Is it a crime to sell/buy someone’s personal information?
Given that breadth of the Criminal Code’s definition of identity information (for example: a person’s name on its own is considered identity information), it is impossible to categorically recommend against distributing or publishing personal information. However, an individual should always be very cautious about attempting to sell, publish, or distribute identity information as defined by s. 402.1 of the Criminal Code:
any information — including biological or physiological information — of a type that is commonly used alone or in combination with other information to identify or purport to identify an individual, including a fingerprint, voice print, retina image, iris image, DNA profile, name, address, date of birth, written signature, electronic signature, digital signature, user name, credit card number, debit card number, financial institution account number, passport number, Social Insurance Number, health insurance number, driver’s licence number or password.
Under s. 402.2 (2) of the Criminal Code it is an offence to sell, offer to sell, or otherwise distribute someone’s identifying information knowing, or being reckless to whether, it will be used for an indictable offence that includes fraud, deceit or falsehood as an element of the offence.
Under s. 402.2 (1) of the Criminal Code it is also an offence to obtain or posses (e.g. purchase) such information with the intend to commit an indicatable offence with fraud, dishonesty, or falsehood as an essential element.
There is a wide degree of difference between publishing someone’s name in the local paper, and selling that name, alongside their SIN number and passwords online.
