[37] Bill 26 Original (PDF)
Bill 26 2002
An Act to provide civil remedies
for the victims of identity theft
Her Majesty, by and with the advice and consent of the Legislative Assembly of the Province of Ontario, enacts as follows:
Definitions
1. In this Act,
"financial institution" means a bank listed in Schedule I or II to the Bank Act (Canada), a loan company or loan corporation or a trust company or trust corporation registered or incorporated under the Loan and Trust Corporations Act or the Trust and Loan Companies Act (Canada), or a credit union or caisse populaire incorporated or registered under the Credit Unions and Caisses Populaires Act, 1994; ("institution financière")
"identity theft" means the offence of fraud under section 380 or the offence of personation under section 403 of the Criminal Code (Canada), using personal information; ("vol d'identité")
"institution" means institution within the meaning of the Freedom of Information and Protection of Privacy Act and the Municipal Freedom of Information and Protection of Privacy Act; ("institution")
"personal information" means personal information within the meaning of the Freedom of Information and Protection of Privacy Act. ("renseignements personnels")
Application for certificate
2. (1) Every person who is the victim of identity theft may apply to the Deputy Attorney General for the issuance of a certificate confirming their identity and the fact that they have been the victim of identity theft.
Certificate proof of facts
(2) For all purposes, a certificate issued under subsection (1) is proof of the facts stated in it and may be filed with any institution, financial institution or similar body.
Certificate enforceable
(3) Any institution, financial institution or similar body with which a certificate has been filed under subsection (2) shall act upon the directions set out in the certificate as if the certificate were an order of a court.
Conviction not required
3. A certificate may be issued under section 2 whether or not any person is charged with, prosecuted for or convicted of identity theft but the Deputy Attorney General may, on his or her own initiative or upon application, delay issuing the certificate pending the final determination of a prosecution or intended prosecution.
Orders
4. (1) The Deputy Attorney General in issuing a certificate under section 2, shall include in the certificate,
(a) such directions as are necessary to correct any personal information held by any institution; and
(b) such directions as are necessary to correct any personal information held by any financial institution or by any consumer reporting agency within the meaning of the Consumer Reporting Act.
Contents of certificate
(2) The certificate under section 2 shall set out,
(a) the full legal name of the victim of identity theft;
(b) the time period during which the identity theft occurred; and
(c) confirmation that the victim of identity theft is not liable for any actions or omissions of any person known or unknown who has committed the identity theft.
Damages
5. (1) Every person who is the victim of identity theft has a right of action for damages arising from the identity theft against the person who committed the identity theft.
Same
(2) No penalty or imprisonment is a bar to the recovery of damages by the victim of identity theft.
Same
(3) A person making a claim under subsection (1) may recover damages without proof of special damages.
Same
(4) Every person who is the victim of identity theft has a right of action for damages against any financial institution or consumer reporting agency that,
(a) knowingly or recklessly accepts personal information acquired by identity theft; or
(b) without lawful justification, fails or refuses to take corrective action after a certificate has been filed with it under section 2.
Protection from personal liability
6. No action or other proceeding for damages shall be instituted against any institution or any employee or agent of such institution for any act done in good faith in the execution or intended execution of a duty, authority or service under any statute or regulation of Ontario or for any alleged neglect or default in the execution in good faith of that duty, authority or service.
Commencement
7. This Act comes into force on the day it receives Royal Assent.
Short title
8. The short title of this Act is the Victims of Identity Theft Act, 2002.
EXPLANATORY NOTE
The Bill provides that a person may apply to the Deputy Attorney General for the issuance of a certificate establishing that they have been a victim of identity theft. The certificate shall contain such directions as are necessary to correct personal information held by public sector organizations, financial institutions and credit reporting agencies. The certificate may be issued even if there is no conviction of a person for identity theft.
The Bill also provides that a person may bring an action for damages against the perpetrator of identity theft and against financial institutions and consumer reporting agencies that knowingly or recklessly accept personal information acquired by identity theft or, without lawful excuse, fail to take corrective action after a certificate has been filed with them.
The Bill does not provide a right of action against a public sector organization, an employee or agent of a public sector organization for any act done in good faith to carry out a duty, authority or service or for alleged neglect or default in carrying out in good faith that duty, authority or service.