Canada is getting serious on identity theft! Will sharpening the teeth of the criminal law be enough?

To clarify the news headlines, Justice Minister Rob Nicholson’s has announced that proposed legislation intends to criminalize preparatory offences, such as gathering and/or trafficking confidential personal information for the purposes of deceit or fraud. While preparatory offences will presumably be explicit crimes, the crime of identity theft does not yet exist in Canada. As it stands, offences involving identity theft are prosecuted under several other Criminal Code sections such as fraud, impersonation, theft, and unauthorized use of a computer.

In view of the complexity of identity theft, criminal law measures are only one instrument in any comprehensive strategy to combat these types of crimes. Specific attention to privacy and intellectual property law considerations are paramount to a well-rounded solution.

Nowadays, “identity thieves” rely on the business world’s dependence on the use of electronic technologies to process and store confidential personal information of individuals. Through techniques such as pre-texting, spoofing, and phishing, criminals depend on potential deficiencies in the protective measures of organization, or lack thereof, in housing the confidential personal information of their clients. Recent cases involving CIBC, Winners, and Homesense have many in the privacy rights community looking for changes.

When it comes to protecting personal information from misuse by commercial organizations, privacy law occupies the field. In Canada, the Personal Information Protection and Electronics Documents Act (“PIPEDA”) obligates companies engaged in commercial activities to adopt safeguards appropriate to the sensitivity of the information they hold. Many experts point to the shortfalls of the PIPEDA legislation in protecting individuals vulnerable to identity theft. Currently, PIPEDA does not extend a requirement upon commercial organizations to notify clients if their information is lost or stolen. Presumably, with this sort of requirement in hand, individuals would have a better sense of how and where their information is being used and stored. On this basis, an individual would be more prepared to respond to threats of identity theft. With that in mind, will such a requirement alone be enough to thwart identity thieves? What about a client’s rights to their personal information?

In the backdrop to criminal and privacy laws on identity theft and confidential personal information, is the often-ignored issue of the intellectual property law. The current strategy in combating identity theft gives no legal consideration to intellectual property. The omission may have stemmed from the Supreme Court decision in Stewart. In R v. Stewart, Justice Lamer held that confidential personal information is not property. His reasoning originated from an understanding that confidential information could not be taken and thereby would not deprive anyone – an essential element of theft. While theft is an explicit crime under the Criminal Code, identity theft is not. Interestingly, the criminal law legislation envisaged by Justice Minister Rob Nicholson may have the unintended effect of attributing property rights to personal information. If Mr. Nicholson plans to amend the theft provisions to include misappropriated personal information, the legal notion of “property” could be altered in a manner that would include personal information – in contract to the findings in Stewart.

If personal information is not property than what about copyright law? Under the principles of copyright law, a work is copyrightable if it is an original expression, fixed in a tangible form, and made with at least a minimum intellectual effort. Accordingly, an author would have a copyright in the combination of letters that form their name, their address, or a combination of their name and address. Copyrights are automatic rights. While a bank or other type of organization which houses personal information may also have a copyright in documents that contain client’ personal information, they are using such information through the consent of the client. It would follow then that an unauthorized use of their personal information, or copyright, would be subject to legal claims for copyright infringement. This could function to find liability on organizations that do not adequately protect personal information that are subsequently used without consent by identity thieves.

In short, the Justice Minister has taken the appropriate step forward in sharpening the teeth of the criminal law. However, with stricter privacy laws and property rights in personal information, there may be greater incentive for commercial organizations to safeguard confidential personal information of clients from misuse, or else face harsher penalties and liabilities.

Criminalizing identity theft is a great start.