Information & Ethics Committee on Dec. 5th, 2024

[The Chair, Conservative, John Brassard]

I call this meeting to order.

Welcome to meeting no. 143 of the House of Commons Standing Committee on Access to Information, Privacy and Ethics.

Pursuant to Standing Order 108(3)(h) and the motion adopted by the committee on Tuesday, October 29, 2024, the committee is resuming its study of privacy breaches at the Canada Revenue Agency.

I would like to welcome our witnesses today.

We have, from the Office of the Privacy Commissioner of Canada, Mr. Philippe Dufresne, who is the Privacy Commissioner, as well as Isabelle Gervais, who is the deputy commissioner, compliance.

Commissioner, I've given you up to 10 minutes to address the committee with your opening statement. Please go ahead.

Thank you.

[Philippe Dufresne, Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada]

Thank you, Mr. Chair.

Members of the committee, thank you for the invitation to speak to this critically important issue.

Data breaches have surged over the past decade, in scale, in complexity, and in severity. As stewards of sensitive personal information, government institutions are attractive targets.

To ensure that personal information is protected, federal organizations, including my office, must be continuously adapting to an evolving threat environment.

In February 2024, we tabled a special report to Parliament with our conclusions on an investigation into a 2020 credential stuffing incident that impacted the Canada Revenue Agency, or CRA, and Social Development Canada, or ESDC.

During the final stages of this investigation, we learned of other breaches related to CERB fraud that the CRA had not reported to the OPC, dating back to 2020 and affecting up to 15,000 individuals. We indicated these breaches in our special report and added that we would be following up on this with the CRA.

The OPC recommendations in this investigation included improving communications and decision-making frameworks to facilitate a rapid response to attacks and developing comprehensive incident response processes to prevent, detect, contain and mitigate future breaches. Both the CRA and ESDC agreed to implement these recommendations.

On May 9, 2024, the OPC received a breach report from CRA, retroactively covering incidents from May 2020 to November 2023, which captured 31,393 separate incidents. The OPC's breach response team has met regularly with the CRA since then to find out more about the CRA's response to the situation and to be kept up to date on the actions that the CRA is taking to address the breaches, to notify, and to mitigate risks to Canadians.

There have been ongoing discussions related to the breach report but also pertaining to the February 2024 investigation report, given the linkages between both. Indeed, the CRA confirmed that, of the 31,393 incidents, approximately 15,000 related to the CERB fraud incidents that were mentioned in our Special Report to Parliament.

In the context of our ongoing engagement with them, on October 25, 2024, the CRA notified my office of approximately 3,200 additional material breaches that occurred in 2023 and 2024 and were assessed retroactively.

This fall, the CRA sought and ultimately obtained an exception from the Treasury Board, so that it could report individual cases of unauthorized use of taxpayer information by a third party to the TBS and to my office on a quarterly basis, instead of within a seven-day period, for operational reasons.

I indicated to the TBS that while I would support this exception, I recommended that it be for a limited time period of 12 months; that the CRA be required to promptly notify and provide information, support and advice to affected individuals; and that the breach reports include additional details including how and when affected individuals were notified and what additional actions were taken by the CRA to improve personal information safeguards.

On October 29, 2024, following the receipt of a complaint, I launched a formal investigation. This investigation will determine whether the CRA met its obligations under the Privacy Act and whether it employed adequate safeguards and breach response processes.

The privacy breaches at the CRA, both in the earlier credential stuffing investigation and in the one more recently reported, underscore the risk to personal information and the importance that must be placed on addressing and mitigating all breaches, including cyber-incidents.

My office regularly engages with federal institutions by providing advice and helping to assess the privacy impacts of new programs and technologies, following up on the response to breach incidents, resolving situations that were raised through privacy complaints, and conducting investigations. Each engagement and compliance activity plays an important role in supporting and advancing privacy protection across the Government of Canada, which is increasingly complex and significant in this digital era.

This includes advice and guidance to support organizations in addressing and mitigating the risks posed by breaches, including on how to prevent, contain and report breaches, as well as the importance of notifying affected individuals.

Data breaches represent one of the most significant threats to personal information globally. In the 2023‑2024 fiscal year ending on March 31, 2024, my Office received over 350 reports of cyber incidents, the vast majority, or over 90%, from private-sector organizations.

This year, I launched investigations into other major privacy breaches. These included the Ticketmaster breach that impacted over half a million Canadians, as well as a joint international investigation with my counterpart, the United Kingdom Information Commissioner, into the 23andMe data breach, which involved sensitive DNA data.

We know that breaches can occur even when organizations have put safeguards in place. This is why an effective response to a breach is also critical to mitigating the impact on Canadians and preserving trust in their institutions.

Given the significance of these risks and the potential impacts they can have on individuals, timely breach reporting requirements need to be made a legal obligation under the Privacy Act rather than a Treasury Board Secretariat policy requirement, as they currently are.

In 2023, the OPC requested and obtained additional temporary funding as part of budget 2023 to deal with breaches. While this request was for temporary funding for a two-year period, I believe that permanent funding is required, as breaches are a permanent and growing concern that pose a significant threat to individuals and organizations.

In a digital world where the risks are higher than ever, investing in privacy is crucial. Privacy protection must be embedded throughout government programs and services.

We must also continue to progress on efforts to modernize Canada’s privacy laws, both the private-sector law and the Privacy Act, which predates the Internet.

I also commend the committee's continuing valuable work in this area, including its report on the federal government's use of technology that can extract data from mobile devices and computers. Another example is the report released just today on regulating social media platforms to ensure online privacy and security.

We also need to ensure that my office is adequately resourced, given the increasingly complex data landscape.

This will continue to be a priority for us, and I will look forward to your committee’s report on this important issue and many others.

Thank you, and I would be pleased to answer your questions.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Dufresne.

We're going to start with Mr. Chambers.

Before we do, we got off to a half-hour start. If there is no objection from the committee, I am going to reset the clock, as we normally do, at the top of the hour to give Mr. Villemure and Mr. Green six minutes each. That should take us to about 5:30. I expect we're going to get through the first round. The committee will determine where we want to go from there.

Mr. Chambers, you're up for six minutes.

[Adam Chambers, Conservative, Simcoe North, ON]

Thank you, Mr. Chair.

Commissioner, deputy commissioner, thank you for appearing at committee. Thank you for your responsiveness on a couple of issues that I personally reached out to your office on, including this one.

We had a bit of confusion around the timeline when we had CRA officials here. If I understand you correctly, can you confirm when you were made aware of the number of breaches dating back to 2020? Was that May 9? Is that correct?

[Philippe Dufresne]

That's when we received the formal notification of those breaches. Treasury Board policy requires that a formal notification be given to my office within seven days of the organization being made aware of it. In this case, clearly, this didn't happen, because some of those incidents date back to 2020.

[Adam Chambers, Conservative, Simcoe North, ON]

There was obviously a large time delay. CRA officials acknowledged that they were aware of these breaches. In fact, testimony suggests that for many of these breaches, the minister was made aware, and that they were not reported in a timely fashion. After that, did I hear you right? In October, CRA officials petitioned Treasury Board to actually not report breaches on the basis of a seven-day period. They actually want more time and to do it on a quarterly basis, is that correct?

[Philippe Dufresne]

Yes, for some of them, that is correct. They identified that it was operationally challenging for them to do that. They requested this exception. As I indicated, I was prepared to support it with some conditions.

The three months and seven days may not make a big difference, but the seven days and three years that we're talking about in this instance is a major concern. Again, if it's for specific operational reasons and for a specific amount of time, that's a different question. The concern that we see, and we saw it, in fact, even in this earlier investigation of the GCKey, which we reported on in February. Even then we had some concerns about being notified and getting responses in time.

It's a concern, not just for CRA. That's why it should be a legal obligation.

[Adam Chambers, Conservative, Simcoe North, ON]

That's very good advice.

Do you think there's an accountability issue within the department about who maybe owns the reporting and accountability requirements within CRA? I'm just trying to understand how, on one hand, a department would acknowledge that it knew these things were happening in real time but, on the other hand, would fail to properly notify or follow the rules that had been set out.

[Philippe Dufresne]

What we hear is that there's a focus from the departments on notifying the individuals, and that's a good thing. That's important, and you need to contain the breach. I don't know the reasons we were not notified formally by the deadline, but what I do know is that it's a concern. If we're not notified in time, we can't provide advice and guidance in time, and that elevates the risk for Canadians.

I also know that if something is required by law, there's a greater likelihood that it's going to be complied with than if it's required merely in policy or directive.

[Adam Chambers, Conservative, Simcoe North, ON]

As part of your investigation, will you be looking at the activities that gave rise to the breach? We've heard some conflicting reports about whether it was a third party or whether it may have been on the departmental side. Is that something you'll be exploring?

[Philippe Dufresne]

We want to understand what happened. We want to understand whether the measures were sufficient. We need to have the context. If there were some third parties who were involved in this situation, then we're going to look at that. If it raises questions under private-sector or public-sector privacy law, then we'll address that and see whether we need to amend the scope of the complaint.

Our position is that if the government is contracting with third parties from the private sector, the government has an obligation to make sure its third party partners are providing adequate protection.

[Adam Chambers, Conservative, Simcoe North, ON]

What obligation would, say, the department have to notify the public generally about potential breaches or risks to their own...if it's from one particular third party or some kind of similar instance? In this case, the public was not notified at all. I acknowledge that the individuals, some individuals, were contacted, but the general public was not made aware either.

[Philippe Dufresne]

There are really three categories.

You notify the individuals because you need to protect them, and you need to make sure they can protect themselves. You need to notify the regulator, which is my office. Finally, you need to notify Treasury Board and others.

However, the question of notifying the public then becomes a question of trust. How do you make sure the public isn't learning of this from the media while considering that the individuals may also be learning of this from the media? In fact, I think this was discussed in earlier testimony.

There's also a taxpayers' ombudsperson, and there's a taxpayers' charter, and one of the principles in it is also that taxpayers be notified promptly if there are fraud schemes and so on, again, for the reasons that this is important for trust and it's important to manage the stress level of individuals.

[Adam Chambers, Conservative, Simcoe North, ON]

Do you feel empowered? Does your office have the right authorities to make recommendations on internal processes and accountabilities?

Also, I recognize this Treasury Board exemption, and I'll call it an exemption, but if you've just gone through a very difficult period where you've not reported, I find it a bit hard to imagine that the answer to that is giving the entity more time to report. You'd think it'd actually be the other way around: “No, you're on remedial actions, and you need to report more frequently.” I think that would make a bit of sense.

[Philippe Dufresne]

That's right, although I think there's something to be said about acknowledging a challenge in meeting a requirement, explaining why and seeking an exception. I think it's better than breaching it and not doing anything and not saying anything about it. I think that's an important element.

To your question, yes, our investigation will look at that. We'll make some recommendations, as we did in the earlier investigation. Our earlier recommendations included improvements in communication and accountability. We found in that earlier case that there were departments pointing fingers at each other and saying, “It's not us; it's this department or that department.” We found that was an issue and had to be corrected.

[Adam Chambers, Conservative, Simcoe North, ON]

Thank you very much.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Chambers and Mr. Dufresne.

I'm going to go to Ms. Shanahan now for six minutes.

Go ahead.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Thank you very much, Chair.

I want to thank you, Privacy Commissioner, for being here, and I want to tell you how much we appreciate your work and how important your work is becoming.

I think it's something that I can remember when I first met with the commissioner occupying your role seven or eight years ago in the context of a committee and this vague idea of privacy, but now we understand very much what that means. It means an individual's personal information that can be used by others, bad actors, to defraud either the persons themselves or other entities.

This is where we're beginning to understand there's not just one type of breach of privacy, so correct me: What are the different types of breach-of-privacy data breaches that we can see? What do they look like? Please refer to the one at CRA.

[Philippe Dufresne]

We can see different situations. One could be an employee snooping. Someone is looking at information that isn't theirs. They're not entitled to it. There's not enough security around that. We also saw, in the investigation, credential stuffing. Someone finds out your password, and you're using that same password with many accounts and devices.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Would they have found it out from the CRA, or would they have found it out from innocent citizens, somehow?

[Philippe Dufresne]

There could be a number of factors. You could have a situation where they find it out from individuals, third party vendors or other sources. Then it's reused.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

It's not from the CRA.

We're looking at what this incident is right now. Was it the CRA that somehow divulged people's passwords to bad actors? Is that what we're looking at?

[Philippe Dufresne]

That's not what it seems to be, at this stage.

We're going to be investigating and reaching our conclusions. It's a situation where it appears passwords were obtained elsewhere, then used to gain access to some of the devices.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

I have concerns about the My Account system. I rely on it. Many family members do. Many of my constituents do.

Do you have any reason to be concerned about the CRA My Account system, where people can go online and see their income tax information?

[Philippe Dufresne]

In our subsequent investigation, we'll look at all of the circumstances and make a recommendation.

One of the big issues we had in our previous investigation was the authentication of users and the fact that there is a lack of multifactor authentication. That was because the sensitivity and risk were assessed to be too low. That is one of the trends we see. It's not just in this instance but also in other instances. There's a sense that harm to individuals is not being treated at the level it should be. They said, “Well, you're just losing some money. It's not your health.”

That was an instance when we disagreed. We said, “Well, this is being assessed at a level 2 risk. We're assessing it at a level 3 risk.” In fact, if a fraudster takes $1,000 from you, you can get sick from that. You can get stressed about that. You can end up in major situations—owing money, going to court and all of those things. We found this is a level 3 risk. If you treat it as a level 3 risk, you're going to put in place level 3 protections, with multifactor authentication.