The privacy commissioner's office has received 15 notifications of a privacy breach and in each case the mortgage brokerage came forward voluntarily, Ms. Hayden said. Each of the notifications came from the Greater Toronto Area, and so the commissioner's office has chosen a sample of a handful of franchises in that area for its audit. Ms. Hayden declined to identify those brokerages.
The law currently does not require brokerages to come forward or volunteer the fact that a breach has occurred, and so the privacy commissioner's office is struggling to obtain the full picture.
Since Ontario's new laws governing mortgage brokers took effect last July, the Financial Services Commission of Ontario has conducted at least 68 investigations into the suitability of individuals who have applied for mortgage broker or agent licences, and at least two investigations involving unlicensed mortgage brokerage activities. It has sought to deny an application for a licence, or to revoke a licence, more than 25 times.
The U.S. subprime mortgage crisis shone a spotlight on mortgage brokers in that country. They have come under fire for, in many instances, not requiring enough information (such as proof of income) from borrowers, and for pushing them to take on homes that they could not afford. That's something that Mr. Selinger referred to when he introduced the new legislation in Manitoba this spring.
Peter Wakefield, vice-president of compliance at Mortgage Intelligence, which has offices in multiple provinces, said he has caught an individual applying to the brokerage with false credentials, and reported the incident to York regional police. “I actually caught him with a forged educational certificate,” he said.
Despite that incident, Mr. Wakefield said he believes there are enough rules governing the industry. “I think there are sufficient rules in place, but what may not be in place in all cases is common sense.”
The privacy commissioner's audit is being conducted under the Personal Information Protection and Electronic Documents Act, which governs how the private sector must protect consumers' data.
“An audit is a pro-active activity, and it allows us to go into an organization and get a sense of their personal information practices,” Ms. Hayden said. “We need to have reasonable grounds in order to conduct an audit.”
She said the commissioner's office hopes to progress quickly enough that it can discuss the issue in a 2009 annual report to Parliament.
