Data Protection: Delayed Reaction

PHOTO CREDIT: Markus Spiske (Unsplash)

One sunny afternoon in June 2019, the media reported that Desjardins, the financial cooperative that almost half of Quebecers bank with, had been the target of the biggest security breach in the Province’s history. A malicious employee at the financial institution had sold the identities of millions of consumers in exchange for gift cards from a popular rotisserie.

For the public, this unfortunate episode was a revelation. Suddenly, many Quebecers realized just how insecure their data is, even when it is entrusted to an established company. Consumers who signed up for Equifax’s credit monitoring program also realized that their credit files were being managed by corporations with questionable business practices and poor customer service.

Should we be surprised? Not really. For years, experts have been saying that companies are reckless in the way they manage our digital data and that they don’t invest sufficiently in cyber security. For decades, consumer associations have been complaining about a myriad of problems with credit agencies, ranging from inaccurate credit reports, consumers’ difficulties with filing complaints, and questionable secondary uses of the data entrusted to these agencies

In spite of all these glitches, nothing helped: the laws remained unchanged, governments stood still and consumers were left to fend for themselves. While other countries were passing laws to deal with the challenges of digital technology, Quebec just stood and watched the parade go by.

By bringing the issue of data protection into the public sphere, the Desjardins affair at least got the government to act. In quick succession, they announced a bill to better supervise credit agencies, another to strengthen privacy laws, and finally, the creation of a digital identity for Quebecers.

That, of course, was encouraging news. But it still left many questions unanswered. Why did they take so long to act, when civil society had been sounding the alarm for years? Why did we let this happen at a time when legislation was being passed all over the world? If governments had acted more quickly, could the Desjardins disaster have been avoided?

We like to maintain the myth that Quebec is an avant-garde jurisdiction that is particularly mindful of the rights of consumers. While this may have been true in the past, we now have to admit that Quebec is lagging behind other countries in many respects—and that it took a disaster like this for us to finally decide that the public needs to be protected.

Let’s hope that our governments will learn something from this and make sure that such events never happen again.