Equifax Inc., offices are shown in Atlanta. File photo by THE ASSOCIATED PRESS

Equifax fell short of privacy obligations to Canadians, says privacy commissioner

Equifax contravened Canada’s privacy law and fell short of its obligations to Canadians during and after a global data breach in 2017, federal privacy commissioner Daniel Therrien said Tuesday.

More than 143 million people around the world, including 19,000 Canadians, were affected by unauthorized access the financial services company’s systems.

“Given the vast amounts of highly sensitive personal information Equifax holds, and its pivotal role in the financial sector as a credit reporting agency, it was completely unacceptable to find such significant shortcomings in the company’s privacy and security practices,” Therrien said in a news release.

His office concluded the company’s deficiencies included poor security safeguards, a lack of accountability for Canadians’ information and limited protection measures offered to affected individuals after the breach.

The Office of the Privacy Commissioner also concluded that Equifax retained information too long.

Therrien said Equifax Canada and its U.S.-based parent company have agreed to improve their security, accountability and data destruction.

The company said it has co-operated with the investigation.

“Although Equifax does not agree with all of the OPC’s findings and recommendations, we value our relationship with the OPC and the work that it does to protect Canadian consumers,” the company said by email.

“Data security and combating cybercrime is an ongoing battle for all organizations which requires continued innovation and attention.”

The breach occurred when hackers gained access to one of Equifax Inc.’s systems on May 13, 2017 through a vulnerability in the software platform the company had known about for more than two months, but had not fixed.

The attackers operated undetected for about 77 days, ultimately gaining access to Canadian personal information unrelated to the compromised portal.

Equifax Inc. detected the attack on July 29, 2017 and contained it the following day. However, Equifax Canada wasn’t notified of the breach until just before the U.S. parent company publicly disclosed it on Sept. 7, 2017.

Canadians whose personal information was breached were notified the following Oct. 23, but letters sent to them included inaccurate information, including inviting them to use a portal that wasn’t accessible from Canada.

Of the 19 people complained to the privacy commission about Equifax, five said their personal information was compromised during the breach.

They alleged that Equifax shouldn’t have allowed their personal information to be compromised and they were surprised their information was in the United States at all.

Equifax Canada stored Canadians’ credit files on servers within the country and segregated from Equifax Inc.’s systems. However, the information of 19,000 Canadians was breached after they purchased products and services from Equifax Canada, with Equifax Inc. playing an integral role in delivering the purchases.

The the OPC said the transfer of information to the United States without the customers’ knowledge was inconsistent with its obligations to obtain consent before disclosing personal information to third parties located in another country.

The privacy office said it has launched a consultation on cross-border transfers that will result in clarified obligations about obtaining valid consent and accountability for protecting the information. Written submissions are accepted until June 4.

“We know there are advantages to transborder data flows, but individuals ought to — and do, under the law — have a say in whether their personal information will be disclosed outside Canada,” Therrien said.

“Whether this affects their decision to enter into a business relationship with an organization or to forego a product or service should be left to the discretion of the individual.”

While Equifax Canada offered free credit monitoring to breach victims for at least four years, other protections didn’t match what was offered by the parent company, including credit freezes that restrict access to credit files.

“Canadians affected by the breach face the same risks, and it is unfortunate that Equifax Canada refused to offer a credit freeze option to affected Canadians,” added Therrien.

Just Posted

WATCH: Cars, airplanes, motorcyles on display at Red Deer Airport

Cars, motorcycle and airplane enthusiasts united at the Red Deer Airport Sunday… Continue reading

Wildfire crews watching for dangerous wind shift in High Level, Alta.

HIGH LEVEL, Alta. — Crews battling an enormous wildfire just outside the… Continue reading

New poll suggests one-third don’t want politicians to wear religious symbols

OTTAWA — While most Canadians firmly back the Charter of Rights and… Continue reading

Red Deer stamp-collecting event a hit, local club expected to start in fall

Postage stamp-loving Red Deerians can expect to have a place to gather… Continue reading

Red Deer woman one of three arrested by Sundre RCMP

The 19-year-old had numerous arrest warrants out of various jurisdictions

WATCH: Sunnybrook Farm Museum in Red Deer welcomes spring

Sunnybrook Farm Museum is celebrating spring in Red Deer. On Saturday, the… Continue reading

Cast your votes for the Best of Red Deer

Nominations for the Best of Red Deer Readers’ Choice Awards are officially… Continue reading

Bid to get D-Day beaches added to list of UN World Heritage Sites in limbo

OTTAWA — The beaches of Normandy, where the Allies stormed ashore to… Continue reading

Could this 20-year-old Montreal polyglot be Canada’s most multilingual student?

MONTREAL — Georges Awaad answers the phone with a polite “Hello,” but… Continue reading

Feds lay out proposed new rules for voice, video recorders in locomotives

OTTAWA — The federal Liberals have laid out their proposal for rules… Continue reading

Trump’s trophy day of sumo, golf and cheeseburgers in Japan

TOKYO — President Donald Trump presented a special U.S.-made trophy to the… Continue reading

Two dead, one seriously injured, following explosion in Calgary home’s garage

CALGARY — Police in Calgary say they believe a house fire where… Continue reading

Raptors fans spill onto the streets ahead of potentially historic game

Cars honked, exhilarated fans chanted and long lines formed outside bars and… Continue reading

Most Read