Confidential data mistakenly posted online is exposed


February 08, 2007 04:30 AM


Tara Perkins

Business Reporter

After accidentally posting a list of thousands of brokers and the number of complaints against them on the Web, the Investment Dealers Association of Canada is trying to regain control of the information and minimize any damage done.

Lawyers for the IDA have sent a letter to Robert Kyle, who discovered the list on the IDA's website and has since posted it to his own website. Kyle, the former director of the Consumers Council of Canada and the Small Investor Protection Association, has been openly critical of the IDA's ability to adequately regulate the industry. The IDA is a national self-regulatory organization of the securities industry.

"You must immediately remove from your website the information relating to IDA members and brokers," the letter states. "The IDA does not accept any responsibility as a result of your unauthorized and wrongful publication and disclosure of the information in any way and, further, will hold you responsible for any loss or damages incurred as a result of you doing so."

Last month, Kyle discovered that when he double-clicked on a graph on the IDA's website, up came raw data that was used to make the graph, including a spreadsheet with names of brokers and the number of customer complaints, civil claims, criminal claims, internal investigations, internal disciplinary actions and external disciplinary actions against them.

The data, which includes complaints from late 2002 to mid-2005, was on the IDA's website for more than a year before he came across it.

It was drawn from ComSet, a confidential database the IDA uses to assess the relative risk of its member firms, their branches, or the individuals working for them.

The letter from the IDA's lawyers, Borden Ladner Gervais LLP, says "even though it became possible to access such information through charts posted on the IDA website, there ought not to be any such access and, if accessed, information ought not to have been copied. The IDA has indicated that the information, as far as it is concerned, remains confidential."

The IDA removed the information from its own website in late January, after it became aware that it could be accessed by the public.

"I don't know even whether I will respond to that letter," Kyle said yesterday. "I think it's clear ... that the IDA breached the confidentiality they had with their members by posting it on the Web in the first instance."

Jeff Kehoe, the IDA's director of enforcement litigation, said yesterday that the IDA's inadvertent disclosure of the information doesn't negate the fact that it's confidential.

Kyle "has a responsibility, and obligation, to remove confidential information from his website, and any damages or potential harm flow to him, not the IDA," Kehoe said.

No legal action has been taken against the IDA as a result of the privacy breach, Kehoe said. "We have been working with the membership and the industry to deal with the information that Mr. Kyle has disclosed." The IDA and Kyle have been at odds before. The organization fined Kyle for failing to co-operate with an investigation. The dispute has not been settled.


Comset data