Public Safety Committee on Oct. 19th, 2017

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

I have no more questions, but before I finish, I would like to make a request.

[The Chair, Liberal, John McKay]

You have 20 seconds.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

We have no copy of your presentation. We can always consult the blues, but would it be possible to send it to our clerk?

[The Chair, Liberal, John McKay]

Mr. Dubé, go ahead for seven minutes.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Thank you very much, Mr. Chair.

Ladies, thank you for joining us today.

Ms. Boisjoly, concerning data retention, I have a few questions on how data is collected. You said that, if there is no match, the data was eliminated. So a match can concern any claimant of the programs in question. Is that right?

[Elise Boisjoly]

To protect privacy, we try not to have information that is not relevant to us. In the case of employment insurance, we recommend to the CBSA to limit its information collection to people aged 16 and over who have spent more than five days outside the country and those over the age of 60 who have spent more than 213 days, or about seven months, outside the country.

That information targets people who fall outside established standards.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Do the matches represent all those individuals who satisfy the criteria you just listed?

[Elise Boisjoly]

We collect the information and, if there is a match with the records in our database, the information—

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Based on those criteria?

[Elise Boisjoly]

Yes, based on those criteria.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

How do you determine whether the information on an individual is pertinent? For instance, in the case of an EI claimant who is older than 16 and who has left the country for more than five days, does CBSA send you the information electronically? Will department staff do an assessment?

[Elise Boisjoly]

In a case like that, the information is shared via computer systems.

We will ensure that a privacy impact assessment is done, that any concerns raised by the Privacy Commissioner are taken into account, that the systems used are highly secure, that only employees dealing with the files in question have access to the information, and that staff are properly trained on how to handle the information.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

What I actually want to know is this.

The agency is going to send you all the information. A mechanism has to be established to access the information collected. The agency is going to collect information on everyone who leaves the country and send it to you. Will there be some sort of mechanism to screen the information before the data deemed pertinent, according to your criteria, is shared with you?

How will the information be screened? Will an employee sitting at a computer do it? That's really what I'm trying to understand.

[Elise Boisjoly]

It will be done electronically. An electronic platform will be set up to collect the information that meets the criteria and match it against the information in our systems.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Given all the problems associated with Phoenix and Shared Services Canada, information technology systems don't exactly inspire confidence these days.

Who is implementing the system? What steps are being taken to ensure the matching process works as it should, so that the department doesn't go after recipients who are entitled to continue receiving their benefits? What is being done so that people who haven't done anything wrong aren't forced to chase after ESDC to provide documentation justifying their claim?

[Elise Boisjoly]

That's a great question, given the factors you mentioned.

Platforms already exist for other data-sharing arrangements, and we haven't had that kind of problem. Obviously, from a technology standpoint, we make sure we have solid processes and sound methods to test the information; we make sure we take an iterative approach and verify the information. The data will be subject to oversight to ensure accuracy and security.

We also do what we call a system security clearance prior to deployment, the purpose being to make sure the security features are indeed in place and that staff are properly trained.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

When the system produces a match, you keep the information, according to the criteria, obviously. How long do you keep the information on file?

[Elise Boisjoly]

In the case of a match, the retention period differs for the two programs.

With EI, for the purposes of retention and redemption—I'm not sure whether I'm using the right terminology—it's approximately 12 years. For OAS, it's six years. The information is highly secure. The department has a number of systems in place. We make sure that the information is destroyed properly and in accordance with Library and Archives Canada rules.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Take, for example, an employment insurance claimant. I've had constituents in my riding tell me that processes can be extremely lengthy and contentious.

Have you put in place any mechanisms or rules to deal with situations where the information is kept longer than planned?

[Elise Boisjoly]

In cases under dispute, holds are often put on the destruction of information. In rare circumstances, information can be retained for extended periods, such as in court cases.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Now, for my last question.

You mentioned a potential savings of $47 million over five years, or money collected in connection with OAS overpayments. You also said, though, that you didn't expect much of an impact on OAS recipients. Unless I'm mistaken—bear with me as I look for it in your speaking notes—the proportion would be something along the lines of 0.1%.

How do you explain such a minimal impact and, yet, such a large amount of money?

[Elise Boisjoly]

It really comes down to the risk model that was put in place.

The proportion of 0.1% may seem minimal when compared with the dollar figure. Nevertheless, it's important to take into account how we estimate the overpayments. It is not just the amount that has been overpaid up to this point, but it is also the amount that would be overpaid if the beneficiary continued to receive benefits. In the case of old age security, that is the appropriate model—a prediction model. Under the model, if the problems were not detected in time, the overpayments would continue for an average of seven years.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

We are talking about very serious cases of fraud continuing for a number of years.

[Elise Boisjoly]

Not necessarily. With respect to OAS, it has to do mainly with the fact that, if the fraud isn't identified at a given point, the person could continue to receive payments for another 10, 15, or 20 years. Therefore, the overpayments could really add up. If the fraud was detected in time and at the right time, the overpayment would be minimal. If, however, payments continued to be made, the overpayment would be considerably more.

The prediction model assumes that people could continue to receive payments for a period of approximately seven years, so that's how the amount is estimated.

[The Chair, Liberal, John McKay]

Thank you, Mr. Dubé.

We have four questioners and we have 12 minutes total left.

Mr. Fonseca, welcome to the committee. You have seven minutes.