Canadian businesses must do better at locking up digital personal information they collect from their customers, according to a new report from the federal Privacy Commissioner.
"Too often, we see personal information compromised because a company has failed to implement elementary security measures such as using encryption on laptops," Privacy Commissioner Jennifer Stoddart said in her 2007 annual report on the Personal Information Protection and Electronic Documents Act. The report is based on data voluntary submitted by companies to the Office of the Privacy Commissioner. Industry Canada is working on a plan to make it mandatory for companies to report when their data security is breached.
Big corporations, including banks, are among those reporting the most security breaches. However, Ms. Stoddart said she is concerned that few small and medium-sized businesses report when their customers' information becomes compromised.
"These numbers were just from voluntary reports, so you can extrapolate what the real-world scenario would look like," said Andrew White, president and chief executive officer of Toronto-based Route1 Inc., a digital security company that specializes in remote desktop technology. "What we should be doing is allowing people access to the information without actually having it there."
Nine out of 10 Canadians whose personal data were compromised were "put at risk" because their information was stored in an insecure electronic format without a firewall or encryption technology, Ms. Stoddart said. Lost and stolen laptop computers are one of the most common sources for data leaks.
According to a recent study from the Canadian Association of Police Boards, Canadians are now more likely to be victims of crime over the Internet than they are on the street.
Meanwhile, application developers aren't doing enough to protect the privacy and personal data of Canadians online, said Elisabeth Rybak, co-chief executive of TrustMe Security, a Moncton company that builds data encryption platforms. "We have embraced the Internet and computing in our daily lives, and there is unprecedented access to private and confidential information about us available."