Information & Ethics Committee on Nov. 26th, 2024

[The Chair, Conservative, John Brassard]

I call the meeting to order.

Good afternoon, everyone. Welcome to meeting number 141 of the House of Commons Standing Committee on Access to Information, Privacy and Ethics.

Pursuant to Standing Order 108(3)(h) and the motion adopted by the committee on Tuesday, October 29, 2024, the committee is resuming its study of privacy breaches at the Canada Revenue Agency.

I would like to welcome our witness for the first hour today.

We have with us André Lareau, associate professor in the Université Laval faculty of law, as an individual.

Professor Lareau, before turning the floor over to you, I propose that the committee adopt a budget in connection with this study.

The documents relating to this request were sent to all committee members last week.

Does everyone agree on adopting the budget?

[Voices]

Agreed.

[The Chair, Conservative, John Brassard]

Professor Lareau, you have the floor for five minutes for your opening remarks.

[Prof. André Lareau, Associate Professor, Faculty of Law, Université Laval, As an Individual]

Thank you, Mr. Chair.

Thanks to the committee for kindly inviting me to this meeting, which is actually a resumption of last week's meeting. I attended here last week, and you can well imagine that I had spent several hours preparing my testimony. However, I waited in vain for over an hour for the meeting to start. Evidently, a majority of you chose to ignore the meeting, for reasons having to do with political squabbling. That is up to you, but I would remind you that your committee deals with ethical issues. When I was very young, my mother taught me that when you invite people to your home, you should be there and receive them properly.

That said, I will begin my presentation.

I should first note that I am not an expert in computers or privacy. My expertise as a retired professor is limited to tax law.

The CRA, the Canada Revenue Agency, is the custodian of the money given to it by taxpayers, in accordance with the obligations set out in tax laws. In a nutshell, it is the trustee of that money, and must act diligently in performing the assignments given to it. It must also make sure that taxpayers are able to maintain a high level of trust in it, or else their adhesion to it might decline significantly.

On the subject of the CRA's obligations, I would note that under subsection 152(1) of the Income Tax Act, “The Minister shall, with all due dispatch, examine a taxpayer’s return of income… assess the tax for the year…”. The CRA then sends out notices of assessment on that basis. According to the way the CRA does things, it must act quickly, act very expeditiously, in order to comply with the act. Of course, there are situations in which the CRA may take action within three years after the return is filed. Nonetheless, it must act speedily.

The frauds that were investigated by CBC/Radio-Canada are based on an increasingly sophisticated use of digital data and they shine a light on two distinct problems.

The first involves the challenges the CRA faces when it comes to detecting these digital fraud mechanisms, particularly when the fraud arises from theft of personal information. The CRA must therefore make every effort to be able to combat these strategies; otherwise, obviously, taxpayer trust will be eroded.

Along this same line, in May 2024, the tax authorities in the Netherlands were placed under the supervision of an agency responsible for protecting personal information in the country for a five-year period, to achieve:

“a sustainable improvement in the protection of personal data of citizens and companies.”

So the agency was placed under supervision.

The second problem concerns the protection of personal data when taxpayers use external platforms to send in their tax returns, such as H&R Block and UFile.

I will point out that these entities permit the personal information of taxpayers—their clients—to be transferred, without their knowledge, using Google, Meta, and so on.

This raises two new questions.

First, what is the role of the Canada Revenue Agency when it comes to protecting the confidentiality of taxpayers' rights?

On this point, the Canada Revenue Agency's website sets out its commitment to Canadian taxpayers: “We are committed to protecting your privacy by making sure that the personal information we have is appropriately managed and protected, and that your right to access your information is respected.” It clearly says “we have”.

The protection is provided in section 241 of the Income Tax Act, whose purpose is to prevent disclosure of tax information by officials to unauthorized third parties. That provision could potentially enable officials to disclose certain information to the privacy commissioner. That might be a topic to consider.

The Canada Revenue Agency's website directs us to the Taxpayer Bill of Rights as the basis for its commitment to protecting privacy. It draws our attention particularly to right no. 3, which provides: “You have the right to privacy and confidentiality.”

However, the CRA does not say that the Taxpayer Bill of Rights is not legislation and does not offer taxpayers any form of judicial protection.

Yes, there is a taxpayers' ombudsperson, whose office is clearly motivated by a desire to protect taxpayers' rights, but the ombudsperson—

[The Chair, Conservative, John Brassard]

Forgive me for interrupting you, Professor Lareau. I would ask that you raise your microphone so the interpreters are better able to hear what you are saying.

You have 50 seconds left.

[Prof. André Lareau]

Thank you, Mr. Chair.

The Canada Revenue Agency does not say that the Taxpayer Bill of Rights is not legislation. There is a taxpayers' ombudsman, but that person has no investigative power regarding right no. 3. The CRA is talking about a right devoid of substance.

This brings me to my second question.

What protection can taxpayers enjoy when they transfer their tax return using online platforms like UFile or H&R Block?

The confidentiality obligations set out in the Income Tax Act by which officials are bound do not apply to these tax return preparation platforms. They are not covered by any form of confidentiality. On its website, the CRA even invites taxpayers to file their tax returns online.

However, the CRA says on its own website that it does not consult the confidentiality policies of the software designers. According to the CRA, it is up to taxpayers to confirm those policies before buying or using a software package or application.

The CRA tells taxpayers to file their tax returns online, but it says that it has not investigated the software.

I have also analyzed the online contracts. They state that taxpayers assign all their rights to Google and Meta when they buy a software package online. That includes all their banking information, among other things.

[The Chair, Conservative, John Brassard]

Thank you for your statement, Professor Lareau.

We are now going to move on to the first round of questions, beginning with Mr. Chambers.

Mr. Lareau, you may choose whatever interpretation channel you like.

[Prof. André Lareau]

Right. Thank you, Mr. Chair.

[Adam Chambers, Conservative, Simcoe North, ON]

Thank you, Professor Lareau.

I appreciated some of the comments that you shared with the media in respect of this privacy breach. I believe you were quoted as saying, “The CRA needs to clean up its act.”

Do you want to expand a little further on what you meant by that?

[Prof. André Lareau]

While doing the analysis of the income tax returns of taxpayers quickly, with some speed, the CRA cannot just say, "Well, we have to act quickly, so we will do it no matter what, and we'll do it quickly." The CRA has to analyze every request for a refund that is made to CRA.

If the computers of the CRA are not adequate to perform a good analysis of the system, CRA has to slow down and do a better job than it did. Right now, it seems that CRA will expedite the tax credit or the refund without any analysis by the system. This, in fact, gives rise to fraud, as we've seen.

[Adam Chambers, Conservative, Simcoe North, ON]

Your concern, and I believe I share it, is because of the stories that continue to occur, including reports from individuals within the CRA who are concerned, people will ultimately lose faith and confidence in the tax authority.

Is that a real risk, in your opinion?

[Prof. André Lareau]

Yes, it is a real risk, because if taxpayers are aware—and they should be aware—of frauds that occur and if taxpayers know that thousands and millions of dollars have left the country and have been sent to people who don't own the amount, taxpayers will say, "Well, why should I pay my own taxes? I work hard. I want to pay my fair share. Why should I do that?”

As I said previously, the CRA is a trustee for the amount that is given by taxpayers. A trustee has to work as a trustee because people have to trust the system. That's why it's called a trustee. A trustee has to work according to the laws. If CRA sends refunds to people who are not allowed to get the refund, then CRA doesn't work according to the laws that govern the CRA.

[Adam Chambers, Conservative, Simcoe North, ON]

Thank you very much.

I'm not sure if you were able to hear the testimony from last week when we had the minister and officials providing testimony. Are you surprised to learn that the RCMP appears to have not been contacted when some of these frauds are quite complex and may even be linked to organized crime?

[Prof. André Lareau]

I did not hear what was said last week. I've heard some of it, but I haven't heard that part, no.

If there was crime, yes, I'm surprised that the RCMP has not been contacted, definitely.

I'm surprised also that there were tax schemes, for instance, six or seven years ago on the Isle of Man, where I investigated with CBC and where there were agreements between CRA and taxpayers for fraud that was committed. Yes, that surprises me as well.

[Adam Chambers, Conservative, Simcoe North, ON]

Should that really surprise you when we're, I think, the only country that hasn't convicted anybody for the Panama papers?

[Prof. André Lareau]

I don't know that we are the only country that has not convicted people, but I'm very disappointed if that's a fact.

[Adam Chambers, Conservative, Simcoe North, ON]

People are now being fined. Were you aware that businesses are now being fined by the CRA for not submitting GST returns electronically?

Now we find out that the electronic system of filing is potentially compromised, yet the CRA is fining people for preferring to send in paper returns for GST filings. Do you think that's fair in the face of potential privacy concerns or potential breaches, which wouldn't be the first breach of people's personal information at CRA?

[Prof. André Lareau]

I'm more in income tax than GST. If the law says that you have to file electronically, then that's a law. I don't know; I'm not into the GST.

[Adam Chambers, Conservative, Simcoe North, ON]

That's fair enough.

Do you believe that the CRA has been asked to do too much by the government? It's well outside of their core competency of reviewing returns and filing payments to individuals. It's been asked time and time again by the government. Every new program or very complicated tax increase that they have to apply takes time, resources and effort.

Then, off of the core competencies of CRA, do you have sympathy that the government is asking this department to do too much outside of its core mandate?

[Prof. André Lareau]

I don't know if they have been asked to do too much, because the CRA has to execute what the Income Tax Act, for instance, requires. This is the job of the CRA. If they don't have enough manpower, that's something else, but they do have to execute and to do what the Income Tax Act and the GST require them to do. Whether it's too much or not is a matter of manpower. I'm sure that they have goodwill, but maybe they don't have enough staff.

[Adam Chambers, Conservative, Simcoe North, ON]

Thank you very much, Professor. I believe we'll have some opportunity later.

[The Chair, Conservative, John Brassard]

Thank you, Professor.

We're still having problems with the microphone. I'm not sure.... It seemed to be fixed temporarily earlier. Maybe it's just talking directly into it. I don't know what the problem is. We'll see if we can work on it at our end.

I'm going to go to Mr. Housefather for six minutes.

Go ahead, sir.

[Anthony Housefather, Liberal, Mount Royal, QC]

Thank you, Mr. Chair.

Thank you, Professor Lareau.

Of all the witnesses I have heard, you may be the first who has started out by saying you are not an expert in the field we are studying.

How did you learn about the results of the CBC/Radio-Canada investigation?

[Prof. André Lareau]

I was simply in contact with people at Radio-Canada.

[Anthony Housefather, Liberal, Mount Royal, QC]

So it was entirely by accident that you were in contact with them, that you were quoted in the article and you are now here at the House of Commons.

Is that right?