Information & Ethics Committee on Nov. 21st, 2024

[Iqra Khalid, Liberal, Mississauga—Erin Mills, ON]

Thank you.

Lastly, I'll ask about reporting and the internal structure within the CRA for reporting and whistle-blowers. Can you elaborate on how that system has evolved over the years and how you feel about that?

What are the measures that have been taken over the years? How can we better improve that system?

[Bob Hamilton]

I can't talk so much about how it's evolved over time, but in describing it today, I feel quite comfortable with it, to be honest with you.

We actively communicate with employees that they can raise concerns they have with their manager. We say that's probably the first route to take, but then we have an internal process, as I mentioned earlier, which is anonymous. People can have a safe space to raise concerns if they see something happening that they don't think is appropriate. Finally, there's the overview of the Public Sector Integrity Commissioner. Cases can go to her.

We have had a few that have gone to the Public Sector Integrity Commissioner, but to my memory, not very many reached her. This could say our internal systems are working well, but I wouldn't say that with total confidence.

I feel very comfortable that what we have is an open regime that people understand. Hopefully, they feel comfortable raising internally, in that anonymous framework, anything they see going on that's inappropriate.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Hamilton.

Mr. Villemure, you have the floor for six minutes.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you very much, Mr. Chair.

Mr. Hamilton, I'd like to dig a little deeper into a subject that was raised a little earlier. In a series of annual reports, the Privacy Commissioner reported only 113 privacy breaches for the years 2020 to 2024. However, in response to questions from CBC/Radio-Canada, we realized that this number was closer to 32,000.

What happened? How much money is involved?

[Bob Hamilton]

There are two parts to this question, as I see it.

With regard to the 2023-24 report, unfortunately these cases were reported to us just after the due date. However, we now know about them. That's one of the reasons for the difference, in my opinion, but Ms. Galarneau may want to add something else.

As far as the 31,000 cases are concerned, the amount of fraud is $190 million, if I remember correctly. Someone can correct me if I'm wrong. This amount is cumulative, from 2020 to the end of the period. Unfortunately, because of the process, these amounts continue to rise. That's the story about the 31,000 cases, isn't it, Ms. Galarneau?

[Sophie Galarneau]

I'd like to make a small correction. There is no deadline. We were indeed a little late, and we explained why: We were really focusing on protecting accounts, protecting citizens and strengthening our systems. However, we are now up to date with our reports to the Privacy Commissioner and Treasury Board. We have reported on all of these cases.

I would also like to clarify that in relation to the $190 million reported by the Commissioner, the vast majority of the frauds took place in the first year, that is, in 2020, at the time of the pandemic. We're talking about $180 million fraudulently obtained at that time.

[René Villemure, Bloc, Trois-Rivières, QC]

It went badly during the pandemic, didn't it?

According to a CBC/Radio-Canada article, the agency has had to develop a reporting process for these types of privacy breaches since the revelations of recent weeks. I wonder why the CRA hadn't already put this process in place.

[Sophie Galarneau]

What I can tell you first is that we've been very transparent with Canadians about the risk. This isn't the first time we've talked about it. We've been educating Canadians for years. We have websites. There are Government of Canada communications initiatives about scams. In one of the websites, we talk about identity theft and inform Canadians about how to protect themselves.

We haven't hidden anything here. There was indeed a delay in reporting, but we are now up to date.

[René Villemure, Bloc, Trois-Rivières, QC]

Is this website widely consulted?

[Sophie Galarneau]

I'd have to go back and see how many hits there were, but the website is easy to find. If you type in the word “scam”, you'll find it.

[René Villemure, Bloc, Trois-Rivières, QC]

All right.

Often, in cases like this, we notice that we leave the burden of responsibility on the user rather than the agency. That's what I'm trying to find out with my question. Without accusing anyone, it's easy to say that there are resources, that there is this and that. But sometimes, people just don't know. Literacy on certain subjects, such as digital or financial literacy, may not be high enough. Nevertheless, that doesn't prevent these people from having rights.

Let's get back to whistle-blowers. There's one thing I'd like to know, because I've been interested in this subject for a long time. When a whistle-blower comes forward, it's usually because they haven't been listened to internally, or because they're afraid because the person concerned is their superior. So there's at least some discomfort. You don't raise an alarm for nothing, and I take it for granted that people are generally honest. So I'd like to know what's going on.

The agency's culture seems to favour secrecy. It seems to me that there has been more of an attempt to find out who the whistle-blowers are than to find out who the culprit actually is. When you look at the sequence of events, it seems that the culprit is actually the whistle-blower.

I'd like you to shed some light on this situation.

[Bob Hamilton]

There's no culture of secrecy at the agency, in my opinion. However, we are very aware that we have a lot of sensitive information about taxpayers. So it's necessary to take precautions to ensure that this information isn't shared with anyone else working at the agency or outside the agency.

We're in a need-to-know environment, but I think most people at the agency respect the fact that we have to do things the right way.

[René Villemure, Bloc, Trois-Rivières, QC]

I understand that confidentiality is essential. However, I'm not talking about the confidentiality necessary for the agency's operations, but about the lack of transparency with regard to citizens.

Secrecy would be a logical extension of confidentiality, to a certain extent. However, at the Canada Revenue Agency, just as, for that matter, within provincial organizations that deal with revenue, secrecy is quite present.

So would you say that you have a culture of secrecy or a culture of transparency?

[Bob Hamilton]

I think it's a mixture of both. Some aspects of our work have to remain secret, because we have to protect information, but we're generally very transparent. We report breaches—

[The Chair, Conservative, John Brassard]

Finish up quickly, please.

[Bob Hamilton]

—and other things. Also, when there's a scam, fraud or conviction, we pass the information on to the public—

[The Chair, Conservative, John Brassard]

Thank you.

[Bob Hamilton]

—because it's a deterrent, and it's good for us.

[The Chair, Conservative, John Brassard]

I'm sorry. When I cut you off, we were 30 seconds over. When I ask you to go short, I need you to go short, please, okay? I have to be fair to all the other members, including Mr. Green.

Mr. Green, you have six minutes. Please go ahead.

[Matthew Green, NDP, Hamilton Centre, ON]

Thank you very much.

I did as I suggested. We'll be taking a bit of a different tone with staff. Obviously, with ministers, it's a bit more adversarial. However, I am keenly interested in the concept of whistle-blowers.

Mr. Hamilton, who in your department is responsible for the Public Servants Disclosure Protection Act?

[Bob Hamilton]

That would be the Integrity Commissioner and the act that defines that.

[Matthew Green, NDP, Hamilton Centre, ON]

I understand that, under the act, every chief executive in the federal public service “must designate a senior officer” and establish an internal disclosure mechanism. Who would that be?

[Bob Hamilton]

In our department, it was Nathalie Meilleur, I believe.

[Matthew Green, NDP, Hamilton Centre, ON]

We understand that there are categories of disclosure. You spoke earlier about loyalty, and I think that when the average taxpayer hears that with all the conspiracies about deep state and all these other things, that might become problematic. I want to take an opportunity to unpack that a bit.

Under what circumstances is it legally allowed for a public sector employee to provide disclosure to the media?

[Bob Hamilton]

As public servants, we can all do that. We do have spokespersons for the agency—