- The document summarizes a manual for responding to identity crime victims. It outlines the roles and responsibilities of individual victims, institutional victims, law enforcement, and other private sector actors. - Individual victims bear primary responsibility for detecting, mitigating, and seeking compensation for damages from identity crime. However, Canadian legislation does not clearly define responsibilities of institutions or provide many legal protections for victims. - The recovery process for victims is difficult given the lack of requirements for institutions to assist, inconsistencies across jurisdictions, and limited rights for victims to access documents or have fraudulent records removed. Reform is still needed to better support victims of identity crime in Canada.

1. Responding to
Victims of Identity
Crime: A Manual
for Law
Enforcement
Agents, Prosecutors
and Policy-Makers
Presentation by: Matthew Kwong

2. Background Information
– Published by the International Centre for Criminal Law Reform and
Criminal Justice Policy (ICCLR)
– Manual meant to assist law-enforcement personnel with responding
to identity crime
– Contains information on what is legally required of victims,
institutions and law-enforcement in the case of identity crime

3. Actors Involved in Identity Crime
– Individual victims – may be victimized directly or indirectly
through a compromised institution
– Institutional victims – includes government and financial
agencies
– Law enforcement – includes police, various legal agencies and
prosecutors
– Other – a catch-all term for everyone else who may be
involved, including service providers, debt collectors and
financial institutions (when not directly targeted by the crime)

4. Individual Victims
– Responsible for notifying all relevant financial institutions –
banks, credit bureaus, creditors, etc – about occurrence of
fraud
– Cancel all compromised payment cards
– Obtain credit reports and monitor accounts to prevent future
fraud
– Responsible for re-establishing identity by obtaining new
documents
– Pursue compensation for damages under civil law if possible –
assuming perpetrator is caught

5. In Other Words...
– Individuals have primary responsibility for detecting, mitigating and
seeking compensation for damages
– Also have responsibility for restoring reputation to pre-crime status
– Institutions and law enforcement may provide information to
individual victims, but are not required to provide assistance

6. Institutional Victims
– Have a right to sue for damages if an institutional trademark
is used fraudulently – considered intellectual property crime
– Responsible for taking immediate measures to prevent further
damages from identity crime
– Generally responsible (depends on jurisdictional legislation) for
notifying individuals who were affected by a security breach
– When the individual victim is not responsible for damages,
release individual from liability
– Reporting to and cooperating with law enforcement

7. A Conflict of Interest
– Institutions are often reluctant to release specific information
regarding the crime to law enforcement and individual victims
– They may however have a legal responsibility to disclose information
– Such information may include IP addresses, telephone numbers,
transaction documents and any other relevant records

8. Law Enforcement
– Keep a record of all reported cases of identity crime and input the
information into appropriate databases
– If possible, investigate the crime and gather evidence from victims,
witnesses, etc
– Cooperate with other law enforcement agencies to investigate cross-
jurisdictional identity crime and other ongoing investigations
– Provide information to victims on how to mitigate damages from
crime and their rights in the situation (in the case of a prosecutor)
– Refer victim to a victim support center for assistance

9. Police Complications
– Law enforcement assistance to victims is mostly restricted to
providing information – i.e. this manual
– Crime investigation and victim assistance becomes more complex
when involving multiple jurisdictions
– Jurisdictions need to be determined, the appropriate agencies
contacted and coordination maintained between multiple agencies

10. Other (Private Sector)
– Be proactive – monitor accounts for suspicious activity and
notify affected individuals as appropriate
– Take necessary precautions when approving credit applications
– If there is reason to believe that identity fraud has occurred,
do not hold victims responsible for incurred debt
– Provide victims with information on how to mitigate damages
and secure new identity documents
– Cooperate with law enforcement by providing all relevant
information on the fraudulent transaction as well as any other
assistance

11. A Legal Grey Area
– The private sector is encouraged to help mitigate damages to a
victim’s credit rating and monitor for suspicious activity
– Nonetheless there is no clearly defined legal requirement for
corporations to do so
– Responsibilities for the private sector is centered on due diligence and
mostly reactionary in nature

12. Pursuit of Liability
– There is no Canadian legislation which protects individual victims
from liability in the case of fraud
– Canadian credit card companies have no liability for electronic
transactions and limited liability elsewhere
– Banks are encouraged not to hold consumers liable for fraudulent
transactions under the Canadian Code of Practice for Consumer
Debit Card Services, but are not required to do so
– In contrast, the US has legislation which protects or limits
individual victims from liability, depending on how promptly the
fraud is reported

13. Double Victimization
– Recovering from identity crime is difficult because victims
must convince others that a fraud has occurred
– Canadian legislation governing debt collectors is restricted to
preventing over-harassment of debtors, not outright preventing
it
– There is no legal requirement for debt collectors to cease trying
to collect funds even after a fraud has been discovered
– In the US, legislation mandates that credit bureaus minimize
damages to victims by notifying companies that fraud may
potentially have occurred

14. Recovery Process for Victims
– Victims in Canada generally do not have a right to access documents
regarding fraudulent transactions
– There is no formal program for repairing a victim’s reputation after
identity crime
– Generally credit bureaus in Canada are required to provide
notification of inaccurate information resulting from fraud, but this
can take anywhere from 2 months to a year
– US legislation allows victims the right to access records to
transactions
– Credit bureaus in the US are required to erase fraudulent records if
conditions are met

15. Detecting and Mitigating Damages
– Under PIPEDA, companies are required to “safeguard” private and
sensitive information
– Actual requirements are vague – institutions may or may not be
required to detect and report fraud
– Laws are inconsistent across the country – credit bureaus under duty
to report accurate information but not specifically to combat fraud
– US law mandates that institutions notify affected parties in the
event of a data security breach
– Individual victims in US have the right to voluntarily place fraud
alerts and credit freezes on credit files, but in Canada this right
exists only in two provinces

16. Restitution
– Criminal injuries compensation applies to violent crime, not identity
crime
– Victims may claim restitution for expenses incurred to re-establish
identity, but only in the minority of cases where prosecution and
conviction occurs
– PIPEDA allows damages to be rewarded for privacy violations in
rare instances
– Generally there is no right of action for lawsuits – even if successful,
compensation may or may not be able to cover legal expenses
– Identity crime victims in US have a right of action to civil suits and
may receive increased compensation

17. Criminal Sanctions
– If prosecution occurs, victims have the right to information
regarding proceedings and to file a victim impact statement to
the court (s.722)
– The Criminal Code carries a maximum sentence of 5 years for
identity theft (s. 402.2)and 10 years for identity fraud (s.403)
– US law features stricter punishments for identity crime,
ranging from 10 to 20 years
– Identity criminals in the US must serve multiple sentences
consecutively and may not apply for parole

18. In Conclusion...
– Canadian legislation surrounding identity crime is vague and
convoluted
– Legislation varies widely between provinces, creating various
jurisdictional problems
– Victims do not have a legal right to protection and institutions are
not legally required to act
– This means that the recovery process is difficult and institutions are
reluctant (and not obligated) to take responsibility
– Law reform is still required in this area

19. And this concludes my presentation, Thank
You for your Attention