Industry Committee on March 26th, 2015

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you very much.

I also have a question concerning the breach notification mechanism proposed in Bill S-4. In your opinion, could this model adequately protect people's personal information?

[Dr. Éloïse Gratton]

I missed the beginning of your question.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

I was talking about the breach notification provisions.

[Dr. Éloïse Gratton]

Yes, those suit me. I know that certain reservations were expressed with regard to the record. All of the records need to be kept. I'm also aware of the position of the Canadian Bar Association, which also has certain reservations as to the records that would have to be kept.

Bill S-4 suggests that the commissioner and individuals be notified in this type of situation where there is a high risk of prejudice. I like that. In practice, when I divulge breaches, I advise individuals, but I also often advise the commissioners. These things are often done together. It does not bother me that the same criteria do not apply to disclosure.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you.

Mr. Bundus or Mr. Dubin, I would put the same question to you.

In your testimony at the Senate on Bill S-4, you said that you preferred the breach notification mechanism model that is used in Alberta. Do you still feel that way? If so, can you explain why?

[Randy Bundus]

Our opinion on that is unchanged from our previous testimony. The reason is that harmonization is critically important for our industry. Our members operate across the country, and if they were to have to take separate approaches for different parts of the country, it would make the cost of the product much larger once you try to specialize for smaller provinces, different provinces.

That's the main reason we would want to have that.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

So you are concerned about the use of several models.

Ms. Gratton, could we have your opinion on that?

[Dr. Éloïse Gratton]

No, that's okay. Of course, in an ideal world, notification provisions would be standardized.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you very much.

Ms. Gratton, do you think that the compliance agreements as proposed in Bill S-4 are sufficient to really encourage businesses to respect people's personal information?

[Dr. Éloïse Gratton]

It's hard to say. We will have to see whether there is a compliance problem and how businesses behave.

Of course, I am sitting on one side of the fence. Businesses contact me because they want to comply with the law. So I am in a bad position to tell you that we have a problem and that people are not respecting the law. I am always on the side of respecting the law and ensuring that we do it well.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you.

Still on this topic, it is certain that complying with the law always requires certain resources. This may be an issue that all of the witnesses can relate to.

Mr. Pigeon, you talked about the fact that there are some very small cooperatives with only one employee. In larger businesses with many employees, there may be a specific department for privacy protection.

Do you think resources will be sufficient to comply with the bill once it is passed?

[Marc-André Pigeon]

I will repeat what we said before. We support the bill as such, but we would also like to see some minor changes.

We have mechanisms to improve the situation or lessen the burden for our small credit unions, even if the burden is much too heavy for them. At the central, we work together, for instance to learn the rules and communicate them to our smaller members. We certainly are proposing that the fines be adjusted, because a $100,000 fine would be a huge punishment for a small credit union that barely generates a million dollars a year. That is our main concern.

[The Chair, Conservative, David Sweet]

Thank you, Mr. Pigeon.

Mr. Carmichael, eight minutes.

[John Carmichael, Conservative, Don Valley West, ON]

Thank you, Mr. Chair.

Welcome to our witnesses. Thank you for appearing today.

I'd like to begin with Mr. Pigeon and Mr. Martin on the credit union side.

You spoke about elder abuse and fraud. You suggested, in your opening comments, that we're doing some things right with Bill S-4. I wonder if you could expand on it. You say in here that the measure could be refined, however, by making it possible to disclose suspected abuse to a member of the individual's family, and that research has shown that often, in the case of elder abuse, the next of kin is the abuser. You also talk about CUSOURCE as a training program, or you've taken some of your solutions and are applying them to day-to-day operations.

I wonder if you could talk about Bill S-4 and how this is making it more feasible to track elder abuse. What are you doing through CUSOURCE to make it work?

[Marc-André Pigeon]

Just briefly, we recognize that this is a major issue as the population ages, and that's part of the reason we're very supportive of this measure. In our day-to-day interactions, we do see instances where these kinds of situations arise, so it's in the interests of our members to have legislative override that gives us that capacity to talk to family members about these suspected cases. That's a very positive thing for our members and for society as a whole.

I don't know if Rob wants to add anything to that.

[Rob Martin, Senior Policy Advisor, Credit Union Central of Canada]

I would just reiterate that the one concern we have in this section is the fact that it's targeted at next of kin rather than, more generally, family members being able to disclose.

There's not a definition of next of kin in the legislation, so it's hard for us to interpret that as institutions. If you take a vernacular view of it, then it could be fairly broad, but if it's based on family law, then it may be very restrictive in terms of who we could actually disclose to.

We'd like to see it expanded out a bit. You can imagine in a small town or someplace where a credit union is fairly prevalent that there may be knowledge by the credit union staff that the person who is actually carrying out the financial abuse is, say, the person who's next of kin.

I'll leave it at that.

[John Carmichael, Conservative, Don Valley West, ON]

Clearly it is an area that's conflicted, because you want to solve the problem, yet if the problem is the individual you are reporting to, you have a serious obstacle.

I'll come back to you in a few minutes, but first I'd like to talk to the IBC.

Again, congratulations for making it today. We are delighted to have you here.

Mr. Dubin, you said that the average Ontario payment for accidents is $31,785. I think you said that's in Ontario?

[Richard Dubin]

Yes: $31,785 is the average accident benefit payment per person in Ontario.

[John Carmichael, Conservative, Don Valley West, ON]

I am anxious to know how you track these fraudsters who come into the system. In your opening remarks, you talked about organized crime, different body shop organizations, and other types of groups that come into this. There has to be a way of tracking this.

Does Bill S-4 give you the tools to do what you need to do in order to start to address some of these issues?

[Richard Dubin]

I would say it is certainly in the right direction, and it is a positive way of moving forward. Obviously, if the insurers can't contact each other, they can't identify the social networks that develop within organized criminal rings. That's the key. Right now, yes, it's a manual process, but it doesn't take very long, and it doesn't take too many files, to start identifying a possible trend and pattern. Once that exists and we are brought into the scene, we will start looking into our database, where we store all of our investigations going back to 2002, when we got into organized activity. We would start looking at whether there is overlap, and often there is overlap. It's a start of identifying and dealing with each insurer independently, giving them reasonable grounds why we believe there may be a suspected fraud. Then, on the other side, they have reasonable grounds to feel that they can disclose that information. It's like putting together a puzzle.

As you know, in the fraud task force—I was a member of one of the committees dealing with this—there was a recommendation to move to analytics to identify that information, so that it would very quickly raise a flag over a certain threshold, saying, “You may want to investigate this further.” It doesn't mean there is fraud. This bill allows the insurers at this point in time to take that manual type of approach and identify possible red flags that give them reason to hold off on payment, bring us into the picture, and possibly involve other insurers so that they know the same thing: time to stop the payment.

[John Carmichael, Conservative, Don Valley West, ON]

As I listen to you, it strikes me that the damage on payments, etc., is already done by the time you establish any type of trending.

[Richard Dubin]

Absolutely.

[John Carmichael, Conservative, Don Valley West, ON]

That would be a concern—no police reports, tracking inconsistencies. Once you have identified the perpetrators by the trends of a particular group, I take it they disappear at that point, and that is where the types of numbers that we heard on payouts have skyrocketed to such a high level.

[Richard Dubin]

Yes: organized crime is extremely creative, and they keep changing their approach. They take advantage of the fact that insurers are unable, currently, to share information with one another, and that is why they are ahead of the curve.

[John Carmichael, Conservative, Don Valley West, ON]

Thank you.

How does the IBC maintain an appropriate balance between being accountable for its customers' personal information and privacy, and its industry's need to deal with insurance crime and fraud? How do you find a balance in that?