Information & Ethics Committee on Dec. 12th, 2024

[Peter Davis]

Thank you.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Davis.

Thank you, Mr. Chambers.

Mrs. Shanahan, go ahead, please, for five minutes.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Thank you, Chair.

I want to touch on a few things. I want to make the distinction between why we're here now, which has to do with The Fifth Estate report that it was through fraudulent use of H&R Block's special credentials for accessing the CRA website, something that's been built up with private companies and the CRA over the last couple of decades for the use of online filing.... Somehow, somebody got those credentials and used them to change information and pose as imposters to access the CRA website. The other bucket has to do with the sharing of clients' private information.

On the first thing, I find curious your lack of curiosity about how that came to be, your lack of co-operation and your company's lack of co-operation. Historically, I think there has been tremendous co-operation between private tax preparation companies and the CRA to make sure that this wouldn't happen.

[Peter Davis]

I wouldn't say there hasn't been co-operation. We have certainly been in communication with CRA throughout this incident, to the extent possible, and we have—

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Mr. Davis, what would make the CRA say that it was H&R Block?

[Peter Davis]

I'm sorry. What would make the CRA say that it was H&R Block for...?

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

The report we have alleges that hackers had obtained confidential data used by H&R Block. It had to do with the confidential credentials that H&R Block uses to access the CRA. Someone, somehow, in H&R Block.... It could be an employee. It could be someone who had access, or it could be a third party, as Mr. Chambers alluded to. I want to get to that in just a moment.

[Peter Davis]

To be clear, as I mentioned earlier, we take the protection of our clients' personal information with the utmost seriousness. I just want to reiterate—

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

It's not the personal information. Somehow, somebody got a hold of your codes.

[Peter Davis]

Yes.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Why would the CRA say that it was the H&R Block codes that were used?

[Peter Davis]

I was just going to get to that.

Our investigation did not suggest in any way, shape or form that our systems were compromised or our security apparatuses or software—

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Your contention is that your codes were not used in this breach. Is that your contention?

[Peter Davis]

No, my contention is that H&R Block Canada and our software systems and security apparatuses were not compromised, so we were not responsible for—

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

You go back to that, but somebody could have still used your codes and left them untouched so that you would not know that they, in fact, had been used. It was CRA on the other side that said, “Hmm, these codes are being used.”

[Peter Davis]

Yes, and we've never heard from CRA in any way, shape or form that they believe this information was compromised by H&R Block Canada.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

We'll put that aside, but I really do think it's important that there be co-operation among all parties in this regard, now and in the future.

Around the disclosure of personal information, you do say the following on your website:

We do not disclose your personal information to third parties except as described in this Privacy Policy, with your consent, or as permitted or required by law. Your personal information may be disclosed....

I take Mr. Villemure's point that people do not always know what they are consenting to, but here's what they're consenting to:

To outside suppliers employed or retained by us or by H&R Block US to perform certain services or functions...including...processing of...transactions, marketing, Instant Refund® processing....

That's there for others who want to read it. I have a second copy if people want to read it.

Also, the website states that this information would be “used or stored in the United States and will, in addition to Canadian laws, also be subject to the laws of the United States.”

I think that's something many Canadians would not know, that their information is being stored in the United States, which can be an issue for some people.

[The Chair, Conservative, John Brassard]

We're past your time, Mrs. Shanahan.

Mr. Davis, I'm going to give you a chance to respond quickly. Go ahead.

[Peter Davis]

I'd just like to point out, as I mentioned earlier, that we take great pride in the client privacy framework that we have in our retail offices at H&R Block Canada. A big part of that is walking with our clients through our privacy assurance form process: exactly how their information is being used in order to provide the products and services they expect. The items you were referring to are items that we do walk through with our clients. We make sure they understand what that means, and we make sure to get their consent.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Davis.

Mr. Villemure, you have the floor for two and a half minutes.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you very much, Mr. Chair.

Mr. Davis, have there ever been customer data breaches in the past at H&R Block?

[Peter Davis]

I'm not able, due to our data security and privacy policy, to discuss any sort of details about that particular subject matter, but what I can tell the committee—

[Matthew Green, NDP, Hamilton Centre, ON]

I have a point of order, Mr. Chair.

[The Chair, Conservative, John Brassard]

Go ahead, Mr. Green, on your point of order.

[Matthew Green, NDP, Hamilton Centre, ON]

Mr. Chair, I don't think Mr. Davis quite understands what process he's in right now. This is not like a textbook response that he can provide Parliament and not actually have to answer basic questions.

If he's not comfortable answering these questions at committee, I would, through you, Mr. Chair, request that he provide that to our committee in writing—if he does not want to do it on the record right now in front of the audience—for the consideration of this committee. We could then determine the worthiness of reporting on it. He can't simply come here to committee, a parliamentary committee of the House of Commons, and refuse to answer basic questions.