WRITTEN QUESTION E-1476/02

by Cristiana Muscardini (UEN) to the Commission

(27 May 2002)

Subject: Identity theft in the US

On Saturday, 4 May 2002 the Italian daily Corriere della Sera carried an article on a new phenomenon which is causing concern to the US authorities. A full-blown market in personal data is in process of being created, and the data concerned range from confidential social security codes to all fourteen digits of credit-card numbers. Official estimates suggest that every year between 500 000 and 700 000 US citizens suffer thefts of this kind of data. The US Attorney-General, Mr John Ashcroft, is particularly concerned at the threat this represents from the viewpoint of terrorism (two of the nineteen persons responsible for the attacks on the Twin Towers had false licences issued in New Jersey). Even if the problem has been raised in the US, the means used for selling personal data are global, since the process happens on the Internet.

The Commission:

1. Is it aware of this disturbing phenomenon?

2. Are estimates available concerning the extent of criminal activity of this kind in the Member States?

3. Has the Commission called on Europol to carry out a detailed investigation into this new type of criminal activity?

4. Does the Commission not consider that, in view of these developments in the US, it is now essential to ensure regulation of the Internet, at least as far as personal data security is concerned?

Answer given by Mr Bolkestein on behalf of the Commission

(16 July 2002)

1. The Commission is aware of the growing phenomenon of identity theft (misuse of personal data and bank facilities of an individual) which, in the United States and Canada, threatens the financial sector. Presentations and a discussion on identity theft recently took place within the Fraud Prevention Expert Group, the steering group for the implementation of the Action Plan to prevent fraud and counterfeiting of non cash payments(1).

2. At the moment, statistics covering the whole financial sector are available only in the United Kingdom, where identity theft is the fastest growing fraud with an increase of 165 % from 1999 to 2001 (where 53 000 cases were recorded).

3. No, but Europol participated in the above mentioned meeting.

4. The Union's legal framework on personal data protection consists of two Directives namely a general Directive and a sector specific telecommunications Directive(2). Both include provisions to limit and protect the processing of personal data, also over the Internet. These Directives determine the scope and nature of legitimate processing of personal data, impose security measures and require the establishment of adequate judicial and other remedies in case of infringements. The limits to the collection and further use of personal data are in general terms much more strict in the Union than in the United States.

Security breaches at e-commerce merchant databases where hackers gain access to customers' personal data and credit card numbers, are also cause for great concern. Preventive measures, such as security requirements for online merchants accepting payment cards, are discussed under the above mentioned Fraud Prevention Action Plan. Furthermore, in addition to the Framework Decision of 28 May 2001 combating fraud and counterfeiting of non-cash means of payment(3), action to increase Internet security has also been undertaken. Finally, on 19 April 2002 the Commission proposed a Framework Decision on attacks against information systems(4), which addresses the new most significant forms of criminal activity against information systems and encourages information security, while ensuring that Europe's law enforcement authorities can take action against this type of cybercrime.

(1) Communication from the Commission Preventing fraud and counterfeiting of non-cash means of payment, COM(2001) 11 final, http://europa.eu.int/comm/internal_market/en/finances/payment/fraud/index.htm.

(2) Directive 95/46/EC of the Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, OJ L 281, 23.11.1995; and Directive 97/66/EC of the Parliament and of the Council of 15 December 1997 concerning the processing of personal data and the protection of privacy in the telecommunications sector, OJ L 24, 30.1.1998, to be updated and replaced by a new Directive that will be formally adopted by the Parliament and the Council in July 2002.

(3) OJ L 149, 2.6.2001.

(4) COM(2002) 173 final.