Public Safety Committee on July 15th, 2019

[The Chair, Liberal, John McKay]

We're reconvened. Thank you to the officials all and sundry for your patience with us. We were in the middle of questioning and I believe it's Mr. Graham up for five minutes, please.

[David Graham, Liberal, Laurentides—Labelle, QC]

Thank you.

Ms. Boisjoly, earlier you heard the people from Desjardins talk about the need to rethink the social insurance number system. Is research being done on the future of the social insurance number?

[Elise Boisjoly]

Thank you for your question.

As you know, the social insurance number is one identifier among many. As we have already mentioned, on our website, we are advising citizens that they should only give their social insurance number in very limited circumstances. This is explained to them. We tell them not to give their social insurance numbers to organizations that cannot legally request them. However, from what we hear, citizens often give it voluntarily to organizations that are not authorized to take it.

We are certainly aware of the discussions. We are still looking at what we can do to improve the protection of our systems and practices related to the social insurance number.

We want to hear the recommendations or see the report that this committee will publish, as well as other reports.

I can assure you that work on improving the security of our systems is ongoing. I know that Treasury Board is also very actively working on digital identity projects. We are participating in these discussions to see how we can improve the digital identity of citizens in Canada.

[David Graham, Liberal, Laurentides—Labelle, QC]

Among the data that was taken, we know that there was a lot of information, not just social insurance numbers. There were also addresses, phone numbers, and so on. You have spoken several times about additional information to authenticate the social insurance number. Is all this information included in the data that was taken?

[Elise Boisjoly]

The social insurance number is an identifier that provides access to federal programs and services, as well as to income and tax systems. In the case involving the federal government, with respect to benefits, for example, my colleague explained that at the Canada Revenue Agency you have to ask an additional, secret question to identify individuals, such as the amount entered on a certain line of the tax return. In the case of employment insurance, participants are given a program access code, and must give two digits of this code in order to access private information related to the employment insurance program.

The social insurance number is an identifier, but it is accompanied by other questions to validate the identity of the person with whom we do business.

[David Graham, Liberal, Laurentides—Labelle, QC]

There are Service Canada officers in every city. If people come to their offices to find out what they need to do about the current situation, what instructions will they be given?

[Elise Boisjoly]

Thank you for your question.

All our call centres, Service Canada offices and agents have received very clear instructions. Our call centres and Service Canada offices answered questions from approximately 1,500 citizens. They have informed them of the steps to take, including contacting a credit bureau, verifying their financial and banking transactions, and exercising extra vigilance with respect to the transactions they make. If they identify activities that are not related to their transactions, they should contact the police, Service Canada offices and the various institutions so that we can resolve the situation. To date, no fraud has been reported.

[David Graham, Liberal, Laurentides—Labelle, QC]

The leak is recent, however.

[Elise Boisjoly]

As I was saying, despite the number of leaks detected in recent years, there are about 60 cases per year requiring a change in the social insurance number.

[David Graham, Liberal, Laurentides—Labelle, QC]

Is there a way to indicate somewhere that the social insurance number is no longer valid and then remove the liability associated with it?

If I change my social insurance number and I am still responsible for the old one, in my opinion, it doesn't make sense. Can you tell us more about this?

[Elise Boisjoly]

One of the reasons is that we do not know to whom citizens have given their social insurance number. The social insurance number should only be used as an identifier to link certain information to provide benefits. Individuals are the only ones who know to whom they have given their social insurance number and for what purpose. You can give your social insurance number for private pensions, insurance and car rentals or purchases, for example.

The social insurance number should not be used to identify the person. This is a number that allows you to link certain files. We need this number to link the information. We now link the two social insurance numbers in our systems, but the first should never again be used by the individual.

[The Chair, Liberal, John McKay]

Thank you, Mr. Graham.

Mr. Clarke, for five minutes, please.

[Alupa Clarke, Conservative, Beauport—Limoilou, QC]

Thank you, Mr. Chair.

Good afternoon, everyone.

Thank you for waiting and staying here.

Ms. Boisjoly, you are the assistant deputy minister at the Department of Employment and Social Development Canada. Did your minister instruct you to get the list? I asked the same question of Mr. Cormier. Have you received ministerial instructions to obtain the list of the 2.9 million Canadians affected by the massive data leak at Desjardins?

[Elise Boisjoly]

You raise an interesting question.

The first thing to do, according to the Personal Information Protection and Electronic Documents Act, is to inform third parties. As you have heard, Desjardins has contacted us to ensure that we will provide the information and help Desjardins branches obtain as much relevant information as possible to help their members. In this case, we have given a lot of information on how to protect their members.

[Alupa Clarke, Conservative, Beauport—Limoilou, QC]

So there were no guidelines. In other words, you are reactive. I'm not talking about you, of course. You follow political orders, and we understand that. At the moment, everything is reactive and absolutely nothing is proactive.

You said you received 1,500 requests or calls about the social insurance number. Our goal is to know how the government can help people proactively. Since you don't know which Canadians are affected, you necessarily have to wait for them to contact you. That is what is happening right now. You wait for the people affected to contact you, not the other way around. That's impossible, because you don't have the data. Mr. Cormier, from Desjardins, seemed to say that they would be ready to send this data. I know I'm asking you to give a political opinion, but you can't.

I have to express something that royally disgusts the people in my riding. I went door-to-door a lot last week and the week before that. People have consistently told me that they doubt that the government can do anything. It saddened me very much. How is that possible? I would like to break the cynicism and listen to people. People contribute 50% of their income to the Canadian government. We Conservatives want the government to work for citizens, not the other way around.

Mr. Cormier said that when someone calls Desjardins, they are proactive and take care of things for them.

We learned something very important today. In fact, we already knew that because it had been mentioned here and there. I learned from an official like you that you can change your social insurance number. I know it's complex and that even if we change it, we still have to reach a myriad of institutions, our former employers, and so on. However, it is the government that requires that citizens have a social insurance number. It is a system that should perhaps even be called into question, and we are discussing it today, in a way.

Wouldn't it be your duty to contact the 2.9 million people? The Liberal government should do this to be proactive. It knows these people. For example, at the Pizzeria D'Youville, where I worked in 2004 when I was 17, it was the boss who sent the GST to the federal government. All these things are well known. Your departments could easily link this information and change the social insurance number, perhaps not in a comprehensive way, but it should support the citizen in the very difficult task of reaching all former employers or government agencies.

I really don't like this. I know it's not your fault. You have political directives from the Liberal government, but it is not proactive at the moment. I don't like it at all. What can you say about this?

[Elise Boisjoly]

In view of the multiple leaks that can occur, the goal is to ensure that citizens and the benefits due to them, whether tax refunds or other benefits, are always protected. That is why we worked very closely with Desjardins to define what measures would enable us to support it in its relations with the affected citizens.

Desjardins has implemented measures. When there were leaks at the federal level, very similar measures were taken with respect to credit bureaus, because it is really the best way to protect citizens from fraud. We continue to work with Desjardins. If an exchange of information proved to be a good solution, we would consider it. However, at this stage, the measures put in place are the best that could have been taken.

[Alupa Clarke, Conservative, Beauport—Limoilou, QC]

Thank you, Ms. Boisjoly.

[The Chair, Liberal, John McKay]

Are there any questions over here? No.

Mr. Dubé, for three minutes.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Thank you, Mr. Chair.

I would like to come back to the question I asked, namely whether you want to hold information sessions in major centres in Quebec, among others. I know that people outside Quebec are also affected, but it is in Quebec that the leak had the greatest impact. The population must be informed.

I forgot what it was, but I have already received a letter in the mail regarding a change in federal policy. I would like to believe that it is possible to send letters by mail to the people of Quebec informing them of the schedule of public consultations or information sessions that will take place in the next two months. You are giving us information today and I think people are listening, of course. Nevertheless, we should make sure to reach as many people as possible. Despite the pervasiveness of social media, I am not convinced that this response is adequate.

Is this something you are open to? I believe that the Department of Finance and the Canada Revenue Agency also have a role to play.

[Elise Boisjoly]

Absolutely.

To be proactive, we have put additional information on our website. We have issued press releases. We used social media, as you said. We hold workshops on the social insurance number in several communities. These are workshops that are given on a regular basis and I won't see why we can't use this method as well.

So, thanks for the recommendation. We will take it into consideration.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Perfect. We thank you for that because these are indeed special circumstances, and when there are natural disasters, for example, the local government—whether it is the municipalities or the Government of Quebec—always answers.

As my colleagues said, and not to insult anyone, the federal government is the furthest away. In this case, there are real impacts on people's lives.

Either way, if we ourselves—I'm just talking about myself right now—don't necessarily know how to navigate the social insurance number system when we are federal legislators, I don't think it's because of our own ignorance. It's just a very complex system. That's why you're here today, and that would be knowledge worth sharing.

Thank you for your openness. This completes my questions.

[The Chair, Liberal, John McKay]

Fine.

You have two minutes, Mr. Fortin.

[Rhéal Fortin, Bloc, Rivière-du-Nord, QC]

Thank you, Mr. Chair.

I'll start with Ms. Boisjoly.

If we consider that the social insurance number was created in 1964 to govern employer-employee and government-to-government relations, we see that it is used in every way now, but in any case, much more widely than before.

Wouldn't it be necessary to review the security regulations concerning its use? For example, there could be a PIN that matches the health card, fingerprints or other data, for example.

In your opinion, can anything be done with this?

[Elise Boisjoly]

That is an excellent question.

As I always say, it is important, when you have situations like this, to review and rethink certain things.

As far as the social insurance number is concerned, as I said, it is one of several identifiers. At the federal level—and, of course, in many places— people are invited to add secret questions that only they can answer. It is not a PIN, but it is an additional way to ensure security and identify the right person.

[Rhéal Fortin, Bloc, Rivière-du-Nord, QC]

Correct me if I'm wrong, but the social insurance number is valid, regardless of whether or not we have matching questions.

I am asked for my social insurance number for a transaction, whatever it is, with a bank, or whatever. I don't have a PIN. I just have the number.