Equifax fell short of privacy obligations to Canadians, says privacy commissioner

More than 143 million people around the world, including 19,000 Canadians, were affected

The Equifax Inc., offices in Atlanta are shown on July 21, 2012. Canada’s privacy commissioner says Equifax fell short of its privacy obligations to Canadians during and after a global data breach last year. Privacy concerns included poor security safeguards, retaining information too long, inadequate consent procedures, a lack of accountability for Canadians’ information and limited protection measures offered to affected individuals after the breach. THE CANADIAN PRESS/AP, Mike Stewart

The Equifax Inc., offices in Atlanta are shown on July 21, 2012. Canada’s privacy commissioner says Equifax fell short of its privacy obligations to Canadians during and after a global data breach last year. Privacy concerns included poor security safeguards, retaining information too long, inadequate consent procedures, a lack of accountability for Canadians’ information and limited protection measures offered to affected individuals after the breach. THE CANADIAN PRESS/AP, Mike Stewart

Equifax contravened Canada’s privacy law and fell short of its obligations to Canadians during and after a global data breach in 2017, federal privacy commissioner Daniel Therrien said Tuesday.

More than 143 million people around the world, including 19,000 Canadians, were affected by unauthorized access the financial services company’s systems.

“Given the vast amounts of highly sensitive personal information Equifax holds, and its pivotal role in the financial sector as a credit reporting agency, it was completely unacceptable to find such significant shortcomings in the company’s privacy and security practices,” Therrien said in a news release.

His office concluded the company’s deficiencies included poor security safeguards, a lack of accountability for Canadians’ information and limited protection measures offered to affected individuals after the breach.

READ MORE: Equifax hack compromised 100,000 Canadians’ personal data

The Office of the Privacy Commissioner also concluded that Equifax retained information too long.

Therrien said Equifax Canada and its U.S.-based parent company have agreed to improve their security, accountability and data destruction.

The company said it has co-operated with the investigation.

“Although Equifax does not agree with all of the OPC’s findings and recommendations, we value our relationship with the OPC and the work that it does to protect Canadian consumers,” the company said by email.

“Data security and combating cybercrime is an ongoing battle for all organizations which requires continued innovation and attention.”

The breach occurred when hackers gained access to one of Equifax Inc.’s systems on May 13, 2017 through a vulnerability in the software platform the company had known about for more than two months, but had not fixed.

The attackers operated undetected for about 77 days, ultimately gaining access to Canadian personal information unrelated to the compromised portal.

Equifax Inc. detected the attack on July 29, 2017 and contained it the following day. However, Equifax Canada wasn’t notified of the breach until just before the U.S. parent company publicly disclosed it on Sept. 7, 2017.

Canadians whose personal information was breached were notified the following Oct. 23, but letters sent to them included inaccurate information, including inviting them to use a portal that wasn’t accessible from Canada.

Of the 19 people complained to the privacy commission about Equifax, five said their personal information was compromised during the breach.

They alleged that Equifax shouldn’t have allowed their personal information to be compromised and they were surprised their information was in the United States at all.

Equifax Canada stored Canadians’ credit files on servers within the country and segregated from Equifax Inc.’s systems. However, the information of 19,000 Canadians was breached after they purchased products and services from Equifax Canada, with Equifax Inc. playing an integral role in delivering the purchases.

The the OPC said the transfer of information to the United States without the customers’ knowledge was inconsistent with its obligations to obtain consent before disclosing personal information to third parties located in another country.

The privacy office said it has launched a consultation on cross-border transfers that will result in clarified obligations about obtaining valid consent and accountability for protecting the information. Written submissions are accepted until June 4.

“We know there are advantages to transborder data flows, but individuals ought to — and do, under the law — have a say in whether their personal information will be disclosed outside Canada,” Therrien said.

“Whether this affects their decision to enter into a business relationship with an organization or to forego a product or service should be left to the discretion of the individual.”

While Equifax Canada offered free credit monitoring to breach victims for at least four years, other protections didn’t match what was offered by the parent company, including credit freezes that restrict access to credit files.

“Canadians affected by the breach face the same risks, and it is unfortunate that Equifax Canada refused to offer a credit freeze option to affected Canadians,” added Therrien.

Ross Marowits, The Canadian Press

Like us on Facebook and follow us on Twitter

Get local stories you won't find anywhere else right to your inbox.
Sign up here

Just Posted

Bystanders attend to a cyclist who is knocked to the pavement of Oak Bay Avenue. Witnesses say the cyclist was knocked off their bike in a dooring incident on Oak Bay Avenue at Fell Street at around 12:40 p.m. on Wednesday. 
(Daniel Opden Dries Photo)
Cyclist ‘doored’ on Oak Bay Avenue

Incident occurred at Oak Bay Avenue and Fell Street

The growing field lacrosse program at Royal Bay Secondary has produced a number of scholarships for its players to American universities, starting in the fall 2021. (Aaron Guillen/News Staff)
Five Royal Bay students sign Lacrosse scholarships at U.S. universities

“It’s a village that raises these kids,” says lacrosse coach

file
Oak Bay resident bilked $3,300 in puppy scam

Three cases of fraud reported in two days

Air Canada Jazz flight 8075 on Nov. 18 and 8081 on Nov. 19 from Vancouver to Victoria have been added to the BCCDC flight exposure list. (Black Press Media file photo)
COVID-19 exposures reported on two flights from Vancouver to Victoria

Air Canada Jazz flights on Nov. 18, 19 have been added to BCCDC exposure list

Sidney and Central Saanich fire crews responded to a small fire at Eurosa Farms Tuesday evening. (Courtesy of Ryan Worsfold)
Small fire extinguished at Brentwood Bay flower farm

Family-run business sprang into action after smelling smoke at Eurosa Farms

Provincial health officer Dr. Bonnie Henry updates B.C.’s COVID-19 situation at the B.C. legislature, Nov. 23, 2020. (B.C. government)
B.C. daily COVID-19 cases hits record 941 on Tuesday

Further restrictions on indoor exercise take effect

Anyone with information on any of these individuals is asked to call 1-800-222-TIPS (8477) or visit the website victoriacrimestoppers.ca for more information.
Greater Victoria Crime Stoppers wanted list for the week of Nov. 24

Greater Victoria Crime Stoppers is seeking the public’s help in locating the… Continue reading

(AP Photo/Haven Daley)
POLL: Do you think the current COVID-19 restrictions should continue beyond Dec. 7?

One week into the new restrictions to curtail the spread of the… Continue reading

An excavator was stolen from a rural property south of Nanaimo this month, say police. (Photos submitted)
Excavator stolen from property south of Nanaimo

Bobcat Mini believed to have been stolen between Nov. 12-14, say RCMP

Krista Macinnis displays the homework assignment that her Grade 6 daughter received on Tuesday. (Submitted photo)
B.C. mom angry that students asked to list positive stories about residential schools

Daughter’s Grade 6 class asked to write down 5 positive stories or facts

B.C. projects targeting the restoration of sockeye salmon stocks in the Fraser and Columbia Watersheds will share in $10.9 million of federal funding to protect species at risk. (Kenny Regan photo)
13 projects protecting B.C. aquatic species at risk receive $11 million in federal funding

Salmon and marine mammals expected to benefit from ecosystem-based approach

Picture of two swans leaving the Cowichan estuary moments before one was shot out of the sky. (Submitted photo)
Petition to stop hunting in Cowichan estuary after swan shot

Hunters blame shooting on illegal poachers

Bob Higgins pulls the gate across on the elevator built inside his home. (Photo by Don Bodger)
Island man’s expertise earns international award with home-built elevator

Experience put to use in winning contest entry for furniture and home projects

Barrels pictured outside Oliver winery, Quinta Ferreira, in May. (Phil McLachlan - Black Press Media)
B.C. Master of Wine reflects on industry’s teetering economic state

Pandemic, for some wine makers, has been a blessing in disguise. For others, not so much.

Most Read