Evidence of meeting #41 for Access to Information, Privacy and Ethics in the 45th Parliament, 1st session. (The original version is on Parliament’s site, as are the minutes.) The winning word was registry.
A video is available from Parliament.
Bloc
Marie-Hélène Gaudreau Bloc Laurentides—Labelle, QC
I was there during the study. They could be uploaded again.
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
Exactly.
Bloc
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
To date, the company has refused to accept our recommendations.
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
This issue isn't theoretical. It exists.
Bloc
Marie-Hélène Gaudreau Bloc Laurentides—Labelle, QC
The headquarters are moved and then it's off to play with the Five Eyes and our legislative rules. That's what happens.
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
Yes. However, even if the headquarters aren't in Canada, we can still have the necessary jurisdiction. That's important. If Canadians are affected by this, we can and will act.
However, the difficulty is that not all organizations will co‑operate. To its credit, OpenAI did. The co‑operation has been good in this area.
That said, if we had had these tools from the start, such as the obligation to carry out privacy assessments or to provide clearer definitions, some of these things could have been done even more quickly. There are many things of this nature.
Rather than having an investigation, I hope that these things don't happen or that they're resolved quickly.
Liberal
The Vice-Chair Liberal Linda Lapointe
That was quite informative.
Mr. Ho, you have the floor for five minutes.
Conservative
Vincent Ho Conservative Richmond Hill South, ON
Thank you, Madam Chair.
It's good to have you back, Commissioner.
Commissioner, in a report today, your office confirmed that the CRA reported more than 42,000 material privacy breaches, dating back as far as 2020.
Canadians hand over their most sensitive financial information to this Liberal government under the threat of fines and penalties. In your view, does the sheer scale and duration of these breaches demonstrate a systemic failure of governance and oversight inside the CRA under this Liberal government's watch?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
Our investigation found that there had been a significant number of privacy breaches since 2020. There were 42,000, more or less.
Our investigation looked at the safeguards, the detection mechanisms and the tools being used. You can't always prevent breaches. They will happen, but you need to have the appropriate safeguards, especially if you are a very attractive target.
We looked at a number of aspects, and we found that there was a lot of goodwill and there was a lot of effort being made, but there were gaps given the very sophisticated bad actors who were fraudulently making those claims, and we have made a number of recommendations to be put in place.
Conservative
Vincent Ho Conservative Richmond Hill South, ON
Back in 2024, because of these breaches in 2020, the Liberals announced that they would be implementing new measures within the CRA to protect Canadians' privacy.
Since 2024, how many times have you met with the Liberal minister responsible for the CRA regarding implementing these measures?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
I have not met with the minister responsible for the CRA, but in the context of the investigation, we have had many meetings with CRA officials, and I have had meetings with—
Conservative
Vincent Ho Conservative Richmond Hill South, ON
To get it straight, we had you at the science and research committee a couple of weeks ago, and you testified there that the Liberal government had not consulted you when they were thinking about importing more Chinese-made EVs.
Now, the Liberal government has not consulted you in implementing these changes. It's a pretty serious concern, and the Liberal ministers can't even find time in their day to meet you even once. I mean, that really goes to show that the Liberals don't take Canadians' privacy seriously. It's not a one-off. We're seeing a pattern here.
Commissioner, according to your office, these unauthorized disclosures within the CRA involve taxpayer information being improperly accessed and even modified by unauthorized bad actors over a period of years before being fully reported. How is it possible that a federal agency as large as the CRA failed to detect, contain and report tens of thousands of breaches—I understand a couple of breaches—in real time? Does this point to a culture inside the Liberal government where privacy compliance is treated as an afterthought?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
To your previous question, I did have meetings with the Minister of Artificial Intelligence, and I did have meetings with the commissioner of the CRA. There have been discussions. In this case, we found that—
Conservative
Vincent Ho Conservative Richmond Hill South, ON
I'm sorry. Did you meet with the Minister of Artificial Intelligence about these breaches, though?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
No, not about these breaches.
Conservative
Vincent Ho Conservative Richmond Hill South, ON
That's what I'm talking about. We're talking about the breaches. I understand there were other initiatives. There were no meetings with Liberal ministers or secretaries of state regarding these breaches during this time.
Continue with your answer.
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
What we found in this investigation was that there were insufficient measures put in place. There were efforts that were being put out, and there were improvements that were being made, but it wasn't enough.
Multifactor authentication is one example. Back in 2021, it was not mandatory. It was optional. It was made mandatory in 2021, but we know that multifactor authentication is an important tool to prevent these fraudulent claims. Now it's mandatory, but we found that the types of multifactor authentication are not all equal. Some are stronger than others. Some are weaker. We identified that despite improvements, more had to be done. We made recommendations to that effect and look forward to this being put in place.
Conservative
Vincent Ho Conservative Richmond Hill South, ON
Your report mentions the multifactor authentication and industry best practices, which you just discussed right now. As you also discussed, the CRA was unable to provide details of every confirmed breach that it had reported, due to limitations of the tracking system—I'm reading that from the report. Also, somehow, attackers were successful in bypassing the authentication process to access...and the CRA was not able to explain that.
It's not just that there's a problem. They don't even know how to fix the problem. The Liberals frequently lecture Canadians about misinformation, cybersecurity and digital trust. What message does this send to Canadians about the federal government's own competence at protecting sensitive data?
Liberal
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
We found that there were things that had to be improved, and they included some of what you described in terms of identifying the threat, finding the reason and being able to track. All of those are part of our recommendation.
Liberal
Liberal
Leslie Church Liberal Toronto—St. Paul's, ON
Hello, Commissioner, thank you again for appearing before our committee. Just to maybe offer you a chance to further explain a line of questioning that my colleague across the table was just raising, can you describe in the course of your investigation pertaining to the CRA the type of involvement, co-operation or input that you would have had from the CRA?