Tag Archives: personal information
Ottawa probes mortgage brokerages
Borrowers’ personal data at risk of misuse, privacy chief says
By Tara Perkins – Globe and Mail
The federal privacy commissioner is auditing a number of mortgage brokerages because of concerns about the security of borrowers’ personal financial information, The Globe and Mail has learned.
The audit, which industry sources say began this month, is looking into the potential misuse of consumers’ information to carry out fraud such as identity theft. It’s an issue that carries added significance in the wake of the U.S. subprime mortgage crisis, because mortgage brokers and lenders are now being pushed to request even more information and documentation from borrowers.
“The reason that we are doing this is we have been concerned that personal financial information of Canadians might have been falling into the wrong hands,” said Anne-Marie Hayden, a spokeswoman for the privacy commissioner’s office. “There have been numerous breaches reported to our office over the course of the last year or so.”
Ms. Hayden stressed that the audit is still in the preliminary stages, and it is too early to say what practices within the industry it might uncover.
While slightly more than half of all mortgages in Canada are sold by staff of the big banks, the broker channel, made up of about 16,000 brokers, is responsible for about 30% of mortgage activity, according to the Canadian Association of Accredited Mortgage Professionals (CAAMP).
In the year up to March, total mortgaging activity in the country (including renewals) was about $235-billion.
Borrowers turn over a large amount of information about themselves in order to make what, in nearly all cases, is the biggest purchase of their lives.
Independent mortgage professionals are subject to provincial laws, and the standards governing the industry vary across the country. British Columbia and Alberta, for instance, each require mortgage brokers to have a certain level of training. Ontario tightened its standards for education and licensing with legislation that took effect last year. Manitoba Finance Minister Greg Selinger introduced legislation in April that requires mortgage brokers to be licensed.
Jim Murphy, president and chief executive officer of CAAMP, said most brokerage firms have policies and procedures in place to deal with the safeguarding of borrowers’ data and fraud avoidance. The privacy laws are so strict that there have been instances where brokers have had trouble sharing information with police, he said.
But many in the industry say that government and regulators need to do more to ensure that brokers are above board.
“There is tremendous fraud going on in the broker industry,” said Alex Haditaghi, chief executive of Mortgagebrokers.com, a Toronto-area mortgage broker. The privacy commissioner’s probe is “much needed,” he added.
Mr. Haditaghi said his firm carries out credit checks and criminal record checks on brokers before they join the company, and has put a privacy policy in place.
The Financial Services Commission of Ontario, which is responsible for the oversight of mortgage brokers in that province, recently issued a warning to the industry that it has “received a number of complaints from mortgage brokerages regarding fraudulent activities by their mortgage agents, who were fraudulently accessing clients’ credit information without proper authorization.
“The mortgage brokering industry’s reliance on personal information to complete mortgage transactions makes it a target for individuals who wish to gain access to personal information for the purpose of engaging in criminal activities.” Brokers are required to obtain the borrower’s consent to check their credit history.
An official at one mortgage brokerage said in an interview that a broker signed up with their firm and proceeded to carry out hundreds of credit checks in the span of 24 hours.
The privacy commissioner’s office has received 15 notifications of a privacy breach and in each case the mortgage brokerage came forward voluntarily, Ms. Hayden said. Each of the notifications came from the Greater Toronto Area, and so the commissioner’s office has chosen a sample of a handful of franchises in that area for its audit. Ms. Hayden declined to identify those brokerages.
The law currently does not require brokerages to come forward or volunteer the fact that a breach has occurred, and so the privacy commissioner’s office is struggling to obtain the full picture.
Since Ontario’s new laws governing mortgage brokers took effect last July, the Financial Services Commission of Ontario has conducted at least 68 investigations into the suitability of individuals who have applied for mortgage broker or agent licences, and at least two investigations involving unlicensed mortgage brokerage activities. It has sought to deny an application for a licence, or to revoke a licence, more than 25 times.
The U.S. subprime mortgage crisis shone a spotlight on mortgage brokers in that country. They have come under fire for, in many instances, not requiring enough information (such as proof of income) from borrowers, and for pushing them to take on homes that they could not afford. That’s something that Mr. Selinger referred to when he introduced the new legislation in Manitoba this spring.
Peter Wakefield, vice-president of compliance at Mortgage Intelligence, which has offices in multiple provinces, said he has caught an individual applying to the brokerage with false credentials, and reported the incident to York regional police. “I actually caught him with a forged educational certificate,” he said.
Despite that incident, Mr. Wakefield said he believes there are enough rules governing the industry. “I think there are sufficient rules in place, but what may not be in place in all cases is common sense.”
The privacy commissioner’s audit is being conducted under the Personal Information Protection and Electronic Documents Act, which governs how the private sector must protect consumers’ data.
“An audit is a pro-active activity, and it allows us to go into an organization and get a sense of their personal information practices,” Ms. Hayden said. “We need to have reasonable grounds in order to conduct an audit.”
She said the commissioner’s office hopes to progress quickly enough that it can discuss the issue in a 2009 annual report to Parliament.
————————————————————————————————————
Contact the Jeffrey Team for more information - 416-388-1960
————————————————————————————————————
Broken Records
Privacy Commissioner’s comment on examination of records
By Andrea C. Krywonis
Gardiner Miller Arnold LLP, Barristers and Solicitors
1202 – 390 Bay Street, Toronto, Ontario M5H 2Y2
PH: 416-363-2614 | FX: 416-363-8451
gerry.miller@gmalaw.ca | www.gmalaw.ca
When the Personal Information Protection and Electronic Documents Act (Canada) (“PIPEDA”) was first introduced in 2000, some condo lawyers took the position that condominium corporations were exempt from its application because condos do not accumulate private information for commercial purposes. Instead, condos function within the authority of the Condominium Act, 1998 (the “Act”) to manage the property and assets of the condo, as a non-profit organization.
Nonetheless, court and Privacy Commissioner’s rulings have taken the opposite stance and equate the operation of condominium corporations to commercial activity. The Privacy Commissioner’s Case Summary #301 found that a condominium corporation must implement practices to protect personal information and ensure that there is a complaint and inquiry process available with respect to privacy. In Rodgers v. Calvert, the Ontario Superior Court found that any organization, whether non-profit or for-profit, that collects, uses or discloses personal information in the course of commercial activity is subject to PIPEDA.
If we apply the Rodgers principle to condos, the hiring of a property manager or maintenance contractor can be considered commercial activity and most condos collect, use or disclose personal information in the course of administration. Therefore, in most cases where a property manager is hired (and in most condos, such is the case), PIPEDA correspondingly applies and creates restrictions on disclosure of personal information. What then, of requests for examination of records under sec-tion 55(3) of the Act? While access to records came before the courts under the Old Act in the context of the provision or appropriateness of disclosure, it has not yet been adjudicated in the context of PIPEDA.
A colleague of ours has circulated a copy of a letter from the Acting General Counsel of the Office of the Privacy Commissioner of Canada. This letter provides the Privacy Commissioner’s com-ment on PIPEDA and its interaction with section 55 of the Act. An excerpt from the letter states:
“Section 55 of the provincial [Condominium] Act sets out a list of records that a condominium corporation is required to keep, and gives the owner of a unit the right to examine the records of the corporation, subject to specified exceptions. I note under the exception in paragraph 55(4)(c), a unit owner does not appear to be entitled to records relating to specific unit owners.
To the extent that records requested by a third party contain personal information about other individuals, and do not fall within the exception in paragraph 55(4)(c) of the Ontario [Condominium] legislation, the relevant provision under PIPEDA is paragraph 7(3)(i). This provision permits an organization to disclose personal information without the knowledge or consent of the individual if the disclosure is “required by law”. This provision has been interpreted by our Office to include provincial laws. Thus, to the extent that a condominium corporation is required under Ontario legislation to disclose personal information to a third party requester, PIPEDA enables that disclosure to take place.
As noted however, it appears that at least some categories of personal information are protected under Ontario’s Condominium Act.”
This commentary is not groundbreaking. Moreover, the Privacy Commissioner’s letter and Case Summary are not binding precedent. They are, nonetheless, helpful in reinforcing what we have come to accept about how PIPEDA and condos interact and emphasize the need for condominium corporations to have a privacy policy.
PIPEDA has crept into the condo world and it appears that disclosure of records relating to specific owners, normally excepted by s. 55(4)(c), must be made if “required by law.” “Required by law” could mean required under provincial or federal laws or legislation and we suggest that the definition is easily be expanded to federal statutes such as the Criminal Code or Income Tax Act. Hopefully, a condo will not be put into the position to make such a judgment call – as always, take heed and consult your lawyer should you have any concerns with a request to examine records or to implement a privacy policy in your condo.
————————————————————————————————————
Contact the Jeffrey Team for more information – 416-388-1960

















