Desjardins is under the scrutiny of provincial and federal authorities following the data theft that affected 2.9 million of the financial group’s members; 2.7 million individuals and 173,000 businesses.
Names, birthdates, social insurance numbers, addresses, phone numbers, emails and transaction patterns were illegally shared with third parties by an employee who has since been fired, the bank said.
According to Quebec’s access-to-information commissioner and the Office of the Privacy Commissioner of Canada, the joint investigations will determine if the organization respected the rules for the protection of personal information.
“Although Desjardins does most of its business in Quebec and is subject to provincial law, it’s also subject to federal law for activities in other provinces,” Reads a statement released Monday, explaining the collaboration.
Reference was made to Quebec’s personal information law and the Personal Information Protection and Electronic Documents Act, the federal act in the private sector in Canada.
Desjardins spokesperson Jean-Benoit Turcotti said over the phone that Desjardins was made aware of the joint investigation on Monday and that they agreed to collaborate.
“For the moment, we’re going to keep our comments for the end of the investigation and for when (Quebec and Ottawa) will have made their conclusions,” Turcotti replied when asked about possible sanctions Desjardins could be subject to.
This isn’t the first time Quebec and Ottawa have collaborated on a case that involved the protection of personal information. They also collaborated in 2016 for the data leak of the dating website Ashley Madison.
“We’re going to conduct our investigations, then a commissioner who renders decisions will make recommendations and will order certain things,” said Quebec commission spokesperson Isabelle Gosselin.
Last week, following criticism, the Lévis-based cooperative announced a series of measures to support its members so they could activate monitoring services by Equifax. Desjardins commissioned the firm to oversee its members’ files, but complaints quickly rolled in because phone wait times were long, the online service was sometimes completely inaccessible and customers couldn’t speak to agents in French.
As of Monday, affected members could contact Desjardins directly to active the surveillance program, which had, as predicted, resulted in an increase in the number of incoming calls.
“The delays were a bit longer than usual, but they were reasonable,” said Turcotti. “At the worst point of the day, we’re talking about five to 10 minutes of waiting. In the afternoon, the situation was back to normal, with a wait time under two minutes.”
This affair could have legal consequences for Desjardins. Two requests for authorization for class action allege that Desjardins violated its members’ right to privacy, or is negligent in protecting their personal and financial information.
The police investigation in the goal of shedding light on data theft is still ongoing.
Committee to hold emergency meeting
Meanwhile, the chair of the Standing Committee on Public Safety and National Security has agreed to a request by Conservative Party Leader Andrew Scheer for an emergency meeting to discuss the issue.
“This situation is inacceptable,” Scheer said in a written statement. “The Committee on Public Safety and National Security needs to meet quickly to provide solutions to Desjardins customers in order to protect their identity.”
He asked his MP Pierre Paul-Hus, who sits on the committee as vice-president, to contact other members to see if they can meet in the next few days to study possible solutions to avoid the theft of personal data, like issuing new social insurance numbers.
This request coincides with a petition that’s been circulating since last week, which is asking the Government of Canada to replace the SINs of those whose information has been stolen. Over 80,000 people had signed the petition as of Monday afternoon.
Committee chair John MacKay, a Liberal, told Presse Canadienne Monday he hopes to hold an emergency meeting at the beginning of next week, but he’s more “realistic” that it would be the end of next week.
“Because members are in recess there’s a lot of work required to prepare (the meeting) correctly. I hope to count on the cooperation of all members,” he said by email.
Crisis handled well, Quebec finance minister says
Quebec’s finance minister Éric Girard says he’s “very satisfied” with how Desjardins Group has handled the major crisis that has shaken the financial institution in recent weeks.
While speaking to journalists on Monday, Girard praised the actions taken by Desjardins management to protect the assets of its clients.
He refused to extrapolate on the future, describing the situation as “very serious.” He said there is no question, for now, to draw conclusions or make any sort of legislative changes to prevent such a situation from happening again.
“Everything in its own time,” Girard said at a weekly council meeting. “Right now, we’re managing the incident.”
He added there will later be “lessons to learn and improvements to bring in medium term,” without mentioning which improvements, or when.
The minister said he’s been in contact with l’Autorité des marchés financiers and Desjardins president Guy Cormier since the beginning of the crisis, to let Cormier know that Quebec will support him as needed.
“We’re here to help Desjardins manage the situation presently,” he said, adding that he’s following the situation closely.