e-Government, e-Commerce, online banking, Facebook – What do these have in common? All these services and functions are made possible by the fact that they are able to associate our activities with our identities. As our reliance on technology continues to grow, the ability to authenticate one’s identity becomes critical in even the most routine social interactions. In this posting, I would like to focus on identity theft specifically in the digital realm.

On October 27, 2009, Canada granted the of Bill S-4, a new addition to the Criminal Code that creates three new offences that are directly linked to the early stages of identity theft:

• Obtaining and possessing identity information with the intent to use the information deceptively, dishonestly or fraudulently in the commission of a crime.
• Trafficking in identity information, an offence that targets those who transfer or sell information to another person with knowledge of, or recklessness as to, the possible criminal use of the information.
• Unlawfully possessing or trafficking in government-issued identity documents that contain the information of another person.

Each of these offences carries both the potential for imprisonment for up to five years, as well as restitution for victims of identity theft.

These are welcome changes in the law that provides law enforcement powerful tools to use in their fight against identity theft.

However, it begs the question – Are they enough to protect you and I?

What if the perpetrator isn’t under the jurisdiction of the Canadian courts? ()

Hi, my password is ‘password’. What’s yours?

Given the high reward and relatively low risk involved with identity theft, attacks and attackers are becoming increasingly sophisticated. There have been reputable claims that even organizations such as crime syndicates and terrorists have become involved, beyond the usual suspects of individually motivated small-time cyber-criminals.

Identity theft can occur in many ways, ranging from complex exploitations of underlying technology flaws to simple common sense, such as brute force (a large number of attempts) or dictionary attacks (trying commonly used passwords). Aside from the sites that are extremely well protected, generally the common sense attacks have worked, often with humiliating and/or devastating results (Case studies: , , ).

Come on in, my door is wide open

While it is important to empower law enforcement with the ability to properly prosecute these offences, I believe that there should equally be an onus on the victims (both corporate and individuals) to ensure that their private information is properly stored and secure.

In this day and age, there are many good tools and leading practices to help users and corporations secure their information properly (e.g. / , Windows Updates, encryption, VPN). It is not likely to stop the most determined attackers, but provides a means of protection against the most common and often very simple attacks.

Given their ubiquity and relatively low cost (as compared to the cost of an adverse effect), it is my opinion that not taking the diligence to secure your information is similar to leaving your front door unlocked. I’m not going so far as to say that unsecured victims are negligent in their own right, but it would be prudent of the government to also enact legislation that would in effect require a higher standard of cybersecurity amongst the general public.

If we, the targets, take the appropriate steps, hopefully the future won't end up looking like .

The post It’s not me, it’s you appeared first on IPOsgoode.

The pith and substance of PIPEDA can be best characterized as . Principle 1 of the PIPEDA states:

For purposes, the guidelines clarify the meanings of the terms: “transfer”, “processing” and “comparative level of protection”. “Transfer”, unlike disclosure, is intended to make the document available only for the use for which the information was collected. Similarly, “processing” is interpreted as the use of the document for the purpose for which the transferring organization can use it. Lastly, “comparable level of protection” means that the third party processor must provide protection that can be compared to the level of protection the personal information would receive if it had not been transferred.

There are different approaches to protecting personal information that is being transferred for processing. European Union member states have passed laws prohibiting the transfer of personal information to another jurisdiction unless the European Commission has determined that the other jurisdiction offers "adequate" protection for personal information. In contrast, Canada does not provide for any authoritative body to make the final call on whether an organization is well-equipped to provide a comparable protection. Instead, OPC recommends that organizations should pre-contract and take all reasonable steps before exchanging the personal information. There is also an underlying emphasis on the consideration that should be given to the third party jurisdictions’ legal requirements, and the that may reduce their ability to provide the service. 

The Canadian approach rightly holds that the final decision on whether to transfer personal information lies with the host organization itself. With the increase in the outsourcing of processes to third parties, it is only fair that the organizations undergoing potential cost savings and making profits also bear the burden associated with personal information misuse. The guidelines also emphasize the need of transparency towards the customers, such as their access to the organization’s personal information handling practices. Such a possibility creates a strong incentive for these organizations to be extra careful and to make a conscious and well-informed decision about the transferring of personal information. Overall, Principle 1 of PIPEDA provides for a balancing provision between the protection of personal information of individuals and the business necessity of transferring information. Therefore, it appears that the current approach adopted by Canada is an efficient way to achieve a safe and favourable personal data transfer. 

The post Guidelines for processing personal data across borders: liability for transferring organizations appeared first on IPOsgoode.