Information & Ethics Committee on Dec. 5th, 2024

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

It's interesting to see that it's gotten to that level of complexity.

I've certainly seen multifactor authentication. You go and put your password in. It says it's sending you a code. You have to run and get your phone. You get the code and all of that sort of thing. That is a step in the right direction. It's very good.

Someone could somehow get a hold of a taxpayer's information or password, and set up a bogus tax return. Isn't that what we're talking about? It takes time for the CRA to determine whether it is indeed a bogus tax return. You file the tax return. There's a deadline going up to April 30. There is the time for processing. Then there is the time—I think this is what you're referring to—for the CRA to contact the taxpayer.

Are these the cases you have seen?

[Philippe Dufresne]

The CRA is in contact with the taxpayer. They inform them and provide them with that information. At that time, there's advice about what to do.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Okay.

However, there's still a question for the CRA about whether or not it was indeed the taxpayer who filed that tax return. They're taking a measure on their side. I think anyone who has dealt with the CRA knows they're very thorough in how they do this.

Would that not explain the delay in reporting the number to your office, and why they need to have the additional time?

[Philippe Dufresne]

I think the time starts to run once you figure out there's been a privacy breach and a real risk of significant harm.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

They talked to the taxpayer. The taxpayer is aware, as the person most involved. The taxpayer is providing proof, saying, “No, that was not me,” or, “What is this?”

It's true that, in secondary and other steps, maybe they talk to the public at large about some sort of scheme going on. Very often, that's the case. The same modus operandi is repeated.

Would you say that your office was in touch with officials at the CRA during this time? Were they trying to determine if this was a one-off, or whether it was indeed the tens of thousands it turned out to be?

[The Chair, Conservative, John Brassard]

It's over the time, but I will let you respond quickly, Mr. Dufresne.

[Philippe Dufresne]

We've been in touch with the CRA in the context of this investigation and since, but we received the formal breach notification only in May. Our exchanges have been good and collaborative, but the concern is the delay in providing that formal response and those details to us as per the policy.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Dufresne and Ms. Shanahan.

Mr. Villemure, over to you for six minutes.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you, Mr. Chair.

I would also like to thank Mr. Dufresne and Ms. Gervais for being with us.

My colleagues have asked a lot of questions about how this works. They looked at the “how”. I would like to talk about the “why”.

At the outset, you mentioned that it was a matter of trust.

Philosophically speaking, trust means you don't need to prove something. However, in cases of invasion of privacy, you have to prove it every time. The obvious conclusion is that there is a lack of trust.

Is this the first incident at the CRA that you're aware of?

[Philippe Dufresne]

No. As I said, the results of an investigation into privacy breaches of 34,000 people through the GCKey system were released in February 2024.

At the time, we made a number of recommendations and found a number of issues, including that the CRA and government organizations had not sufficiently assessed the risk level.

A big issue is understanding how serious this is and the impact it has on people. It's not a conceptual thing. Fraud in the thousands of dollars causes stress and can have an impact on health. It also has an impact on people's time, because the money needs to be recovered and so on.

We found that security had been lacking, so we recommended that it be increased through multifactor verification.

We also found communication problems between decision-makers and departments. We then made several recommendations, all of which were accepted. I have to say that there was excellent co-operation with the agency during that time, and there still is.

Nevertheless, a breach occurred, and the necessary corrective measures must be taken.

[René Villemure, Bloc, Trois-Rivières, QC]

In your opinion, are problems related to personal information on the rise among government entities?

[Philippe Dufresne]

We're seeing a general increase. We see that the number of attempts is increasing and that the repercussions are more serious. According to last year's statistics, even though the number of incidents was about the same, twice as many Canadians were affected. Last year it was 12 million. This year it was 25 million.

We see that governments and departments are prime targets. At my office, a number of investigations are under way, one of which concerns privacy breaches at the Department of Foreign Affairs. Another one is about public servants who suffered a significant breach related to relocation support.

That is a trend seen all over the world.

[René Villemure, Bloc, Trois-Rivières, QC]

You said you made recommendations that were all accepted, which is good news.

Is there good co-operation with government entities in general?

[Philippe Dufresne]

The entities co-operate well with us. We have regular meetings with the CRA on privacy breaches and privacy issues.

Our overall investigation of the incidents from 2020 to 2023 found that there was sometimes a lack of co-operation among the departments themselves. Representatives of a department could say that the responsibility didn't lie with them, that Shared Services, for example, was responsible, or the Treasury Board or the Revenue Agency. We stated in our report that working in silos was a problem.

It doesn't matter to Canadians which department is responsible for the problem. They deal with the government and need solutions. One of our recommendations dealt with that very subject.

However, we are still seeing, as I said, that the official notifications of breaches are unfortunately still coming to us too late and that the seven-day deadline set out in the Treasury Board policy is not being followed.

[René Villemure, Bloc, Trois-Rivières, QC]

I'm glad to hear that there is co-operation, but it's unfortunate that they work in silos. We've talked about that a lot. People do, in fact, deal with the government.

Professor André Lareau, who appeared before the committee, talked about the ombudsman and the Taxpayer Bill of Rights. He said that, unfortunately, the burden of proof usually lies with taxpayers. Also, there is no point having the right to contact the ombudsman when it's meaningless. These are good tools, but they don't seem to be working.

Do you have a comment that would expand on that idea?

[Philippe Dufresne]

As you say, people can turn to the taxpayers' ombudsman, François Boileau, who is an excellent colleague. However, he does not have the power to issue orders. I agree that the ombudsman should have only the power to make recommendations, but that power is not as effective as the power to issue formal orders. The power to make recommendations is persuasive and important. The recommendation is often followed, but not always. If it isn't, the redress process becomes more complicated, when there is one.

However, the ombudsman produced a report on the Taxpayer Bill of Rights and on communication with taxpayers, as well as a very significant report on the importance of communications.

[René Villemure, Bloc, Trois-Rivières, QC]

I saw a parallel when you said that a reprimand could be given through a regulation. It is not legally enforced. It's just a directive. The logic is the same, in that there is regulatory power, but no power to impose penalties.

Earlier, you talked about risk levels. We often read about a “serious breach”, for example. Could you explain to us what the various levels involve?

[Philippe Dufresne]

Are you talking about the various breach levels, for example when I was talking about levels 2 and 3?

[René Villemure, Bloc, Trois-Rivières, QC]

Yes, that's correct.

[Philippe Dufresne]

In our report, we laid out the methodology used by the government to determine the risk level and the verification level required.

In this specific case, the departments considered it to be a level 2, which required verification, but not multifactor verification. That is what allowed the breach to occur. We said in our report that level 3 is related to situations that cause moderate harm, both financially and health-wise. We indicated that, in our opinion, the potential loss of thousands of dollars could certainly have a considerable impact on people, including on their health. They get stressed and they struggle. Financially, people could have their wages garnished and then have to go through a process.

[René Villemure, Bloc, Trois-Rivières, QC]

Would you be able to provide us with the breakdown?

[The Chair, Conservative, John Brassard]

Mr. Villemure, your time is up.

Mr. Green, go ahead for six minutes, please.

Thanks.

[Matthew Green, NDP, Hamilton Centre, ON]

Mr. Chair, I just want to note that I'm on a parliamentary server, and it's saying that my Internet is slow, so if I glitch, it's certainly not because I'm not using the appropriate technology.

[The Chair, Conservative, John Brassard]

You're cutting in and out. I can hear your voice, but the video is awkward.

[Matthew Green, NDP, Hamilton Centre, ON]

Okay. Does it still seem to be cutting in and out?