:
I call the meeting to order.
Good afternoon, everyone. Welcome to meeting number 141 of the House of Commons Standing Committee on Access to Information, Privacy and Ethics.
[Translation]
Pursuant to Standing Order 108(3)(h) and the motion adopted by the committee on Tuesday, October 29, 2024, the committee is resuming its study of privacy breaches at the Canada Revenue Agency.
[English]
I would like to welcome our witness for the first hour today.
[Translation]
We have with us André Lareau, associate professor in the Université Laval faculty of law, as an individual.
Professor Lareau, before turning the floor over to you, I propose that the committee adopt a budget in connection with this study.
The documents relating to this request were sent to all committee members last week.
Does everyone agree on adopting the budget?
Voices: Agreed.
Thanks to the committee for kindly inviting me to this meeting, which is actually a resumption of last week's meeting. I attended here last week, and you can well imagine that I had spent several hours preparing my testimony. However, I waited in vain for over an hour for the meeting to start. Evidently, a majority of you chose to ignore the meeting, for reasons having to do with political squabbling. That is up to you, but I would remind you that your committee deals with ethical issues. When I was very young, my mother taught me that when you invite people to your home, you should be there and receive them properly.
That said, I will begin my presentation.
I should first note that I am not an expert in computers or privacy. My expertise as a retired professor is limited to tax law.
The CRA, the Canada Revenue Agency, is the custodian of the money given to it by taxpayers, in accordance with the obligations set out in tax laws. In a nutshell, it is the trustee of that money, and must act diligently in performing the assignments given to it. It must also make sure that taxpayers are able to maintain a high level of trust in it, or else their adhesion to it might decline significantly.
On the subject of the CRA's obligations, I would note that under subsection 152(1) of the Income Tax Act, “The Minister shall, with all due dispatch, examine a taxpayer’s return of income… assess the tax for the year…”. The CRA then sends out notices of assessment on that basis. According to the way the CRA does things, it must act quickly, act very expeditiously, in order to comply with the act. Of course, there are situations in which the CRA may take action within three years after the return is filed. Nonetheless, it must act speedily.
The frauds that were investigated by CBC/Radio-Canada are based on an increasingly sophisticated use of digital data and they shine a light on two distinct problems.
The first involves the challenges the CRA faces when it comes to detecting these digital fraud mechanisms, particularly when the fraud arises from theft of personal information. The CRA must therefore make every effort to be able to combat these strategies; otherwise, obviously, taxpayer trust will be eroded.
Along this same line, in May 2024, the tax authorities in the Netherlands were placed under the supervision of an agency responsible for protecting personal information in the country for a five-year period, to achieve:
[English]
“a sustainable improvement in the protection of personal data of citizens and companies.”
[Translation]
So the agency was placed under supervision.
The second problem concerns the protection of personal data when taxpayers use external platforms to send in their tax returns, such as H&R Block and UFile.
I will point out that these entities permit the personal information of taxpayers—their clients—to be transferred, without their knowledge, using Google, Meta, and so on.
This raises two new questions.
First, what is the role of the Canada Revenue Agency when it comes to protecting the confidentiality of taxpayers' rights?
On this point, the Canada Revenue Agency's website sets out its commitment to Canadian taxpayers: “We are committed to protecting your privacy by making sure that the personal information we have is appropriately managed and protected, and that your right to access your information is respected.” It clearly says “we have”.
The protection is provided in section 241 of the Income Tax Act, whose purpose is to prevent disclosure of tax information by officials to unauthorized third parties. That provision could potentially enable officials to disclose certain information to the privacy commissioner. That might be a topic to consider.
The Canada Revenue Agency's website directs us to the Taxpayer Bill of Rights as the basis for its commitment to protecting privacy. It draws our attention particularly to right no. 3, which provides: “You have the right to privacy and confidentiality.”
However, the CRA does not say that the Taxpayer Bill of Rights is not legislation and does not offer taxpayers any form of judicial protection.
Yes, there is a taxpayers' ombudsperson, whose office is clearly motivated by a desire to protect taxpayers' rights, but the ombudsperson—
The Canada Revenue Agency does not say that the Taxpayer Bill of Rights is not legislation. There is a taxpayers' ombudsman, but that person has no investigative power regarding right no. 3. The CRA is talking about a right devoid of substance.
This brings me to my second question.
What protection can taxpayers enjoy when they transfer their tax return using online platforms like UFile or H&R Block?
The confidentiality obligations set out in the Income Tax Act by which officials are bound do not apply to these tax return preparation platforms. They are not covered by any form of confidentiality. On its website, the CRA even invites taxpayers to file their tax returns online.
However, the CRA says on its own website that it does not consult the confidentiality policies of the software designers. According to the CRA, it is up to taxpayers to confirm those policies before buying or using a software package or application.
The CRA tells taxpayers to file their tax returns online, but it says that it has not investigated the software.
I have also analyzed the online contracts. They state that taxpayers assign all their rights to Google and Meta when they buy a software package online. That includes all their banking information, among other things.
Thank you for being with us, Mr. Lareau. Your reputation precedes you.
I'm going to keep the ball rolling, as you did earlier.
What we can gather from the testimony that the minister gave before the committee last week is that the burden of proof is always on the taxpayer. The department essentially assumes no responsibility.
You said there was a charter that isn't legislative, which makes it somewhat useless. A person has a right to complain to the ombudsperson's office, but you say that's an empty right.
I'd like you to tell us more about that.
:
You're absolutely right.
In the case before us, when the bill was created some 25 years ago and the position of ombudsperson was established, the ombudsperson could investigate with respect to more rights. Over time, some rights were removed, even though it was hoped that the 16 rights could be subject to investigation.
However, when the government created this position, it chose to limit to eight the number of rights that could be subject to an ombudsperson's review.
That investigative power is also not a coercive power. It's just a power of recommendation.
What's even more abnormal is that, when Canada created the position of taxpayers' ombudsperson, the person who occupied a similar position in the United States was asked to come and meet with the people at the Canada Revenue Agency.
In the early 2000s, that person came and met with the CRA people and provided them with all the information he had about his position, in which he managed a budget of approximately $700 million a year. He had direct access to the files of all taxpayers in the United States.
He could also make recommendations and publish directives for the IRS to be used in modifying taxpayer files, a much more powerful role than we have here.
In Mexico, the situation is quite different in the case of the PRODECON, as it's called there, which also has much broader powers than here in Canada.
Ultimately, Canada's taxpayers' ombudsperson, though brimming with good will, is unfortunately bound hand and foot.
:
Thank you very much, Mr. Chair.
Monsieur Lareau, I really appreciate your coming back to committee. I know these administrative quirks happen at committee from time to time. I will say that I was online and ready to hear your testimony at the last meeting.
I want to begin with how you feel this privacy breach, from your perspective, has ultimately impacted taxpaying Canadians.
People had their information compromised. People had monies that were supposed to come to them sent fraudulently to somebody else. Of course, as you know, there might be impacts on their OAS and GIS. I think about seniors in Hamilton Centre.
Can you comment on the scale of tens of thousands of Canadians having their data compromised in this way?
Thank you, Professor, as well, for being here. I can also, like Mr. Green, say that I was here last time, and I appreciate the fact that you've shown us the courtesy of showing up again, despite the fact that not all parliamentarians did. I appreciate that, because I probably wouldn't have, if I was in your position. I thank you for the grace that you've shown this committee in what would otherwise be difficult circumstances to attend again, in my view.
Professor, I understand that you didn't see the 's testimony, but my colleague Mr. Chambers, who asked you questions earlier, asked the minister about how much was written off based on privacy breaches by CRA. The minister, in my view—and you can agree or disagree—hid behind section 241 of the act to essentially dodge the question, saying she couldn't comment on specific cases. To me, Mr. Chambers was asking in generalities about how much money had been written off. Does that seem to you to be an appropriate use of section 241?
Thank you, Professor Lareau, for joining us again here today.
I know that you've indicated what the government has done with respect to the incident response. My understanding is that when a breach of this kind happens, the CRA individually notifies each affected person, and then the TBS and the privacy office would report regularly on the privacy matters and information would be available on government sites in some capacity.
Can you talk a little bit about what would have been an effective incident response plan to this data breach?
Part of the reason I'm asking is that our goal in the work we do in committees is to find recommendations and make sure that we're making improvements along the way. I know you've talked a little bit about what should have been done. Can you provide more recommendations and talk a little bit about the data protection breaches and what responsibilities should be put forward as well?
:
You see, the answer is that CRA says it has contacted every taxpayer who was targeted. Well, that's fine, but at the same time, this ignores one specific problem. Canadian society is more like a partnership. A partnership means that we all pitch in. When there's fraud, we all lose.
I understand that these people who were defrauded did not lose any money. If the money from their tax returns went away, then it was refunded to these people. That's fine. However, if the government was defrauded of millions of dollars, then you and I lost on that. That's why all taxpayers lose in that fraud system. That's why we all should be informed of what happened.
We should be informed also of the mechanism that will be put in place by the CRA to correct that. With the current system, when you buy from H&R Block or UFile online, the contract says specifically that they are a worldwide corporation. They know that when you trade with them, you allow them to transfer your information. You have to understand that this information will go to other countries. It says in the licence that the information will go to other countries and that you recognize that these countries might offer you a lower protection than Canada does. They say in the contract that you accept that by buying their software.
You see, it's all in that—
:
The corrective measure is to prevent those companies, when you buy software, from transferring any type of information to other parties. The most important thing that has to be done is to have government software so that you file your tax return through the Government of Canada using CRA software.
You see, the CRA is aware of my income, your income and 90% of the taxpayers' income. Why does the CRA ask people to file a tax return? There's no reason for that. The CRA should, in fact, send all of the information to taxpayers, asking, “Do you have anything to add?”
That would not be on private software but on the government file on your platform with the CRA. You all have a platform. If you wanted to do that, you could do it on the platform. You could say “yes” or “no”. If you want to add something, that's it; it's gone. That would work well.
In Australia, as Rick Krever said, nothing goes outside the software.
:
Yes and no. The situation is reversed in the United States because you can't transfer taxpayer information without taxpayers' express consent.
However, you should know that, in spite of that, the Google corporation has seized data. A class action case, Smith v. Google, filed in 2023, is under way. The plaintiffs are seeking damages and interest because Google intercepted data when, under American law, it was not allowed to do so.
However, Google's defence is that it obtained only pixels. However, in the paper written by two professors, one from Stanford University and the other from the University of California at Berkeley, and published by Princeton University in 2017, the authors wrote
[English]
Google's tracking software can de-anonymize data through information collected on the user's web browsing history.
[Translation]
So it's possible to track pixels and de-anonymize information. That's what Google claims it did.
:
I imagine that Mr. Lareau has already left us, but I wanted to say that his comments were very interesting. I did a lot of work in this field in another life, and he raised some very important points.
With regard to the motion we're debating, there appears to be a problem. Its purpose is to summon two witnesses, which is nothing new. However, my understanding is that the clerk has had trouble contacting people and the dates are a problem.
Having said that, I want to discuss the fact that we're proposing to retain the services of a skip tracer.
[English]
A skip tracer brings me back to my banking collection days, Chair. I wasn't even really sure that it was still a thing, because there are so many ways to find people online now and so on.
It seems bizarre, to say the least, that a parliamentary committee—which has the power, if it so desires, to invite people, reach out to people and, if need be, summon people—would be hiring the services of a private third party. I'm not sure we have the budget for that, Chair. I would like to see just what would be involved. At the very least, I would think that daily rates for these kinds of professionals would be around $500 a day.
It seems very bizarre to me that we would even be talking about this, but maybe it's a new thing that can go on social media. We'll have a skip tracer and we'll be doing a reality show or something like that. Maybe that's what we're going for. I don't know.
[Translation]
It's all quite bizarre. I think we can adopt a motion to that effect, if necessary, but we should normally start by inviting people to appear.
I don't think it's absolutely necessary to set dates. I'm really quite uncomfortable with the idea of hiring a third party to find these people when we have no budget for it. I can't agree on this motion as drafted and think other changes should be made.
I'd like someone on the team to explain the reasoning for this motion to me.
Mr. Chair, if the committees start hiring people to do these things, where does it all lead? We have highly qualified employees, and the committee has powers and privileges that it can normally use.
I'd like some changes to be made to this motion. I'm thinking about that.
I'd like you to put my name on the speakers list once again, Mr. Chair.
:
Thank you, Mrs. Shanahan.
Again, to reiterate what the motion says, it reads:
That the committee summon Felix Papineau and Shawna Parker to testify before this committee on December 10, 2024, provided that the chair and clerk be directed to retain, if necessary, the services of a skip tracer to assist with the service of the summonses.
This doesn't preclude our use of that service. We have, within our authority and the authority that's granted to us, the ability to hire services if we need to. As you know, the clerk has been having difficulty finding Felix and Shawna. Anyway, I'll leave it at that.
I have Mr. Fisher online. Go ahead, please.
:
I guess my issue, Mr. Chair, is that I wouldn't want to see the date missed because we couldn't find them so that no summons could be issued and then have someone claim there's a privilege motion to be made because they didn't come on the date in the motion. I just wanted to understand. I'm fine.
What I was going to suggest, Mr. Chair, was that if the summons could be served, the chair would call them within seven days of being able to find them and delivering the summons. Again, if they're not found by December 10, I don't know what would happen, but I don't want to see another privilege motion going to the House because they didn't come when we couldn't summon them in the first place. They may not even be in Canada, and then we may have no authority to summon them.
I guess my logic, Mr. Chair, was that once they are found, I'm fine to have a date within seven days of the date that they're found. I just don't understand how we could include a date when we don't know if we'll find them.
:
I think that makes more sense. I think it's kind of illogical otherwise.
I leave it to you, Mr. Chair, but if we have a date, like the last date that was proposed before we were amending the motion, and we pass the motion today, obviously we've missed the date.
We don't know where they are. What happens on December 10? Do we stop looking again?
I'm just having a friendly talk with my colleagues about saying that it would be within seven days of the date—whatever the date is—that the summons would be delivered to them. Then the chair can decide what the right day would be.
:
I'm going to just go back to the clerk for a second.
Let me now go to Mr. Caputo, because it's his amendment we're dealing with.
Based on the discussion that we just had, I'd have to go back to Mr. Caputo and ask, if he's in agreement with this, if he would withdraw his amendment, and then we can deal with Mr. Housefather's subamendment as the amendment. We're actually not specifying a date. We're leaving it at the discretion of the chair, and of course we're going to make our best efforts to contact them.
It wouldn't change the motion in any way, with the exception of.... It would still allow the committee to “summons Felix Papineau and Shawna Parker to testify before this committee”. It would strike “on December 10” and it would then say “at a date determined by the chair in consultation with the vice-chairs and the NDP”. Then it would continue on to say, “provided that the chair and clerk be directed to retain, if necessary, the services of a skip tracer to assist with the service of the summonses.”
To me, that is a reasonable solution.
Mr. Caputo, I'm going to leave it to you, sir.
I do appreciate the goodwill that's going around to try to get to the bottom of this. I'll just reiterate that the has stepped down and GHI is no longer on the list.
This is an important study for us to continue. What I will say is that I have no intention of being part of a Standing Order 106 or a chair's directive to be pulled back to this committee for some kind of faux urgent meeting over the holidays because somebody wants to get in a news cycle. I want to be very clear about that.
I'm not in the room. I know this is a made-for-Netflix miniseries that we've been a part of for the last few months, but I have no intention of revisiting these witnesses as secondary bit players in this drama from now until we return on a regular sitting day.
I would also say that just in terms of the order of operations, just on the face value of it, I would agree—although it doesn't happen often—with Mrs. Shanahan that there doesn't seem to be a need to go ahead and call the skip tracers or the bailiffs or Dog the Bounty Hunter, or whatever the hell you want to call it here, in advance of actually having the summons go out. I do think that's a tad bit dramatic. I know that my friend Mr. Barrett has a flair for dramatics, but I would say that on the face value of the committee work that we have done, a summons would be appropriate.
Should there be a reluctance or a refusal, I want to know through you, Mr. Chair, at what point do we enact this Dog the Bounty Hunter clause, and who decides?
:
Well, then, in closing, I would say this.
If you're out there and you're watching this right now, Shawna Parker and Felix Papineau, I would strongly urge you to come to this committee and not make a mockery out of the House of Commons and our standing committees by trying to duck this committee. You do have a duty and a responsibility to report to the House of Commons when you're summonsed. I'll just go ahead and put that out there as a preliminary. Otherwise, you may have Dog the Bounty Hunter knocking on your door and serving you with an official summons. I just think that's way too dramatic for what we're dealing with.
Those are my comments. I have no plans on seeing any of you over the holidays. This issue is important, but it's not urgent.
With that, I'll support whatever amendments come out of committee. Notwithstanding the fact that I think the flair for dramatics on the skip tracer is a bit much, we'll humour it.
:
I'm not even sure we have bounty hunters in Canada.
Mr. Frank Caputo: [Technical difficulty—Editor]
The Chair: Mr. Caputo, a former Crown prosecutor, just confirmed that.
We are on the amendment. I don't see any other discussion.
Do we have agreement on the amendment proposed by Mr. Housefather?
(Amendment agreed to [See Minutes of Proceedings])
The Chair: On the main motion as amended, are we good?
Go ahead, Mrs. Shanahan.
I trust you. You've done a lot on this. I don't know why getting a skip tracer is such a big deal. These people don't want to be found.
As much as Mr. Green says he doesn't want to come back to committee on off days, we have now spent 40 minutes talking about this. Do we really want to come back and hear, “These people can't be found”, when we have a respected parliamentarian who can say, “I authorize the expenditure of however much money it would cost”, which would probably pale in comparison with the amount of money we are spending by talking about this? It's ridiculous.
I trust you to do it. I'm going to vote against the amendment.
Thank you.
:
Oh, boy. Here we go. Okay.
The clerk has captured it. This is without the approval of Mrs. Shanahan's amendment.
As it stands now, the motion is “That the committee summons Felix Papineau and Shawna Parker to testify before this committee”. Then we changed “December 10” to include “at a date determined by the chair in consultation with the vice-chairs and the NDP, provided”. The motion as it stands right now says, “provided that the chair and clerk be directed to retain, if necessary, the services of a skip tracer to assist with the service of the summonses.”
Now Mrs. Shanahan has proposed an amendment. At the point where “provided” is, the amendment is to remove all of that section of the motion as amended right now, which includes what I said earlier—“at a date determined by the chair in consultation with the vice-chairs and the NDP”.
That's where we're at.
:
If Mrs. Shanahan's motion is approved, it would delete from the point of “provided” onward, and everything else would be included.
That's where we're at.
I don't see any other hands.
We are on the amendment proposed by Mrs. Shanahan.
Do we have agreement on the amendment?
We don't. Okay, I'm going to ask the clerk to call the roll.
Go ahead, Madam Clerk, on the amendment proposed by Mrs. Shanahan.
(Amendment agreed to: yeas 5; nays 4 [See Minutes of Proceedings])
The Chair: We are on the motion as amended. I don't have any other discussion.
:
I'm now going to answer Mr. Caputo's question regarding Thursday.
We have reached out to literally everyone as it relates to a couple of things. Number one is the privacy issue study with Uber and some of the others. None of those witnesses were available this week.
We also tried to reach out further on the TikTok study. We got information back from the minister that he's unavailable for an extended period of time.
It was too short notice for CSIS to come to committee on Thursday. Mr. Vigneault, who's part of the witness list, is apparently working in the United States. The clerk is still in the process of trying to contact him.
The Privacy Commissioner was on the motion that was adopted by committee. He was here. Unfortunately, we didn't have the meeting that day because we didn't have quorum. He is out of the country, but he has told me he will be available to appear before the committee. He won't be back for probably another week or so. I fully intend to get the Privacy Commissioner back to discuss the CRA issue, because I think he's a key component to this, and the committee felt that in the motion as well.
As it stands right now, I have nothing for Thursday, just to let you know, in terms of witnesses. Believe me, Nancy's been working the phones this week. Unfortunately, it's just the situation that we're in.
Ms. Khalid, did that address some of the questions you might have had?