Evidence of meeting #67 for Human Resources, Skills and Social Development and the Status of Persons with Disabilities in the 41st Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was information.
A video is available from Parliament.
NDP
Charmaine Borg NDP Terrebonne—Blainville, QC
Then it's appropriate to talk about the situation in general? I think it is.
Conservative
Joe Daniel Conservative Don Valley East, ON
No, this is specific to the policy of the department. That's the question. It relates directly to what's being talked about.
Deputy Minister, Department of Human Resources and Skills Development
I think, Mr. Chair, we understood the question to be an elaboration of the measures that we have taken in response to these incidents which, as I understood it, was included in the order.
Conservative
The Chair Conservative Ed Komarnicki
That's the idea, but answer it within those confines. If members still find that objectionable, raise your objection.
Go ahead.
Associate Deputy Minister, Department of Human Resources and Skills Development
Only approved USB keys will be allowed, and the department is acquiring a large number of encrypted USB keys. As a result, portable hard drives are no longer allowed to be plugged into the network, nor are personal devices that use a USB connection. We are monitoring the network and accessing the network on a regular basis and moving to ensure that none of these devices are connected, which is a big step in preventing the movement of data off of the network, which is encrypted.
The other significant measure is the implementation of the data loss protection software. This will tell us exactly what sensitive information is on the network, where it is, and how it's stored, and it will allow us to take appropriate measures to make sure it's secure.
I repeat, the network is encrypted. It will also allow us to deal with the movement of the data. We can control or prevent the movement of data once this software is in place. These are very important measures that we're taking in response to the incident.
Conservative
Joe Daniel Conservative Don Valley East, ON
Are there any measures you're taking to constrain how much data can be put on any one USB at a time, or anything like that?
February 14th, 2013 / 12:05 p.m.
Associate Deputy Minister, Department of Human Resources and Skills Development
We have not looked at that particular issue at this time.
Conservative
Joe Daniel Conservative Don Valley East, ON
Okay.
What guarantees can you offer my constituents that this data will not be used fraudulently as a result of this error?
Deputy Minister, Department of Human Resources and Skills Development
Mr. Chair, I don't think we can ever offer guarantees. What we can offer is the assurance that, as Mr. Parker has said, we are monitoring things extremely closely, both through the Equifax arrangement and through the annotations in the social insurance register, to spot any suspicious activity that could give rise to suspicion. That suspicion alone would be the basis for the individual and for HRSDC to take appropriate action.
Again, quite obviously we are very pleased that we have absolutely no indication at this point of malfeasance or of misuse by any third party of any of this information.
Conservative
Joe Daniel Conservative Don Valley East, ON
For my colleague across the way, we talked earlier about using TransUnion and Equifax, but you've chosen to use just Equifax. Can you help me understand again why you're just using one of the credit companies?
Associate Deputy Minister, Department of Human Resources and Skills Development
I'm afraid the answer will be very similar. We're exploring the possibility of engaging with other credit bureaus and financial institutions to gain incremental services. At this moment, that's all that we can say about where we are.
Conservative
Joe Daniel Conservative Don Valley East, ON
But pretty much all the clients will be serviced by Equifax.
Associate Deputy Minister, Department of Human Resources and Skills Development
At the moment, yes, the contract is with Equifax.
Conservative
The Chair Conservative Ed Komarnicki
Thank you for that.
With that, we've concluded the first round of questioning. We'll take a brief five-minute suspension of proceedings and then come back here so we can complete the second round.
Conservative
The Chair Conservative Ed Komarnicki
If we could get the members back to their seats and get department officials, deputy ministers, and associate deputy ministers back to their tables, we'd like to start if we could. If we could get you back to the table there, that would be good. We'd like to complete a second round if that's possible.
We're going to start our second round of questioning. I believe we're going to lead off with Madame Boutin-Sweet.
NDP
Marjolaine Boutin-Sweet NDP Hochelaga, QC
Thank you, Mr. Chair.
Thank you, gentlemen.
We have not talked a great deal about the protection for those you call “clients”. I for one will use the term “former students”. We are also talking about 250 employees, but we often tend to forget them.
The minister said that you contacted the people whose information was up to date. We are talking about half a million students or former students. So they are people who move a lot.
How many of those people were you able to reach?
Assistant Deputy Minister, Learning Branch, Department of Human Resources and Skills Development
We contacted approximately 320,000 people.
NDP
Marjolaine Boutin-Sweet NDP Hochelaga, QC
In other words, 200,000 people still don't know that they might have problems. If those people were victims of identity theft or some other issues, those problems might still come up, especially if this happened in December before the whole situation was released in the papers.
Associate Deputy Minister, Department of Human Resources and Skills Development
That is why we put out announcements, posted documents on our website and made efforts to have this out in the media in order to be able to contact the students whose current information we didn't have.
NDP
Marjolaine Boutin-Sweet NDP Hochelaga, QC
You also said that there were 300,000 calls. So that means that 200,000 people perhaps didn't call or see those announcements and they don't know that their personal protection might be at risk.
Associate Deputy Minister, Department of Human Resources and Skills Development
There have been 200,000 calls so far. As Al said, we sent 326,000 letters. Some of those people may still contact us.
NDP
Marjolaine Boutin-Sweet NDP Hochelaga, QC
Could you tell us more about Equifax? As Mr. Sutherland said, it is complicated. I would like you to be very clear about what is being offered to people. First, do the students need to make a request? What do they get? Who pays for what? What types of services are we talking about? Is it just a notation on their credit files, or do you have a surveillance and oversight system in place? Could you make this clear for me and everyone here today?
Associate Deputy Minister, Department of Human Resources and Skills Development
The students have to call the call centre to have access to the program. They have to opt in for the protection of their private information. That is the only way to do so safely.
In terms of services, we have a customized package for our clients. There is a notation on the Equifax file that tells financial institutions that people's privacy may have been compromised. In those cases, the financial institution will ask clients to provide additional proof of identity if they want to increase their credit limit, to get a new credit card, or for any other transactions like that.
In addition, as mentioned, there is a call centre specifically for our Equifax clients. Those services will be provided for six years. After six years, we will have to review the situation closely.
Also, we have added notations to the social insurance numbers that might have been affected. For any changes to social insurance numbers, additional proof of identity will be requested.