Bill S-4 tightens noose around identity thieves

A bill came into force last Friday that makes early stages of identity-related crime an offense in the Criminal Code, thereby granting Canadians greater protection against identity theft.

 

Bill S-4 creates three new core offenses in the Code: obtaining and possessing identity information with the intent to use it in a crime; trafficking of identity information knowing it will be used in a crime; and unlawfully possessing or trafficking government-issued identity documents.

 

David Young, partner and co-chair of the privacy group with Toronto-based law firm Lang Michener LLP, said the changes make it quite explicit that certain activities that can be part of an identity theft or fraud activity are considered criminal. “These provisions will permit the government to obtain convictions, initiate investigations leading to convictions,” said Young. “If ultimately criminals know they are more easily going to be caught … they will be more wary in committing these offenses and in committing these activities.”

 

While crown prosecutors did have the tools at their disposal to fight identity theft prior to this change in legislation, Young said this will definitely raise awareness of identity theft and act as a deterrent to criminals. “Publicizing it both to the criminals and to the world at large may be the most salutary effect of this new law,” said Young.

 

Bill S-4, an act to amend the Criminal Code, was introduced in the Senate on Mar. 31, 2009.

 

David Fewer, lawyer and acting director of Ottawa-based Canadian Internet Policy and Public Interest Clinic (CIPPIC), said Bill S-4 leaves no ambiguity as to whether precursor steps in identity theft are lawful or not. This proactive approach now lets police and justice officials identify early activities as criminal, said Fewer.

 

“Once the fraud has occurred when the law would have applied it’s almost too late,” said Fewer. “From a remediation perspective, the harm has already occurred.”

 

But although Fewer thinks this legislation is a good first step, victim remediation is one of many other things still requiring attention. Government must understand the consequences of identity theft because it’s the sort of harm that doesn’t strike just once, he said. “You keep getting victimized over and over again. It’s so hard to clear your credit, it’s so hard to clear your name, it’s so hard to get your documents re-established,” said Fewer.

 

Bill S-4 also requires offenders to pay damages to victims, such as the cost of applying for a new passport. Fewer said he only hopes victim compensation is “progressive and forward-looking” to recognize other forms of financial loss associated with identity theft, like the time it costs to clear one’s name.

 

Having offenders compensate victims for the financial loss associated with re-establishing one’s name may be hard to quantify, argued Young. Including a specific dollar amount in the legislation is a little rigid and difficult to apply to every situation, he said. “If it’s enabled through a remediation provision, how do you give direction to a court to figure out what that is?” said Young.

 

He also points out that because Bill S-4 is criminal legislation, the most extreme type of remedy sought in court, there are civil remedies available for victims to pursue.

 

While the punishment aspect of legislation is nice to have, Young said crime prevention is really what the legislation is about.

 

But monetary compensation for damages aside, Fewer said Canada is grossly lacking in remediation services for identity theft victims. “It’s horrible, there’s virtually nothing. You’re on your own,” he said.

 

Brian O’Higgins, Toronto-based independent security consultant, agrees with the proactive approach that the legislation takes to combat identity theft, but expressed surprise at there being nothing on breach notification.

 

Such a law would require businesses that have suffered a data breach of customer data, for instance, to report it. Breach notification legislation exists in the U.S., where it appears to have had substantial impact, said O’Higgins.

 

One possible reason for the omission, said O’Higgins, is that the legislation wouldn’t find a strong fan base among businesses. “Almost any little thing could trigger a requirement for notification and that is a very expensive endeavour,” said O’Higgins.