Hacks and Security Breaches
While organizations are happy to collect your private data, they aren't committed to protecting it as carefully as they do their own private information.
Instead, much of this data is protected only with the least effective (and least expensive) technology and some companies leave the information unprotected and available to anyone that can locate the server it is stored on.
The Equifax data breach is a great example of how weak protections are and how data breaches affect millions of people.
More Common Than You Think
Data breaches are more common than you'd think, given the infrequency of news reports. How often?
Every day. Multiple times. Every day, without question.
— Troy Hunt
Only the very largest breaches are reported in media and then often months or years after they actually happen.
Data breaches now happen so often that they rarely make the regular news cycle, but that doesn't make them any less dangerous. A data breach gives cybercriminals the chance to uncover your private information and use it for nefarious purposes, such as identity theft.
Breaches Go Back Years
These companies seldom report the loss until much later (often years later) and are not financially responsible because of their vague terms of service and poor privacy policies.
You only need to look at the way Facebook, Hotmail and others so quickly changed their privacy policies to enhance their profitability. You're on your own when it comes to protecting your identity.
Numbers Affected Understated
Often initial breach reports understate the actual number of affected accounts. Later reports progressively report larger numbers.
One example is the Yahoo breach which initially reported 500 million accounts were breached in 2013. Now we know that all 3 billion Yahoo accounts were affected including Yahoo Mail, Tumblr, Flickr and Fantasy Football.
The Motive: Financial Gain and Espionage
The primary purpose of hacking these sites is financial gain, although other factors such as espionage are likely factors.
Cyber criminals have placed 617 million hacked accounts for sale on the dark web, stemming from 16 separate data breaches.
Personal Data Revealed
Most large companies now make at least some of their income by collecting and analyzing personal data from people on social media, websites and more.
Companies like Facebook are based entirely on abusing that trust.
These companies seldom provide decent protection for collected information because they paid virtually nothing for it and the consequences of a data breach seldom affect their bottom line.
Neither Facebook nor Clearview AI suffered significant fines for their part in the scraping of millions of photos on Facebook accounts without permission in order to sell the data to police forces in North America, yet ordinary citizens can face huge fines when caught posting images not owned by them.
Everyday we hear about another undisclosed data breach. Private information being collected, sometimes sold, and given away without our knowledge or consent. CEOs sit before Congress saying they will "do better" while stories continue to break about negligence and wrong-doing.
There have been at least 200 documented data breaches since 2005, and the number of records exposed is only on the rise as more folks move their lives online. It's impossible to know the impact and extent to which data breaches are occurring as many almost certainly go unreported.
— Interest.com (2019)
Each year the number and severity of data breaches, compromised accounts is becoming increasingly frequent and more severe.
Example Privacy Breaches
A new study looking into data breaches in 2019 found that on average, a US citizen had their personal information leaked to the public at least four times. This is only based on publicly reported data and leaves out hundreds of other breaches that may have occurred behind closed doors.
- The average American had personal information stolen at least 4 times in 2019.
- 15 million LifeLabs customers had their data hacked in late October.
- PDL data leak affected 1.2 billion.
- Last year 28 million Canadians were impacted by data breaches.
This is unprecedented: almost half of all people in Canada had their sensitive, personal information from a medical testing company hacked and stolen. And it took over 6 weeks for the public to be informed.
Be sure to read the resource links at the bottom of the OpenMedia petition to understand the scope of the problem and why action must be taken to stop this loss of personal data.
Over 75% of Canadians Affected
In the first year that reports are mandatory under PIPEDA ending October 31, 2019, the OPC received 680 breach reports affecting more than 28 million Canadians, six times as many as the year before.
|Type of incident||Total breach reports|
Clearly breaches of private businesses has been greatly undereported.
Where is the Accountability?
Would you simply shrug your shoulders if your bank “lost” your life savings because of lax security? Why should mass data breaches be any different?
Many of these companies either are unaware that the breach took place (indicating technical incompetence) or have opted not to report the breach to those affected (essentially fraud).
Insufficient security resources to protect the information in their care should not be an accounting decision.
Clearly, company executives have no skin in the game. They should be personally liable with their personal assets on the line.
Government Agencies and Political Parties
Privacy should start with our government representatives. It is shocking that our federal parties totally ignore privacy laws and that our governments not only spy on us but share that information widely both internally and internationally.
Buying Power Influence
Consumers need to assess privacy in their purchase decisions. This hits business where it hurts.
First, as consumers we need to stop shrugging and accepting data leaks as business as usual. Security should influence our buying decisions: the organisations we deal with won't take security seriously unless customers and the public do, too.
Canada's businesses and employees need to understand that ignoring the problem is not acceptable and that the consequences for businesses and employees involved could be significant. Failure to report a breach is fraud.
Employee Snooping is Fraud
Employee snooping, whether malicious or simple curiosity, needs to be stopped. A “need to know” should be a first line of defense backed by severe penalties for failure to protect privacy.
Not only should personal data be protected by excellent security, but there should be a tracking system that records who accessed the data and when.
Businesses should be responsible for their employees. Training in security, accountability and ethics as a condition of employment is the least of those responsibilities.
Responding to Privacy Breaches
Responding to such shocking numbers is important. Canada's privacy laws are over 35 years old and greatly out of date, especially compared with other countries.
Existing laws pre-date the Internet, cell phones, social media not to mention wide-spread surveillance and data collection.
Unfortunately the current Liberal government took the road of further compromising personal privacy in their recent attempts to address privacy in the 21st century with Bill C-11:
We were told that Bill C-11 would introduce huge fines for privacy violations. We put it to the test and it completely fails.
We need to look at how technology can be used to catch criminals or remove their access to Canadian phones and email accounts.
If companies faced massive fines for failing to protect the data they collect “just in case” its useful, they would be far less likely to collect it as well as secure what they collected more effectively.
While Bill C-11 was supposed to provide these sorts of fines, it needs revision if it is to succeed.
Our government boasted about imposing some of the highest fines for privacy violations in the world.
Now we know these fines won't apply to many of Canada's most high profile and egregious privacy incidents over the last few years.
Failure to Report Privacy Breaches
Canadian businesses and organizations are legally required to report privacy breaches. Hoping it goes away could cost you both customer loyalty and significant fines.
- Report a privacy breach at your business.
- What you need to know about mandatory reporting of breaches of security safeguards.
Legislation is Probably Required
These large numbers indicate that most individuals in Canada have already been affected. We need to stop unsafe practices and start treating ignorance as a public menace.
Too often we try to tell folks how to protect themselves, but how to you protect yourself from credit card and other information stolen from retailers other than by strictly using cash and refusing any personal details such as requests for your email address to “email your receipt.”
You should receive a printed receipt with your transaction, so you're providing information with little return value to yourself compared to the future value of your email address to the retailer.
Corporations must be held legally and financially accountable for security breaches that affect customers. There need to be fines, investigations, and court-ordered consequences. Money needs to be spent on lawyers—a lot of money. The current model where customers have to spend their own money and energy to bring lawsuits to bear is unreasonable.