Tenants' private data available on Internet

[khris]

Tenants' private data available on Internet
Landlords' file lists mental health issues, social insurance numbers
John Goddard
Staff Reporter

LUCAS OLENIUK/TORONTO STAR
Geordie Dent, director of the tenant hotline for the Federation of Metro Tenants’ Associations, was able to access almost 1,400 private files on tenants on a website operated by Landlord’s Source Centre. (March 4, 2009)


Private information for landlords about tenants, including social insurance numbers and mental health issues, can be accessed on the Internet.

A database kept by Toronto company Landlord's Source Centre yesterday showed intimate details about 1,393 tenants on everything from landlord-tenant disputes to children's names, ages and where they go to school.

One file says a tenant's son is mentally and physically disabled. Another page accessed from the Star newsroom says a tenant "is diagnosed with depression" and "is known for abusing substances." Names, addresses and phone numbers are given.

"Your whole life is there," said Mississauga autobody worker Mark Warker, on hearing that his social insurance number pops up in a file regarding a complaint to his landlord two years ago about mice.

"I'm thinking, `Who else has seen that?' There's got to be other people who've seen it."

Landlord's Source Centre charges landlords to investigate tenants for issues such as criminal convictions, previous evictions, bankruptcy history, income and spending, the company's website says. Rates are also listed for "trace and locate" services.

The company's head office is in Toronto, with a branch in Springfield, Mass.

The security breach in the database came to the attention of the Federation of Metro Tenants' Associations, an advocacy group funded by the City of Toronto, in November.

In an email, a landlord complained to a tenant about property damage, said Geordie Dent, director of the federation's tenant hotline.

The tenant messaged the landlord back. Then Jennifer Smith, operations director of Landlord's Source Centre, sent the tenant a "case record" on the matter, indicating the centre was tracking the complaint.

Feeling intimidated, the tenant forwarded all email exchanges to the tenants' advocacy group, Dent said.

As he looked them over, he noticed the case-record number contained a hyperlink, which when clicked gave him access to nearly 1,400 other files going back three years. He simply changed the case number at the end of the Internet address.

"This information should not be viewable on the Internet," Dent said. "There are questions around identity theft. There are personal information and privacy issues."

The hyperlink to the database begins, "www.landlordsinfo.com" – the website address for Landlord's Source Centre.

Company operations officer Smith said flatly that no such database exists.

"To be clear, we don't have a database with tenant information, with tenants' social (insurance numbers) etc.," she said early yesterday, before such information was accessed from the newsroom. Subsequent phone calls and emails to Smith for clarification went unanswered all day.

In 2004, the federal privacy commissioner in Ottawa investigated the company over alleged violations of the Protection of Personal Information and Electronic Documents Act, said Tracy Heffernan, a lawyer for the Advocacy Centre for Tenants Ontario.

"(The company) used to have a delinquent tenant list and they would take the top 10 of those for each area of Ontario – a Top 10 of bad tenants, openly publicized," Heffernan said.

The centre's privacy complaint led to the company voluntarily removing the information from the site four years later, but it might have been reinstated, she said. A tab "View Bad Tenants List $10.95" appears on the site.

The federal privacy commissioner's office has begun investigating a complaint from the tenants' federation about the security breach, the commissioner's spokesperson said, declining to give details.

Brad Butt, president of the Greater Toronto Apartment Association lobby group, said he knows nothing about Landlord's Source Centre.

"I've never had any interaction with them at all," he said.

Anybody concerned about a privacy violation, Dent said, can call the Tenant Hotline at 416-921-9494.

Source

 

[TrickyRicky]

I can understand the concerns on privacy issues and society may rightly limit the public availability of such information. Here's the thing though. All landlords want is to have their buildings operate smoothly. This is good and desirable and benefitial to all building occupants. Trust me you do not want problematic tenants as neighbours. The argument is that information outlining possible problems should be hidden from landlords in order to avoid discriminating practices. Fair. But by extension this suggests that landlords should be fooled into renting to said tenants and that they and their existing tenants should be obligated to absorb the costs and complications that may result. Perhaps this is their societal obligation but you can't blame them for attempting to mitigate such problems. Conversely I'm sure prespective tenants would love to have publicly available information citing the quality of the operations of their landlords. Or should that information and discussions of it be censored or limited in the name of privacy concerns?

 

[afransen]

I can understand the concerns on privacy issues and society may rightly limit the public availability of such information. Here's the thing though. All landlords want is to have their buildings operate smoothly. This is good and desirable and benefitial to all building occupants. Trust me you do not want problematic tenants as neighbours. The argument is that information outlining possible problems should be hidden from landlords in order to avoid discriminating practices. Fair. But by extension this suggests that landlords should be fooled into renting to said tenants and that they and their existing tenants should be obligated to absorb the costs and complications that may result. Perhaps this is their societal obligation but you can't blame them for attempting to mitigate such problems. Conversely I'm sure prespective tenants would love to have publicly available information citing the quality of the operations of their landlords. Or should that information and discussions of it be censored or limited in the name of privacy concerns?

Well, for one thing it is completely unacceptable to broadcast someone's SIN, phone number, address, child's name, their school, medical conditions, etc. to the internet or even other landlords. I do agree that tenants have a right to have their property and income protected, but I think that for every bad tenant, you have bad landlords that brazenly abuse the rights of others.

 

[Admiral Beez]

Another page accessed from the Star newsroom says a tenant "is diagnosed with depression" and "is known for abusing substances." [/url]

When I lived in New Brunswick for three years we rented out our Cabbagetown house. Turns out the tenant was bipolar. When we called about several bounced rent cheques, he threatened to kill himself in the bathtub. My wife flew out that night to Toronto, and began the eviction process. Turns out this guy had a history of depression and suicidal boasts. If we'd had his name on such a database, we could have avoided him, and expense, from the start.

 

[dosbox]

If we'd had his name on such a database, we could have avoided him, and expense, from the start.

You're missing the point. The existence of the database isn't the real issue here, it's the availability of sensitive information over an unsecured channel - i.e. no authentication required, not even the trivial barrier of having to pay money for access. Heck, a SIN number, address, and date of birth and a few other bits of demographic information is enough to commit identity fraud.

 

[Hydrogen]

Who verifies this database? While some landlords can be reasonably flexible with the behaviour of their tenants, others can fall into the opposite extreme.

That being said, I have sympathies for some landlords. There are some serial assholes out there who are as much a problem to their renter neighbours as they are to landlords.

 

[khris]

Landlords' group admits Web breach
Legal files on tenants accessible on Internet
John Goddard
Staff Reporter

The Landlord's Source Centre acknowledged a security breach yesterday that exposed the company's legal files about tenants to the Internet.

"Our tech department is working aggressively to fix the problem and we will make sure this never happens again," said company owner and operations director Jennifer Smith.

She said the 1,393 files – some including social insurance numbers, criminal records, and names and ages of children – were legal case files on tenants compiled for the Toronto company by lawyers.

The files could be accessed through an insecure web address discovered in an email from Smith to a tenant in November.

Tenants worried about privacy overwhelmed the tenant hotline at the city-sponsored Federation of Metro Tenants' Associations, said hotline co-ordinator Geordie Dent.

"The phones have been ringing like crazy all day," he said. "Beyond going to court, tenants seem to have no way to deal with this (security breach)," Dent said.

The federal privacy commissioner's office is investigating the matter under the Personal Information Protection and Electronic Documents Act, a spokesperson said.

Such complaints usually take years, at the end of which the office can recommend that the police take action.

The Better Business Bureau of Mid-Western and Central Ontario gives the Landlord's Source Centre an "F" rating – its worst – with 29 complaints over the last three years.

The tenant hotline is 416-921-9494.

Source

 

[Admiral Beez]

You're missing the point. The existence of the database isn't the real issue here, it's the availability of sensitive information over an unsecured channel - i.e. no authentication required, not even the trivial barrier of having to pay money for access. Heck, a SIN number, address, and date of birth and a few other bits of demographic information is enough to commit identity fraud.

A SIN number is not required to rent an apartment. Nor is the name of your employer. When I was renting, I provided first and last month's rent, and nothing more.

 

[Hank]

A SIN number is not required to rent an apartment. Nor is the name of your employer. When I was renting, I provided first and last month's rent, and nothing more.

That's also not the point. The landlords have this information somehow (whether they should have it is a different question) and by posting it on the web on an unsecured link they are violating people's privacy (not to mention breaking the law).

 

[waterloowarrior]

When I lived in New Brunswick for three years we rented out our Cabbagetown house. Turns out the tenant was bipolar. When we called about several bounced rent cheques, he threatened to kill himself in the bathtub. My wife flew out that night to Toronto, and began the eviction process. Turns out this guy had a history of depression and suicidal boasts. If we'd had his name on such a database, we could have avoided him, and expense, from the start.

That's against the law... (refusing to rent to someone because of a mental disability/condition), isn't it?

 

[Admiral Beez]

That's against the law... (refusing to rent to someone because of a mental disability/condition), isn't it?

Too bad. If I can avoid a suicidal tenant who may destroy my property while he destroys himself, I'll do what I must.

I imagine such discrimination goes on all the time. You're definitely going to find landlords who will refuse a possible tenant on ethnic background due to overpowering cooking odour, or on parental background to people with too many noisy kids, or if they're on welfare, or plain old racial background.

 

[Hydrogen]

Of course landlords are going to "discriminate." The law noted above is defined to in order to stop the more reprehensible forms of discrimination (race, religion, gender, etc). Landlords can reject potential tenants on the basis of whether they appear to be able to pay their rent.

When living in Ottawa, I lived in a smaller building. When I moved in maybe ten percent of it was rented to students. As the price of renting in that city sky-rocketed, more students began to move in and share apartments. After a while, the landlord quietly began to reduce the number of undergraduate students living in the building because the amount of noise and physical damage started to go way up. She did rent to graduate students largely on the basis that they appeared to be more responsible to her. Discriminatory? Yes. But she did note a big drop in noise complaints and damage.

 

[Woodbridge_Heights]

Read the article and visit the site. The information is not widely available nor available free of charge. Landlords are asked to register and pay an annual fee, it's plastered all over it's home page. The information was found through an unsecured database where one could enter the specific url of a certain record and access it without being asked for a password, by changing the record number one can access other records. However without the link the security hole would not have been discovered.

Try it. Visit the site and try to gain access to the records (if the hole hasn't been filled already) without knowing the password. I did and I got nowhere fast.

 

[afransen]

You shouldn't be able to buy the private information of others. Landlords sure as hell do not have that right.

 

[johnalexter]

There are a number of organizations that private landowners can use to check the creditworthiness of its tenants. What kind of report you want and what should be in the report will help you decide which service to go with.