Canada is getting serious on identity theft! Will sharpening the teeth of the criminal law be enough?
To clarify the news headlines, Justice Minister Rob Nicholson’s has announced that proposed legislation intends to criminalize preparatory offences, such as gathering and/or trafficking confidential personal information for the purposes of deceit or fraud. While preparatory offences will presumably be explicit crimes, the crime of identity theft does not yet exist in Canada. As it stands, offences involving identity theft are prosecuted under several other Criminal Code sections such as fraud, impersonation, theft, and unauthorized use of a computer.
In view of the complexity of identity theft, criminal law measures are only one instrument in any comprehensive strategy to combat these types of crimes. Specific attention to privacy and intellectual property law considerations are paramount to a well-rounded solution.
Nowadays, “identity thieves” rely on the business world’s dependence on the use of electronic technologies to process and store confidential personal information of individuals. Through techniques such as pre-texting, spoofing, and phishing, criminals depend on potential deficiencies in the protective measures of organization, or lack thereof, in housing the confidential personal information of their clients. Recent cases involving CIBC, Winners, and Homesense have many in the privacy rights community looking for changes.
When it comes to protecting personal information from misuse by commercial organizations, privacy law occupies the field. In Canada, the Personal Information Protection and Electronics Documents Act (“PIPEDA”) obligates companies engaged in commercial activities to adopt safeguards appropriate to the sensitivity of the information they hold. Many experts point to the shortfalls of the PIPEDA legislation in protecting individuals vulnerable to identity theft. Currently, PIPEDA does not extend a requirement upon commercial organizations to notify clients if their information is lost or stolen. Presumably, with this sort of requirement in hand, individuals would have a better sense of how and where their information is being used and stored. On this basis, an individual would be more prepared to respond to threats of identity theft. With that in mind, will such a requirement alone be enough to thwart identity thieves? What about a client’s rights to their personal information?
In the backdrop to criminal and privacy laws on identity theft and confidential personal information, is the often-ignored issue of the intellectual property law. The current strategy in combating identity theft gives no legal consideration to intellectual property. The omission may have stemmed from the Supreme Court decision in Stewart. In R v. Stewart, Justice Lamer held that confidential personal information is not property. His reasoning originated from an understanding that confidential information could not be taken and thereby would not deprive anyone – an essential element of theft. While theft is an explicit crime under the Criminal Code, identity theft is not. Interestingly, the criminal law legislation envisaged by Justice Minister Rob Nicholson may have the unintended effect of attributing property rights to personal information. If Mr. Nicholson plans to amend the theft provisions to include misappropriated personal information, the legal notion of “property” could be altered in a manner that would include personal information – in contract to the findings in Stewart.
If personal information is not property than what about copyright law? Under the principles of copyright law, a work is copyrightable if it is an original expression, fixed in a tangible form, and made with at least a minimum intellectual effort. Accordingly, an author would have a copyright in the combination of letters that form their name, their address, or a combination of their name and address. Copyrights are automatic rights. While a bank or other type of organization which houses personal information may also have a copyright in documents that contain client’ personal information, they are using such information through the consent of the client. It would follow then that an unauthorized use of their personal information, or copyright, would be subject to legal claims for copyright infringement. This could function to find liability on organizations that do not adequately protect personal information that are subsequently used without consent by identity thieves.
In short, the Justice Minister has taken the appropriate step forward in sharpening the teeth of the criminal law. However, with stricter privacy laws and property rights in personal information, there may be greater incentive for commercial organizations to safeguard confidential personal information of clients from misuse, or else face harsher penalties and liabilities.
Criminalizing identity theft is a great start.
One Response
There is certainly strength in the proposition that personal information can constitute copyrighted material, and such an idea could be incorporated into the suggested ‘well-rounded solution’ to combat identity theft. Although criminal ramifications for the collection of data for future purposes of deceit or fraud constitute a strong deterrent for abusers, a heightened awareness of the rights that the laws of privacy and copyright can afford to those at risk would help erect a further barrier.
Personal information is unpublished, or if done so is on a strict licence. Intellectual property rights can be used to suppress information and enhance privacy because you are not allowed to ‘deal fairly’ with an unpublished work. In addition, the protection of moral rights in intellectual property law, where an author is protected from prejudice to his honour and integrity, may offer an unofficial nod to the increased protection of identity theft beyond the criminal sphere. After all, identity theft can severely damage one’s reputation and credit-worthiness, and can lead to long-term emotional consequences for those involved, harm akin to that protected by moral rights.
Criminalizing identity theft is indeed an essential first step in the right direction. It is necessary however, to ensure the aforementioned ‘well rounded’ solution to the problem, that owners are also educated on their specific ownership rights over their personal information. The problem can then be attacked at the source, notably the willingness with which people freely distribute their personal information in this new technological era.
Comments are closed.