Evidence of meeting #143 for Access to Information, Privacy and Ethics in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was cra.
A recording is available from Parliament.
Conservative
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I think there are situations perhaps where timing would preclude that, because you want the organization to safeguard the information, so there are situations in which you're going to wait a little before making something public.
Ultimately, as a lesson learned, I think it's something that—
Conservative
Adam Chambers Conservative Simcoe North, ON
That's good. I'm getting at this because the government claims that it sent these very private details, including previous convictions and licence plate numbers, to 50 organizations. A couple of those organizations, in particular the Ontario Securities Commission and the Mutual Fund Dealers Association of Canada, then went on to send that information to upwards of thousands of individuals, but we actually don't even know how far and wide that information went.
I'm just trying to understand. For me, it would make sense that we know the processes that led to it, and how far and wide.... I just wanted your opinion on whether you think the public has a right to know and whether Parliament has a right to know.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
It's important to know how far the breach went and how widely the information was shared. Was it appropriately done? Were there some valid reasons, and were there some valid contractual or other protections? Those are the things we're going to be looking at in our investigation.
Conservative
Conservative
The Chair Conservative John Brassard
Thank you, Mr. Chambers and Mr. Dufresne.
I'm going to go to Ms. Khalid now, for five minutes.
Liberal
Iqra Khalid Liberal Mississauga—Erin Mills, ON
Thank you very much, Chair, and thank you, Commissioner and deputy commissioner for being here today. We really appreciate it.
I just want to clarify. H&R Block previously said in a statement that there was no evidence that the breach came from its firm. The tax firm said that a comprehensive internal investigation had concluded that none of its data systems, software or security had been compromised. H&R Block said it was not aware that any of its own clients were impacted by the breach.
Do you have any information that would confirm that?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I can't speak to that, because we have launched an investigation. That's what we're going to be looking into.
Liberal
Iqra Khalid Liberal Mississauga—Erin Mills, ON
You will be getting to the bottom of where exactly the breach occurred. Is that right?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Yes.
Liberal
Iqra Khalid Liberal Mississauga—Erin Mills, ON
As we go through this digital age, the nature of nefarious actions is different. In so many ways, the more we are public, the more we try to find that balance between raising public awareness and battling the crimes as they're occurring. The changes are so fast as technology changes.
Where do you think that balance is in terms of public protection and public awareness?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I think it is a balance. Organizations need to work together. This is the importance of early notification, bringing all of the key players around the table, including my office and the Canadian Centre for Cyber Security. Dealing with all of those different perspectives is important in order to bring lessons learned to parliamentarians and Canadians.
There are many tips in terms of changing your passwords and being aware of those things. Ultimately, we want organizations to have very strong privacy protection mechanisms to diminish the load on individuals.
Liberal
Iqra Khalid Liberal Mississauga—Erin Mills, ON
What do you think the nature of that relationship should be? Who is ultimately accountable here?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Ultimately, departments, governments and private sector organisms that control the information are accountable for it. They have legal obligations under the Privacy Act. They have legal obligations under the private sector privacy legislation. In the private sector, those obligations include notifying regulators, getting input, getting advice and getting best practices.
We're seeing that the public and private sector are aware of this. People are seeing the cost and the harm. We need to do more to be more successful.
Liberal
Iqra Khalid Liberal Mississauga—Erin Mills, ON
I appreciate that.
Recently, the government hosted an auto theft summit, which dealt with many of these similar issues. As digital technologies are used more and more in vehicles, it makes it easier for them to be stolen, for example. Bringing all of industry, different levels of government and police together led to some really significant steps forward.
Who do you think should be at the table if we were going to have a conversation like this with respect to privacy, especially regarding the breach we're talking about today?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Make sure you have the experts, like the Canadian Centre on Cyber Security. Make sure you have the regulator—in my case, my office. Make sure we are consulted. Make sure we're involved early on. This is why I recommended that privacy impact assessments be done and made a legal requirement. This should be done publicly, because it will raise confidence.
There's a role in working even beyond our sectors. I'm working very closely with the Competition Bureau, the CRTC and the Copyright Board. Wherever there are these commonalities, partnership collaboration is always going to be beneficial.
Liberal
Iqra Khalid Liberal Mississauga—Erin Mills, ON
Lastly, can you help us understand the differences between the roles of ministries, departments and agencies as they engage with you?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Their obligations are similar in the sense that they all have the obligation to protect personal information they have and that Canadians entrust them with. They need to ensure they have adequate safeguards. They need to ensure they work with my office and Treasury Board to report in a timely way and be responsive to the recommendations.
It's an important obligation, because it goes to the trust of Canadians. Those breaches have significant impacts on Canadians.
Liberal
Iqra Khalid Liberal Mississauga—Erin Mills, ON
Thank you very much, Commissioner.
Those are all the questions I have.
Conservative
The Chair Conservative John Brassard
Thank you, Ms. Khalid and Mr. Dufresne.
We're going to reset the clock here.
I am glad you brought up the issue of H&R Block, though, because that had not been brought up to this point. I'm equally glad to hear, Mr. Dufresne, that they are part of the investigation, because they were implicated in this. In fact, the motion that was passed by this committee was to have H&R Block come here to answer questions. We received correspondence from them, as committee members know, to say they have done their own internal investigation and found that it wasn't their issue. I look forward to your report on this to see if they were involved at all and if the information of Canadians was not breached as a result of their mechanisms as well.
This is a six-minute round. This will take us to about 5:30. I'm going to leave it up to the committee to decide whether they want to go past this point.
Mr. Barrett, you have six minutes. Go ahead.
Conservative
Michael Barrett Conservative Leeds—Grenville—Thousand Islands and Rideau Lakes, ON
In 2020 you made several recommendations to the government. Do you believe the recommendations you made are being followed by the government?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I do. Some of them have a 12-month implementation period. My sense is that they are on track to meet them.
Conservative
Michael Barrett Conservative Leeds—Grenville—Thousand Islands and Rideau Lakes, ON
Would the implementation of any of those recommendations prior to this point have prevented the breach that occurred?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
We're going to be looking into that in our current investigation, so I can't speak to that.
Conservative
Michael Barrett Conservative Leeds—Grenville—Thousand Islands and Rideau Lakes, ON
Is it your view that privacy breaches should be immediately brought to the attention of Canadians?