Human Resources Committee on Feb. 14th, 2013

[Brad Butt, Conservative, Mississauga—Streetsville, ON]

Did you want to add something, Mr. Parker? Go ahead.

[Ron Parker]

Let me pick up on one of the first points you made with respect to examining current practices.

With their employees, each assistant deputy minister in the department is examining their practices around the movement and storage of data. Employees, I believe, are taking these incidents as seriously as we are, and we are pursuing in nitty-gritty detail exactly how information is stored and how it is moved branch by branch within the department, right down into the trenches.

This is a very intensive process. We're meeting with each unit throughout the department and looking at what they're doing in the verification of their data or inventories and how they're storing that information.

[Brad Butt, Conservative, Mississauga—Streetsville, ON]

Can you expand on the measures the minister commented on for the tougher consequences for employees in the future, should they not abide by the new policies? What are some of the likely outcomes that may take place, should this kind of breach in protocol happen in the future?

I'm assuming that part of your plan will be intensive training and reminding all the employees in HRSDC of what the rules and protocols are, but you may come up with a situation in which a breach has been caught yet again. We all hope not, but if we do, what are some of the likely consequences that you would be administering?

[Ian Shugart]

Mr. Chair, Mr. Butt will know that I won't enter into the hypothetical, but the range of potential, at the one end of the spectrum, is of course termination, and that is explicit to staff in the policy and in the code of ethics. That obviously is a very severe measure and has to be justified concomitantly by severe behaviour.

Beyond that spectrum, if there is any malfeasance involved on the part of the employee—and sadly, we know that in the public service's history there have been occasions when criminal behaviour has been undertaken—the full force of the law is available and waiting to deal with any such situation.

[The Chair, Conservative, Ed Komarnicki]

Thank you. If you have a short closing comment, make it, and then we'll move to Mr. Cuzner.

[Ian Shugart]

I would say that throughout that spectrum, for individuals who are part of the “pay at risk” system, that element would be brought into play. Behaviour in this area could play into decisions about promotion and advancement, and there are measures such as suspension that can be a part of that arsenal of discipline.

[The Chair, Conservative, Ed Komarnicki]

We'll move to Mr. Cuzner. It's for seven minutes.

[Rodger Cuzner, Liberal, Cape Breton—Canso, NS]

Thank you.

Just to reiterate my comments from my last questioning with regard to Equifax, if you could be vigilant on this to make sure that Equifax is very much up to speed, I know that those engaged would appreciate it.

The other thing is with securing TransUnion; you indicated that you're weighing that possibility. We see the federal Privacy Commissioner suggesting that this is where we should be and the Financial Consumer Agency of Canada recommending it. Know that I strongly advise that you make sure that this protection, to at least.... What we're trying to do now is alleviate some of the concern for the 600,000 people who have been affected.

You indicated in your remarks, Mr. Shugart, that 250 employees were affected. Is the coverage those employees have been offered the same as for the 600,000?

[Ron Parker]

It is the same. We've been in touch with the employees formally by letter and have offered exactly the same services.

[Rodger Cuzner, Liberal, Cape Breton—Canso, NS]

Thank you very much.

I had offered the example of Sony's taking out the insurance policy on those impacted by their breach. I would think the answer to whether you guys have insurance would be that the Government of Canada is its own insurer. Should someone have their information stolen in this case and end up with a degree of financial loss, is the government willing to cover the cost of that loss if it can be proven that security was breached or was a result of that breach? Are we there?

[The Chair, Conservative, Ed Komarnicki]

Again, it's up to you whether you answer that or not. What the government will do is obviously not in your purview, and it's hypothetical. In essence it's....

If you have a comment, go ahead. I just want to warn you.

[Rodger Cuzner, Liberal, Cape Breton—Canso, NS]

Can I ask if the department is going to do it, Mr. Chair?

[Ian Shugart]

I was just going to say, Chair, that I don't want to be evasive, but I think I have to regard that as hypothetical. I wouldn't be comfortable in venturing into that area at this stage.

You indicated “should” something happen, and “if”. Let me just say that our action plan involves very careful monitoring at our end and via the service provided by Equifax, and we will be following this very carefully.

[Rodger Cuzner, Liberal, Cape Breton—Canso, NS]

So the department would not be in the process.

[Ian Shugart]

I'm not in a position to speak hypothetically about what the government would or wouldn't do in a situation—

[Rodger Cuzner, Liberal, Cape Breton—Canso, NS]

So you wouldn't be preparing a contingency in that regard?

[Ian Shugart]

Well, the circumstances itself are hypothetical, and I'm not in a position to comment on that area. I just don't want to venture into that hypothetical realm at this stage.

[Rodger Cuzner, Liberal, Cape Breton—Canso, NS]

Mr. Sutherland, we've been in contact with Equifax since the last round of questioning. A very senior member of the company has assured us that what the students are getting is exactly the same as the average Joe gets, which is free of charge in eight out of ten provinces.

Draw me two columns. Tell me the difference between the two types of coverages, the one that's free and this special design you guys have.

[Allen Sutherland]

My information is also from Equifax. Maybe it's something you need to work through with Equifax. The discussions we've had have been very direct and have been senior as well. The lost wallet service is a service that is not available nationally. It's not available—

[Rodger Cuzner, Liberal, Cape Breton—Canso, NS]

I had indicated that—it's available in eight out of ten provinces—but it does extend for six years.

[Allen Sutherland]

My understanding and what they've told me is that it extends for three months.

[Rodger Cuzner, Liberal, Cape Breton—Canso, NS]

It's six years, but that's okay.

[The Chair, Conservative, Ed Komarnicki]

Carry on.

[Rodger Cuzner, Liberal, Cape Breton—Canso, NS]

What are the other differences?

[Allen Sutherland]

The other difference is the lost wallet alert is of a different standard than the credit flag. The credit flag requires the credit grantor to ask additional questions requiring enhanced authentication, which is different from the lost wallet service, which doesn't have the same requirement and compulsion to it.