Information & Ethics Committee on April 14th, 2016

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Thank you again for coming to our committee once more.

You mentioned that you expect there to be limits to the collection, use, and retention of personal information and that all parties must limit the collection of personal information to what is necessary. Do you have examples, or can you provide some examples of personal information that might be collected for tax purposes that you do not consider necessary to collect and that you would like to see excluded from information-sharing agreements?

[Daniel Therrien]

An example would be these accounts under $50,000.

Again, you start from the principle that it is legitimate for the two states, Canada and the U.S., to share information to avoid tax evasion. In order for Canada to obtain information from the United States, we have to provide some information to the United States in reciprocity.

The purpose of the whole scheme is to ensure that the tax regimes of both Canada and the U.S. are applied properly, yet the arrangement provides for certain exceptions. You've heard tax officials refer to some of them having to do with TFSAs and so on and so forth. Even though the rule is exchange of information for tax purposes, the arrangement provides for certain exemptions, including this question of whether or not accounts under $50,000 should be reported.

The rules should be clear. What happens to records under $50,000? If the rule is that they should not be reported, then that would be an example of information that theoretically would be relevant to a tax assessment and that should not be and would not be necessary to be transferred, because the arrangement so provides.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

With respect to retention periods for information, do you have any suggestion on how to require that these or any other aspects of our agreement be enforced? We heard from the minister that ceasing the reciprocity of our agreements is the one threat that we have. Are there other means, though, other than that, to ensure, to require, or to enforce respect for retention periods—for example, from the IRS—for information that's been shared under the agreement?

[Daniel Therrien]

From the privacy perspective, the retention issue relates to, again, the ultimate purpose of the arrangement, which is to avoid tax evasion. The two governments share information for that purpose and should only retain that information for a period that is necessary for the other government to actually take tax enforcement action.

Normally in Canada the information is retained for seven years. Originally, the information shared between Canada and the U.S. was retained for 11 years. We asked the CRA to justify that period. They have agreed, in their response to our comments of December, to reduce the period from 11 to seven years. We think seven years is a reasonable period.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

My question was more about ensuring reciprocity. Do we take any steps to verify or assure ourselves that the IRS respects our notion of an acceptable retention period and that they in fact destroy or otherwise not have use of information for a period that exceeds what we would consider to be appropriate for retention and use of the information?

[Daniel Therrien]

I don't believe we have asked for clarifications along those lines, but they are certainly relevant. We will check on the content of the IGA. If the agreement does not speak to this aspect, we will ask these questions of the CRA.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

What remedies or recourse do Canadians, whose information has been shared with the IRS under the IGA, have if the IRS breaches their privacy through improper disclosure? Is there any remedy or recourse available to Canadians?

[Daniel Therrien]

I would start with what recourse there would be for improper disclosure, either by Canadian institutions or the CRA. Canadian financial institutions normally would have to keep the information of their clients secret, but the arrangement provides the legal basis for them to share information with the CRA with a view to sharing it with the IRS.

If there is something wrong, and if there's oversharing of information, PIPEDA would be a ground to invoke. In terms of oversharing by the CRA to the IRS, the Privacy Act could be invoked.

If on the American side, there is something untoward that is happening, again we will have to look into this question.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

In July 2015 there were reports of a cyber attack on the United States government's computers that contained the records of some 20 million current and former holders of United States security clearances, as well as their friends and families, which was a disturbingly large breach of privacy in the United States.

Can you comment on whether any Canadians had their privacy breached in this incident and what recourse...? I guess you've answered that question in that we're not sure what recourse a Canadian would have under American law, but is there one under Canadian law, perhaps? Is this an area where the IGA and other information-sharing agreements address security of information adequately?

[Daniel Therrien]

We have asked along those lines for the CRA to give us information about the threat assessment or the risk of breach assessment that they are conducting. We have not received that information yet, and it will be part of the next round of information that the CRA has promised to give us by the fall of 2016.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

So we don't know yet.

[The Chair, Conservative, Blaine Calkins]

That's seven minutes, Mr. Kelly.

We are now moving on to another seven-minute period. We'll start with Mr. Dusseault.

[Pierre-Luc Dusseault, NDP, Sherbrooke, QC]

Thank you, Mr. Chair.

I'd also like to thank the commissioner, Mr. Therrien, for being with us this morning to discuss this important issue.

As I told the minister at the beginning, what really caused us to question this was the fact that your assessment and your recommendations came out after the information was transferred.

So, right off the bat, I'm going to ask you the same question. Do you think it was an appropriate practice for a government agency who asked you to provide your opinion and recommendations on the issue to go ahead and transfer the information to a foreign government, without waiting for them?

[Daniel Therrien]

I'll start with some general comments and, then, I'll speak specifically to the transfer of information that occurred.

In his answer earlier, Mr. Gallivan told you that, in addition to the correspondence that was exchanged, a certain number of meetings between the CRA and my office were held before the PIA was actually passed on. That is entirely true. We had two or three meetings prior to our correspondence.

Treasury Board policy on PIAs does not state that the commissioner's office has to have given its approval or input before a new program can come into effect. I think the CRA acted in accordance with the policy in effect, in doing what it did. We did meet a number of times and we did correspond in August, one month before the information was transferred. Three months after our correspondence, we provided our comments. All of that is acceptable under the Treasury Board policy.

Generally speaking, is that the best way to proceed? No, it's not ideal for departments to be able to adopt and implement new programs before receiving a formal opinion on the privacy implications from the commissioner's office. But that's the system we have in place.

I would add that the commissioner's office recommended amendments to the Privacy Act, as the members of this committee are well aware. And one of those recommendations sought to make the obligation to conduct PIAs a statutory requirement, as opposed to a policy one. The idea was to give the process more teeth and, ideally, ensure that the comments of the commissioner's office are taken into account before any new program comes into effect.

[Pierre-Luc Dusseault, NDP, Sherbrooke, QC]

Thank you. That's an informative answer.

During that process, did you ever have access to a copy of a file or all 155,000 records? If not, you had to take the word of the CRA officials who explained the content of the records to you. Is that correct? Did you get a copy to make sure that the CRA was indeed following the rules on the protection of personal information?

[Daniel Therrien]

The question we asked was of a general nature. If we had reason to believe that the regime was not properly applied, we could conduct an audit under the Privacy Act, but we aren't there yet.

[Pierre-Luc Dusseault, NDP, Sherbrooke, QC]

I'll have another question a bit later, but right now, I'm going to turn the floor over to Mr. Boulerice.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

Thank you, Mr. Therrien, for joining us this morning.

A little while ago, my colleague asked a very interesting question about the limits around the collection of information. During your opening remarks, you talked about limiting the information collected. You gave the example of accounts under $50,000 possibly being exempted, if I understood correctly. Other than cases where dollar thresholds are used, can you give us any examples where information should not be transferred? I don't mean when it comes to dollar amounts but, rather, in terms of the protection of personal information.

[Daniel Therrien]

Technically speaking, the Privacy Act authorizes the sharing of information for all the purposes listed in the agreement between the two governments. Once again, the purpose of the agreement is to combat tax evasion. Provided, then, that the information is shared for the purpose of preventing tax evasion, the CRA can transfer that information to the American government under the agreement. Because an agreement exists and because the Income Tax Act provides for that, the sharing of information is allowed under the Privacy Act. I mentioned accounts under $50,000 because the rules around that are not clear.

To pick up on an earlier discussion with the minister and the government officials, I would say that, although the sharing of information is allowed to verify that tax evasion was not committed, it is also important to make sure that the two governments do not share information beyond what is set out in the agreement. That's one of the things we've asked the CRA about because there still isn't a clear answer on the matter.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

I was just going to ask you about your oversight or auditing authority over the content of the information that is shared.

What you're telling us is that you ask the questions, but the answers aren't clear.

[Daniel Therrien]

We haven't yet asked that question, specifically, but the developments we've seen in the situation overall have led us to do so now. We will receive information from the CRA, and, once again, if the answer is satisfactory, we will say so. If, however, the answer isn't satisfactory, we do have the authority to take a deeper look at things.

[The Chair, Conservative, Blaine Calkins]

We only have about a half a minute left, but I thank you for your good use of time.

Mr. Bratina is going to start us off now.

[Bob Bratina, Liberal, Hamilton East—Stoney Creek, ON]

Thank you.

Coming back to the questions that you had for CRA and so on, we had the Swedish ambassador discussing access to information in Sweden, and the generally accepted response time there was today. I understand that the questions that you've asked don't involve data on a piece of paper and just handing the paper over—someone's got to think it through—but what would you anticipate?

I'm thinking of the public trying to get access to information. We have the Privacy Commissioner trying to access information, so I'm just curious to know what you anticipate would be a timely response to your inquiries.

[Daniel Therrien]

It would be a few weeks, or months at the most.

[Bob Bratina, Liberal, Hamilton East—Stoney Creek, ON]

I loved the clarity of your presentation. You note that part XVIII of the Income Tax Act seems to require reporting on all U.S. reportable accounts unless the financial institution specifically designates an account to not be a U.S. reportable account. There are financial institutions like the Lehman Brothers and others I could mention that may not have been exactly clear on how they conducted their business. In this case, they don't forward accounts under $50,000. They just say that it isn't reportable. How would we ensure that a zero wasn't accidentally left off an account so that it could escape the scrutiny of the process?

I guess my direct question is—and it goes back to “seems to require”—why the Income Tax Act would be so grey and unclear in its wording. One would presume that a lot of very smart people work on these things and review them. Someone should be able to see that there's a soft area in this reporting. Is it a recommendation that you would have that we review and revise these matters to ensure clarity?