Working Together to Prevent Identity Theft
Consultation Workbook

Comments from CIPPIC to the Consumer Measures Committee 
September 2005

Your Contact Information

First Name:	Philippa 
Last Name:	Lawson	
Organization & Address: 
Canadian Internet Policy and Public Interest Clinic (CIPPIC), 
University of Ottawa, Faculty of Law, 
57 Louis Pasteur, Ottawa ON K1N 6N5
tel: 613-562-5800 x.2556
fax: 613-562-5417
email: cippic@uottawa.ca

Option I – Truncate (partially blank out) payment card numbers 

Persons that accept payment cards (including credit cards and debit cards) for the transaction of business must not print the expiry date or more than the last five digits of the card number on any receipt generated electronically at the point of sale or transaction.

1. Do you think this option would better protect against identity theft?

Yes.  While this measure will not stop ID theft (especially since it is limited to electronic receipts), it can help to stymie thieves in their efforts to collect and fraudulently use the credit cards of others.   Truncating card numbers on receipts appears to be the prevailing market practice in any case, clearly workable from the perspective of businesses and the credit card industry.

2. What would be the costs / savings of such an initiative? Who should pay for the costs, if any? 

3. Should there be exemptions?  If yes, what type?

We see no reason for exemptions, given that the rule is limited in scope to electronic receipts.  (i.e., non-electronic methods of processing credit cards would not be captured.)

4. Should there be a penalty associated with this provision (as proposed in Option 9)?

If there is no incentive for companies to respect a rule, they will not do so.  Some penalty for non-compliance may be needed in order to ensure compliance. 

5. For this option, who should ultimately be responsible for losses incurred from identity theft?  

Credit card companies should continue to be responsible for losses incurred by consumers as a result of fraudulent use of their credit cards, where the consumer reports the fraud or potential for fraud as soon as it comes to his/her attention.  Credit card users are at the mercy of an industry that has chosen convenience and widespread use over security; the industry should bear the cost of that choice.

6. Are there disadvantages for consumers or industry?  Please describe.

No disadvantages from the consumer perspective.  
If limited to electronic receipts, few disadvantages for industry – i.e., few businesses that would have to purchase new equipment.

7. What are the existing or planned industry standards for truncation of payment cards, and if any, what are timelines for implementation? Do the standards exclude handwritten and/or imprinted cards?

Option II – Verify the identity of persons and organizations accessing credit reports

Credit bureaus must take reasonable steps to authenticate the people and organizations that are accessing credit reports.

1. Do you think this option would better protect against identity theft?

Yes.  Once again, consumers are at the mercy of industry – in this case, credit bureaus, who collect and share detailed sensitive personal information about them with a host of other organizations.  The evidence suggests that identity theft has been aided by too-easy access by thieves to the credit reports of their victims, either through routine business access to the reports or impersonation. 

2. What would be the costs / savings of such an initiative? Who should pay for the costs, if any? 

The credit bureau industry should pay for the costs of proper security of its operations.  

3. Should there be exemptions?  If yes, what type?

No.  There is no reason for exemptions in this case.

4. Should there be a penalty associated with this provision (as proposed in Option 9)?

Yes.  Credit bureaus, like any other business, need incentives to comply with the law.  If the cost of non-compliance is effectively zero, there is no incentive to comply.

5. For this option, who should ultimately be responsible for losses incurred from identity theft?  

Credit bureaus should be responsible for losses incurred as a result of identity theft and fraud that was facilitated by ineffective security measures on their part.

6. Are there disadvantages for consumers or industry?  Please describe.

7. Should this obligation to authenticate be required of third party resellers of credit reports? If not, why not? 

All those who sell credit reports should be subject to the same requirement for authentication of those accessing the reports.

8. Do credit bureaus provide different levels of information in credit reports depending on the need of the organization and/or individual requesting the credit report?  If so, what standards are applied? 

9. What would be the costs associated with authenticating credit lenders and consumers?  

Option III – Do not disclose social insurance numbers (SINs) on credit reports or use them as a unique identifier for consumers

Where it is appropriate for financial institutions to collect SINs, they should keep the numbers confidential.  In particular, consumer reporting agencies and financial institutions should not use a SIN as a unique identifier for consumers, or disclose the consumer’s SIN on a credit report.

1. Do you think this option would better protect against identity theft. Why or why not?

Yes. The SIN, as a unique identifier, has become a key element of personal information that facilitates identity theft when in the wrong hands.  Its widespread use outside specific tax-related purposes should be curtailed.  Without a person’s SIN, identity thieves are less able to impersonate and engage in fraud.

SINs should never be disclosed on credit reports.  We understand this to be the practice already of at least on major credit bureau.  It should be the law.

2. What would be the costs / savings of such an initiative? Who should pay for the costs, if any? 

Credit bureaus, financial agencies and others who currently use SINs to identify individuals will presumably incur some costs in order to remove this identifier and rely on other information (e.g., address, telephone number) to distinguish between people with the same name.

3. Should there be exemptions?  If yes, what type?

No.

4. Should there be a penalty associated with this provision (as proposed in Option 9)?

Yes – as with other requirements, penalties are necessary in order to give the business an incentive to comply.  The threat of bad publicity or consumer opprobrium is unlikely to be sufficient to generate compliance. 

5. For this option, who should ultimately be responsible for losses incurred from identity theft? 

If a business has failed to comply with the law, and if a case of identity theft appears to have been facilitated by the business’s failure, then the business should be responsible for losses incurred from the identity theft/fraud.

6. Are there disadvantages for consumers or industry?  Please describe.

Industries that currently use SINs as consumer identifiers will have to revise their databases so as to remove this field, and find other ways of distinguishing between people with the same name (e.g., address, tel.no.).

7. For financial institutions, is there an industry standard with respect to requesting the SIN? If so, when is it requested and when is it not requested.  What are the grey areas?

8. For retailers, real estate agencies, telecomm companies, are there any industry standards in terms of when SINs are requested?

9. What would be the costs associated with developing a unique identifier?  How long would it take to implement this?

10. Would truncating the SIN be a preferred solution? If so, how could that be implemented?

Option IV – Allow consumers to place freezes on their credit reports

Upon a consumer’s request, credit bureaus must place a freeze on the consumer’s credit report free of charge.  If a freeze is in place, the credit bureau would not be permitted to release the credit report to a third party without prior express authorization from the consumer.  Authorization may be obtained by contacting the consumer at a predetermined telephone number or street address.

1. Do you think this option would better protect against identity theft. Why or why not?

	Yes.  This measure would clearly reduce the incidence of inappropriate or unauthorized access to consumer credit reports, and would give vulnerable consumers an effective tool to protect themselves against identity theft and fraud.  We understand that other jurisdictions have seen fit to legislate a similar requirement, for good reason.  

2. What would be the costs / savings of such an initiative? Who should pay for the costs, if any? 

	Consumers should not have to pay for a credit report freeze.  Individual vulnerability to identity theft is a function largely of lax business practices with respect to personal information of consumers.  Businesses should bear the costs of the consequences of their lax approach to data protection.

3. Should there be exemptions?  If yes, what type?

No.

4. Should there be a penalty associated with this provision?

Yes.

5. For this option, who should ultimately be responsible for losses incurred from identity theft?  

6. Are there disadvantages for consumers or industry?  Please describe.

7. Should this be offered as a preventive and/or post theft instrument?

Both.  Any consumer who wants to protect him or herself from ID fraud should be able to insist upon express authorization prior to disclosure of their credit report to a third party.  If available only to consumers who can prove that they have been the victim of a ID fraud, the effectiveness of the measure in reducing the incidence of ID theft will be limited.

8. Are there implications for monitoring of credit worthiness and other marketing activities?

	Credit bureaus will have to obtain consent before disclosing credit reports.  This will make monitoring of credit worthiness and other marketing activities more difficult.  However, the benefits to the consumer in terms of security may well outweigh the costs in terms of more difficult access to credit.  This trade-off should be left up to the individual consumer. 

9. Should there be any exceptions to the freeze on credit reports?

This option should be available to all consumers, as both a preventative and mitigation tool.  

10. Should there be a reasonable cost-recovery fee chargeable for this service?

Consumers should not have to pay in order to control the disclosure of their personal credit information to third parties.  This should be a cost of doing business for the credit bureaus.

Option V – Require organizations that store personal information to notify individuals and credit bureaus in cases of security breaches

When the security of personal information held by an organization is breached, the organization must contact the individuals whose personal information has been compromised as well as relevant credit bureaus as soon as reasonably possible

1. Do you think this option would better protect against identity theft. Why or why not?

	Yes.  There is no market incentive for companies to inform vulnerable consumers of potential identity theft as a result of security breaches that the company has suffered, so that the consumers can take action to protect themselves.  Without a legal requirement for such disclosure, consumers will continue to be unaware that their personal information has been compromised and will not take steps to protect themselves from identity theft.  

2. What would be the costs / savings of such an initiative? Who should pay for the costs, if any? 

	The savings in terms of reduced ID theft and all of the costs associated with it would be enormous, and would surely outweigh any costs to businesses.  In any case, it is only appropriate that businesses pay for their negligence in failing to protect personal information from falling into the hands of thieves.  To the extent that security breaches are commonplace and do not always result from negligence, then the costs of reporting such breaches should be treated as a cost of doing business.

3. Should there be exemptions?  If yes, what type?

No.  

4. Should there be a penalty associated with this provision?

Yes – as with other proposed measures, compliance will only occur if there is some incentive to comply, and such incentive is most appropriately designed in the form of a meaningful penalty for non-compliance.

5. For this option, who should ultimately be responsible for losses incurred from identity theft?

Businesses should be held responsible for losses incurred by consumers as a result of ID theft and fraud that can be linked to security lapses or failure to comply with the law.

6. Are there disadvantages for consumers or industry?  Please describe.

	There are no disadvantages for consumers.  

7. Are there any market place incentives, i.e. contractual obligations that require organizations to disclose when they have had a breach of security? If so, what are they and do they pertain solely to breaches of specific information, i.e. financial breaches?

8. As a consumer, would you be willing to give up some control over your personal information by allowing a company to put a fraud alert on your credit bureau file in a timely way to protect you from identity theft?

	Yes – assuming that I was notified of this at the earliest possible opportunity, informed of all of the implications of such an alert, and given options for continuing it.

9. What should be the threshold for notifying the consumer that personal information has been breached? 

	Any potential for ID theft should trigger the notification requirement.  There should be no threshold.

10. Within what period of time, and by what means, should companies have to notify consumers?

Companies should be required to notify consumers without delay (e.g., within the shortest reasonable period of time), by means of email, telephone and/or mail.  

11. Should this proposal include a duty for the organization to notify PhoneBusters National Call Centre? 

Yes.

12. Is this a good approach to achieving a centralized reporting organization that can detect trends and compile more accurate statistics? 

This information would be very useful in the collection of relevant statistics.

Option VI – Require credit bureaus to place fraud alerts on consumers’ credit reports in cases of security breaches or upon the request of an identity theft victim

Upon receiving notice from an organization that the security of the victim’s personal information has been breached, or upon request by an identity theft victim, a credit bureau must place a fraud alert on the consumer’s credit report that his or her identity may have been used without consent to fraudulently obtain goods or services.  A creditor that receives a credit report with such a notice must not give or extend credit in the person’s name without first taking reasonable steps to verify the identity of the credit applicant.

1. Do you think this option would better protect against identity theft. Why or why not?

	Yes.  Clearly, this measure would guard against fraudulent credit activity by identity thieves impersonating others.  It is our understanding that credit bureaus are already doing this in some cases voluntarily, suggesting that it is a reasonable measure from the credit bureau perspective.  However,  voluntary action on the part of credit bureaus is not enough; consumers should have a legal right to have a fraud alert placed on their file.

2. What would be the costs / savings of such an initiative? Who should pay for the costs, if any? 

The costs of such an initiative are likely outweighed by its benefits in terms of preventing identity fraud.  In any case, the costs should be borne by the industry whose practices are facilitating identity theft.  Consumers should not have to pay for this service.

3. Should there be exemptions?  If yes, what type?

	No.  This should be a consumer right.

4. Should there be a penalty associated with this provision?

	As with all other measures, penalties for non-compliance are necessary in order to create an incentive for compliance.

5. For this option, who should ultimately be responsible for losses incurred from identity theft?

If losses are incurred from identity fraud that could have been prevented had the credit bureau imposed a fraud alert on the consumer file, in response to a request, then the credit bureau should be responsible for such losses.

6. Are there disadvantages for consumers or industry?  Please describe.

	Fraud alerts will likely slow down and complicate the process of obtaining credit for those consumers whose records contain an alert.  Consumers should be given the opportunity to choose between fast, easy credit (no fraud alert) and protection against ID fraud (alert); the consumer should be permitted to decide whether the disadvantages of a fraud alert are worth the protection that it offers.

Option VII – Require credit lenders to disclose details of fraudulent debts to victims

Upon request, credit lenders must provide identity theft victims with details regarding the fraudulent debt that was incurred in their name.

1. Do you think this option would better protect against identity theft. Why or why not?

Yes.  While the initial ID theft may have already taken place (and therefore obviously can’t be prevented), further ID fraud can be prevented if victims are able to access relevant information about frauds that have occurred.  In addition, this measure would assist victims in the long and arduous process of clearing their names.  In any case, consistent with laws providing individuals with rights to access their personal information generally, all consumers should have the right to full details regarding any debts incurred in their name.  This is a fundamental element of fair information practices.

2. What would be the costs / savings of such an initiative? Who should pay for the costs, if any? 

Credit lenders should bear the costs of access to information requests by their customers, as part of doing business.  The costs to the lenders of this requirement would likely be outweighed by the savings to individuals and society in terms of reduced ID theft and easier recovery from ID theft by victims.

3. Should there be exemptions?  If yes, what type?

	No.

4. Should there be a penalty associated with this provision?

Yes – as with all other requirements, non-compliance should be punishable by penalty as well as by liability for losses incurred as a result of ID fraud that could have been prevented had the business complied.

5. For this option, who should ultimately be responsible for losses incurred from identity theft?

	The credit lender should be responsible if it failed to comply.

6. Are there disadvantages for consumers or industry?  Please describe.

	There are no disadvantages to consumers, as long as proper authentication is used to ensure that such requests are being made by the individuals in whose name they are being made (to avoid further ID fraud).

Option VIII – Require credit bureaus to block information about fraudulent debts appearing on a consumer’s credit report

Upon receipt of proof of identity theft, a credit bureau must block information about debts incurred in a consumer’s name by an identity thief from being reported in the consumer’s credit report.  A credit bureau may deny or rescind a block in certain circumstances.  If the block is denied or rescinded, the bureau must notify the consumer of their decision to do so and provide reasons for their decision.

1. Do you think this option would better protect against identity theft. Why or why not?

Yes – in the sense of protecting ID theft victims from further consequences as a result of the ID theft.  Clearly, it would not protect against the ID theft that has already taken place, but it would prevent further victimization of those who have fallen prey to ID theft.

2. What would be the costs / savings of such an initiative? Who should pay for the costs, if any? 

	Whatever the costs of this initiative, they should be borne by the credit bureaus, not the consumers (who have already been victimized by the ID theft).  Once again, this should be treated as part of doing business as a credit bureau.

3. Should there be exemptions?  If yes, what type?

	No.

4. Should there be a penalty associated with this provision?

	Yes.

5. For this option, who should ultimately be responsible for losses incurred from identity theft?

6. Are there disadvantages for consumers or industry?  Please describe.

We see no disadvantages of this measure for either party, other than some costs of doing business.

7. Should information be blocked based on the consumer submitting the identity theft statement?  Alternatively, should there be time for the credit bureau to verify facts with the credit lender before blocking the information?

	Verification is acceptable as long as it is done forthwith upon request (e.g. no longer than a few days delay).

8. Blocked information may need to be retained on file for investigation purposes.  But, at what point should information that is blocked be completely removed from the file?
9. Should blocks be streamlined such that when information is blocked at one credit bureau, it is handled in the same way at other credit bureaus?  Alternatively, should there be one central clearing agency for handling consumer requests to block information about debts incurred by identity thieves?

	There should be a central credit bureau clearing agency for all consumer requests regarding credit freezes, alerts, as well as requests to block information about debts incurred by ID thieves.

Option IX - Make organizations liable for damages

Organizations would be liable for damages for failing to comply with the following proposals:

A.  Creditors must:
	(a) Contact consumers at a pre-designated telephone number before issuing credit, where there is a fraud alert on the credit file,

B. Credit bureaus must:
(a) Properly verify the identity of someone accessing a credit report, or
(b) Put a freeze on consumers' credit report in accordance with the provisions set out in Option 4,
(c) Put a fraud alert on the file where requested to do so in accordance with the provisions set out in Option 6,
(d) Block information in accordance with the provisions set out in Option 8.

C. All Organizations must:
(a) Truncate payment card numbers in accordance with the provisions set out in Option 1,
(b) Notify people affected by a security breach in accordance with the provisions set out in Option 5. 

All these organizations would be legally responsible for damages suffered by identity theft victims if they fail to comply with these measures.

1. Do you think this option would better protect against identity theft. Why or why not?

	Yes.  Commercial organizations (including creditors and credit bureaus) are in the business of maximizing profits, not protecting consumers or otherwise promoting the public interest.  They cannot be expected to take these measures voluntarily, since market forces do not demand it.  The only way to ensure that these measures are taken is to require them by law, and the only way to ensure that the law is respected is to establish effective enforcement mechanisms, including liability for damages.

2. What would be the costs / savings of such an initiative? Who should pay for the costs, if any? 

If damages must be proven in court in order for a consumer to obtain compensation under this measure, it is unlikely that many cases will be brought (due to the high cost of litigation).  However, in cases of non-compliance affecting numerous consumers, class actions may make enforcement by consumers of their rights to damages more likely.  The costs of court actions are determined by the courts.

Consideration should be given to making the recovery process more accessible to individual consumers than would be the case via the courts.

3. Should there be exemptions?  If yes, what kind?

No; indeed the legislation should explicitly bar efforts by industry to avoid liability under this measure via mandatory arbitration or the like.

4. For this option, who should ultimately be responsible for losses incurred from identity theft?  

5. Are there disadvantages for consumers or industry?  Please describe.

	No disadvantages for consumers, but the effectiveness of this measure will depend on the cost of enforcement to consumers.

Option X – Inform victims of their rights

Organizations must make information about victim’s rights readily available. Repairing the effects of identity theft is a costly and time-consuming process.  Victims need information in plain language that tells them how to settle fraudulent debts and correct their financial and credit records.

1. Do you think this option would better protect against identity theft. Why or why not?

	This measure would clearly assist victims in recovering from ID theft, and could thereby assist in the prevention of additional ID theft.

2. What would be the costs / savings of such an initiative? Who should pay for the costs, if any? 

	This measure would be minimally costly to industry.  It should be treated as a cost of doing business by those whose businesses are implicated in identity theft and fraud.

3. Should there be exemptions?  If yes, what kind?

Consideration should be given to which businesses would be subject to this requirement.  Credit bureaus and large credit grantors should be covered.

4. Should there be a penalty associated with this provision?

5. For this option, who should ultimately be responsible for losses incurred from identity theft?  

6. Are there disadvantages for consumers or industry?  Please describe.

7. Should organizations be required to have a toll-free number for this purpose?

	Credit bureaus should be required to have a toll-free number for this purpose.

8. What type of information would be required to provide, e.g. dispute resolution process, how to prevent further ID theft (alerts, freezes, blocking of information), identity theft statement, contact names and numbers, etc?

All of this information should be provided.

9. Should a separate centralized agency be set up for this purpose?  Should such an agency also help facilitate requests for fraud alerts following security breaches, freezes on credit reports and the blocking of negative information in a streamlined manner?

	Yes – a centralized national identity theft information and victim assistance centre could be tremendously useful to consumers, could dramatically cut the costs of victim rehabilitation, and could save organizations expense as well (by shouldering a large part of the burden of ID theft consumer protection and victim assistance).  Such a centre should function as a national clearinghouse for victim assistance and general consumer information on ID theft-related laws and practices.

Please attach any additional comments you may wish to convey.

	See 2003 PIAC report on Identity Theft, which recommends a number of these measures.  

In many cases, these measures should already have been taken by industry regardless of cost.  In other words, they should be treated as a cost of doing business, and there should be no issue as to who pays.  All of the suggestions are sensible consumer protections, the overall cost of which is outweighed by their likely benefits in terms of reduced ID fraud and/or reduced cost of rehabilitation to victims.

Thank you for your participation in this consultation.