, Parliament, can truly make a difference and needs to step up to the challenge.

The bill seeks to do three things in particular. First, it seeks to make the practice of pretexting illegal through changes to the Criminal Code and the Competition Act. Second, it seeks to provide a remedy for victims of this kind of invasion of privacy through legal recourse in the courts and compensation. Third, it seeks to tackle the cross-border aspect of pretexting, by holding the Canadian affiliates of foreign companies liable for invasions of privacy committed against Canadians.

By introducing the bill, I hope, above all, to open the debate on how our laws can keep pace with changing technology to meet the needs of Canadians. In doing so and in asking members to support the bill, I would like to discuss three things: first, the need for the bill in the new information economy; second, the loopholes that currently exist in Canada's data protection framework; and third, what the bill means for Canadians.

First is the need for the bill. It is our job as legislators to ensure that the law can keep up with the evolution of technology. The communication revolution of the last decade and the growing information economy have accelerated the exchange of information around the world. All kinds of data circulate around the globe and across borders at the click of a button in ways never before imagined. Furthermore, more data is being created, stored and traded than ever before. As with any new evolution, new possibilities breed new relationships and new patterns of transgression.

To evoke a cliché, knowledge is power and this has never been truer than it is now. Information is one of the most valuable commodities in the new economy, typified by the growing data brokerage industry. Data brokers buy and sell information, sometimes personal, usually for commercial or marketing purposes.

Some of this industry is legal and consensual, however, there is mounting evidence to suggest that many aspects of the data brokerage industry are poorly regulated and that pretexting is a recurring problem.

In a free and democratic society, individuals should be able to control how information about them is used and accessed. Personal information should not be treated as a saleable commodity like any other. We see that in a networked economy, where innocuous details about people's personal lives and transactions can be transformed into a complete profile of the person with a variety of serious implications.

Simple details like a birthday, postal code or graduation date can be used to obtain credit card records and can track an individual's location, activities and purchases without their knowledge. The possibility to track people without their knowledge, aided by data brokering and pretexting, ultimately undermines the inherent autonomy and independence of the individual and leaves him or her vulnerable to numerous abuses.

An individual's data profile can be used for a wide range of purposes, from unsolicited marketing to fraud, identity theft or intimidation of the individual and his or her family. Apart from the economic and security risks attached to invasions of privacy, there is a significant psychological dimension. Do we really want to live in a society where we know that our actions can be traced without our knowledge for commercial or other purposes?

We have to think about how this will change the way individuals think about themselves and society. As Canada is a society that has adopted many of the values of the Enlightenment, I think it is appropriate to quote one of my favourite philosophers, John Stuart Mill, from his treatise On Liberty. He states:

The only part of the conduct of any one, for which he is amenable to society, is that which concerns others. In the part which merely concerns himself, his independence is, of right, absolute. Over himself, over his own body and mind, the individual is sovereign.

These are important issues and questions to look at in our changing technological environment.

The second issue is the loopholes in Canada's data protection framework.

First, it is important to remember that as a democracy, the police and judiciary require a warrant in order to access people's personal information. The bill in no way changes the powers or information available for the purposes of law enforcement.

Now let us consider the following. The very same personal information that police officers require a warrant for could very well be purchased online for a few hundred dollars in a matter of hours.

This is exactly what happened to federal Privacy Commissioner Jennifer Stoddart in an investigative report done by Macleans magazine in November 2005. In the report, journalists were able to purchase Ms. Stoddart's cell phone records and access conversations between the commissioner and members of her family. The purchase was done through one of at least 40 online services that offered to track down significant personal information using just a name and postal address. This was possible despite the fact that the Privacy Commissioner was obviously more savvy about protecting her personal information than the average Canadian.

The journalists reported that pretexting was a major factor in obtaining the Privacy Commissioner's records. Common practices include masking phone lines so that the call appears to come from the account in question and hacking into accounts using passwords, birthdays and other personal information. Frequently, however, pretexters are able to simply ask for the information from service providers by impersonating the victim with the use of other personal information.

Broadly speaking, there are two kinds of data brokers with the potential to invade people's privacy.

First, there are the larger companies which trade in data, often for commercial or marketing purposes. Much of this is aggregated and not particular to individuals; however individual information may sometimes be extracted from these databases.

Second, a range of smaller companies offer to target individuals for a fee, as in Ms. Stoddart's case. These companies may simply sell personal information or they may offer more invasive services such as private investigation.

At the federal level, data protection falls under the Personal Information Protection and Electronic Documents act, known as PIPEDA. Commissioner Stoddart has already submitted a report to the privacy and ethics committee detailing possible improvements to the act in May of this year.

Notwithstanding possible changes to PIPEDA, there are three major loopholes in Canada's data protection framework.

First, though fraud and personation are crimes under the Criminal Code, they do not apply to personal information such as phone records, consumer preferences or purchases.

Second, while these actions violate PIPEDA insofar as it says that information cannot be disclosed without the expressed consent of the consumer or court order, this does not guarantee a remedy. The commissioner's rulings are not legally binding without a federal court order and the transgressors are not named.

Bill C-299 would change that by making it a crime under the Criminal Code to collect or counsel to collect personal information through fraud, personation or deception. Bill C-299 would also change the Competition Act to make it an illegal trade practice to obtain personal information through fraud, deception or personation. It would also characterize the promotion of a product that is provided by means of fraud, false pretense or fraudulent personation as a false or misleading representation to the public.

Third, the Privacy Commissioner has no jurisdiction to pursue complaints outside of Canada. However, as in Ms. Stoddart's case, Canadians can easily be targeted by data brokers in other countries, particularly the United States. In Ms. Stoddart's case, the Canadian phone service providers had to seek an injunction against the offending data brokers in a Florida court. Going abroad to get injunctions is both expensive and yields unpredictable results in different jurisdictions.

Bill C-299 would allow victims of privacy invasion to seek compensation from Canadian affiliates of foreign companies that invade their privacy. This is not a perfect solution, but it helps to deal with the problem of extraterritoriality.

Third, what does the bill mean for Canadians? If the bill is implemented, it would help preserve the trust and individual autonomy in a society that Canadians enjoy today. The legal remedy for invasions of privacy in Bill C-299 does two things. First, it assures Canadians that their right to privacy is recognized and seeks to compensate them for damages caused. Second, it seeks to catch invasions of privacy before it leads to more serious criminal activity.

In seeking criminal sanctions for intentional invasion of privacy for commercial purposes, it weakens the invasive parts of the data brokerage industry as a whole. For example, if the practice of pretexting is criminalized it will cut down on the instruments of identity theft. Charges can be brought for the invasion of privacy before they have to be brought for more large scale financial fraud and theft of identity. Moreover, cutting down on identity theft is in and of itself an important aspect in the fight against organized crime and international terrorism.

Furthermore, the bill recognizes the economic, social and psychological harm caused by the systemic invasion of privacy. It seeks to stem the fraudulent and invasive aspects of the data brokering industry, particularly, the practice of pretext.

If a law-abiding citizen has undergone the anxiety and inconvenience of being traced or interfered with for commercial gain, the bill would provide for recourse, through the courts, for a recovery of damages. In the event that the perpetrator is a foreign company with a Canadian affiliate, that Canadian affiliate may be held accountable.

Bill C-299 seeks to respond to the new challenges of information technology and close some of the gaps in our legal system. Invasion of privacy, through pretexting and data brokering, is a growing area and we need to open a debate on how to enforce meaningful protections.

Therefore, I ask all members to consider this legislation very seriously. It is a serious issue, which is growing, and it needs to be addressed. I am putting forward the bill to obviously address the protection of personal information. We also need to address, however, the whole issue of identity theft as well.

I believe the bill is the first step to do that. I look forward to the comments of other members. I note one of the Liberal members opposite has offered some helpful comments, as has the parliamentary secretary to the justice minister.

I would ask members to discuss the bill in principle at second reading, to move it forward to committee. If amendments are needed in terms of the bill itself, I would look forward to those. I am willing to work with all members in the House to improve the bill to address this important issue.

[Brian Murphy, Liberal, Moncton—Riverview—Dieppe, NB]

Mr. Speaker, this is a very thoughtful bill. In the brief time the member had, I know he did not have time to canvass what was going on in the rest of the world, from a law reform point of view.

He will know that the U.S. Trade Commissioner often and routinely prosecutes such crimes as are codified in the United States. He will also likely know that the United Kingdom information commissioner has tabled a report before the Parliament of Westminster on this very topic.

In principle, I support the bill, but in all fairness it has certain gaps and lacks clarity in some respects. Could he elucidate for the members of the House what is going on internationally, which might aid in beefing his bill up or making it certain for more clarity?

[James Rajotte, Conservative, Edmonton—Leduc, AB]

Mr. Speaker, I thank the member opposite for sending me a note, offering some helpful suggestions.

First, we should acknowledge that this is a first step.The broader issue of protection of privacy and personal information identity theft would have to be dealt with in a much more comprehensive package. I readily acknowledge that.

I think a second issue, which the member may be hinting at and which the parliamentary secretary has raised, is the bill may have to be amended to insert “knowingly” to add mens rea so there is intent itself in the legislation. That is something I would be willing to add, if it goes to committee.

With respect to what other nations are doing, the member mentioned the United Kingdom and the United States. As he knows, two House committees in the United States are looking at three pieces of legislation: protecting consumer phone records act; law enforcement and phone privacy act; and prevention of fraudulent access to phone records act. According to my information, these bills have been approved at committee. My understanding is that both the senate and the House will be working in conference to try to bring the bills forward in a more comprehensive package.

I hope that addresses what the United States is doing in creating offences for fraudulently obtaining confidential consumer information from telephone or VoIP carriers to selling information, providing for substantial fines and a range of maximum years of imprisonment, from five to 20 years, and also creating a civil right of action, which I have in my bill. It is important to note there is a criminal as well as a civil provision in my bill.

[Réal Ménard, Bloc, Hochelaga, QC]

Mr. Speaker, I am always pleased to participate in private members' business. I hope that one day, we will witness a reform that will allow us to dedicate every Friday to debates among parliamentarians on private members' bills.

When I read our colleague's bill and when my party and I analysed it, we asked ourselves why our colleague wanted to add a new infraction to the Criminal Code—that is the crux of my question—when, quite frankly, it seems that his objectives would be reached quite effectively through section 403 of the Criminal Code?

Can he explain why we should amend the Criminal Code? Why create a new infraction from scratch? Why not use section 403? It clearly states:

Every one who fraudulently personates any person, living or dead,

(a) with intent to gain advantage for himself or another person,

(b) with intent to obtain any property or an interest in any property...

is guilty of an indictable offence and liable to imprisonment for a term not exceeding ten years or an offence punishable on summary conviction

I would like an answer, because I really do not understand why we need this bill, but I know he must have had a good reason for introducing it.

[James Rajotte, Conservative, Edmonton—Leduc, AB]

Mr. Speaker, I did cover part of the hon. member's question in my speech. I hope it does address it, but the concern is that there are three loopholes that are not covered by section 403.

First, though fraud and impersonation are crimes under the Criminal Code, they do not apply to personal information such as phone records, consumer preferences or purchases. Second, while these actions violate that section and they violate the PIPEDA insofar as it says that information cannot be disclosed without express consent, this does not guarantee a remedy in the sense that the Privacy Commissioner is very limited to what she can actually do.

Our concern is with the Privacy Commissioner in her own situation. Maclean's magazine highlighted the fact that it was an American data broker who did this through impersonation. There is no recourse for the Privacy Commissioner or anyone else to remedy that problem unless there is a situation that we are putting forward in the bill whereby we make Canadian affiliates responsible in some way.

We feel that, in the new information technology, section 403 simply does not cover that. We need to cover phone records as the United States is doing through VoIP services. That requires these three pieces of legislation, the Canada Evidence Act, the Competition Act and the Criminal Code to be amended for that purpose.

[Brian Murphy, Liberal, Moncton—Riverview—Dieppe, NB]

Mr. Speaker, first of all, this is only the second time I have spoken in this House.

I would like to thank the people of Moncton—Riverview—Dieppe for their support in the recent election.

I would like to underline that Moncton hosted the Memorial Cup. It is a hockey town and a Hockeyville, but that Memorial Cup was sponsored by MasterCard and what a fitting title for the MasterCard Memorial Cup when we are talking about identity theft and credit card misuse.

The issue of identity theft is becoming a concern for many Canadian citizens and the media reminds us of this daily. Canadians want to know that their information is safe and that misuse of their personal information will not take place. The unfortunate reality is that in Canada we are known for our mass marketing frauds. Many fraudsters operate from this country targeting Americans, the British, and to a lesser degree our own Canadian citizens. Let us not forget the Nigerian scams that Canadians and many others have been subjected to for a number of years.

One goal of these fraudsters is to gain the personal information of their victims and to use this information to further their illegal schemes. One example of the use of personal information is to obtain a credit card in the name of an innocent victim and use the card to its maximum without of course making any payments. It may take months, maybe years, for the payments to be made and the victims are probably not in a position to re-establish their credit rating.

In the United States data brokers are being sued by the trade commissioner of that country for the acts that are impugned in this proposed act. Unfortunately, many of our global partners are of the opinion that not enough is being done in this country to curtail this illegal activity and in that vein I welcome this bill.

Our American counterparts are being told by Canadian agencies, such as the RCMP, that it is better to have those committing the frauds from Canada on American victims deported to the United States so proper sanctions can take place. In the United Kingdom the information commissioner has just released his report on this very vexing problem.

Bill C-299 puts us on the right track. It targeted the existing problem, but does it go far enough? That is the question.

First and foremost is the definition given to personal information. Bill C-299, the bill in question, uses the definition found in PIPEDA. We ask ourselves whether that goes far enough. Personal information in that regard means information about an identifiable individual, but does not include the name, title or business address or telephone number of an employee or organization.

PIPEDA is designed to protect people. The hon. member plucked the definition of personal information from the act without perhaps giving it some thought, which at committee it will likely get, to ensure that the information which is stolen is in fact valuable information which does include the name, title and business address of the person in question. Otherwise, what use would the information be? The definition section may be a minor thing. With all due respect to the hon. member, that begs the question: Why limit the definition of personal information? A better definition could be drafted.

The material sought to be protected is also very much in question. By simply shadowing the definition found in another act of Parliament, it probably does not go far enough. It is necessary to broaden the definition with a non-exhaustive list. We should think wide if we are trying to protect our citizens.

In the proposed amendment to subsection 362(1), the offence in question is obtaining personal information from a third party. This subsection does not create the offence that is necessary in order to combat the theft or illegal use of personal information.

This amendment does not properly address the unlawful conduct that is at the crux of this problem. In its present state, the amendment to the Criminal Code does not deal with the victim who is directly targeted. Should the offence not be “obtains from any person”, and this would be more Catholic, if we like, and would be more inclusive. The argument will be made that a third party is a person who facilitates the obtaining of the personal information. It does not automatically follow that it comes directly from a victim.

The term “third party” is ambiguous and must be replaced by “any person”. It removes the ambiguity and it gives greater protection to Canadian citizens.

Further, the amendment to the Criminal Code limits that the personal information was obtained by false pretence or by fraud. If the mover were serious about tackling the misuse of personal information, and I have no doubt that he is, with his integrity and track record in Parliament, why would we limit the unlawful manner in which the material is obtained?

I suggest that the proper amendment should be “obtains in any manner”. It therefore does not really matter whether it is obtained falsely, which is certainly bad, or illegally, which is very bad. If it is obtained in any way and misused, that is the crime that should be protected as well. We could of course be looking at tiers or subsections to an amendment to the Criminal Code.

Finally, the information could be acquired illegally and used for an illegal purpose. This is very debatable. I really do look forward to the debate in committee on this. Law enforcement officials and in some cases journalists, ombudspeople, and committees recently created that I am on studying Bill C-2 may in fact find ways and means to use information for illegal purpose. This either must be eliminated completely or addressed in a section of this amendment.

I am not of the same mind as my hon. friend across the way that there must be an exemption, but there probably could be an exemption for illegally obtained information which is used for illegal purpose, and it should be in the section.

Clearly, the use to be made of the obtained personal information must then be attacked, but the offence is to use the material for a fraudulent purpose. Whether it is for personation, to utter forged documents, et cetera, the issue is one where the use of the material needs to be dealt with.

We talked about credit card fraud, which I think is on everybody's minds, but these uses, these personations and using personal information can be a lot less illegal and a lot less damaging, but nonetheless deserve the same protection under this law. The amendment does not deal with the person who steals personal information directly.

An example is the thief who enters a residence and sees the personal documents on a table. Many people just keep their PINs for the ABMs and Aeroplan points and so on by the phone in case they forget them. That personal information, including the social insurance number, might just be there for a thief to see. It might be a friendly worker who appropriates this information.

This information could be used to obtain a credit card and to use the credit card. The victim is not aware of any loss since a theft, as defined by the Criminal Code, never occurred. A year or so later the victim applies for credit and we know the rest of the story. He or she is refused because of a bad credit rating.

In its present form then, Bill C-299 deals with the matter in a less than complete way. On the other hand, should the thief sell the information, he or she may fall within one of the amended sections. This cannot be the intent of the amendment to the Criminal Code.

The other proposed amendments to the Canada Evidence Act and the Competition Act are made as a result of those made to the Criminal Code. I applaud the part of my colleague's bill that creates a civil wrong, or a tort, out of what we always thought of as a criminal act. I cannot say enough about how important it is for government to have hybrid motions and bills like this which encompass both the civil reality and civil loss.

The previous comments apply. The CEA and the Criminal Code must reflect that the personal information may be obtained in any manner. The use of the material is the crux of the issue, I submit.

Bill C-299 is a good idea in principle. I congratulate the hon. member.

The issue of dealing with personal information is complex and must be dealt with effectively. In its present form, this bill needs some work.

To combat the theft and the misuse of personal information, it is necessary, however, to draft a more comprehensive bill attacking the problem from all angles.

Only in this way will we be able to protect all Canadians' personal information.

[Réal Ménard, Bloc, Hochelaga, QC]

Mr. Speaker, I would first like to congratulate our colleague for introducing his bill, even though when we first read it in the Bloc Québécois, my colleagues and I and our research service were somewhat concerned about the possibility that it might be criminalizing some behaviour for no reason. I will provide more examples later. However, I know that the member for Edmonton—Leduc has been a serious member in the past, that he has served this House well, and I do not doubt that his motives are noble. Nonetheless, we have some concerns.

One of Quebec's premiers whom we hold in high esteem was called René Lévesque and was a powerful communicator. In the early 1960s, he said—and think how true this is today—that information was power. Obviously, the more information one has, the better a citizen one can be, and obviously, the better a member of Parliament.

The member for Edmonton—Leduc, who also chairs the Standing Committee on Industry, Science and Technology, is asking us to consider the extent to which the circulation of nominative information can be used for fraudulent purposes. Personal information about our identity, access to our credit, our telephone number—that is the example the member gave in his remarks—is what is called, generically, nominative information. If I understand correctly, the member is afraid that nominative information might be used for fraudulent purposes.

Certainly, in a world where networks, computers, communications and even cybernetics are burgeoning sciences, this question is a very relevant one.

The member told us that section 403 of the Criminal Code—and I will come back to this—is not completely adequate when it comes to a number of wrongful acts that he is afraid will occur. He therefore wants better protection. He is concerned about the reality of impersonation by telephone.

It is true that as potential consumers we are all very often solicited over the phone. You are familiar with my fundamentally generous nature and my propensity for communicating. I respond to every telephone survey that comes my way. Obviously, when there are political questions, I do have the ethics and honesty to say that I am a member of Parliament. Often it is young students who are earning their living by telemarketing, and I would not want to do wrong by them. Perhaps there are even some of our young pages who have done this in the past.

It is true that we are constantly at the mercy of this kind of solicitation, of being preyed on by telemarketers. The member for Edmonton—Leduc explained to us that there is unfortunately no real recourse, that the Criminal Code was powerless and that it was possible to obtain nominative, personal and confidential information over the phone.

That being said, our colleague’s objectives are extremely noble and we are prepared to look at how far we must go in amending the Criminal Code, but we have some concerns. The member can perhaps tell me whether our concern is warranted.

Let us imagine the following situation. Hon. members know what a powerful motivation love is in life—there is nothing grander and more beautiful than love—and how great we feel when we are in love. Now, let us imagine the situation where a person meets someone, a new love interest. You know how it is. But the truth of the matter is that we never know exactly how the relationship will turn out. So, this person calls the workplace of the someone in question to get his or her telephone number or information about this person he or she hopes to have a date with.

In the opinion of the hon. member for Edmonton—Leduc, who believes in love and in interpersonal relationships, is this a case for summary conviction, where a person might be liable to a sentence?

My colleagues in our caucus and our research staff were wondering how far-reaching this bill was. I am convinced, of course, that the hon. member for Edmonton—Leduc does not wish for such behaviour to be criminalized.

We are asking ourselves this question: How far should we go in our quest for privacy protection? We would have been more comfortable if the government had amended the Access to Information Act instead, as promised during the election campaign. We were also expecting Bill C-2 to be amended in a more fundamental way than it has so far.

Once again, we are starting from the premise that the member is serious, that he has served this House well, that his objective is honourable, and that he is worried about the networks, about computers. In his speech, the member talked about data brokers. When I was health critic, I remember having met people who specialized in managing information, computer data, for example, concerning what type of citizen was more likely to develop certain types of illnesses over others. As an MP, I have even met people from companies that specialize in the kind of billing used by general practitioners, since these doctors are statistically more likely to recommend certain types of medication over others.

Protecting personal data is a very worrisome topic. We must ask ourselves if this is not something that could lead to harm, a barrier that society does not want to breach.

Our fellow citizens should know that there exists at this time, in the Criminal Code, a section that provides for prosecution of anyone who personates a third party or against anyone who attempts to obtain information for more or less malicious purposes. I will take the time to read this entire section of the Criminal Code because I believe that sharing information is important. I would very much like to discuss with the member for Edmonton—Leduc the scope of his bill.

Section 403 of the Criminal Code states:

Every one who fraudulently personates any person, living or dead...is guilty of an indictable offence and liable to imprisonment for a term not exceeding ten years or an offence punishable on summary conviction.

There is intent to personate that is punishable as a criminal offence. The Criminal Code adds—and that is what we refer to as mens rea in legal language—:

(a) with intent to gain advantage for himself or another person,—

Obviously, telemarketers and others would fall under this provision of the bill.

Section 403 of the Criminal Code also states:

(b) with intent to obtain any property or an interest in any property,—

In addition to the intent to personate, there is a gain, a more pecuniary interest. There is an interest in a property or the intent to obtain it.

Section 403, which deals with both personation and obtaining a property, adds:

(c) with intent to cause disadvantage to the person whom he personates or another person.

Earlier I was talking about malicious intent; I think we find it synthesized in section 403(c):

with intent to cause disadvantage to the person whom he personates or another person.

I have only a minute left? Time flies. In that case, I will wrap up.

From the outside it seemed that the provisions of section 403 offered some protection. However, the hon. member seemed to be saying that it was not sufficient for cross-border trade or for telemarketing.

Again, in closing, we have concerns about using criminalization because we are nonetheless talking about 10 years in prison. We fear this is a bit excessive, but I would be pleased to discuss this with my colleague and ask him about his true intentions. I am not questioning his intention to serve the House well, with the serious—

[The Acting Speaker, Andrew Scheer]

Resuming debate. The hon. member for Windsor West.

[Brian Masse, NDP, Windsor West, ON]

Mr. Speaker, I have had the opportunity to work with the member for Edmonton—Leduc since 2002, on the industry committee and on private members' business, and I know his legislation is always thoughtful. However, on this particular bill, some issues need to be examined.

Overall, I see the strategy the member is pursuing here. He is trying to focus on a particular aspect of three different acts that has left a gaping wound in the public privacy of Canadians right now and the repercussions for individuals who are abusing the public trust in many respects. This is a serious crime because identity theft threatens not only adults, but also the youth in our society, especially as we see the use of text messaging and the Internet type of technologies expanded to their present capacities.

Prior to the last 10 years, this technology was less used in terms of business, commerce and personal use. It often was certain segments of society that used the Internet, email, web visualizations, as well as contact through different types of protocols. Now we have the use of voice-over protocols and a whole series of new technologies that are rolling out.

What we have witnessed is that the number of citizens who were able to use this type of information and technology has expanded significantly. Seniors are now able to use technologies such as never before because they have become a lot more proficient. The technology is much more accessible for individuals who are just becoming used to the system. People are becoming much more quickly involved in terms of using these technologies than in the past.

With this expansion, not only in the private sector but in the business sector as well, it requires changes in legislation. One of the difficulties we have with Bill C-299, an act to amend the Criminal Code, the Canada Evidence Act and the Competition Act, for personal information obtained by fraud, is what we need from the government at the end of the day, and this is not the responsibility of the member for Edmonton—Leduc because it is private members' business, but we need an omnibus review of the Criminal Code.

There is a series of updating that is required and this bill is a targeted piece of that update. I think it is worthy of support to move the bill to committee for second reading.

I must say that I am filling in for the New Democratic member for Windsor—Tecumseh who sits on the committee. I know the committee has a lot of legislation that is being tabled as private members' business, as well as government business. Hopefully the committee will get a chance to move this bill through the order so it can have a full review. Whether there is enough time to do so is a question in itself.

The issue of personal privacy is not new. The member went through a good examination of the details of the bill. I will touch on a few elements. One element concerned the data brokers. An important point to note is that the bill would bring into line the change in technologies that I noted. It was not unusual in the past to have individuals collect data information from people prior to the Internet and also the expansion of the Internet.

People do accumulate data information for purposes of marketing, although those with criminal intent do it for predatory practices. In my youth I worked for a telephone solicitation company. We made phone calls from a list of names that basically were out of the phone book. However, we eventually transferred that data to purchasing, decision making and tracking, whether there was an actual purchase of a circus ticket. If the person said no, we would track the person's reasons for saying no. Specific information was also used.

I know some of the information was sold or given to other types of companies. This was certainly a practice that was very valuable because the accumulation of that information can be very important, not just in terms of the type of customer we would get, but in terms of the contact. The list was certainly cleaned up in terms of new numbers, availability, a correct contact and was worth quite a bit for those trying to get customers.

I would like to outline a few specifics of the bill because they are important. The bill, as I noted, is an act to amend the Criminal Code to create the following criminal offences:

(a) obtaining personal information from a third party by a false pretence or by fraud;

(b) counselling a person to obtain personal information from a third party by a false pretence or by fraud; and

(c) selling or otherwise disclosing personal information obtained from a third party by a false pretence or by fraud.

It also amends the criminal offence of “personation with intent” to include fraudulent personation with intent to obtain any record containing personal information about a third party.

The bill would strengthen the Criminal Code and, as it has been identified, it would fill the hole or the void that is currently in legislation.

I know there was debate earlier about keeping the PIPEDA definition of privacy. What I interpret in terms of that, especially with private members' legislation and in particular this bill, is that to amend PIPEDA's definition of privacy would be a lot more complicated. We would have to amend that act to change the definition and a private members' act would then need to be amended later on to be consistent.

We have control of this right now but until the government actually examines or brings forth PIPEDA we need some type of way to proceed if the member's bill is to go forward. I think it is something that needs to be looked at.

I want to touch on another important point that cross-sections this in terms of privacy in general terms, which I hope members will take to heart. One point that is important to note is the one dealing with the patriot act and privacy. This bill in particular does have some elements related to the penalties of actually having data invasion and fraudulent use from the United States' perspective and having some type of Canadian repercussions so that companies are held more accountable when they do that, and then we have some international obligations.

What is important to note is that we cannot have that behaviour happening. I can understand that we do want to actually clamp down on those types of practices and we have an obligation to the rest of the world to do the same here but we are not addressing the larger picture. We have not and the bill does not address the issue of the patriot act. The patriot act, passed after September 11, 2001, has several clauses dealing with privacy. They basically allow the CIA, the Department of Homeland Security, as well as other U.S. governmental agencies to access Canadian private information.

There have been a number of different subsequent responses to this. They have come from the provinces, in particular British Columbia. Quebec has been the latest and it intends to table legislation to deal with that.

Until the federal government brings forth an international treaty, we are susceptible to this privacy invasion. The privacy invasion is very important too because it also has the problem where our personal information is accumulated and taken by the American government. It is actually against the law for the company to disclose what happens to the information.

In the previous circumstance with which I was dealing, the CIBC decided to outsource its credit card data accumulation. It actually cannot tell Canadian customers, including myself, whether or not our information has been accumulated by any department of the U.S. government. Similar to that, there is no record of where the information goes.

The second point is that we do not know how that information is disposed of, treated or developed. What ends up happening is that we have a gaping hole that is not plugged.

I commend the member for bringing forth a private member's bill that does address some of the problems that we have on privacy. However, it opens up a larger issue, and perhaps the government is listening, that the Criminal Code is deficient at this point in time, not only in terms of protecting Canadian privacy from the elements of business and conduct on our side related to companies, but by individuals who use it for fraudulent purposes. The government has an obligation to protect the privacy of Canadians from American legislation.

[Rob Moore, Conservative, Parliamentary Secretary to the Minister of Justice and Attorney General of Canada]

Mr. Speaker, I am very pleased to speak to Bill C-299. I would like to say at the outset that the government applauds the member for this very timely bill as well as his hard work in putting the bill together.

This bill would do several things. It would amend the Criminal Code, the Canada Evidence Act and the Competition Act, all with a view to dealing with the obtaining of personal information by deception. More generally, this bill seeks to address the scourge of identity theft.

Identify theft is a term that is frequently used and freely bandied about. For the most part, identity theft refers to the acquisition and improper use of another person's identification information.

This is an activity that is by all accounts rising rapidly in Canadian society. The types of information and information based items which may be obtained and exploited include names, addresses, financial account numbers, credit cards and debit cards and numbers, driver's licences, health insurance cards, passports, and social insurance numbers, to name but a few of the more significant and highly targeted items.

Armed with this information, a criminally minded person may do any number of things, such as obtain direct access to a person's bank accounts or make purchases with a person's credit card. Title fraud, a particularly troublesome form of identity crime, involves fraudulently assuming the identity of a property owner and using that identity to sell or mortgage the property out from under the owner.

In each of these manifestations of identity crime, the criminal is out to obtain money, obtain some form of financial value, or gain access to a service for which he or she would otherwise have to pay. Indeed, most incidents of identity theft are motivated purely by financial gain. Many of us as members of Parliament sometimes have had to deal with the very troubling stories from constituents who have been the victims of identity theft. It is something that leaves people feeling very vulnerable and violated.

There is another side to identity theft which is no less dangerous to society. Assuming the identity of another can get a person things, but it can also be used as a shield to blanket the identity thief in a form of anonymity. There is a freedom in having people believe that someone is other than who that individual actually is, a freedom that allows the individual to operate undetected by others from whom the individual wishes to hide.

In this form, identity theft may amount to a person renting an apartment or obtaining services in someone else's name. In many cases the criminal is very diligent about paying bills on time as this avoids raising suspicions. Criminals may also use the identity of another person to obtain employment. Worse still, a person may offer up the identity of another if detained or arrested in the investigation of a crime.

Both objectives of identity crime, financial gain and anonymity, may be closely linked to several very serious issues which this government is dealing with currently, such as drug trafficking, organized crime, and most alarmingly, terrorism. The reasons for this are obvious.

Identity theft is a means of generating revenue. Those involved in these types of activities directly seek this type of revenue. It is essential for them to fund their operations. They are seeking this revenue either as an end in itself or because money furthers their primary criminal intentions.

Drug traffickers, organized criminals and terrorists are certainly interested in staying beneath the radar of law enforcement, out of the eye of border authorities and away from the view of intelligence officials. Unfortunately, one of the best ways to accomplish all of these aims is to exploit and assume the identity of some innocent and law-abiding Canadian.

In many ways identity theft is not new. Human beings have been deceiving each other to obtain advantages for millennia. Identity deception is just one of many ways one person may deceive another in order to obtain something of value. It may be, for example, that one factor contributing to the rise in identity crime is the pace of new technologies. We have seen an explosion in technologies in recent years. While we are all reaping many of the benefits of new technologies, there is also the threat of new harms.

The Internet in particular has allowed computer hackers to get inside private sector and government databases to steal sensitive personal information. Any of us who have read the news are familiar with some of those situations.

Mass e-mailings or spam sometimes contain what is known as a “phishing” attack. This is a link to a deceptive website designed to look like the legitimate website of a known commercial establishment with a request for the recipient to input personal data. Phishing is a prime method of stealing identity information for criminal use.

The impact of identity theft on the victims of this practice can be devastating. There are obviously the financial losses suffered by the victim, including dozens or hundreds of hours and significant costs associated with rectifying frauds, clearing credit card records and squaring things with banks or credit card companies.

There is also the emotional and psychological harm to the victims who frequently report a feeling of being violated or having had their personal lives invaded. The seriousness of identity theft can be seen in the fact that there is a range of activities and initiatives currently under way to better safeguard Canadians from identity theft. The private sector, provincial governments, police, consumer advocacy groups and document issuing authorities to name just a few are tackling identity theft in a variety of ways. Through public education campaigns, consumer advisories, improvements to the security features on credit cards and identity cards, enhanced protection of privacy interests within businesses and government, and improved security of computer networks, the corporate, public and the not for profit sectors are working together to help minimize this behaviour.

In terms of the current criminal law, hon. members should know that where the term identity theft is used to refer to the actual use of another person's identity to commit a crime, our Criminal Code contains some offences that cover this range of behaviour. Where a person pretends to be another person and thereby obtains property or something of value or service, that person may be guilty of fraud or false pretense. Our Criminal Code also has a very broad and flexible offence of impersonation which prohibits pretending to be another person with intent to gain an advantage or cause a disadvantage. This is broader than an economic advantage.

There is also a range of offences related to forgeries, specific credit offences, specific passport offences and mail theft.

It is clear that identity theft at its worst is addressed in some offences in our Criminal Code. However, Bill C-299 accurately highlights the fact that there are limitations to the current reach of the Criminal Code, and as always, there is room for improvement. As I mentioned, the explosion in new technologies and the fact that criminals never rest means that we also as a government can never rest in our defence of Canadians' rights and protection of their property and their freedoms.

In 2004, justice officials consulted with some key stakeholders on basic questions about improving our Criminal Code. Based on this input, officials are refining some key points for improving the criminal law's ability to deal with identity theft. New and more focused consultation is certainly needed with the banking community and other sectors covered by identity theft.

We look forward to the fruits of those consultations. We are committed to ensuring that our criminal laws contain comprehensive and effective tools to combat identity theft.

I also look forward to working with my colleague, the member for Edmonton—Leduc, on protecting Canadians' personal information. I also wish to thank the member for introducing his bill and for giving me the opportunity today to discuss this pressing issue.

[The Acting Speaker, Andrew Scheer]

The time provided for the consideration of private members' business has now expired and the motion is dropped to the bottom of the order of precedence on the order paper.

The House resumed from June 13 consideration of the motion that Bill C-299, An Act to amend the Criminal Code, the Canada Evidence Act and the Competition Act (personal information obtained by fraud), be read the second time and referred to a committee.

[The Acting Speaker, Andrew Scheer]

Order, please. Once again I would ask all hon. members to carry on any conversations they may need to have outside the chamber so that we can continue with private members' business.

Resuming debate. The hon. member for Mississauga South.

[Paul Szabo, Liberal, Mississauga South, ON]

Mr. Speaker, a recent poll conducted by PhoneBusters of Canada has revealed that approximately 9,000 people have fallen prey to identity theft in the last 10 months. Almost 77% of them were concerned about it, but only a meagre 10% of us are aware of what we have to do to protect ourselves from identity theft.

The financial damages caused by this crime amount to $7.2 million.

Another shocking personal fact is that nearly 45% of Canadian adults do not monitor their credit card bills. This is part of the problem.

I looked at some of the statistics generally available and found that persons under 18 years of age represented only about 2% of the persons who fall victim to this crime of identity theft. Those from ages 18 to 29 were at about 25%, those 30 to 39 were at about 28%, those 40 to 49 were at about 20%, those 50 to 59 were at 12%, and those over 60 years of age were at a little less than 10%.

So it appears that working people between the ages of 18 and 50 account for about 75% of identity theft. These are the people who have assets and cash that it may be able to detect.

The reason I raise this is that Bill C-299, which is before us today, seeks to address the whole issue of identity theft. It is an act to amend the Criminal Code, the Canada Evidence Act and the Competition Act.

We have had some excellent speeches from the members who spoke during the first hour, including the mover, the member for Edmonton—Leduc, as well as the member for Hochelaga, and also the member for Moncton—Riverview—Dieppe, I believe.

I think that what was concluded by the speakers was that there is a general agreement that in principle this is a matter which has to be addressed from the standpoint that it is a function of the improvement in the technological tools available. It is a function of criminals becoming more sophisticated in what they are doing. It is a function of the need of Canada to continue to ensure that it keeps pace with the changing approaches that those who would perpetrate identity theft have evolved to.

I am not going to talk too much to the specificity of the bill, other than to suggest that hon. members already have raised some concerns about details within the bill, but we are at second reading, which asks hon. members to consider approving the bill in principle, this being that we should examine and identify ways in which we can mitigate the impact and consequences of identity theft.

I doubt very much that there are too many members in this place who are going to argue with the basic premise or the fundamental principle of this bill. Therefore, I will be supporting it at second reading to go to committee and I will be recommending that to my caucus colleagues.

Having said that, I note that committee is the best place to address some of the points that have been raised by hon. members in debate with regard to potential deficiencies or areas in which the approach may be augmented. I believe in having the experts come before committee to provide more detailed analysis and consideration of perhaps the deficiencies within Criminal Code amendments, or ways in which there may be enhancements, and also to deal with section 403 of the Criminal Code. On section 403, there seems to be some disagreement between the Bloc and the Liberal member who spoke.

Notwithstanding that, I believe these matters are reparable in committee or at report stage. I much suspect that they will be.

I thought it would be useful simply to use the rest of my time to advise Canadians on how they can protect themselves from identity theft.

There are government and general websites that include a substantial amount of information about consumer protection. Let me highlight a few suggestions.

The most important thing obviously is to prevent access to our personal information. It is recommended that people not release their social security or account numbers in response to email, phone or in person requests. Instead of using Internet links, type the full address. Keep all sensitive documents, cheque books and credit cards securely locked away at home and at work. Carry only those credit cards that one needs to have on one's person or in one's wallet.

All private documents should be shredded before discarding them. Retrieve paper mail promptly from the mailbox and place outgoing cheques or other sensitive documents in the postal box directly and do not keep them on one's person for any great period of time.

Signing up for automatic payroll deposits is another preventive approach. Replace paper bills, statements and cheques with on-line paperless versions. Keep passwords hidden even in one's own home and change them frequently. Use regularly updated firewall and anti-virus protection software on computers. The public should know that computer access is one of the growing areas in which identity theft is occurring.

Do not respond to suspicious emails. Delete them, and if there is any doubt, contact the company from which they were sent. Do not discard a computer without completely destroying the data on the hard drive. Even in the case of a severely damaged computer where the hard drive does not work, very important information still can be recouped from the hardware components.

Another aspect of taking regular general prevention measures is to detect unauthorized activity. That includes reviewing bank, credit card and bill statements weekly through on-line access accounts. Contact the financial provider if statements are not received in a timely manner. Often what happens is people will take mail out of someone's mailbox.

We should review our credit information regularly. Free annual credit check reports are available through the web. Use email based alerts to monitor transfers, payments, low balances, withdrawals, or to detect other irregular activity in an account. Visit banks, credit card and other bill statement websites frequently to monitor regular account activity.

After doing the prevention and following some good habits, if something should happen, it is absolutely vital that the conflict be resolved. Some members have already indicated that in some cases resolving a loss related to identity theft and sorting out all the problems with regard to the accounts can take weeks, months and maybe even years. It may be quite expensive and very disruptive.

This invasion of personal matters is very disruptive. With regard to resolving matters which come up, obviously we want to minimize losses and protect the credit record. Having one's credit record jaundiced is a problem.

The financial provider should be asked about zero liability guarantees. Victims of theft should notify the financial providers and begin monitoring the accounts more frequently in the event that there may be subsequent attempts. Federal and local enforcement authorities should be alerted if one suspects identity fraud.

These are just some examples of things that we can do. This is all because the member thought it important enough to bring to the House a bill that in principle says we need to be more vigilant to reduce the incidence of identity theft. It is a good bill in principle. In my view, any matters on which concerns have been raised would appear to be reparable at committee and report stage.

I congratulate the hon. member for bringing this bill forward.

[Mario Laframboise, Bloc, Argenteuil—Papineau—Mirabel, QC]

Mr. Speaker, I am pleased to speak on behalf of the Bloc Québécois about Bill C-299, An Act to amend the Criminal Code, the Canada Evidence Act and the Competition Act (personal information obtained by fraud).

I will try to summarize the content of Bill C-299 for the people who are watching. I will also try to explain the Bloc's position on this bill, which is at second reading. After the vote, we will decided whether or not the bill will go to committee.

The purpose of this bill is to amend the definition of “personal information”. The Personal Information Protection Act says:

“Personal information” means information about an identifiable individual, but does not include the name, title or business address or telephone number of an employee of an organization.

The bill will create three new criminal offences: obtaining personal information from a third party by a false pretence or by fraud, counselling a person to obtain personal information from a third party by a false pretence or by fraud, and selling or otherwise disclosing personal information obtained from a third party by a false pretence or by fraud.

Consequently, the bill really adds one new offence to the Criminal Code: obtaining personal information on a third party. In our view, at first blush, the Criminal Code already includes these types of offences. Once again, the Conservatives are trying to control the work of the judiciary, the work of judges, so that they have no leeway.

I will read section 403 of the Criminal Code, because it gives a good idea of the existing offences with regard to personal information. Section 403 of the Criminal Code says this:

Every one who fraudulently personates any person, living or dead,...is guilty of an indictable offence and liable to imprisonment for a term not exceeding ten years or an offence punishable on summary conviction.

Section 403 of the Criminal Code already provides that it is an offence to impersonate someone else. We feel it is pointless to add “personal information on a third party” because it is already included in the Criminal Code.

Section 403 says this:

Every one who fraudulently personates any person, living or dead: (a) with intent to gain advantage for himself or another person, (b) with intent to obtain any property or an interest in any property, or (c) with intent to cause disadvantage to the person whom he personates or another person ... is guilty of an indictable offence and liable to imprisonment for a term not exceeding ten years.

To add “with intent to obtain any record containing personal information about a third party” serves no purpose, in our opinion. Once again, this shows the Conservative tendency to try to restrict judges and lead them in a certain direction, although this is not the authority our society has given itself in the Criminal Code. The values defended by Quebeckers, and the values defended by the Bloc Québécois on behalf of Quebeckers, are very important to us. We support a society founded on a justice system that is balanced between the harm caused and the sentence that the courts may impose on a person who commits a crime.

We must always strive for balance. This is why our judicial system is based on an independent judiciary. For some time, we have been repeating in this House that we are anxious to see the day when patronage appointments no longer exist in the judiciary, and when we have independent committees to select our judges to ensure they are the most competent individuals for the role. I am not saying that the current judiciary is incompetent. What I am saying is that judges are often appointed on a partisan political basis. The press often criticizes this state of affairs, thus informing the general population.

Lastly, we hope to pass on to today's youth the values that we learned from our parents, grandparents and great-grandparents. This is the society that Quebeckers want, an equitable society based on a fair balance between the crime committed and the sentence imposed.

That is why we put our trust in the judiciary. Every time members introduce bills such as Bill C-299, the Conservative Party seeks to provide a framework for the work of the judiciary, that is, they try to package the work of the justices so that, in the end, all they have to do is read the text and apply the sentence. Quebeckers do not want this kind of society or these values. That is why the Bloc Québécois always challenges these bills.

In our opinion, the changes that Bill C-299 seeks to bring about are already found in the Criminal Code under section 403 and other sections that the bill would amend. Why try to add just a little bit more? This question comes up all the time. Our citizens are entitled to question the values of the Conservatives, these values that are often borrowed from the Republicans in the United States. That is why, although they only came into power nine months ago, the Conservatives already seem to be an old government. They clearly have a tendency, particularly as a minority government, of trying to pass on their values as quickly as possible.

When justice issues and amendments to the Criminal Code are at the fore, as in Bill C-299, we have an unfortunate tendency to try to control the judiciary's work and restrict judges' decision-making freedom. Obviously, this could be counter-productive and not in the best interest of the citizens we represent. We, the Bloc Québécois, are trying to maintain a balance here.

This is why, since 1993, a majority of Quebeckers have given Bloc Québécois members their vote of confidence: because the men and women of the Bloc Québécois know how to listen to what their constituents want. They did not make anything up. We trust the society our parents and grandparents left us. This is the very society we are fighting for today—a society seeking greater justice and equality. We hope it will be less controlling. It is this desire for control that leads to legislation like Bill C-299.

Since being elected, the Conservative government has been attempting to direct the decisions taken by the judiciary and judges. The fact is that no two crimes are committed under the same circumstances. That is why we as a society chose to have a judiciary system. Juries are sometimes brought into play. This is all pretty complex. An entire system is called upon in an effort to determine the appropriate sentence for the crime committed.

Of course, this unfortunate tendency to make penalties harsher or to take responsibilities away from the judges is reminiscent of the right-wing Republican tendency in that regard, and it is increasingly obvious from the actions of this Conservative government. Those are not values that Quebeckers defend or values that they want members of the Bloc Québécois to defend.

One might understand that, under the circumstances, we are not to eager to see Bill C-299 passed, especially since it concerns personal information about a third party. This could be interpreted quite broadly. We must bear in mind that there are certain realities in our society. I often think of our businesspeople trying to establish a client list who sometimes ask for information. We would not want matters of everyday life in our society to be misinterpreted. If the purpose of this bill is to prohibit the obtaining of any personal information, efforts should be made to strike a balance between the reality and business opportunities today.

Essentially, we have laws and amendment to the Criminal Code. There is no point adding in the Criminal Code that obtaining personal information about a third party constitutes a criminal offence. As I said, section 403 is already very clear:

403. Every one who fraudulently personates any person, living or dead,

(a) with intent to gain advantage for himself or another person,

( b) with intent to obtain any property or an interest in any property, or

(c) with intent to cause disadvantage to the person whom he impersonates or another person,

is guilty of an indictable offence and liable to imprisonment for a term not exceeding ten years or an offence punishable on summary conviction.

We believe obtaining personal information on a third party by fraud is already an offence that carries a maximum jail sentence of ten years, under section 403. Therefore, we see no reason to change that. However, the bill will probably be sent to committee and we will be open to debate the matter, and perhaps even to make amendments, in order to protect good citizens from bad ones.

Quebeckers were right again to put their trust in the men and women of the Bloc Québécois, because they will yet again protect their interests and make sure that the penalties imposed by the Conservative government strike a fair balance, given the offence committed.