Stolen Personal Information and Identity Theft: The QLP Offers 5 Concrete Proposals to Face the Life-Shattering Threat

Personal Information: The Crux of the Issue in the New Economy

The 21st century’s black gold is without a doubt data. It is no coincidence that technology companies like Google, Apple, Facebook and Amazon (GAFA) sit enthroned at the top of the stock exchange and have outclassed all the oil companies hands down![1]

Information is the crux of the issue in the new economy. Thanks to new sophisticated algorithms, companies seek to and can learn everything to get to know us better, better analyze us and therefore better target us with a products and services offer that is made to measure our potential needs. The information gathered can definitely be useful in certain situations by allowing companies to analyze consumers’ behaviours and habits.

But what about when citizens’ personal information finds itself in the hands of the State? Should we just accept that our medical files, income tax declarations, social insurance numbers, workplace and residence locations can wind up in the hands of companies that are subject to other countries’ laws? Confronted with numerous recent scandals and data leaks, the Quebec Liberal Party, as the National Assembly’s Official Opposition, has put clear questions to the CAQ government, questions that still remain unanswered.

Already Red Flags

Let’s take a walk down memory lane. In 2015, the Swedish government entrusted the American company IBM with the management of some of its data, registers of drivers’ licences and vehicle registrations. This decision was made with the stated goal of cutting costs within the public budget. A short time thereafter, Sweden faced the worst data leak in its history, which led to the resignation of a number of cabinet ministers. The leak also caused concerns that intelligence officers and people living under secret identities could have been compromised.

In the fall of 2017, it was Equifax that was faced with a data leak, this time on a global scale, touching no less than 143 million people, including thousands of Canadians.

In 2018, we all also recall the Cambridge Analytica scandal where we learned that the British firm gained access to 87 million Facebook profiles. The information collected without users’ knowledge was used to influence the 2016 American election campaign. In April 2019, Facebook experienced a major data leak which affected 540 million profiles stored on Amazon’s cloud computing service.

Here at home, 2.9 million Quebecers were affected by the Desjardins’ data theft. Desjardins subsequently offered its clients a monitoring service with none other than… Equifax! The same company that experienced a data breach and was sanctioned by the American government with fines of 700 million USD.

Last Monday evening, we learned that the fifth-largest credit card issuer in the United States, Capital One, had also experienced a data breach. An engineer working for Amazon stole the data stored by Capital One on Amazon’s cloud computing service. Over 100 million clients in the United States and 6 million clients in Canada have been affected, in particular those with Costco or The Bay credit cards.

The CAQ government’s reaction to these latest events was timid and surprising, to say the least. Éric Caire, the Minister responsible for Government Digital Transformation indicated that Equifax “remains an effective means of prevention for monitoring credit and preventing identity theft”. Yet, to date, only 20% of Desjardins members have registered for this monitoring system which is frequently unavailable in French, our official language in Quebec. With regards to the Capital One file, the Minster minimized the incident, defending Amazon’s servers and blaming Capital One instead. We repeat, the former employee worked for Amazon.

The CAQ Government’s Project to Privatize Our Data

We can better comprehend the Minister’s interventions when we look to the past. On February 4, 2019, the CAQ government proudly announced its intention to entrust to the private sector with 80% of the personal information that had been collected on Quebecers by the State, in an effort to save 100 million dollars (on an annual budget of more than 115 billion).

But since then, the Minister is incapable of answering the questions we put to him: What personal information on Quebecers will be entrusted to foreign private companies? Will Amazon and other multinationals monitor and control our names and addresses, our social insurance numbers, our driver’s licences, our medical files and our income tax declarations? What measures will be implemented to prevent businesses, foreign governments or malicious individuals and groups from accessing our information?

Faced with a lack of answers, the Quebec Liberal Party is offering the government an action plan to ensure cybersecurity and the confidentiality of Quebecers’ information.

5 concrete solutions for a State that is at Quebecers’ service and is completely free from all interference by foreign companies

1. Maintain our sovereignty over the data collected by the State

First of all, it has become imperative for the Legault government to backtrack and exclude the possibility of entrusting the management of Quebecers’ data to foreign companies. Let’s take the time to do our homework and learn from the mistakes made elsewhere in the world.

2. Hold a genuine national reflection

We ask for a parliamentary committee so that we can hear from financial institutions, credit agencies like Equifax and experts in identity theft and financial crimes, as well as the GAFA.

We want to ask questions in order to have a fuller understanding of data theft and their ability to adequately manage the data entrusted to them by their clients, members or users. We also want to better understand the credit rating system which directly impacts Quebecers’ purchasing power.

3. Ensure that the State and companies are accountable to citizens

Facebook blames Amazon for the data leak. Amazon blames Facebook. Capital One blames Amazon and Éric Caire blames Capital One. Guy Cormier, PDG of Desjardins, has passed the buck to Ottawa.

Let’s be clear, companies collect data from their clients. It is their responsibility to protect them.

Governments collect data from their citizens. It is their responsibility to protect them.

The government must take action now through:

• the creation of a digital identity;
• the implementation of prevention measures inspired by global best practices;
• the creation of a joint investigation team;
• the implementation of a Quebec digital literacy program.

4. Develop Quebec’s internal expertise

Each threat presents us with an opportunity. We have here an occasion to invest to develop our own expertise and even become a world leader in the field.

We can be proud of Quebec’s information technology expertise. Today we are a world leader in artificial intelligence and information technologies. A policy for managing State data is a golden opportunity to support our local business development. We shouldn’t let it slip away by entrusting our data to American giants!

5. Legislate

Let’s give the Consumer Protection Act more teeth to punish offending companies. Let’s require that companies have a policy and sufficient insurance to face cyber risks. The Act Respecting the Protection of Personal Information in the Private Sector must be reviewed and corrected to increase the fines (the maximum fine in case of repeated offence is currently 100,000 dollars).

Lastly, let’s ask Ottawa to revise the Criminal Code to make financial crimes and identity theft more serious crimes. The Criminal Code provides for a maximum sentence of 5 years’ imprisonment for the sale of personal information[2].

Identity theft shatters dreams, shatters retirement, shatters lives.

We must stand firm!

Marwah Rizqy
MNA representing Saint-Laurent
Official Opposition Critic for the Digital Strategy

Gaétan Barrette
MNA representing Lapinière
Official Opposition Critic for the Conseil du Trésor

Lise Thériault
MNA representing d’Anjou-Louis-Riel
Official Opposition Critic for Consumer Protection

Marc Tanguay
MNA representing LaFontaine
Official Opposition Critic for Access to Information

Notes

[1] In 2006, the oil company Exxon Mobil was at the top with a value of 540 USD and in 2017, it was Apple, valued at 744 USD, GALLOWAY, Scott, “The Four”, Portfolio/Penguin, 2017.
[2] Article 402.2 of the Criminal Code.