Information & Ethics Committee on Dec. 12th, 2024

[Peter Davis]

I'd be happy to.

Each year, we have what's called H&R Block Canada's tax academy. Starting in late summer, we begin taking applications from interested Canadians who want to take our training and become tax associates with us. Through that process, we teach them all about the tax code and how to work with Canadians in preparing and filing their taxes. We also spend time talking about security measures and how to ensure that taxpayer data is being treated with the utmost confidentiality at all times. This also includes information that is required in order to electronically file returns to CRA. There is quite a bit of training on that end.

For those individuals whom we choose to hire from our tax academy, we also provide additional training before they start with us preparing and filing taxes in our offices.

There is quite a bit of security and privacy training. That's held annually for all our staff every year.

[Darren Fisher, Liberal, Dartmouth—Cole Harbour, NS]

I assume that it would be the norm within the industry for third parties and private sector organizations.

[Peter Davis]

I can't speak for all organizations, but it's certainly a norm for H&R Block Canada.

[Darren Fisher, Liberal, Dartmouth—Cole Harbour, NS]

Okay.

When H&R Block Canada transmits a tax return to the CRA on behalf of the Canadian taxpayer through e-file, how do you ensure, from your end, that the data is secure?

[Peter Davis]

That information is transmitted through tax software, which is certified by the Canada Revenue Agency. Every tax software developer, including H&R Block Canada, has to undergo a rigorous certification process with CRA every year to ensure our tax software meets a number of CRA requirements.

In addition to that, we also have to make sure that tax software complies with all data privacy and data security legislation. There's a very comprehensive process that goes into ensuring that tax software is safe and secure for Canadians to use.

[Darren Fisher, Liberal, Dartmouth—Cole Harbour, NS]

Have you had any breaches of any kind at H&R Block Canada of your clients' data?

[Peter Davis]

I'm unable to talk about any specifics around privacy breaches due to our data security and privacy policies. What I can say is that—

[Matthew Green, NDP, Hamilton Centre, ON]

I have a point of order, Mr. Chair.

[The Chair, Conservative, John Brassard]

Go ahead on your point of order.

[Matthew Green, NDP, Hamilton Centre, ON]

Mr. Chair, perhaps Mr. Davis isn't familiar with parliamentary proceedings or the powers of committees to demand testimony.

He doesn't have the ability, unfortunately, to sit behind some kind of pseudo client-solicitor privilege. He's here before Parliament, and he has to answer parliamentary questions.

I would ask that you apprise him of what his responsibilities are before the committee.

[The Chair, Conservative, John Brassard]

Thank you for that, Mr. Green.

Mr. Davis, I understand the sensitive nature of the security system and the mechanisms that are in place within H&R Block. You made that very clear in your opening statement.

I would ask that you do answer the questions to the best of your ability. We are covered by parliamentary privilege, but we certainly don't want to put at risk—and I would agree with you on this—any proprietary issues within H&R Block that could cause problems. I'm going to direct you in that way.

Mr. Green, I hope you understand that when the request was made to have H&R Block come before the committee, there wasn't a specific individual who was asked to come. H&R Block has sent Mr. Davis as a representative, and I am satisfied that he's answering the questions to the best of his ability given the nature of what we're dealing with.

I stopped your time, Mr. Fisher, when the point of order was issued, so you have a minute left.

[Darren Fisher, Liberal, Dartmouth—Cole Harbour, NS]

Okay.

You may have already said this, but can you confirm that all of H&R Block Canada's client data is stored solely on servers that are 100% in Canada?

[Peter Davis]

In terms of how that information is stored—this is all disclosed to our clients, and we do attain their consent—there are instances where client data may be sent to the United States to our parent company, H&R Block. Those instances would include that being required in order to provide the client with a specific product or service. In some cases, it may be to notify them if there may be some products and services that they wish to avail themselves of. That data is largely stored there, and it is not included in any pixels or anything else that could be provided to other parties.

[The Chair, Conservative, John Brassard]

Okay.

Thank you, Mr. Fisher.

[Darren Fisher, Liberal, Dartmouth—Cole Harbour, NS]

Thank you.

[The Chair, Conservative, John Brassard]

Mr. Villemure is next.

Mr. Davis, can you put your earpiece in, please, and make sure it's on English interpretation? Please make sure the volume is up so that you can hear it.

Mr. Villemure, you have the floor for six minutes.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you very much, Mr. Davis, for being with us today.

I won't repeat my colleagues' questions, which were all relevant. I would rather talk about privacy. Could you describe H&R Block's privacy policy?

[Peter Davis]

Can I ask that the question be repeated? The last part cut out a little bit there.

[René Villemure, Bloc, Trois-Rivières, QC]

Could you walk us through H&R Block's privacy policy?

[Peter Davis]

We have a number of client privacy policies in place at H&R Block Canada. The one that I'd like to highlight for the committee is what we call our privacy assurance form. This is what we consider to be a gold standard within the industry here in Canada. We take the time to sit down with our clients in our offices, and we explain to them how their data is being used by H&R Block Canada and why. We take great consideration in limiting the use of the data to just ensure that it's used for what the client needs in order to have the products and services they expect. We sit down and talk through how this data is used. We talk about a number of provisions related to it, and we seek the client's consent in order to proceed as we've laid out.

What makes our privacy assurance policy a little unique is that, each year, when our clients come back to see us in the following tax seasons, we will also walk through any changes to that privacy assurance form. It's very important to us that our clients understand the importance we place on protecting their data. We want them to be informed and comfortable with the processes we have in place to protect their personal information.

[René Villemure, Bloc, Trois-Rivières, QC]

You are probably familiar with the European Union's General Data Protection Regulation, or GDPR. Is the H&R Block gold standard in line with the GDPR or just the current Canadian protection?

[Peter Davis]

It is certainly required by Canadian legislation. I don't know offhand for sure if it's also compliant with the GDPR. I will follow up in writing once I get some confirmation on that.

[René Villemure, Bloc, Trois-Rivières, QC]

That's perfect. Thank you very much.

You were just talking about consent. Do you believe that clients of H&R Block understand what they're actually consenting to?

[Peter Davis]

We take great pains at H&R Block Canada to make sure that our clients really understand how we use their information in order to provide them the products and services they expect. Our tax professionals across Canada are trained to really invest the time and sit down to explain our privacy protections and data policies in plain language. I can say with a high level of confidence that our clients do have a good understanding of how their data is used.

[René Villemure, Bloc, Trois-Rivières, QC]

Consent forms are often one page long and written in legalese. That's why I'm going to ask my next question.

How long after tax filing do you keep your clients' data?