Evidence of meeting #145 for Access to Information, Privacy and Ethics in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was data.
A recording is available from Parliament.
Associate Vice-President, Government and Stakeholder Relations, H&R Block Canada Inc.
Thank you.
Conservative
The Chair Conservative John Brassard
Thank you, Mr. Davis.
Thank you, Mr. Chambers.
Mrs. Shanahan, go ahead, please, for five minutes.
Liberal
Brenda Shanahan Liberal Châteauguay—Lacolle, QC
Thank you, Chair.
I want to touch on a few things. I want to make the distinction between why we're here now, which has to do with The Fifth Estate report that it was through fraudulent use of H&R Block's special credentials for accessing the CRA website, something that's been built up with private companies and the CRA over the last couple of decades for the use of online filing.... Somehow, somebody got those credentials and used them to change information and pose as imposters to access the CRA website. The other bucket has to do with the sharing of clients' private information.
On the first thing, I find curious your lack of curiosity about how that came to be, your lack of co-operation and your company's lack of co-operation. Historically, I think there has been tremendous co-operation between private tax preparation companies and the CRA to make sure that this wouldn't happen.
Associate Vice-President, Government and Stakeholder Relations, H&R Block Canada Inc.
I wouldn't say there hasn't been co-operation. We have certainly been in communication with CRA throughout this incident, to the extent possible, and we have—
Liberal
Brenda Shanahan Liberal Châteauguay—Lacolle, QC
Mr. Davis, what would make the CRA say that it was H&R Block?
Associate Vice-President, Government and Stakeholder Relations, H&R Block Canada Inc.
I'm sorry. What would make the CRA say that it was H&R Block for...?
Liberal
Brenda Shanahan Liberal Châteauguay—Lacolle, QC
The report we have alleges that hackers had obtained confidential data used by H&R Block. It had to do with the confidential credentials that H&R Block uses to access the CRA. Someone, somehow, in H&R Block.... It could be an employee. It could be someone who had access, or it could be a third party, as Mr. Chambers alluded to. I want to get to that in just a moment.
Associate Vice-President, Government and Stakeholder Relations, H&R Block Canada Inc.
To be clear, as I mentioned earlier, we take the protection of our clients' personal information with the utmost seriousness. I just want to reiterate—
Liberal
Brenda Shanahan Liberal Châteauguay—Lacolle, QC
It's not the personal information. Somehow, somebody got a hold of your codes.
Associate Vice-President, Government and Stakeholder Relations, H&R Block Canada Inc.
Yes.
Liberal
Brenda Shanahan Liberal Châteauguay—Lacolle, QC
Why would the CRA say that it was the H&R Block codes that were used?
Associate Vice-President, Government and Stakeholder Relations, H&R Block Canada Inc.
I was just going to get to that.
Our investigation did not suggest in any way, shape or form that our systems were compromised or our security apparatuses or software—
Liberal
Brenda Shanahan Liberal Châteauguay—Lacolle, QC
Your contention is that your codes were not used in this breach. Is that your contention?
Associate Vice-President, Government and Stakeholder Relations, H&R Block Canada Inc.
No, my contention is that H&R Block Canada and our software systems and security apparatuses were not compromised, so we were not responsible for—
Liberal
Brenda Shanahan Liberal Châteauguay—Lacolle, QC
You go back to that, but somebody could have still used your codes and left them untouched so that you would not know that they, in fact, had been used. It was CRA on the other side that said, “Hmm, these codes are being used.”
Associate Vice-President, Government and Stakeholder Relations, H&R Block Canada Inc.
Yes, and we've never heard from CRA in any way, shape or form that they believe this information was compromised by H&R Block Canada.
Liberal
Brenda Shanahan Liberal Châteauguay—Lacolle, QC
We'll put that aside, but I really do think it's important that there be co-operation among all parties in this regard, now and in the future.
Around the disclosure of personal information, you do say the following on your website:
We do not disclose your personal information to third parties except as described in this Privacy Policy, with your consent, or as permitted or required by law. Your personal information may be disclosed....
I take Mr. Villemure's point that people do not always know what they are consenting to, but here's what they're consenting to:
To outside suppliers employed or retained by us or by H&R Block US to perform certain services or functions...including...processing of...transactions, marketing, Instant Refund® processing....
That's there for others who want to read it. I have a second copy if people want to read it.
Also, the website states that this information would be “used or stored in the United States and will, in addition to Canadian laws, also be subject to the laws of the United States.”
I think that's something many Canadians would not know, that their information is being stored in the United States, which can be an issue for some people.
Conservative
The Chair Conservative John Brassard
We're past your time, Mrs. Shanahan.
Mr. Davis, I'm going to give you a chance to respond quickly. Go ahead.
Associate Vice-President, Government and Stakeholder Relations, H&R Block Canada Inc.
I'd just like to point out, as I mentioned earlier, that we take great pride in the client privacy framework that we have in our retail offices at H&R Block Canada. A big part of that is walking with our clients through our privacy assurance form process: exactly how their information is being used in order to provide the products and services they expect. The items you were referring to are items that we do walk through with our clients. We make sure they understand what that means, and we make sure to get their consent.
Conservative
The Chair Conservative John Brassard
Thank you, Mr. Davis.
Mr. Villemure, you have the floor for two and a half minutes.
Bloc
René Villemure Bloc Trois-Rivières, QC
Thank you very much, Mr. Chair.
Mr. Davis, have there ever been customer data breaches in the past at H&R Block?
Associate Vice-President, Government and Stakeholder Relations, H&R Block Canada Inc.
I'm not able, due to our data security and privacy policy, to discuss any sort of details about that particular subject matter, but what I can tell the committee—
Conservative
NDP
Matthew Green NDP Hamilton Centre, ON
Mr. Chair, I don't think Mr. Davis quite understands what process he's in right now. This is not like a textbook response that he can provide Parliament and not actually have to answer basic questions.
If he's not comfortable answering these questions at committee, I would, through you, Mr. Chair, request that he provide that to our committee in writing—if he does not want to do it on the record right now in front of the audience—for the consideration of this committee. We could then determine the worthiness of reporting on it. He can't simply come here to committee, a parliamentary committee of the House of Commons, and refuse to answer basic questions.