Cyber risk concerns behind this consumer protection law

Identity theft risk increases when banks release customer information to government agencies doing research, an Ontario politician suggests.

“The more information flows around, the more likely there is to be a hacking. It’s just like the more you are driving on the highway, the likelier you are going to get in an accident,” Stephen Crawford, member of provincial parliament for Oakville, said Tuesday in an interview.

Crawford is chair of the Standing Committee on Finance and Economic Affairs, which will be studying draft legislation designed to protect the privacy of consumers’ banking information. Bill 55, the Safeguarding our Information Act, passed second reading Nov. 29.

Identity theft and privacy breaches affect insurers for several reasons. Many home insurance policies cover identity theft. Liability insurers can be on the hook when companies fall victim to data breaches but are sued by the people’s whose privacy was breached.

It will be at least February – and possibly early spring – before Bill 55 goes before committee, Crawford told Canadian Underwriter Tuesday. Crawford tabled Bill 55 – a private member’s bill – on Nov. 14 at Queen’s Park.

If passed into law, Bill 55 would require a consumer’s consent before a lender can give that consumer’s financial information to an Ontario government organization. It would change existing provincial laws including the Consumer Protection Act.

“We should be moving to a more digital government and world, but we do have to protect consumers and individuals. We have to strike a balance,” Crawford said.

One reason Crawford tabled Bill 55 was Statistics Canada’s recent effort to compel banks to hand over account information on 500,000 Canadian households. The StatsCan project is on hold while the federal privacy commissioner investigates, The Canadian Press reported earlier.

One of the driving factors was concern from consumers about the risk of a bad actor getting the data, Crawford said.

Bill 55 is not binding on Statistics Canada, but if passed into law, Bill 55 would make sure that no Ontario government agency would be able to do something similar to what StatsCan wants to do unless it had consumers’ consent.

Identity theft is not the only concern for consumers, Crawford said Tuesday. It’s also the principle of it – this is the consumers’ private financial information.

A case can be made that if research organizations such as Statistics Canada are able to get anonymized data on banking habits, they could potentially get useful insights from that data.

Crawford does not deny there is some insight to be gained, “but you could get a lot of that data just be doing a little bit of research. You can see how much online shopping there is. You can get that without going into the bank accounts of individuals.”