Information & Ethics Committee on April 1st, 2014

[Louis Beauséjour]

Clearly, we think that they should not because we changed the way we do our business. Right now, when this type of personal information has to be put on this kind of device, it will have to be encrypted to ensure that the information is protected. One of the first measures that we put in place at the time when we lost the hard drive was to ensure that those devices would not be used anymore and any devices that could be used on the system are devices that are encrypted.

We also implemented the data loss prevention system where we can control what could be copied from the system to a device. We also monitor the devices that are linked or put in any computer within the department.

[Lawrence MacAulay, Liberal, Cardigan, PE]

Breach is related to stolen identity. Could you just elaborate what effect that would have on businesses with any idea what percentage of breaches that take place are connected with that? Possibly not even with theft but loss, but most likely theft I would have to think....

[Louis Beauséjour]

I cannot comment on the overall impact of identity theft or on the economy. It's not something we are looking at.

[Lawrence MacAulay, Liberal, Cardigan, PE]

I'd like you to elaborate. It looks like, and it's easy to understand, it's a game of catch-up. Who is doing the catching up is sometimes hard to know. But when you put in the certification training of agents and the SIN code of practice...would you elaborate a bit on the SIN code of practice?

[Louis Beauséjour]

Yes, the SIN code of practice is an element where we provide advice to employers, stakeholders, and individuals of what they should do or not do to protect personal information.

One example for employers is that we would recommend they don't use the social insurance number as the employee identifier on their system, and also we would recommend to only put the social insurance number in letters if required, like for a T4. But for other kinds of communication, we would recommend that they don't communicate the social insurance numbers. That would be an example that we put in the code of practice, just to increase their awareness around the importance of protecting the social insurance number, in particular.

[Lawrence MacAulay, Liberal, Cardigan, PE]

Okay.

The SIN is used to identify people. If it hasn't been used in five years, you indicate that something clicks in, in order to.... Is that to investigate what's taken place? Also, is it used in order to detect income tax fraud, or these types of things? I'd be interested to know.

[Louis Beauséjour]

I cannot speak about income tax fraud. I think CRA would be a better place to determine the techniques to identify that. But clearly for us, we put the dormant flag because when people are leaving the country—most of the time it's because they are not in the country or they could be active in a war zone—there's an issue of not knowing where they are any more. There's always increased risk as time passes that if that person wants to reactivate the SIN, it could be misused. and because of that, it's one of the things we implement. We begin to put what we call a dormant flag. It's a flag which is on the SIR to indicate that.... In that case, we require that the individual who wants to reuse their social insurance number come to the office to reactivate their social insurance number. That will give us additional assurance that it is the right person who wants to reactivate their SIN. It's to ensure that the right person receives the right benefit.

[Robert Frelich, Director, Enterprise Identity Services Divison, Service Canada, Department of Employment and Social Development]

The dormant flag is one of the things that allow the agents to look at additional SIR records, and if it hasn't been used in a long time, it's one of the extra factors they look at when they're agreeing to reactivate a SIN. If there's something that doesn't fall right, if you have an individual who, for example, doesn't correspond with the documents or any of the facts of the situation when they're coming in, then you'll refer it to our national identity centre for investigation.

[The Chair, NDP, Pat Martin]

Thank you, Mr. Frelich, and thank you, Mr. MacAulay. That concludes your time, sadly.

We're going to move now to the Conservatives, Pat Davidson. You have seven minutes, Pat.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

Thanks very much, Mr. Chair.

Thank you, gentlemen, for being with us today on this extremely important venture that we're starting studying.

I just had a couple of things I wanted to ask about from the remarks that you made.

The first one goes back to Mr. MacAulay's question about the dormant status of the SIN card. You say that if it hasn't been active for a period of five consecutive years or more then it can have this dormant flag identifying it. Then you say it's for taxation and those types of things that it's being used for. But then you also said that a child can have one issued at birth. So how is that SIN card used? Kids don't file taxes. What would they be using theirs for? Would theirs always become dormant and have to be reactivated?

[Louis Beauséjour]

I will need to follow up specifically on what the process is for. But the reason parents would like to have a social insurance number at birth is to be able to contribute to the student savings account and be able to get the grants associated with it. Basically, that is one of the reasons.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

So if an RESP is in place, the card is being used.

[Louis Beauséjour]

Yes, because it's considered as program use.

[Robert Frelich]

Through our vital events linkages with the provinces and territories, when they get a birth certificate from the province, the newborn registration is marked in their SIR record as having been issued as part of the newborn registration process or SIN at birth.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

Okay. Thank you.

One thing that most of us as MPs deal with is the falsified email communications that go out to our constituents. Often they use email that mimics such official government agencies as Canada Revenue Agency or Service Canada.

Just recently I had to communicate to constituents about this issue, with the phishing scams that were taking place. Could you elaborate on how or whether your departments try to educate the public about these scams?

[Louis Beauséjour]

For many years we had information on our Internet site to indicate that Service Canada will not reach clients that way. More recently, we took further steps. We put it more up front, on the first page of the Service Canada website, to ensure that people are aware that they could face phishing scams. It refers them to a more detailed page concerning what they should not respond to and gives examples of potential phishing scams.

But we are constantly playing a proactive role, in terms of putting it up front in our main Service Canada page, to ensure that people are aware that they could face those kinds of scams.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

Would an individual basically have to go on the Service Canada website to access that information? Is it not available elsewhere?

[Robert Frelich]

Actually, one of the contexts in which we've had to deal with attempted phishing scams is the government's Job Bank website. We have put up a number of messages there that say, among other things, that Job Bank will not ask you for your financial information, will not ask for money, and that this is the only validated job site.

The Canadian Anti-Fraud Centre provides a website with things to look for, such as phishing scams, how to prevent fraud and identity theft, among other things.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

I realize that there probably isn't too much business being conducted by paper mail these days, but if it is in fact, do notices go out that way as well to constituents?

[Louis Beauséjour]

I will have to check. I don't think we systematically put an insert in with mailing information about potential phishing scams, but I will look into that to see whether we're doing something on a more systematic basis. My understanding is that we don't do it. In fact, as I said, these days the Internet has become the vehicle of preference to communicate information.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

Okay.

We all know that it's extremely important to protect the privacy of Canadians. Certainly, as a government we need to protect the privacy of those who are being served by such government departments as Service Canada or Revenue Canada, or any of them.

The Privacy Commissioner made it clear that specific breaches declared as material breaches should be made known to the department.

Can you clarify what a material breach, in your opinion, would be, and how an example would be qualified as a material breach or a more minor type of incident that perhaps wouldn't warrant the specified report to the Privacy Commissioner's office?

[Louis Beauséjour]

In fact, this would not be my opinion, but there's an agreement we have in terms of the three characteristics of what is considered a breach that needs to be reported to the Privacy Commissioner.

It's that the information is directly related to personal information that is sensitive, such as financial or medical information, or to a personal identifier such as the social insurance number. It's that there is a risk of identity theft or fraud. And it's if the incident may cause damage to the career, reputation, financial situation, security, health or well-being of the person.

This is the criteria that are used to assess if it is necessary to report the breach to the Privacy Commissioner.

[The Chair, NDP, Pat Martin]

That concludes your seven minutes. Thank you very much.

Mr. Andrews was late getting in and has asked permission to interject briefly with one small question. Is there willingness of the committee to allow Scott that latitude?

[Some hon. members]

Agreed.

[The Chair, NDP, Pat Martin]

Go ahead, Scott, and then we'll go to the NDP.