Public Safety Committee on July 15th, 2019

[Maxime Guénette, Assistant Commissioner and Chief Privacy Officer, Public Affairs Branch, Canada Revenue Agency]

Thank you, Mr. Chair.

Good afternoon to all committee members.

My name is Maxime Guénette. I'm assistant commissioner of the public affairs branch and chief privacy officer at the Canada Revenue Agency. With me today is my colleague Gillian Pranke, deputy assistant commissioner of the assessment, benefit and service branch at the CRA.

The CRA is an organization that touches the lives of virtually all Canadians. We're one of the largest holders of personal information at the Government of Canada. We process more than 28 million individual income tax returns annually. It's therefore critical that the CRA has an extensive privacy framework in place to manage and protect personal information for all Canadians.

Integrity in the workplace is the cornerstone of agency culture. The agency supports its people in doing the right thing by providing clear guidelines and tools to ensure privacy, security and the protection of personal information, our programs and our data.

The agency is subject to the Privacy Act and associated Treasury Board policies and directives for the management and protection of Canadians' personal information. Section 241 of the Income Tax Act also imposes confidentiality requirements on its employees and others with access to taxpayer information.

The agency also adheres to the policy on government security and direction provided by lead security agencies like the Communications Security Establishment and the Canadian Centre for Cyber Security.

In April 2013, the agency appointed its first chief privacy officer, who is also responsible for the access to information and privacy functions within the agency.

Part of my role as the chief privacy officer is to ensure that the CRA's respect for the privacy of the information it holds is reinforced and strengthened by overseeing decisions related to privacy, including assessing the privacy impacts of our programs; championing privacy rights within the agency, including managing internal privacy breaches when they occur; and reporting to CRA senior management on the state of privacy management at the agency.

Our responsibility for sound privacy management goes beyond appointing a chief privacy officer, though. It's a responsibility that all employees share.

Protecting the CRA's integrity includes ensuring that we have the proper systems in place to safeguard sensitive information from external threats. Agency networks and workstations are equipped with malware and virus detection and removal software, which are updated daily and protect the CRA environment from the increasing threat of malicious code and viruses.

At the agency employee level, computers are secured with a suite of security products ranging from anti-virus software to host intrusion software.

External services are conducted on secure platforms and protected by firewalls and intrusion prevention tools to detect and prevent unauthorized access to agency systems.

During online transactions we ensure that all sensitive information is encrypted when it is transmitted between a taxpayer's computer and our Web servers. Regardless of how Canadians choose to interact with the agency, they must complete a two-step authentication process before gaining access to their account.

These steps are crucial to making sure that access to personal information is only available to authorized individuals. The process includes validation of a number of personal and confidential data points, including a person's social insurance number, their month and year of birth, and information from the previous year's income tax return.

The CRA will shortly also be implementing a new personal identification number for taxpayers who choose to use it when calling the individual inquiries line. In addition, the CRA is currently examining additional security procedures to safeguard the information of taxpayers. As cybercrime and phishing scams become more sophisticated and commonplace, the CRA is being proactive in warning the public about fraudulent communications claiming to be from the CRA.

One very simple way in which taxpayers can safeguard against fraudulent activity is to sign up for My Account, or for businesses to sign up for My Business Account, so that they can use the CRA's secure portals to access and manage their tax affairs easily and securely. When an individual is signed up for My Account, they can also sign up for online mail in order to receive account alerts informing them of possible scams or other fraudulent activity that may affect them.

CRA is proud of its reputation as a leading-edge organization committed to excellence in administering Canada's tax system. However, inappropriate fraudulent activity can occur in the workplace. CRA has incorporated a broad array of checks and balances to ensure that those who access taxpayer information are strictly limited to employees required to do so as part of their job and to detect misconduct when it does occur.

Monitoring of employees' access to taxpayer information is centralized, ensuring an independent process that enables the agency to detect and, if necessary, address any suspect transactions in our systems. This provides assurance that authorized users are accessing only the applications and data they are allowed to access based on strict business rules.

In 2017 the CRA implemented a new enterprise fraud management solution, which complements existing security controls and further reduces the risk of unauthorized access and privacy breaches. This solution enables proactive monitoring and detection of unauthorized access by CRA employees. Any allegations or suspicions of employee misconduct are taken very seriously and are thoroughly investigated. When wrongdoing or misconduct is founded, appropriate measures are taken, up to and including termination of employment. If criminal activity is suspected, the matter is referred to the proper authorities.

Upon hire, agency employees are required to read and acknowledge the agency's code of integrity and professional conduct and the values and ethics code for the public sector.

The code clearly outlines the expected standard of conduct, including the obligation to protect taxpayer information in accordance with section 241 of the Income Tax Act. Unauthorized access to taxpayer information is considered to be serious misconduct, as reflected in the agency's directive on discipline.

The code ensures that current and former employees are aware that the obligation to protect taxpayer information continues even after they leave the CRA. All employees are asked to review and affirm their obligations under the CRA's code of integrity every year.

In the event a privacy breach does occur, it is assessed in accordance with TBS policy and procedures to document and evaluate all potential risks to the affected individual. In such a case, the CRA offers support to the affected individual through a dedicated agency representative so that the client has the opportunity to ask questions and find information as well as, on a case-by-case basis, get access to free credit protection services.

On the rare occasion when a taxpayer's information is confirmed to have been compromised, the CRA will act to resolve all outstanding issues. This includes reviewing all fraudulent activity that may have occurred in the account, including fraudulent refund payments.

We at the agency are deeply committed to safeguarding the trust Canadians place in our organization, and to meeting their expectations that we have the right checks and balances in place to secure the information entrusted to us. We have worked hard to earn the public's trust, because it is the foundation of our self-assessment tax system.

A good reputation takes years to establish. We safeguard it by remaining vigilant in our efforts to protect taxpayers from security breaches and to protect Canada's tax administration system from misconduct and criminal wrongdoing.

Thank you, Mr. Chairman. I'd be pleased to answer any questions you may have.

[The Vice-Chair, Conservative, Pierre Paul-Hus]

Thank you, Mr. Guénette.

If there is no one else, we will begin the question period.

Mr. Drouin, you have seven minutes.

[Francis Drouin, Liberal, Glengarry—Prescott—Russell, ON]

Thank you very much, Mr. Chair.

I thank all witnesses for appearing before the committee on short notice.

I should mention that I am one of the victims of the data breach at Desjardins, as are many of my constituents.

Ms. Boisjoly, you referred to the online petition asking that the social insurance numbers of those affected be changed. Can you explain to the committee why that would not be done and why it would only complicate things without providing better security for Canadians?

[Elise Boisjoly]

I briefly mentioned that in my presentation and I thank you for giving me the opportunity to talk about it at greater length.

First, an information leak does not necessarily mean that fraud or identity theft has occurred. Second, we do not automatically change social insurance numbers after a leak like this because it doesn't really solve the problem or automatically remove all risk of fraud.

Let me explain that first point a little more. If you do not change the social insurance number linked to a certain credit number and if a credit agency uses the old credit number, the person involved will not necessarily be able to get credit. In addition, if a lender does not properly check the identity of that person, and a fraudster borrows money using his name, the lender could ask him to pay the debt. So there can be other cases of fraud if lenders do not correctly check people's identity.

The second reason is that it can create serious problems of access to benefits and services. As I said in my presentation, victims of data breaches must warn everyone, financial institutions, credit agencies, past and future employers, and the managers of pension schemes to which they belonged with their old social insurance numbers, and make the necessary changes. Often, people no longer remember those to whom they have given their social insurance number, especially at the beginning of their careers. That can prevent people from receiving a pension, for example, because it is no longer possible to establish a link between an individual and the benefits to which they are entitled.

At federal level, we would certainly advise the Canadian Revenue Agency and all organizations involved. But changes could be made manually and there may be errors. This could complicate the calculation of pensions or employment insurance benefits. If someone forgets an employer and makes errors, the calculation of employment insurance benefits or the old age pension could be wrong.

[Francis Drouin, Liberal, Glengarry—Prescott—Russell, ON]

In other words, changing our social insurance number does not necessarily protect our personal information.

Why is another social insurance number issued in cases where fraud has been proven?

[Elise Boisjoly]

When fraud has been proven, we look at the type of fraud and discuss the matter with the person involved. Often people decide not to change their social insurance numbers. They register, or have someone register them, at a credit checking agency. By so doing, they will be better protected than they would be if they changed their social insurance number. Often, having been informed, people decide not to change their social insurance number. In a very small number of cases, 60 per year since 2014, people insist on making a change when fraud has been confirmed. At that point, we allow a new social insurance number to be issued, but we will also explain that it will not necessarily solve the problem.

[Francis Drouin, Liberal, Glengarry—Prescott—Russell, ON]

Here is a more practical question.

Like everyone in the same situation as myself, I see a risk of fraud. How then can I advise the authorities, whether at Revenue Canada or Service Canada, that my social insurance number may perhaps be used fraudulently? Can I call Service Canada to advise them of that? Is there an internal process that allows the public to do that?

[Elise Boisjoly]

Absolutely. Let me make two points about that.

First, since this leak was made public, we have received between 1,400 and 1,500 requests directly from members of the public. They have called us to find out how to better protect their personal data and we have given them a lot of information about doing so. They will often take the steps that we advise them to take, such as looking at the credit agency reports and checking their bank transactions.

Second, if they notice a suspicious activity, they must follow the very clear procedures to give us that information. If suspicious transactions are detected, we ask them to contact Service Canada, which will be able to take the steps needed to help them.

[Francis Drouin, Liberal, Glengarry—Prescott—Russell, ON]

Okay.

The website lists 29 cases in which Canadians are allowed to give out their social insurance numbers. To banking institutions and other entities, for example.

What does Service Canada do so that Canadians know when they should give out their social insurance number and when they should not? What recourse is possible when an organization asks for a social insurance number when it should not do so?

[Elise Boisjoly]

Our website, our call centres and the Service Canada centres tell Canadians who they may give their social insurance numbers to. When we issue social insurance numbers, we actually tell people who they should and should not give it to. A certain number of organizations are authorized to ask for social insurance numbers, for example when a bank or creditor pays interest, which the Canada Revenue Agency needs to know.

If someone not on that list asks for a social insurance number, people can refuse and ask to provide another form of information. For example, a long time ago, landlords often asked tenants for social insurance numbers in order to check their credit. They can simply provide a credit report rather than give out their social insurance number. The person asking the question must—

[The Chair, Liberal, John McKay]

Thank you.

It's helpful if the witnesses look at the chair from time to time so that I can signal them.

[Elise Boisjoly]

Thank you very much.

These glasses just—

[The Chair, Liberal, John McKay]

Mr. Paul-Hus, you have seven minutes, please.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

Thank you, Mr. Chair.

My thanks to you all for being here today.

Listening to you is like being in The Twelve Tasks of Asterix. Let us put ourselves in people's shoes. Their concern is that they have no real idea of what will happen. We asked to meet with you so that we could have some information on the subject. We know that the social insurance number is one measure but is there anything else that should be done in the future to change the system? Could we do as other countries have done, such as providing more digital identification, whether it is by means of fingerprints or something else?

Ms. Boisjoly, you say that there about 60 cases per year, but look, 2.9 million people had their data stolen. Are you expecting a major increase in the number of requested changes of social insurance numbers following these identity thefts?

I also have a question for you, Mr. Guénette.

The people following what is currently happening want to know what is being done. You proposed a good solution, and solutions are what people need. You mentioned people going on the Government of Canada site and opening their financial records. If I understand correctly, by opening your records, you can receive alerts or warnings.

It has now been three weeks. We are here today as the result of an emergency request. Why was there no communication with the public, immediately or within a week following the thefts, to let people know what the Government of Canada can do to help? That's what we need to know.

I am all ears, Ms. Boisjoly.

[Elise Boisjoly]

Thank you.

To answer your first question on new measures, every situation like this gives us the opportunity to review our security and privacy protection measures. All of our colleagues and myself certainly focus on that when there are incidents of this kind. The colleagues who have gone before us spoke a lot about the evolution of cybersecurity. They said that we always have to be ready. We are certainly always focused on that.

My colleague mentioned the Treasury Board, whose mandate includes identity management. They are focusing on ways in which we can better solve the problems associated with digital identity, specifically by conducting pilot projects with the provinces. We participate in those forums, and we are thinking of ways to move the discussion on digital identity forward.

Second, in terms of the number of identity thefts, we have been advised of many in the last 14 or 15 years. Probably millions of people have already been affected and, despite that, the number asking for a new social insurance number remains rather low. So I cannot answer your question, because I am not aware of the future, but I can say that there have been a lot of thefts and that the number seems constant, around 60 per year.

[Maxime Guénette]

Thank you for the question, Mr. Paul-Hus.

As Ms. Boisjoly said, there is never a bad time to remind people about the things they can do. At tax time, we conducted advertising campaigns and communication initiatives online and on social media to remind people about the services at their disposal. However, more can always be done. We are always looking for opportunities to communicate more in this respect. So—

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

Okay, but the case before us is about managing a crisis. We are here to find out whether a federal organization can lend a hand to Desjardins, who are taking their own steps to rectify the situation as best they can. Currently, I see some inter-agency measures but really no proactive measures to help Canadians, aside from a message that has already been sent out.

In your opinion, why does the government seem to be so passive? Why is it saying nothing? Is it because nothing can be done? Is there no solution?

We are looking for solutions because people are concerned. If you are telling us that current agencies do not have the means or the tools to help them, we are going to look for other solutions.

Are solutions like the one Desjardins proposed, the Equifax services, quite effective in your experience and as you assess this situation? We are looking to reassure people with things that are true. We don’t want to say just anything.

[Maxime Guénette]

Currently, because the investigation is still in progress, there is a lot of information…

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

The investigation has nothing to do with it because we know how the data breach happened. We also have an idea of where the data was sent, but, at the moment, that is not what we are interested in. We know that someone, somewhere on the planet, has our information and is in a position to harm us by stealing our identity. So we want to know whether our agencies can become proactively involved or, if not, what can be done.

You have a solution in my case, so that is already something that the public could be told about. It is important to do that quickly because people are not in a very good mood during their holidays. Then we will have to see if something else can be done.

The issue of the social insurance number has come up everywhere. A number of suggestions have been made. You are responsible for that file and you are saying that nothing can be done, at least not in that way. These are the answers that people need to hear. But the fact remains that we have to leave here telling people what the government can do to help, first Desjardins and second, the 2.9 million people who have been affected. We are hearing a lot about internal protocols, but, for the Canadians listening to us, that does not mean a lot. This is why I want to hear clear answers. I know that you are giving them when you can, but basically, when we leave here, we will need to know what can be done.

[Maxime Guénette]

I can assure you that very proactive discussions are going on between the various departments involved.

As far as the revenue agency is concerned, as I said in my remarks, the social insurance number, the address and the date of birth are some of the pieces of information people need in order to identify themselves to the agency. We also need information on tax returns from previous years, which was not in the information stolen from Desjardins, according to the discussions we have had. However, once again, the investigation is still in progress. So these questions—

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

As I told you, that really changes nothing.

How much time do I have left, Mr. Chair?

[The Chair, Liberal, John McKay]

You have about 10 seconds.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

What is the first thing people should do if their identity is stolen? Call the police?

[Elise Boisjoly]

Yes.

[Maxime Guénette]

Certainly.