Information & Ethics Committee on March 21st, 2024

[The Chair, Conservative, John Brassard]

Ms. Damoff, on your point of order, go ahead.

[Pam Damoff, Liberal, Oakville North—Burlington, ON]

He was not allowing the minister to speak. If he's going to ask questions, it would be the polite thing to do to let her speak.

I also think it's really rude of a member to call another member dumb in front of everyone. I think the way he spoke to Ms. Khalid earlier was completely uncalled for.

[The Chair, Conservative, John Brassard]

I didn't hear that language being used, Ms. Damoff, so—

[Pam Damoff, Liberal, Oakville North—Burlington, ON]

It was pretty close, Mr. Chair.

[The Chair, Conservative, John Brassard]

Well, it wasn't used in the context in which you said it.

Mr. Barrett, you have a minute. Continue, please.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Minister, you've demonstrated your lack of seriousness on the issue by trying to shut down that Auditor General's report. Again, as I said, it is only when you're dragged kicking and screaming that you take action.

Was there a privacy impact assessment done on the $60-million ArriveCAN app?

[Anita Anand, Liberal, Oakville, ON]

I want to clarify that I respect the Office of the Auditor General extremely seriously. I have read her report. I take this issue seriously—

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

It's a yes-or-no question.

[Anita Anand, Liberal, Oakville, ON]

—and that's why I made the announcement I did yesterday.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Then your defence—and, again, you didn't answer the question—on the question of privacy impact assessments and no wrongdoing by your departments is that there have been no investigations launched.

Ma'am, over a dozen investigations have been launched into your government's $60-million ArriveCAN scam. What does that tell you? If the absence of an investigation implies innocence, what do you infer from 12 investigations launched in the case of the ArriveCAN scam?

[The Chair, Conservative, John Brassard]

Give a very quick answer, please.

[Anita Anand, Liberal, Oakville, ON]

There was a PIA done on the application called ArriveCAN.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Is there a delay between my...? She seems to be answering my questions out of sequence or missing them.

[The Chair, Conservative, John Brassard]

I can't determine that, Mr. Barrett.

Thank you.

Mr. Sorbara, you have five minutes. Go ahead, please.

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Thank you, Mr. Chair.

Welcome, Minister, to this committee.

I want to turn back to the motion at hand with regard to privacy and the privacy risk assessment process. I will try, Mr. Chair, to stay relevant to what the motion speaks to and why the minister is here today. I think that is the job of all members of this committee.

Minister, I have a couple of, hopefully, straightforward questions. I'm sure they will be.

In terms of the privacy impact assessment, why is a privacy impact assessment so important for the employees who are onboarded to the federal government?

[Anita Anand, Liberal, Oakville, ON]

It all goes back to the Privacy Act and making sure that we're respecting personal information that is collected or intended to be collected in the interest of all public servants. That is the work we need to do across government to protect personal information under the Privacy Act. We work closely with the commissioner's office in making sure that our directives and our tools and guidelines respect the Privacy Act at all times.

I will say again in this case that the Privacy Commissioner did not find any violation of the legislation. There were no complaints lodged and no investigations undertaken. What we can do from a Treasury Board perspective is examine that directive and strengthen it, which is exactly what I'm doing, and I will publish that in the summer.

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Thank you, Minister.

I believe that on our side, there are three lawyers sitting on this committee, if I'm not mistaken. I think Pam and I are the only ones who are not lawyers.

There's a balance required in terms of the Privacy Act and these privacy impact assessments that are made by the government. Can you speak to that?

Before you answer, Minister, you are prudently undertaking a spending review at the Treasury Board, and I take it that there is no impact from that on how the government views privacy. Could you speak to ongoing successful measures with regard to your spending review?

[Anita Anand, Liberal, Oakville, ON]

Yes. There's no impact on the compliance with the Privacy Act, which we take very seriously. We are on track to save $15.8 billion over five years and $4.8 billion every year thereafter in the spending review. We've done two stages of that spending review now, and in them I've tabled two tranches of results. We will be continuing it, as specified in the fall economic statement.

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Thank you.

Mr. Chair, I have another minute or two, I think.

[The Chair, Conservative, John Brassard]

You have two, Mr. Sorbara.

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Minister, after hearing what departments have said regarding the use of this software with regard to privacy, do you have any concerns?

[Anita Anand, Liberal, Oakville, ON]

I think we need to update our directive in order to ensure that departments are clear that when there is new software being used, they need to do a PIA. I want to make sure that all measures are taken, from a Treasury Board perspective, to protect the personal information of public servants.

Dominic, do you want to add anything?

[Dominic Rochon]

Thank you, Minister.

What I would say, having heard from all the departments and having reached out to them to understand exactly how they're using these tools, is that nothing has come about that has caused us pause with regard to an impact on privacy. Why is that? It's because they've been following strict guidelines and protocols with regard to the use of these tools.

That said, we want to make it clear that anyone else who wants to delve into the use of these types of tools should automatically think about doing a privacy impact assessment when they bring it into their activities and their programs.

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

To quickly follow up with Mr. Rochon, when there are issues of non-compliance, how are they generally handled?

[Dominic Rochon]

On issues of non-compliance, as we did in this case, if there's a question, we would follow up with the department or agency and delve into the matter as to whether or not a PIA was indeed required. If we're in disagreement with the department on the topic, what we can do is ask them to report on it through their annual report.

Of course, with regard to compliance, the Privacy Commissioner can do the same in terms of following up, looking into the matter and launching an investigation.