Identity theft refers to the unlawful acquisition, possession, transfer, or use of another person’s identifying information without consent, typically for fraudulent or deceptive purposes. In Canadian law, identity theft is treated as a serious offence because it undermines personal security, financial integrity, and trust in commercial and governmental systems. The concept extends beyond the act of impersonation itself and includes preparatory conduct aimed at facilitating fraud or other offences. 

Nature of Identity Information

Identifying information includes any data capable of identifying an individual, whether alone or in combination with other information. This commonly encompasses:

• names, dates of birth, and addresses;
• government-issued identifiers;
• financial account and payment information;
• digital identifiers such as usernames, passwords, or authentication credentials.

The misuse of such information exposes individuals to financial loss, reputational harm, and long-term privacy consequences.

Criminal Liability and Scope

Canadian criminal law recognises identity theft as both a standalone offence and as conduct linked to broader fraud-related crimes. Liability may arise from:

• obtaining or possessing identity information knowing it will be used to commit an offence;
• trafficking or transferring identity information;
• using identity information to impersonate another person.

The law targets both the misuse of identity and the upstream conduct that enables it.

Distinction Between Identity Theft and Identity Fraud

A key legal distinction exists between:

• identity theft, which focuses on the unlawful handling of identity information; and
• identity fraud or personation, which involves the actual use of that information to deceive or cause harm.

This distinction allows law enforcement to intervene at earlier stages, even before financial loss occurs.

Intent and Knowledge Requirements

Criminal liability generally requires proof that the accused acted with knowledge or intent that the information would be used fraudulently or dishonestly. Mere accidental possession or lawful handling of personal data does not constitute identity theft. The mental element is central to distinguishing criminal conduct from negligent or inadvertent data handling. 

Civil and Regulatory Implications

Beyond criminal consequences, identity theft may give rise to:

• civil liability for damages resulting from negligence or breach of privacy obligations;
• regulatory sanctions for organisations that fail to adequately protect personal information;
• contractual consequences where data security obligations are breached.

Organisations that collect or store personal information are expected to implement reasonable safeguards to prevent misuse.

Victim Impact and Legal Remedies

Victims of identity theft may experience prolonged financial and emotional harm. Legal remedies may include:

• restitution orders in criminal proceedings;
• civil claims for damages;
• corrective measures such as credit restoration and fraud alerts.

Canadian law recognises the enduring nature of harm caused by identity-related offences.

Prevention and Due Diligence Obligations

Prevention is a central policy objective. Individuals and organisations are expected to exercise reasonable care in protecting identity information. In organisational contexts, this includes:

• secure data storage and access controls;
• monitoring and detection mechanisms;
• prompt response to breaches.

Failure to meet these obligations may aggravate liability. 

Conclusion

Identity theft erodes confidence in financial systems, digital transactions, and personal privacy. Canadian law addresses this through a combination of criminal sanctions, civil remedies, and regulatory oversight. In Canadian law, identity theft is not merely a personal wrongdoing. It is a systemic threat that justifies early intervention, strong deterrence, and robust protection of identity information grounded in enduring principles of trust, security, and accountability.