The Ottawa Sun, Canada
March 18, 2007 Sunday
FINAL EDITION
Swiping at identity theft;
Ontario’s privacy czar has her hands full
BY CHRISTINA BLIZZARD
For the past 20 years, she has been a quiet warrior fighting a
neverending battle against an unseen enemy.
The war is on your privacy — which is increasingly under attack from
dumpster divers, hackers, Eastern bloc con artists, organized crime,
intrusive government agencies and even sloppy computer practices by
big hospitals and big businesses.
The province’s privacy commissioner is a tiny, elegant woman. But
don’t be fooled. She’s one gritty fighter.
Dr. Ann Cavoukian has a passion. And it’s your privacy. And the right
to privacy, she believes, is intrinsically linked to your freedom.
"The linkage between privacy and freedom is one of the strongest
associations, because the first thing that goes when society changes
from a democracy to a totaliatrain state, the first thread to
unravel, is privacy," she said in an interview.
DEFENDING OUR RIGHTS
In the Internet era, it seems rarely a day passes that Cavoukian
isn’t front and centre defending our right to keep our personal
information just that — personal. Most recently, she issued an order
requiring hospitals to take measures to ensure the safe storage of
patients’ records after a doctor at the Hospital for Sick Children
had a laptop computer — along with thousands of patients’ medical
records — stolen.
Identity theft and debit and credit card fraud using stolen personal
information have exploded in the two decades Cavoukian’s been in her
job.
"Organized crime is now into the area of identity theft big time, so
they are looking for access to personal information," she said.
Most worrying is individuals can take all the protective measures
they can to keep their personal data safe — and they are still
vulnerable to attack.
As long as businesses don’t encrypt their databases of personal
information, rogue employees and hackers have a steady stream of
identifiable data they can sell to the highest bidder. Ditto for
businesses where employees take unencrypted information home with
them on laptop computers or BlackBerries. All it takes is for the
device to be lost or stolen and your most vital information has been
compromised.
"The major two sources of identity theft have nothing to do with
consumers’ best practices," she said. "Consumers can do everything
and their information could still be subject to this enormous risk.
"If all the major companies started tomorrow encrypting the personal
identifiers associated with information they have in their databases,
you could significantly minimize the incidence of identity theft,"
she said.
Cavoukian would like the province to bring in "breach notification,"
legislation that would require businesses, hospitals and other
organizations to inform customers, clients and patients when their
personal information has been compromised. Companies that encrypt
data would not be exempt.
If the public is made aware of security breaches, they can defend
against it, Cavoukian says. They can contact credit bureaus, for
example, and ask for a fraud alert that would stop any organization
from automatically extending credit unless the victim is notified.
There are now web sites that instruct people on how to mine personal
information such as dates of birth, social insurance numbers and
driver’s licence information. That information is then sold to
organized crime.
"And that is the fear," she said. "Once it becomes big business you
are going to have more and more people entering the field — more and
more rogue employees."
But identity theft isn’t Cavoukian’s only concern.
Red flags went up on privacy recently about a plan by convenience
store owners to swipe driver’s licences as proof of age for purchases
of cigarettes, lottery tickets and other age-restricted products.
Cavoukian’s office was consulted about the program and they are
satisfied it not only doesn’t retain information from the licence, it
actually restricts the amount of information the store clerk gets —
since he or she doesn’t need to read the licence, just swipe it. They
see only the year of birth.
FACEBOOK AND MYSPACE
One alarm bell Cavoukian has been ringing has to do with on-line
"social network," web sites such as Facebook and MySpace. Her office
has produced a brochure in partnership with Facebook which, she says,
unlike other web sites, has strong privacy protection measures.
Schools now ask her to speak to students to warn them of on-line
risks.
"Parents and teachers are getting very concerned with the naivete,
especially of high school students," she says.
She reminds students, "this can come back to haunt you.
"You are going to be applying for jobs in a couple of years," she
tells youngsters, and tells the cautionary tale of a girl who was a
prefect at a university — until the administration saw an on-line
picture of her smoking a joint at a party.
"This information lives for life," Cavoukian points out. "So if
you’ve got pictures of yourself at drunken parties doing things that
you think is funny now, do you want this in the hands of a
prospective employer? What about a professor? This is going to follow
you forever. What happens if it gets into the wrong hands?" she asks.
She reminds them there are pedophiles out there who prey on the
naivete of young people. Don’t let anyone access your profile. Limit
it to people you know and never, ever put an address or locator
information in your profile.
When Toronto Police wanted to install surveillance cameras on the TTC
and in Dundas Square, she gave them guidelines of acceptable ways to
do it. The first was the public had to be notified the cameras were
there. Next, there had to be assurances that the images captured by
the cameras would be only used for the purpose for which they were
collected — and destroyed as soon as possible. And she urged police
to keep strict control on who is authorized to access the information
and how it could be used.
"One of the big problems in London, England was there are millions of
surveillance cameras and they were abused," she said. Attractive
women were tracked by people who had access to the information,
Cavoukian said.
Like freedom and democracy, privacy is often something society only
values when it has been lost. And Cavoukian’s personal background is
such that she never takes those values for granted. Of Armenian
background, her family was living in Egypt when it was nationalized
from British rule. The ensuing loss of personal freedom forced her
family to flee to Canada when she was four years old.
"My parents gave up everything so they could raise their children in
freedom. So for me the message of freedom has been drilled home" she
said.
Cavoukian’s message is slowly getting through to all of us. Because,
litttle by little, most of us have felt the gnawing vulnerability of
a privacy breach. Each time our debit card is compromised, each time
a department store acknowledges they have compromised thousands of
accounts, we feel defenceless. And we all loose a little freedom.