Evidence of meeting #143 for Access to Information, Privacy and Ethics in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was cra.
A recording is available from Parliament.
Conservative
The Chair Conservative John Brassard
The voice is working, but the video is freezing a bit.
Let's see where it takes us, Mr. Green, and we'll go from there. Okay?
NDP
Matthew Green NDP Hamilton Centre, ON
I'll do the best I can. If the voice is fine, I'm just going to roll with it.
NDP
Matthew Green NDP Hamilton Centre, ON
Mr. Dufresne, I'm going to ask some fairly direct questions.
There have been lots of questions about the consumer impacts. The concerns I have are actually about your delay in adequately informing Parliament.
What rationale do you have for deferring the inclusion of the 31,468 material privacy breaches until the next reporting period?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
We were informed of half of those 30,000, so we were informed of 15,000 of them at the end of our investigation into the GCKey matter, and we presented a special report to Parliament on this matter in February 2024. Those 15,000 were made public and were included in that report, and that report was included in our annual report to Parliament.
What we did not include was the fact that we received a formal notification of this from the department, and that was because we did not receive the formal notification of this in the fiscal year. That formal notification year happened after the period we're reporting on in our annual report, so that's why that number was not in those statistics.
NDP
Matthew Green NDP Hamilton Centre, ON
Given the scale of these breaches, why was there no effort made to provide an interim or supplementary report to Parliament?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
We included our special report to Parliament in our annual report. The information on this major investigation into the CRA, including the fact that there were these 15,000 additional breaches of which we received late notification, was part of our annual report. However, the updated information that we then received after the end of that period was not included because it was not in that fiscal year.
NDP
Matthew Green NDP Hamilton Centre, ON
Why not then provide an additional adequate report? Would you not agree that 15,000 material privacy breaches are, in fact, material to the accountability of Parliament?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
The annual report was filed in Parliament in June. Parliament rose, and then we were into September and we were finding out more about the situation. Of course, we received the complaint in October, and we announced that complaint immediately.
NDP
Matthew Green NDP Hamilton Centre, ON
From my perspective on this committee, I've worked with you, alongside you, for many years now. I am concerned that we don't, as opposition members at least, have timely information.
You referenced, I believe, in your opening statements that, given the significance of these risks and the potential impacts they can have on individuals, timely breach reporting requirements need to be made a legal obligation under the Privacy Act, rather than a Treasury Board Secretariat policy requirement.
Would you not agree that the same duty of candour and legal requirement as a reporting mechanism to this particular committee would help to make sure that these significant issues are communicated properly?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Certainly I agree, and we're going to be looking at how we can improve on this. This was reported to Parliament in June. We were finding out more about the situation subsequently, and a month or so after the House returned, we announced the launch of our investigation on this, but we'll certainly be reflecting on that in the future.
NDP
Matthew Green NDP Hamilton Centre, ON
Yes, I would put to you that we can deal only with the information we have. The governing side has the information; opposition does not. We look to you as an arm's-length arbitrator of this type of oversight, working in partnership with this committee to help provide oversight.
When can we expect, moving forward, that you will be able to provide recommendations or some kind of reflection or learning from that gap in reporting that occurred between the knowledge of the breaches, what you called the fiscal cycle, the lack of an interim report, and then, of course, your annual reporting?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Certainly I think that this will be part of the report that we issue in our investigation into this matter, because we do, as we did in the previous GCKey report, talk about when we were notified, the circumstances, when the complaint was launched—
NDP
Matthew Green NDP Hamilton Centre, ON
Let me ask you a more direct question just for the benefit of this, because we might be ahead of you on this, given that we're doing this study right now.
What three reflections can you offer this committee to ensure to us, as recommendations for the study that we're doing right now, that timely reporting will come to this committee that will give us full information on these types of material privacy breaches?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I think the early reflections are, looking back at the GCKey investigation in 2020, that it was made public by the Treasury Board. The government department made it public, and then we launched an investigation after that. I think that's probably the preferred solution at this stage, but certainly we'll be reflecting on how this can be done in the optimal way with government departments, my office and this committee.
As I say, we issue annual reports. We issue special reports to Parliament from time to time. We'll look at all of those tools and mechanisms, but I think early thoughts would be that this should be something that the affected department makes public to Canadians.
NDP
Matthew Green NDP Hamilton Centre, ON
Would you agree that the delays affect our ability to provide timely parliamentary oversight?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I think that any delay has an impact on any oversight, so certainly, the earlier the information is made available, the better.
Conservative
The Chair Conservative John Brassard
Thanks, Mr. Green.
That concludes our first round. We're going to go to our second round of five minutes, and I'm going to go to Mr. Caputo.
Go ahead, Mr. Caputo, for five minutes.
December 5th, 2024 / 4:30 p.m.
Conservative
Frank Caputo Conservative Kamloops—Thompson—Cariboo, BC
Thank you very much, Chair.
I appreciate the two of you being here today for a couple of hours to answer the questions.
I'm relatively new to the committee, so I don't have the knowledge that some of my colleagues do. I'll launch into a few questions, but forgive me if I'm asking some background questions to acquaint myself.
The minister appeared here November 21. You saw the minister's testimony. Is that correct?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Yes.
Conservative
Frank Caputo Conservative Kamloops—Thompson—Cariboo, BC
Was there anything you disagreed with when you saw the minister's testimony?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
As I say, my position is that my office should be notified within seven days of those events unless there's an exception that's granted. That's a key point that I would say. I haven't heard that. I don't know if that's a disagreement, but this is something that I would want to see as a legal obligation.
Conservative
Frank Caputo Conservative Kamloops—Thompson—Cariboo, BC
The minister should be taking action to do her job and notify you when there are these pretty significant breaches.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Well, I think it's all departments. It's certainly my position that this should be done. It should be a legal obligation. That will allow us to provide input earlier and better.