Privacy law must have teeth

Take a look at David Canton's latest column in the London Free Press: Privacy law must have teeth. Good read.

More on privacy and the Canada Revenue Agency

The Canada Revenue Agency continues to be in the news as of late.

The Canadian Press has found that the CRA official leading the investigation into the disclosure of information about high profile taxpayers, including MP and former hockey star Ken Dryden, once faced the wrath of George Radwanski:

CRA commissioner probing Dryden tax leak once dismissed privacy breach finding

Gregory Bonnell

Canadian Press

Monday, January 08, 2007

TORONTO (CP) - The senior public servant leading a probe into the leak of Ken Dryden's confidential tax information once dismissed a scathing ruling by the federal privacy commission that found Canada Revenue Agency employees had violated the Privacy Act.

Larry Hillier, the agency's assistant commissioner for the Ontario region, launched an "immediate investigation" last month after a published report that employees had violated the Income Tax Act, the Privacy Act and possibly criminal law by leaking Dryden's information.

In an internal e-mail sent to CRA employees, Hillier also warned of possible disciplinary action, including dismissal.

"When one employee breaches confidentiality, as is currently alleged, each and every one of us is impacted," he wrote.

Hillier, however, had a decidedly different response in 2003, when the federal privacy commissioner found CRA employees committed a "serious violation" of the Privacy Act by accessing and disclosing the tax information of former employee Lillian Shneidman while investigating allegations that she had violated a taxpayer's privacy rights.

In an October 2003 letter obtained by The Canadian Press, Hillier defended the actions of his employees, despite the privacy commissioner's findings.

"I offer the following regarding the above-referenced report, which concludes that we inappropriately accessed Ms. Shneidman's tax information," Hillier writes in a letter to then-CRA human resources branch assistant commissioner Dan Tucker.

"It is felt that this particular investigation warranted the accessing of Ms. Shneidman's tax information, as a taxpayer raised serious allegations."

CRA employees who are found guilty of disclosing confidential tax information - a violation of the Income Tax Act - face fines of up to $5,000 or jail time of up to 12 months. Under the Criminal Code of Canada, breach of trust by a public officer is punishable by a maximum prison sentence of five years.

Shneidman, who was fired from the CRA in 2001, had been assured in a July 2003 letter from Tucker that the agency viewed "any breach in privacy as a very serious matter."

The CRA "will ensure that appropriate corrective action will be taken," Tucker wrote.

At least one of the employees involved in the incident has been promoted, said Shneidman - who continues to fight her termination, with cases pending before the Public Service Labour Relations Board and the Federal Court of Appeal.

Former privacy commissioner George Radwanski was unequivocal in his condemnation of the CRA's treatment of Shneidman.

"Accessing that information . . . for the sole purpose of confirming your status as a (CRA) employee was, in my view, totally unnecessary and a gross misuse of taxpayer information," wrote Radwanski, who faces charges of fraud and breach of trust after resigning that same year amid an expense-abuse scandal.

"I consider the use of your (tax) information in this instance to constitute a serious violation of the confidentiality rights afforded you under . . . the Privacy Act."

...

Toronto police remove downtown CCTV cameras

It's not every day that you hear about police operated CCTV cameras being taken down, but that's what's happening in downtown Toronto. The municipal police erected three cameras at busy intersections during the holiday season and have now taken them down. The removal of the cameras has caused some controversy, as some merchants and police investigators say they have potential in deterring and investigating crime. Others ask what sort of deterrence they offer as a shooting took place under one of the cameras in the past week. Check out: City News: Police shut off closed circuit cameras at three downtown intersections and Blog TO: Yonge and Dundas Security Cameras Turned Off.

Thanks to Rob Hyndman for passing along the link.

Presidential signing statement may open door to opening mail

According to the Associated Press, a "signing statement" issued by President Bush when signing postal legislation may open the door to greater powers for law enforcement and intelligence authorities to open first class mail.

Here's the signing statement"

"The executive branch shall construe subsection 404(c) of title 39, as enacted by subsection 1010(e) of the act, which provides for opening of an item of a class of mail otherwise sealed against inspection, in a manner consistent, to the maximum extent permissible, with the need to conduct searches in exigent circumstances, such as to protect human life and safety against hazardous materials, and the need for physical searches specifically authorized by law for foreign intelligence collection.

See: Bush signing may change mail laws.

Kitty credit cards

An Australian with a sense of humour got his cat a credit card to test his bank's "identity security":

Bank issues credit card to cat

SYDNEY, Jan 4 (Reuters Life!) - An Australian bank has apologized for issuing a credit card to a cat after its owner decided to test the bank's identity security system.

The Bank of Queensland issued a credit card to Messiah the cat when his owner Katherine Campbell applied for a secondary card on her account under its name.

"I just couldn't believe it. People need to be aware of this and banks need to have better security," Campbell told local media on Thursday.

The bank said the cat's card had been canceled. "We apologize as this should not have happened," it said in a statement.

Incident: CRA misdirects taxpayer information

A Halifax resident was more than slightly surprised when he went to the Canada Revenue Agency to pick up his requested notice of assessment. While the notice was conspicuously absent from the envelope, he did find a raft of information about ten complete strangers. Apparently, the CRA stuffed the wrong envelopes and handed over confidential and sensitive information to the wrong person.

When the individual who received the information was not satisfied with the CRA's reaction, he called the other taxpayers and went to the media. The story is on the front page of the Halifax Chronicle Herald.

To make matters worse, the notice of assessment was mailed but nobody knows who to.

CTV is doing a piece for the supper hour news here in Halifax, for which I was interviewed earlier today. They are hoping to get some comment from the unshuffled Minister responsible for CRA.

From today's paper:

More than he wanted to know

Government mistakenly mails other people’s tax papers to Whites Lake man

By JOHN GILLIS Staff Reporter

Andrew Doiron of Whites Lake just wanted to find out his RRSP contribution limit for the year. But what he got was a raft of personal information about 10 strangers from as far away as British Columbia.

The Canada Revenue Agency is now investigating how the confidential tax documents landed in Mr. Doiron’s mailbox and where the information he requested ended up.

"It looks like somebody just picked a handful of paper off a printer and just slipped it in an envelope with my (address) page on top," Mr. Doiron said Wednesday. "But of course they didn’t put my papers in there."

The confusion began Dec. 20 when Mr. Doiron went to the Canada Revenue Agency’s Halifax office in person to ask for a copy of his notice of assessment. He was told he had to call a toll-free number to ask for the document. Staff let him use a phone in the building.

Mr. Doiron was surprised Tuesday when he found an envelope from the agency in his mailbox, and it contained about 35 pages. The documents bore the names, addresses, social insurance numbers, income, marital status and other personal information for 10 other people. His own notice of assessment was not included.

He immediately called a toll-free Canada Revenue Agency number again but said it was tough to persuade the person who answered to let him speak to a supervisor. When he finally did, he said he was asked to mail the documents back to the agency and advised he could claim the price of the postage stamp on his tax return next year.

Mr. Doiron also called as many of the people whose tax information he’d been sent as possible.

One, Sandra Ambersley of Brampton, Ont., told CTV she was very concerned about what might have happened if someone had wanted to use that information.

"I was totally shocked yesterday when I received a call from Halifax, this man saying that he’d received all my personal information," she said Wednesday.

Mr. Doiron noted that on the same online telephone directory he used to find people’s telephone numbers, there was an ad pointing to a Capital One credit card application that required only an address and a social insurance number.

He personally returned all the strangers’ documents to the Halifax office Wednesday.

Mr. Doiron said he felt he did not get a serious response from the agency until after he began contacting the media.

Jack Lee, acting director of the Nova Scotia office, called to apologize and had a copy of the notice of assessment Mr. Doiron requested sent to him. It arrived safely.

The notice had been mailed previously, but not to him.

"Mine’s out there somewhere, floating around," Mr. Doiron said. "I hope somebody threw it away."

Canada Revenue Agency spokesman Roy Jamieson said security is the No. 1 priority for the service, but mistakes happen.

"We’re certainly scrambling to try and piece together what took place," he said. "There’s quite an active and quite an intense investigation going on right now."

He said a call to a toll-free number could be answered at any one of a number of call centres across the country, depending in part on the nature of the request. A requested document could be printed at the appropriate location and mailed from there.

The agency sends about 90 million pieces of mail per year and it’s rare that something gets mixed up, he said.

"To be misdirected in the magnitude of this case, it’s certainly unusual," Mr. Jamieson said.

He said the agency will contact all of the people whose documents were involved and will keep Mr. Doiron abreast of its investigation into the mix-up.

"There’s no question that any kind of breach of security and compromising of an individual’s privacy and confidentiality is our most significant issue in this agency," Mr. Jamieson said.

Mr. Doiron has little confidence that anything will change.

"My gut feeling is, this is government, nothing’s going to happen," he said.

Update: From CTV:

Canada Revenue investigates botched mailout

The Canada Revenue Agency is scrambling to restore public trust and has launched an internal investigation after confidential information on several Canadians was sent to a Halifax-area man.

Documents that Andy Doiron of White's Lake, N.S., were mistakenly sent include social insurance numbers, income, addresses and the marital status of 10 Canadians, including some from as far west as Edmonton.

Doiron said he called most of the people to tell them what happened, and returned the documents to Revenue Canada.

With the trust of Canadians potentially on the line and tax time just around the corner, the agency is promising tough action if necessary.

Revenue Canada spokesperson Roy Jamieson called the incident a rare case of misdirected mail, but admitted somebody in the department made a mistake.

"Certainly if we identify breaches of policy process and procedure, there are disciplinary measures that can be taken and I expect they will be looked at quite seriously," he told CTV Atlantic.

Federal Minister of National Revenue Carol Skelton said she was "disturbed" by the security breach.

"The instant that I found out about it we had launched an investigation," she told CTV News in Saskatoon. "I really can't say much more about it than that. The incident is being looked into."

The agency is still trying to determine which one of five locations was responsible for the botched mail out.

David Fraser, a legal expert in security matters, told CTV Halifax that if such information were to fall in the wrong hands, it could easily be used to commit fraud.

"There really does need to be something done in order to make sure the trust is always there. Accidents happen but so often trust is won or lost in the aftermath of how they decide to deal with it," he said.

Sandra Ambersley of Brampton, Ont. was one of the people Dorion called.

"I was totally shocked when I received the call (on Tuesday) from Halifax," Ambersley told CTV Toronto.

"This man (was) telling me that he received all my personal information. As a joke he did say 'I could duplicate you right now.'"

The confusion began when Doiron called the revenue agency on Dec. 20 requesting a copy of his notice of assessment.

On Tuesday, an envelope from the agency arrived in his mailbox, containing over 30 pages of documents with all the information. His own assessment wasn't included.

Doiron said he immediately called the toll-free Canada Revenue Agency number again and he was asked to mail the documents immediately.

With a report from CTV Atlantic reporter Marc Patrone.

New Year privacy resolutions

The Privacy Commissioner of Canada suggests that you make a few New Year's resolutions to protect your privacy:

Start the New Year with privacy resolutions

Ottawa, December 27, 2006 – Privacy Commissioner of Canada Jennifer Stoddart is urging Canadians to add good privacy habits to their list of New Year’s resolutions.

"Polls have told us again and again that Canadians value their privacy. The start of the New Year is a great time for everyone to check whether they are doing enough to protect this important right," Ms. Stoddart said. "I hope people will add some good privacy habits to their New Year’s resolutions list."

Ms. Stoddart today released her top 10 resolutions for consumers to protect their privacy in 2007 and beyond. They are:

1. Guard your information

   Ask questions when a cashier ringing in your purchases wants your name, address or telephone number. Why is the information being requested? How will it be used? If you are concerned about unwanted junk mail or telemarketing calls, decline to provide the information. It’s as simple as saying, "Sorry, I don’t want to share that personal information." Privacy laws give you a choice. You don’t always have to say "Yes."

2. Check your receipts

   Some retailers still use older equipment that prints receipts with a complete credit card number – creating a risk the number will fall into the wrong hands and be fraudulently used. If the number is complete, use a pen to scratch out the middle four numbers on your copy.

3. Become a junk mail buster

   If you don't want to be added to marketing lists, check the "no thanks" or opt-out box, or initial a note stating your preference, whenever you give personal information to magazine publishers, retail stores, charities and other organizations.

4. Take three steps to create more quiet nights at home
   • Take advantage of the Do Not Contact Service (do-not-call, do-not-mail, and do-not-fax) offered at no cost by the Canadian Marketing Association (CMA). You can make the request online at www.the-cma.org.
   • Ask your telephone company to remove you from the lists it sells to external organizations.
   • When telemarketers call, insist they remove your name from their calling lists. They are now required by law to maintain do-not-call lists.
5. Develop a shredding habit

   Make sure your blue box is not a goldmine for identity thieves. Buy a shredder (many are surprisingly inexpensive). Destroy all documents that include sensitive personal information, such as bank statements, credit card statements, credit card receipts, and pre-approved credit card applications.

6. Check loyalty program fine-print

   Re-evaluate your membership in "rewards" or "points" programs. Often stores see your participation as consent to share your information without directly asking for permission. This can mean more junk mail and telemarketing calls. Read the program’s privacy policy. If you have concerns, don't join or ask the store not to share your personal information.

7. Become more privacy-aware on-line

   Educate yourself about protecting your privacy on-line. Install the latest anti-spyware, anti-virus and firewall software on your computer. Shop only on secure sites – check for a lock symbol on the bottom right of the window. There’s plenty of advice on the Internet.

8. Stop Spam

   Invest in a good spam filter and learn how to use it. Spam affects privacy rights because it involves the inappropriate use of personal information – your e-mail address. Protect your regular e-mail address by using it only with trusted friends and business associates. Get another address for other online uses. If you receive an e-mail from a sender you don’t recognize, or with a subject line that doesn’t make sense, just delete it. Opening spam may send a confirmation that an e-mail address is valid – and lead to more spam. The OPC homepage, www.privcom.gc.ca, includes a link to more information about spam.

9. Caution on the phone

   Apply a healthy dose of skepticism when an e-mail or phone caller warns that your bank account or credit card has been compromised. Never reply to such e-mails, which may have been sent by ID thieves. Call your bank instead. Fraudsters are also using the telephone to get personal information. The best way to determine whether a call about account problems is legitimate is to say, "I’ll call you right back," and then call either the number on your credit card or account statement.

10. Protect your SIN

    Ask questions when an organization asks for your Social Insurance Number. An ID thief could use your SIN to apply for a credit card or bank account in your name. Companies can’t insist that you provide a SIN unless it is required for a specific and legitimate purpose, such as tax reporting. Ask why the organization needs your SIN and whether you are required by law to provide it. If you are refused a product or service unless you give your SIN, complain to the Office of the Privacy Commissioner of Canada.

Identity theft insurance

The Canadian Press is running an article about the growing business of identity theft insurance, both as an add-on to traditional homeowners policies and as a standalone policy of insurance. This is something I've seen in the US for some time, but is relatively new north of the 49th. See: Insurance providers offer policies that can take sting out of identity theft.

State and local governments getting into the intelligence business

According to the Washington Post, a number of US states are fed up with the level of cooperation with federal authorities and are hanging up their own shingles in the intelligence business. Dozens of operation centres are currently operating from coast to coast, and some concerns are being raised about privacy concerns and the level of information sharing these centres are predicated upon.

The post cites an example, which was first hailed as a success, but this sentiment fizzled out:

Officials say an incident on the Chesapeake Bay Bridge in 2004 shows the center's effectiveness. State transportation police stopped an SUV after a veiled passenger was seen videotaping the bridge in a suspicious manner. The officers called the fusion center, which discovered that the driver was an unindicted co-conspirator in a Chicago case involving Hamas, a U.S.-designated terrorist group.

Eisenberg contacted a prosecutor in Chicago, who quickly obtained an arrest warrant for the driver as a material witness in the Hamas case.

"The 9/11 commission's major criticism was that people didn't talk to each other," said Dennis R. Schrader, Maryland's director of homeland security. "Well, this is an example of how you had state, local and federal all working together. . . . It's really pretty unbelievable."

To some, though, the incident raised questions about what constitutes dangerous behavior.

The driver, Ismail Elbarasse, a U.S. citizen of Palestinian origin living in Annandale, was quickly released on bond, and the material-witness warrant eventually expired. He was not charged with a crime. His family said the veiled woman, Elbarasse's wife, was simply taping the bay while returning from the beach.

"It was regarded in the community as just a case of overreaction to seeing somebody in a head scarf videotaping," said Ibrahim Hooper of the Council on American-Islamic Relations.

Civil liberties advocates worry that the fledgling fusion centers could stray into monitoring people engaged in lawful activities, as some members of new police homeland security units have done. A Georgia homeland security officer, for example, was discovered photographing a protest by vegans at a HoneyBaked Ham store in 2003. Privacy advocates are also concerned about the vast amount of information some fusion centers collect -- and the sometimes vague limits on its use and storage.

Happy New Year!

Happy new year to all the readers of the Canadian Privacy Law Blog. Thank you so much for reading this blog and for all your contributions, links and suggestions over the past year.

Best wishes for a very successful '007.

Photo courtesy of Tony V, who posted this image of fireworks in Zurich on Flickr under Creative Commons terms.