Equifax fell short of privacy obligations to Canadians, says privacy commissioner

More than 143 million people around the world, including 19,000 Canadians, were affected

The Equifax Inc., offices in Atlanta are shown on July 21, 2012. Canada’s privacy commissioner says Equifax fell short of its privacy obligations to Canadians during and after a global data breach last year. Privacy concerns included poor security safeguards, retaining information too long, inadequate consent procedures, a lack of accountability for Canadians’ information and limited protection measures offered to affected individuals after the breach. THE CANADIAN PRESS/AP, Mike Stewart

The Equifax Inc., offices in Atlanta are shown on July 21, 2012. Canada’s privacy commissioner says Equifax fell short of its privacy obligations to Canadians during and after a global data breach last year. Privacy concerns included poor security safeguards, retaining information too long, inadequate consent procedures, a lack of accountability for Canadians’ information and limited protection measures offered to affected individuals after the breach. THE CANADIAN PRESS/AP, Mike Stewart

Equifax contravened Canada’s privacy law and fell short of its obligations to Canadians during and after a global data breach in 2017, federal privacy commissioner Daniel Therrien said Tuesday.

More than 143 million people around the world, including 19,000 Canadians, were affected by unauthorized access the financial services company’s systems.

“Given the vast amounts of highly sensitive personal information Equifax holds, and its pivotal role in the financial sector as a credit reporting agency, it was completely unacceptable to find such significant shortcomings in the company’s privacy and security practices,” Therrien said in a news release.

His office concluded the company’s deficiencies included poor security safeguards, a lack of accountability for Canadians’ information and limited protection measures offered to affected individuals after the breach.

READ MORE: Equifax hack compromised 100,000 Canadians’ personal data

The Office of the Privacy Commissioner also concluded that Equifax retained information too long.

Therrien said Equifax Canada and its U.S.-based parent company have agreed to improve their security, accountability and data destruction.

The company said it has co-operated with the investigation.

“Although Equifax does not agree with all of the OPC’s findings and recommendations, we value our relationship with the OPC and the work that it does to protect Canadian consumers,” the company said by email.

“Data security and combating cybercrime is an ongoing battle for all organizations which requires continued innovation and attention.”

The breach occurred when hackers gained access to one of Equifax Inc.’s systems on May 13, 2017 through a vulnerability in the software platform the company had known about for more than two months, but had not fixed.

The attackers operated undetected for about 77 days, ultimately gaining access to Canadian personal information unrelated to the compromised portal.

Equifax Inc. detected the attack on July 29, 2017 and contained it the following day. However, Equifax Canada wasn’t notified of the breach until just before the U.S. parent company publicly disclosed it on Sept. 7, 2017.

Canadians whose personal information was breached were notified the following Oct. 23, but letters sent to them included inaccurate information, including inviting them to use a portal that wasn’t accessible from Canada.

Of the 19 people complained to the privacy commission about Equifax, five said their personal information was compromised during the breach.

They alleged that Equifax shouldn’t have allowed their personal information to be compromised and they were surprised their information was in the United States at all.

Equifax Canada stored Canadians’ credit files on servers within the country and segregated from Equifax Inc.’s systems. However, the information of 19,000 Canadians was breached after they purchased products and services from Equifax Canada, with Equifax Inc. playing an integral role in delivering the purchases.

The the OPC said the transfer of information to the United States without the customers’ knowledge was inconsistent with its obligations to obtain consent before disclosing personal information to third parties located in another country.

The privacy office said it has launched a consultation on cross-border transfers that will result in clarified obligations about obtaining valid consent and accountability for protecting the information. Written submissions are accepted until June 4.

“We know there are advantages to transborder data flows, but individuals ought to — and do, under the law — have a say in whether their personal information will be disclosed outside Canada,” Therrien said.

“Whether this affects their decision to enter into a business relationship with an organization or to forego a product or service should be left to the discretion of the individual.”

While Equifax Canada offered free credit monitoring to breach victims for at least four years, other protections didn’t match what was offered by the parent company, including credit freezes that restrict access to credit files.

“Canadians affected by the breach face the same risks, and it is unfortunate that Equifax Canada refused to offer a credit freeze option to affected Canadians,” added Therrien.

Ross Marowits, The Canadian Press

Like us on Facebook and follow us on Twitter

Just Posted

Co-creatorsAdrianna Hatton and Malcolm McKenzie stand next to the little free library revealed Sunday at 9710 First St. (Wolf Depner/News Staff)
Literary crowd helps opens little free library in Sidney

Located at 9710 First St., the book sharing box features original art and reclaimed wood

Deep Cove Elementary School principal Shelley Hardcastle (right) and vice-principal Mary Kaercher help to restock Reay Creek with fish – in this case, coho fry – after a recent bleach spill killed hundreds of fish. (Wolf Depner/News Staff)
North Saanich’s Deep Cove Elementary School helps to restock Sidney’s Reay Creek

Restocking followed bleach spill that killed hundreds of fish in creek

A new report pegs the annual cost of hiring a third party to monitor use of pickleball courts in North Saanich at $12,000. (Black Press Media file photo).
North Saanich could end up hiring third party to monitor pickleball courts

Other options up for consideration include use of cameras and timed locks

The barred owl is the most likely to be spotted in the south Island. (Ann Nightingale photo)
Barred owls dominate Greater Victoria owl-scape

Western screech owl population decimated, partly due to barred owls

Between June 1 and 7, 168 net unconditional sales were made for properties in the VREB region. (Black Press Media file photo)
Victoria home sales slightly behind last June’s pace

Benchmark value of single-family home in Greater Victoria tops $1 million

At an outdoor drive-in convocation ceremony, Mount Royal University bestows an honorary Doctor of Laws on Blackfoot Elder and residential school survivor Clarence Wolfleg in Calgary on Tuesday, June 8, 2021. THE CANADIAN PRESS/Jeff McIntosh
‘You didn’t get the best of me’: Residential school survivor gets honorary doctorate

Clarence Wolfleg receives honorary doctorate from Mount Royal University, the highest honour the school gives out

Two-year-old Ivy McLeod laughs while playing with Lucky the puppy outside their Chilliwack home on Thursday, June 10, 2021. (Jenna Hauck/ Chilliwack Progress)
VIDEO: B.C. family finds ‘perfect’ puppy with limb difference for 2-year-old Ivy

Ivy has special bond with Lucky the puppy who was also born with limb difference

A million-dollar ticket was sold to an individual in Vernon from the Lotto Max draw Friday, June 11, 2021. (Photo courtesy of BCLC)
Lottery ticket worth $1 million sold in Vernon

One lucky individual holds one of 20 tickets worth $1 million from Friday’s Lotto Max draw

“65 years, I’ve carried the stories in my mind and live it every day,” says Jack Kruger. (Athena Bonneau)
‘Maybe this time they will listen’: Survivor shares stories from B.C. residential school

Jack Kruger, living in Syilx territory, wasn’t surprised by news of 215 children’s remains found on the grounds of the former Kamloops Indian Residential School

A logging truck carries its load down the Elaho Valley near in Squamish, B.C. in this file photo. THE CANADIAN PRESS/Chuck Stoody
Squamish Nation calls for old-growth logging moratorium in its territory

The nation says 44% of old-growth forests in its 6,900-square kilometre territory are protected while the rest remain at risk

Flowers and cards are left at a makeshift memorial at a monument outside the former Kamloops Indian Residential School to honour the 215 children whose remains are believed to have been discovered buried near the city in Kamloops, B.C., on Monday, May 31, 2021. THE CANADIAN PRESS/Darryl Dyck
‘Pick a Sunday:’ Indigenous leaders ask Catholics to stay home, push for apology

Indigenous leaders are calling on Catholics to stand in solidarity with residential school survivors by not attending church services

“They will never be forgotten, every child matters,” says Sioux Valley Chief Jennifer Bone in a video statement June 1. (Screen grab)
104 ‘potential graves’ detected at site of former residential school in Manitoba

Sioux Valley Dakota Nation working to identify, repatriate students buried near former Brandon residential school

The Queen Victoria statue at the B.C. legislature was splattered with what looks like red paint on Friday. (Nicole Crescenzi/News Staff)
Queen Victoria statue at B.C. legislature vandalized Friday

Statue splattered with red paint by old growth forest proponents

Most Read