Information & Ethics Committee on Oct. 6th, 2016

[Chantal Bernier]

I certainly can take a first try at it.

I think there is a lot of misinformation, which is why—and I'm going back still to the report of January 28, 2014, because it focused so clearly on this—we made 10 recommendations that I really hope will not be forgotten because they address those very practical issues. One was transparency. Can the government tell us more specifically what it does?

From having been both at Public Safety Canada, where I was assistant deputy minister, and at the Office of the Privacy Commissioner, I can tell you that it's really not that bad. There is no Big Brother. The government doesn't have the money, it doesn't have the interest, and frankly, it's much more strategic and ethical than this representation.

However, the comments you hear—and I know you do because I hear them, as well—really underscore the need for greater transparency, specifically that there be annual reports for all the agencies that collect public safety information or collect signal information, and that there be regular appearances by the heads of these agencies before House of Commons committees, such as this one or public safety, etc. Bring them to account and say, “Once a year, we want a report from you. What do you see as a threat, what are your activities in relation to the threat, and how do they respect fundamental rights?”

[Julie Dzerowicz, Liberal, Davenport, ON]

You originally started your presentation by talking about information sharing agreements between states and agencies. Who does it well? Which country does it well? Do the agreements that end up being created identify how long the data is kept? If there are errors in data that's being sent over, if there's some misinformation that goes from Canada to Austria, and then all of a sudden we correct it, is there some sort of mechanism to do that on the other side, as well? To what extent do we actually inform? If a person's data is being transported, to what extent do we inform the person that their data has been shared with other states and agencies?

[Chantal Bernier]

Nobody does it ideally. The remedies you referred to are very fragmented. For example, the passenger protect program does have a remedy whereby if you are stopped because of the no-board list—we've all heard about the seven-year-old boy who was denied boarding because he happened to have the same name as someone who's on the list—there is a remedy process. It takes a very long time, but Minister Goodale has already announced that they're looking at addressing that. In fact, it is part of the green paper “Our Security, Our Rights” that is being put to consultation.

My answer to you is that, sadly, I cannot answer because the level of transparency that would be needed to know the answer to your question is simply not there. Every country must step up.

[Julie Dzerowicz, Liberal, Davenport, ON]

How much time do I have left?

[The Vice-Chair, Liberal, Joël Lightbound]

None—

[Julie Dzerowicz, Liberal, Davenport, ON]

Okay.

Thank you.

[The Vice-Chair, Liberal, Joël Lightbound]

—but we'll have some more time at the end.

Mr. Dusseault, the floor is yours, and you have three minutes.

[Pierre-Luc Dusseault, NDP, Sherbrooke, QC]

Thank you, Mr. Chair.

My question is for the Canada Revenue Agency representatives, and is about the measures taken in the event of privacy violations.

Recently, a USB key or a laptop—I can't remember which—was left in a bus. Malicious people got access to CRA data. The vulnerability that made this possible is called Heartbleed.

In another incident, the CBC made an access to information request, and was given a file mistakenly in response. So the CBC ended up with very sensitive information, and, naturally, it reported on all that information.

I'd like to know exactly what measures are being taken in this regard. Earlier, there was talk of possible damages, but you don't seem to be envisaging them for the moment, since they're not mandatory. What do you do to inform and reassure taxpayers in such cases? Do you take measures to attenuate the repercussions for the victims of these privacy breaches, such as ensuring that their credit score remains good? When the data falls into the wrong hands, what do you do? How do you react?

[Maxime Guénette]

Since this was something that happened at a very high level, I'm going to ask Ms. Juneau to explain the details of the relevant procedure.

There is indeed a procedure within the Agency. We work with the Agency's security officer, who is our first point of contact. Incidents must be reported to that person, and that person must prepare a report.

A bit earlier, we spoke about the criteria we use to assess how serious the breach is. Ms. Juneau is consulted to determine whether there has been a breach of privacy, and if there has been, the measures to be taken are discussed. If the risk evaluation matrix provides for it, we contact the taxpayer. That's part of the steps to be taken.

Ms. Juneau, would you like to add something on the subject?

[Marie-Claude Juneau]

Yes, certainly.

As Mr. Guénette just mentioned, the Agency follows a well-established process for reporting all types of incidents. Following an incident, the Security and Internal Affairs Directorate conducts an investigation and sends us its findings. The question to be determined is whether there's been a security breach. If there has been we report the breach to the Privacy Commissioner. We also have a disciplinary framework at the Agency. Based on that framework, we verify how the breach was reported, and whether a disciplinary measure is applicable in such a case.

As for what we do to mitigate the impact of security breaches, I will come back to the example you gave concerning the CBC. When the incident occurred, what we did in terms of access to information and privacy measures was to verify the processes implemented by the Agency, and determine where surveillance or review could be enhanced with a view to preventing such a situation from recurring.

Another process was developed too. A private firm verified whether our processes were indeed adequate, and whether there were still shortcomings. Following that audit, the firm made a few recommendations. The measures it recommended were mainly about systems, system audits, and quality assurance. We have implemented those procedures, to prevent such situations from recurring.

[Pierre-Luc Dusseault, NDP, Sherbrooke, QC]

Thank you.

Actually, you have already answered my second question, about the procedures put in place to ensure these types of incidents don't happen again.

In any event, I think the time available to me has elapsed.

[The Vice-Chair, Liberal, Joël Lightbound]

It has indeed.

However, we've finished the official question period, and we're ahead of schedule. So I extend an invitation to those who have questions, but have not yet intervened. I can already see that Mr. Massé would like to intervene; as for Mr. Dusseault, if you have additional questions, you'll be able to ask them a bit later. The same suggestion applies to Ms. Rempel and Ms. Kelly. Just give us a hand gesture if you have any other questions.

Mr. Massé, you have the floor.

[Rémi Massé, Liberal, Avignon—La Mitis—Matane—Matapédia, QC]

Thank you, Mr. Chair.

I thank the witnesses for taking part in this meeting of the committee. It's much appreciated.

My question is for Mr. Guénette.

As far back as 2013, the Privacy Commissioner had conducted an audit, and pointed out the deficient CRA security practices. He also said that, because of these suboptimal practices, the CRA had made it easier for employees to improperly access thousands of documents over the course of several years.

You've made reference to these 2013 recommendations. Tell us about the measures you put in place to ensure this type of situation no longer occurs.

[Maxime Guénette]

Thank you very much for the question.

Mr. Chair, two types of actions were taken in that regard. One is more technical, and the other is about employee education.

From the technical standpoint, we're continuing to implement measures. In fact, I alluded to them in my preliminary remarks. They have been and are continuing to be put in place, in order to better document and control employee access to Agency databases and applications. As I was mentioning, reviews are done twice a year, to ensure that if there are changes to the duties of certain employees, and access needs to be reviewed, it's done.

Improvements were also made so that an "audit trail" can be created in the National Audit Trail System. This makes it possible to detect accesses not tied to certain duties, and to notify managers of those accesses. So measures were put in place so that managers can receive automatic notifications of this kind. For example, I might need to speak to Ms. Juneau because I received an indication that she accessed some information that doesn't seem to fit with her duties. Several applications are subject to this type of audit.

[Rémi Massé, Liberal, Avignon—La Mitis—Matane—Matapédia, QC]

Are they in operation now?

[Maxime Guénette]

Yes, they're in operation, but they continue to be improved. We anticipate the work will be finished in 2017—that is, by the end of next year. Those are the more technical elements.

However, since that 2009 audit, a lot of emphasis has been placed on employee education. We have certain data that enables us to identify the cases where privacy breaches are reported the most. This is because, as you were saying, what needs to be reported is now clear to employees, compared to the situation five years ago. There's the Integrity Code, to which I've referred. There's also the Integrity Framework. Added to that are the communication initiatives we've implemented, and mandatory training. There are several indicators on our performance management dashboard. As Chief of Privacy, I must check on the extent to which employees are doing training, and the extent to which they're consulting the available information. For example, we recently made a video available. Based on the most recent numbers we have, it was viewed more than 12,000 times by employees. The video explains the kinds of privacy breaches that can occur inadvertently.

All this to say that a major communications effort has been made in this regard, and certainly must continue. We see—and I think the data support this—that there is now a better understanding of the importance of protecting personal information, of what can constitute a privacy breach, and of the procedure to follow so these breaches can be identified when they arise.

[Rémi Massé, Liberal, Avignon—La Mitis—Matane—Matapédia, QC]

Do I still have 30 seconds?

[The Vice-Chair, Liberal, Joël Lightbound]

Yes. You have 30 seconds.

[Rémi Massé, Liberal, Avignon—La Mitis—Matane—Matapédia, QC]

Ms. Bernier, if I understand correctly, you helped develop this audit process. Did you have a chance, subsequently, to verify the measures put in place by the Canada Revenue Agency? Mr. Guénette provided some explanations about these measures. Based on what you've seen, it is your impression that the measures put in place are sufficient? Or do things have to be taken further as far as the Agency is concerned?

[Chantal Bernier]

Obviously, it's my successor who is now keeping track of the subject, and he is the one who can answer this question. I can only speak to the situation up until June 2014. At that time, I was very convinced that the Agency was taking our recommendations very seriously. The recommendations identified shortcomings, but these were taken seriously. I can't discuss the current situation, but when I was present, I was seeing a real effort on the Agency's part.

[The Vice-Chair, Liberal, Joël Lightbound]

Thanks.

And thank you, Mr. Massé.

I now give the floor to Mr. Dusseault.

[Pierre-Luc Dusseault, NDP, Sherbrooke, QC]

Thank you, Mr. Chair.

I have a few brief questions to ask.

Ms. Bernier, I would like to go back to what you said about political parties, which you didn't have time to expand on.

I asked the same question to the British Columbia representative this week. He told me that the political parties in that province, including both the provincial and municipal levels, were covered by the act, but I would like to address the legislation that applies to the private sector.

In your view, what would be the best solution to consider? Could the legislation that is applicable to the private sector technically apply to political parties? Is it conceivable to make it apply?

[Chantal Bernier]

The Personal Information Protection and Electronic Documents Act would have to be amended to create a separate part, because the statute applies to the private sector, and is based on the consent paradigm, as part of business activity. In other words, I give my personal information in exchange for a good or service. That is not at all what is happening when information is given to a political party.

PIPEDA should be expanded to include all non-governmental relationships. It should contain a part applicable to business activities, which is the case at present. This covers situations where personal information is imparted in a transactional context. There should be a part applicable specifically to political parties.

[Pierre-Luc Dusseault, NDP, Sherbrooke, QC]

We will certainly take that into consideration as our work continues.

In the Agency's report to Parliament on the application of the Privacy Act, there is reference to a case where information was requested, but a translation from English to French was refused. There is little explanation—just a short paragraph of the report deals with this question. Moreover, in the appended tables, there is only one instance of refusal.

If you have any information on this, could you provide me further details? Why was this information not translated so the person concerned could have it in the language of their choice?

[Marie-Claude Juneau]

Thank you for this very good question, but unfortunately, I don't have the answer. I will do some research and ensure the answer is sent to the committee in the coming days. I apologize.