Data breach risk prompts new Ontario legislation

Recent backlashes against Statistics Canada and Facebook have prompted Ontario lawmakers to make it harder to share consumer banking information.

“Financial data is especially vulnerable to hacking,” Stephen Crawford, Ontario MPP for Oakville, said Thursday at Queen’s Park in Toronto. “In the past 10 years, the number of attacks has increased greatly, including a data breach that impacted Home Depot in 2014; in 2017, Equifax was impacted by a data breach as well.”

Crawford was commenting on Bill 55, which passed second reading Thursday. If passed into law, the Consumer Protection Act would be changed to require a consumer’s consent before a lender can give that consumer’s financial information to a government organization.

“We live in a very different world than 30 years ago or even five or 10 years ago. We need to update our laws, particularly with respect to consumer protection, to be in modern times, so that we can protect our consumers and banking information,” Crawford said Thursday. Bill 55, the Safeguarding our Information Act, is a private member’s bill drafted by Crawford, a backbench Progressive Conservative MPP who chairs a committee.

Bill 55 was prompted in part by a recent plan by Statistics Canada to force financial institutions to hand over banking information on 500,000 Canadian households. That revelation led to an investigation by federal privacy commissioner Daniel Therrien, the Canadian Press reported. StatsCan is holding off on the project while Therrien proceeds with his investigation.

The StatsCan project shocked Faisal Hassan, NDP MPP for York South-Weston, a riding in northwest Toronto.

“Statistics Canada has told the public that it anonymizes information after they aggregate the financial data with the geographical data, but it is alarming to consider what could happen to the data in the process of being transferred and aggregated,” Hassan said Thursday during discussion of bill 55. He was one opposition member who spoke Thursday in favour of Bill 55.

If Statistics Canada goes ahead with its data collection plan, the federal agency could get its hands on data about people’s deposits, withdrawals, loan repayments and debit card purchases, said Tom Rakocevic, NDP MPP for Humber River-Black Creek.

Financial data on Canadians (including names, addresses, social insurance numbers and credit card numbers) may have been compromised when Equifax was targeted by hackers, the credit bureau reported in 2017. Equifax is facing a class-action lawsuit in Ontario.

Earlier this year, Facebook acknowledged that as many as 87-million people may have had their data accessed by Cambridge Analytica, a data mining firm that worked for United States President Donald Trump’s election campaign, The Associated Press reported earlier.

“Facebook has faced intense criticism in its inability to prevent unauthorized use of users’ data by firms such as Cambridge Analytica,” Crawford said Thursday. “Facebook CEO Mark Zuckerberg was called to appear before the US Senate commerce and judiciary committees to justify his company’s actions with respect to privacy, data-mining regulations and Cambridge Analytica.’

The Cambridge Analytics controversy “was a wake-up call for the world,” Crawford added.

Bill 55 was referred Thursday to the  Standing Committee on Finance and Economic Affairs.

Politicians who spoke in favour included Gila Martow, PC MPP for Thornhill, which borders Toronto to the north.

“If you look at our phones, so many of us have apps. We have Uber apps. I have a Cineplex app. I have a CIBC app and an Air Canada app, and Google Nest now to control your thermostat and things in the house. All of this has very personal information,” Martow said Thursday. “In the old days, you used to be afraid to tell the newspaper delivery that we were going out of town. We preferred to have the neighbour pick up the paper, because we didn’t even want the Toronto Star to know that we were away. But now we all recognize that our lives are just such an open book, but that doesn’t mean that we have to completely give up giving any kind of consent.”