Information & Ethics Committee on Dec. 12th, 2024

[The Chair, Conservative, John Brassard]

Just let me deal with this, Mr. Davis.

Mr. Green, I fully agree with your assessment that these answers can be provided in writing to the committee, if it is the desire of the committee to do so. If that's what you want to do, Mr. Green, if we want information to be provided to the committee, we can certainly do that.

I believe that Mr. Davis is sincere in his attempts to answer the committee's questions. Again, as I said earlier, I understand that there's also some sensitive nature here. If the nature of any questions is sensitive enough, then we can request a written response from Mr. Davis on these issues, for the sake and benefit of the committee.

Mr. Barrett, on that point of order, go ahead, sir.

Mr. Villemure, I stopped the clock.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

It has happened a couple of times. I fully agree with Mr. Green's intervention. Obviously, the witness is required to provide a fulsome answer, to the best of their ability, to any of the questions that are put forward by members of the committee.

As you said, Chair, it's up to the committee if we're willing to accept an answer in writing. That's the proposal from Mr. Green. I don't have any objection to that. It should be noted, though, that it remains the committee's prerogative whether that information is held in confidence, or whether we publish that information—if it's perhaps, simply put, in the public interest—but certainly there is no discretion on the part of the witness to answer or not to answer the question.

While we don't have an objection to the response to this question from Mr. Villemure being provided in writing, an answer must be provided.

[The Chair, Conservative, John Brassard]

Based on the two points of order, I think it's pretty clear where the committee stands on this, Mr. Davis.

I don't want to speak for other members of the committee, but if it's your contention that this information can be provided to the committee, then I would recommend that you do that, and the committee will dispose of it in whatever fashion it determines, based on how it affects this study for us as well, because this is a very serious issue for Canadians. I hope you understand that.

There is another option for the committee, too. That is to go in camera and deal with this, but I don't really want to entertain that unless it's the will of the committee to do that.

Mr. Green, are you okay with that?

[Matthew Green, NDP, Hamilton Centre, ON]

Yes. Just on the point of order—and this isn't about Mr. Davis in particular, as I know he's here in his capacity—I just want the committee to note that this is a long-standing trend that we're now seeing when corporations send their public relations or government relations people and not the president. Moving forward, I think what we need to do with this committee, in order to get fulsome answers, is to actually have people here who have the power and the discretion to speak on behalf of the corporation that we're speaking to.

I would ask that you take that into consideration for future invitations.

[The Chair, Conservative, John Brassard]

Yes, I think we're going to have to be more specific when we propose motions about whom we want to come to the committee, to your point, Mr. Green. Is that correct? Okay.

Mr. Villemure, you have—

[Peter Davis]

Mr. Chair, can I please continue on the earlier point of order that was mentioned? I want to clarify very quickly that if there ever were a situation of a breach of information occurring, our company would be statutorily obligated to report—

[The Chair, Conservative, John Brassard]

Hold on.

There's no interpretation.

[René Villemure, Bloc, Trois-Rivières, QC]

The sound is going in and out. Sometimes there's interpretation, sometimes there isn't.

[The Chair, Conservative, John Brassard]

Is it working now? Maybe it's the headphones that are faulty.

Is it not working at all?

I'm sorry, Mr. Davis. We're going to make sure that Mr. Villemure hears your point.

It's not really on the point of order. I've given you a little latitude on this one, Mr. Davis, just because we have less time than normal.

It's working now, Mr. Villemure.

Mr. Davis, perhaps you can quickly state the point you want to make.

[Peter Davis]

Thank you.

Very quickly, if there ever were a situation of information being part of any type of breach, our organization would be statutorily obligated to report that information to the Privacy Commissioner.

We're not trying to be evasive here in front of the committee, but we have to also respect our privacy policies.

[The Chair, Conservative, John Brassard]

Thank you. That's wonderful.

Mr. Villemure, you have the floor for two minutes.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you very much.

All of those question marks were part of my question as well. Thank you.

I wasn't asking you what steps had been taken. I was asking you whether or not there had been such leaks.

[Peter Davis]

Thank you for the question. Are you referring to the incident with the e-file credentials, specifically? Okay.

Our investigation absolutely addressed that piece as well, and there has never been an incident involving our e-file credentials in the past.

[René Villemure, Bloc, Trois-Rivières, QC]

Okay.

I know you touched on this briefly earlier, but have all privacy breaches been reported to the Privacy Commissioner of Canada?

[Peter Davis]

I'm not an expert on the reporting of privacy breaches, but what I can say is that if there was a situation that required us to report something to the Privacy Commissioner, that would absolutely take place.

[René Villemure, Bloc, Trois-Rivières, QC]

Would it be possible to ask your team to provide us with that answer?

[Peter Davis]

Yes, I can. Thank you.

[René Villemure, Bloc, Trois-Rivières, QC]

That's great.

Thank you very much, Mr. Chair.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Villemure.

Mr. Green, you have two and a half minutes. Go ahead, please.

[Matthew Green, NDP, Hamilton Centre, ON]

Thank you very much.

I would like to go back to the opening statements on the idea of private sector breaches in security.

During his appearance on December 5, 2024, the Privacy Commission of Canada stated, “Data breaches represent one of the most significant threats to personal information globally. In the 2023-2024 fiscal year ending on March 31, 2024, my Office received over 350 reports of cyber incidents, the vast majority, or over 90%, from private-sector organizations.”

Mr. Davis, in your opinion, do these statistics show that cyber-incidents are more frequent and more likely to occur in private sector organizations than in federal government institutions?

[Peter Davis]

I'm not a privacy breach expert, so I'm not able to offer an opinion on where breaches like these would tend to take place more often than not.

[Matthew Green, NDP, Hamilton Centre, ON]

Mr. Davis, you came to provide expert testimony.

In your letter to the committee, you said, “There is no credible basis to support the notion that CRA automated tax filing and pre-filled tax returns will further secure taxpayer information.”

Based on the very general statistic I just provided you, how do you explain the difference between government breaches and private sector breaches?

[Peter Davis]

I'm sorry, but I don't see the connection between CRA automatic tax filing and potential breaches of information by the private sector. Can you clarify that for me a little?

[Matthew Green, NDP, Hamilton Centre, ON]

Yes, I'm happy to.

Out of all the incidents, 90% of the privacy breach reports were from private sector organizations and 10% were from the government. Would that logic not extend to private sector organizations being more vulnerable to privacy breaches?

[Peter Davis]

As I stated earlier, I can't provide an opinion on statistics that I'm hearing just second-hand now. I'm unable to make an informed judgment on that.