VANCOUVER (Reuters) - Canada's mortgage brokers are not doing enough to protect the personal information of their customers from theft and misuse, the country's privacy czar said in her annual report on Tuesday.
The report by Privacy Commissioner Jennifer Stoddart included a special audit of five mortgage brokers to see what security measures had been taken after incidents in 2008 in which the private financial information of hundreds of people was compromised.
About 25 percent of Canada's mortgage transactions are done through brokers, whose agents have access to credit reports and other personal information that would be valuable to criminals attempting identity theft, the report said.
The audit of the brokerages in Ontario that suffered data thefts -- either by "rogue" agents or people impersonating agents -- found hiring practices had been tightened, but other problems remained.
"Our audit found significant vulnerabilities with a Web-based tool that brokers use to obtain credit reports," Stoddart wrote.
Lack of adequate access controls in the system allows agents to use it to download the credit reports of hundreds of people, including people who have never applied for a mortgage, without the brokerage being aware of possible problems.
The report said officials in Stoddart's office are talking with the unnamed maker of the system on ways to improve its security.
The report did not name the brokerages, nor give details on the 2008 incidents, citing ongoing criminal investigations into the data theft.
Other problems found included files of private information being stored in an unsecured parking garage, and an agent was using the reverse side of filled-out mortgage applications to print new ones for other people.
The Canadian Association of Accredited Mortgage Professionals, which has 12,000 members, said it supports Stoddart's recommendations and will work with the privacy office to address the concerns.
The audit involved only five brokerages and a "vast majority of mortgage professionals have implemented stringent and effective privacy standards," the association said in a statement.
The report said the audited brokerages co-operated with investigators and have agreed to implement changes recommended, including not holding on to private information of people who did not receive mortgages.
Mortgage brokers are provincially regulated in Canada.
Identify theft is a growing problem nationally. The Canadian Anti-Fraud Center said it received reports from more than 11,000 victims last year, and losses from ID theft totaled more than C$10 million ($9.5 million).
$1=$1.05 Canadian Reporting Allan Dowd; editing by Rob Wilson