//www.ourcommons.ca/Parliamentarians/en/members/88504David de BurghGrahamDaviddeBurgh-GrahamLaurentides—LabelleLiberal CaucusQuebec//www.ourcommons.ca/Content/Parliamentarians/Images/OfficialMPPhotos/42/GrahamDavid_Lib.jpgInterventionMr. David de Burgh Graham: (1420)[Translation]Earlier, we were talking about passwords. Nowadays, we see two-factor authentication being used a lot more for bank accounts. Could the same thing be done for social insurance numbers?Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers6013214AndréBoucherAndréBoucherAndréBoucherAndré-BoucherInterventionMr. André Boucher: (1420)[Translation]I'm going to say the same thing I did earlier. I'm not an expert in social insurance numbers, but we strongly advise people to use two factors whenever possible. It's not perfect, but it improves the security of their information.Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers6013215David de BurghGrahamLaurentides—LabelleMichelPicardMontarville//www.ourcommons.ca/Parliamentarians/en/members/71529MichelPicardMichel-PicardMontarvilleLiberal CaucusQuebec//www.ourcommons.ca/Content/Parliamentarians/Images/OfficialMPPhotos/42/PicardMichel_Lib.jpgInterventionMr. Michel Picard: (1420)[Translation]I'd like to revisit the issue of a unique identifier.Other models exist. On other committees, we've talked about the popular Estonian model, I believe. It's a system that's in line with our discussions on open banking. All the information is centralized and people can access it using a unique identification number.At the end of the day, no matter what you call it, a social insurance number is a unique identification number, so it's important to understand the system's limitations. It's all well and good to have the ultimate ultra-modern system, but if a single unique identifier is assigned to an individual, the information will always be vulnerable if someone gets a hold of it.Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers601321660132176013218AndréBoucherAndréBoucherAndréBoucherAndré-BoucherInterventionMr. André Boucher: (1420)[Translation]Absolutely. I can't name them today, but a number of countries around the world have endeavoured to adopt a system that relies on a national unique identification number. Some have been successful, and others, less so. As you said, the number becomes an essential piece of information and the slightest vulnerability puts the data at risk.Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers6013219MichelPicardMontarvilleMichelPicardMontarvilleEliseBoisjolyElise-BoisjolyInterventionMs. Elise Boisjoly (Assistant Deputy Minister, Integrity Services Branch, Department of Employment and Social Development): (1445)[Translation]Thank you very much, Mr. Chair.My name is Elise Boisjoly, and I am the assistant deputy minister of the integrity services branch at Employment and Social Development Canada. I am joined by Anik Dupont, who is responsible for the social insurance number program.Thank you for the opportunity to join you today. My remarks will focus on the social insurance number, or SIN, program. Specifically, I will clarify what the social insurance number is and provide information on its issuance and use; inform the committee on privacy protection related to the SIN; and provide information on our approach in the case of data breach.What is the SIN? The SIN is a file identifier used by the Government of Canada to coordinate the administration of federal benefits and services and the revenue system. The SIN is required for every person working in insurable or pensionable employment in Canada and to file income tax returns.It is issued prior to your first job, when you first arrive in Canada or even at birth. During the last fiscal year, over 1.6 million SINs were issued.The SIN is used, among other things, to deliver over $120 billion in benefits and collect over $300 billion in taxes. It facilitates information sharing to enable the provision of benefits and services to Canadians throughout their life such as child care benefits, student loans, employment insurance, pensions and even death benefits. As such, the SIN is assigned to an individual for life.The SIN is not a national identifier and cannot be used to obtain identification. In fact, it is not even used by all programs and services within the federal government; only a certain number use it. The SIN alone is never sufficient to access a government program or benefit or to obtain credit or services in the private sector. Additional information is always required.(1450)[English] While data breaches are becoming increasingly commonplace, the Government of Canada follows strong and established procedures to protect the personal information of individuals. My colleague mentioned the Privacy Act and the Personal Information Protection and Electronic Documents Act, which is being administered by Innovation, Science and Economic Development Canada. They provide the legal framework for the collection, retention, use, disclosure and disposition of personal information in the administration of programs by government institutions and the private sector, respectively.As my colleague mentioned, on November 1, 2018, a new amendment to the Personal Information Protection and Electronic Documents Act came into force, which requires organizations that experience a data breach and that have reason to believe there's a real risk of significant harm to notify the Office of the Privacy Commissioner, the affected individuals and associated organizations as soon as it's feasible. Violating this provision may result in a fine of up to $100,000 per offence.At Employment and Social Development Canada, we have internal monitoring strategies, privacy policies, directives and information tools for privacy management, as well as a departmental code of conduct and mandatory training for employees on protecting personal information. We believe that any security breach affecting social insurance numbers is very serious and, in fact, we ourselves are not immune to such a situation. For example, in 2012, the personal information of Canada student loan borrowers was potentially compromised. The breach was a catalyst for further improvements to information management practices within the department. Preventing social insurance number fraud starts with education and awareness. This is why our website and communication materials include information that can help Canadians better understand the steps they should take to protect their social insurance numbers. Canadians can visit the department websites, call us or visit us at one of our Service Canada centres to learn how best to protect themselves. It is important to note that protecting the information of Canadians is a shared responsibility among the government, the private sector and individuals. We strongly discourage Canadians from giving out their social insurance numbers unless they are sure that doing so is legally required or necessary. Canadians should also actively monitor their financial information, including by contacting Canada's credit bureau.[Translation]A loss of a social insurance number does not necessarily mean that a fraud has occurred or will occur.However, should Canadians notice any fraudulent activity related to their social insurance number, they must act quickly to minimize the potential impact by reporting any incidents to the police, contacting the Privacy Commissioner and the Canadian Anti-Fraud Centre, and informing Service Canada. In cases where there is evidence of the social insurance number being used for fraudulent purposes, Service Canada works closely with those affected.Despite ever larger data breaches, the number of Canadians who have had their social insurance number replaced by Service Canada due to fraud has remained consistent at approximately 60 per year since 2014.That being said, we understand that many Canadians have signed a petition asking Service Canada to issue new social insurance numbers for those impacted by this data breach. The main reason we do not automatically issue a new social insurance number in these circumstances is simple: getting a new social insurance number will not protect individuals from fraud. The former social insurance number continues to exist and is linked to the individual. If a fraudster uses someone else's former social insurance number and their identity is not fully verified, credit lenders may still ask the victim of fraud to pay the debts.In addition, it would be the individual's responsibility to provide their new social insurance number to each of their financial institutions, creditors, pension providers, employers—current and past—and any other organizations. Failing to properly do so could put individuals at risk of not receiving benefits or leave the door open to subsequent fraud or identity theft.It would also mean doubling the monitoring. Individuals would still need to monitor their accounts and credit reports for both social insurance numbers on a regular and ongoing basis. Having multiple social insurance numbers increases the risk of potential fraud.Active monitoring through credit bureaus as well as regular reviewing of banking and credit card statements remain the best protection against fraud.In closing, protecting the integrity of the social insurance number is critical to us, and I can assure you that we will continue to take all necessary action to do so, including reading this committee's report and considering advice from this committee and others on how to best improve.Thank you for your time. I'd be happy to answer your questions.Computer crimeCrime preventionCrime reportingDepartment of Employment and Social DevelopmentDesjardins GroupInformation disseminationPrivacy and data protectionSocial insurance numbers60133066013307601330860133096013310601331160133126013313601331460133156013316601331760133186013319601332060133216013322601332360133246013325PierrePaul-HusCharlesbourg—Haute-Saint-CharlesPierrePaul-HusCharlesbourg—Haute-Saint-Charles//www.ourcommons.ca/Parliamentarians/en/members/88756FrancisDrouinFrancis-DrouinGlengarry—Prescott—RussellLiberal CaucusOntario//www.ourcommons.ca/Content/Parliamentarians/Images/OfficialMPPhotos/44/DrouinFrancis_Lib.jpgInterventionMr. Francis Drouin: (1500)[Translation]Thank you very much, Mr. Chair.I thank all witnesses for appearing before the committee on short notice.I should mention that I am one of the victims of the data breach at Desjardins, as are many of my constituents.Ms. Boisjoly, you referred to the online petition asking that the social insurance numbers of those affected be changed. Can you explain to the committee why that would not be done and why it would only complicate things without providing better security for Canadians?Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers6013360601336160133626013363PierrePaul-HusCharlesbourg—Haute-Saint-CharlesEliseBoisjolyEliseBoisjolyElise-BoisjolyInterventionMs. Elise Boisjoly: (1500)[Translation]I briefly mentioned that in my presentation and I thank you for giving me the opportunity to talk about it at greater length.First, an information leak does not necessarily mean that fraud or identity theft has occurred. Second, we do not automatically change social insurance numbers after a leak like this because it doesn't really solve the problem or automatically remove all risk of fraud.Let me explain that first point a little more. If you do not change the social insurance number linked to a certain credit number and if a credit agency uses the old credit number, the person involved will not necessarily be able to get credit. In addition, if a lender does not properly check the identity of that person, and a fraudster borrows money using his name, the lender could ask him to pay the debt. So there can be other cases of fraud if lenders do not correctly check people's identity.The second reason is that it can create serious problems of access to benefits and services. As I said in my presentation, victims of data breaches must warn everyone, financial institutions, credit agencies, past and future employers, and the managers of pension schemes to which they belonged with their old social insurance numbers, and make the necessary changes. Often, people no longer remember those to whom they have given their social insurance number, especially at the beginning of their careers. That can prevent people from receiving a pension, for example, because it is no longer possible to establish a link between an individual and the benefits to which they are entitled.At federal level, we would certainly advise the Canadian Revenue Agency and all organizations involved. But changes could be made manually and there may be errors. This could complicate the calculation of pensions or employment insurance benefits. If someone forgets an employer and makes errors, the calculation of employment insurance benefits or the old age pension could be wrong.Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers60133646013365601336660133676013368FrancisDrouinGlengarry—Prescott—RussellFrancisDrouinGlengarry—Prescott—Russell//www.ourcommons.ca/Parliamentarians/en/members/88756FrancisDrouinFrancis-DrouinGlengarry—Prescott—RussellLiberal CaucusOntario//www.ourcommons.ca/Content/Parliamentarians/Images/OfficialMPPhotos/44/DrouinFrancis_Lib.jpgInterventionMr. Francis Drouin: (1505)[Translation]In other words, changing our social insurance number does not necessarily protect our personal information.Why is another social insurance number issued in cases where fraud has been proven?Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers60133696013370EliseBoisjolyEliseBoisjolyEliseBoisjolyElise-BoisjolyInterventionMs. Elise Boisjoly: (1505)[Translation]When fraud has been proven, we look at the type of fraud and discuss the matter with the person involved. Often people decide not to change their social insurance numbers. They register, or have someone register them, at a credit checking agency. By so doing, they will be better protected than they would be if they changed their social insurance number. Often, having been informed, people decide not to change their social insurance number. In a very small number of cases, 60 per year since 2014, people insist on making a change when fraud has been confirmed. At that point, we allow a new social insurance number to be issued, but we will also explain that it will not necessarily solve the problem.Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers6013371FrancisDrouinGlengarry—Prescott—RussellFrancisDrouinGlengarry—Prescott—Russell//www.ourcommons.ca/Parliamentarians/en/members/88756FrancisDrouinFrancis-DrouinGlengarry—Prescott—RussellLiberal CaucusOntario//www.ourcommons.ca/Content/Parliamentarians/Images/OfficialMPPhotos/44/DrouinFrancis_Lib.jpgInterventionMr. Francis Drouin: (1505)[Translation]Here is a more practical question.Like everyone in the same situation as myself, I see a risk of fraud. How then can I advise the authorities, whether at Revenue Canada or Service Canada, that my social insurance number may perhaps be used fraudulently? Can I call Service Canada to advise them of that? Is there an internal process that allows the public to do that?Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers60133726013373EliseBoisjolyEliseBoisjolyEliseBoisjolyElise-BoisjolyInterventionMs. Elise Boisjoly: (1505)[Translation]Absolutely. Let me make two points about that.First, since this leak was made public, we have received between 1,400 and 1,500 requests directly from members of the public. They have called us to find out how to better protect their personal data and we have given them a lot of information about doing so. They will often take the steps that we advise them to take, such as looking at the credit agency reports and checking their bank transactions.Second, if they notice a suspicious activity, they must follow the very clear procedures to give us that information. If suspicious transactions are detected, we ask them to contact Service Canada, which will be able to take the steps needed to help them.Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers601337460133756013376FrancisDrouinGlengarry—Prescott—RussellFrancisDrouinGlengarry—Prescott—Russell//www.ourcommons.ca/Parliamentarians/en/members/88756FrancisDrouinFrancis-DrouinGlengarry—Prescott—RussellLiberal CaucusOntario//www.ourcommons.ca/Content/Parliamentarians/Images/OfficialMPPhotos/44/DrouinFrancis_Lib.jpgInterventionMr. Francis Drouin: (1505)[Translation]Okay.The website lists 29 cases in which Canadians are allowed to give out their social insurance numbers. To banking institutions and other entities, for example.What does Service Canada do so that Canadians know when they should give out their social insurance number and when they should not? What recourse is possible when an organization asks for a social insurance number when it should not do so?Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers601337760133786013379EliseBoisjolyEliseBoisjolyEliseBoisjolyElise-BoisjolyInterventionMs. Elise Boisjoly: (1510)[Translation]Our website, our call centres and the Service Canada centres tell Canadians who they may give their social insurance numbers to. When we issue social insurance numbers, we actually tell people who they should and should not give it to. A certain number of organizations are authorized to ask for social insurance numbers, for example when a bank or creditor pays interest, which the Canada Revenue Agency needs to know.If someone not on that list asks for a social insurance number, people can refuse and ask to provide another form of information. For example, a long time ago, landlords often asked tenants for social insurance numbers in order to check their credit. They can simply provide a credit report rather than give out their social insurance number. The person asking the question must—Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers60133806013381FrancisDrouinGlengarry—Prescott—RussellJohnMcKayHon.Scarborough—Guildwood//www.ourcommons.ca/Parliamentarians/en/members/71454PierrePaul-HusPierre-Paul-HusCharlesbourg—Haute-Saint-CharlesConservative CaucusQuebec//www.ourcommons.ca/Content/Parliamentarians/Images/OfficialMPPhotos/44/PaulHusPierre_CPC.jpgInterventionMr. Pierre Paul-Hus: (1515)[Translation]The investigation has nothing to do with it because we know how the data breach happened. We also have an idea of where the data was sent, but, at the moment, that is not what we are interested in. We know that someone, somewhere on the planet, has our information and is in a position to harm us by stealing our identity. So we want to know whether our agencies can become proactively involved or, if not, what can be done.You have a solution in my case, so that is already something that the public could be told about. It is important to do that quickly because people are not in a very good mood during their holidays. Then we will have to see if something else can be done.The issue of the social insurance number has come up everywhere. A number of suggestions have been made. You are responsible for that file and you are saying that nothing can be done, at least not in that way. These are the answers that people need to hear. But the fact remains that we have to leave here telling people what the government can do to help, first Desjardins and second, the 2.9 million people who have been affected. We are hearing a lot about internal protocols, but, for the Canadians listening to us, that does not mean a lot. This is why I want to hear clear answers. I know that you are giving them when you can, but basically, when we leave here, we will need to know what can be done. Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers601340660134076013408MaximeGuénetteMaximeGuénetteMaximeGuénetteMaxime-GuénetteInterventionMr. Maxime Guénette: (1515)[Translation]I can assure you that very proactive discussions are going on between the various departments involved.As far as the revenue agency is concerned, as I said in my remarks, the social insurance number, the address and the date of birth are some of the pieces of information people need in order to identify themselves to the agency. We also need information on tax returns from previous years, which was not in the information stolen from Desjardins, according to the discussions we have had. However, once again, the investigation is still in progress. So these questions—Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers60134096013410PierrePaul-HusCharlesbourg—Haute-Saint-CharlesPierrePaul-HusCharlesbourg—Haute-Saint-Charles//www.ourcommons.ca/Parliamentarians/en/members/71368MatthewDubéMatthew-DubéBeloeil—ChamblyNew Democratic Party CaucusQuebec//www.ourcommons.ca/Content/Parliamentarians/Images/OfficialMPPhotos/42/DubéMatthew_NDP.jpgInterventionMr. Matthew Dubé: (1515)[Translation]Thank you, Mr. Chair.Thank you all for taking the time to come here today.Ms. Boisjoly, I was struck by one point in your reply to Mr. Drouin. You said that a personal data breach does not lead to identity theft. That is basically what brings us here today. Canadians want to avoid identity theft, of course; it’s their main concern. I have some questions about it.You said that people should report suspicious activities associated with a social insurance number. I am a federal lawmaker and I don’t know what a suspicious activity associated with a social insurance number is. I have never been a victim of fraud, thank heavens, and the same goes for the people around me, touch wood. However, I do know people who have been victims. They find out when they receive a bill for a cellphone they do not have, or for a Canadian Tire credit card that they never applied for. They end up with debts and obligations that are not theirs. Can you tell me exactly what a suspicious activity associated with a social insurance number is?Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers60134196013420601342160134226013423JohnMcKayHon.Scarborough—GuildwoodEliseBoisjolyEliseBoisjolyElise-BoisjolyInterventionMs. Elise Boisjoly: (1515)[Translation]Thank you for your question.You have certainly identified some suspicious activities, as you say. We ask people to protect themselves as best they can by working with a credit bureau so that transactions are monitored as closely as possible. They should look at their bank and credit card transactions. If they see actions in their name that they did not make, we asked them to contact the bureau—Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers60134246013425MatthewDubéBeloeil—ChamblyMatthewDubéBeloeil—Chambly//www.ourcommons.ca/Parliamentarians/en/members/71368MatthewDubéMatthew-DubéBeloeil—ChamblyNew Democratic Party CaucusQuebec//www.ourcommons.ca/Content/Parliamentarians/Images/OfficialMPPhotos/42/DubéMatthew_NDP.jpgInterventionMr. Matthew Dubé: (1520)[Translation]As for getting a new social insurance number, I have a little difficulty understanding. Basically, the argument is that it becomes complicated for people. In principle, a social insurance number is issued for reasons of efficiency. A unique identifier makes transactions with government agencies easier.Forgive me if this analogy may not be an exact one. If I see a problem with my credit card today, the bank or the company that issued it is still able to transfer a balance or to link the legitimate transactions on my credit card that has been used fraudulently and the new one it sent to me.Why would a financial institution be able to do that, while you are not able to say that someone’s social insurance number has been compromised and to give them a new number? A former employer, for example, might have to take care of questions about that person’s pension. Knowing that is the same person, why are you not able to link the previous social insurance number to a new one? You may perhaps have to do some additional checking, given that the number has been compromised. But I am still having a little difficulty understanding why you can’t do it. Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers601343060134316013432EliseBoisjolyEliseBoisjolyEliseBoisjolyElise-BoisjolyInterventionMs. Elise Boisjoly: (1520)[Translation]When you started, you said that the first reason we do not automatically give out social insurance numbers is that it can make life difficult for people. The first reason is actually that it would not really prevent fraud. This is a very important point. People have to continue to check their previous social insurance number because there are still—Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers6013433MatthewDubéBeloeil—ChamblyMatthewDubéBeloeil—Chambly//www.ourcommons.ca/Parliamentarians/en/members/71368MatthewDubéMatthew-DubéBeloeil—ChamblyNew Democratic Party CaucusQuebec//www.ourcommons.ca/Content/Parliamentarians/Images/OfficialMPPhotos/42/DubéMatthew_NDP.jpgInterventionMr. Matthew Dubé: (1520)[Translation]I am sorry to interrupt you, but, if I lose my credit card, it does not necessarily mean that it has been stolen. It may have fallen down a sewer somewhere, meaning that it will never be seen or used again. I would still call my bank, Visa or whomever, to ask them to cancel the card. I would still keep checking and I would have some peace of mind, knowing that I am protected.Why not use the same logic for victims of breaches of personal data, especially ones that are all over the news? To make sure they are protected, people want to dot all the i's and cross all the t's that they can. They change their credit cards and everything, as they do when they lose their wallets. Why not proceed in the same way?Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers60134346013435EliseBoisjolyEliseBoisjolyEliseBoisjolyElise-BoisjolyInterventionMs. Elise Boisjoly: (1520)[Translation]A social insurance number is not like a credit card, which is a bank's only way of identifying that person. It is an identifier used by employers for as long as people are in the workforce. It is also used for various programs and services.At the moment, no computer system links all those systems so that social insurance numbers can be updated by employers and by the various groups and programs. That task would be done manually. That is why we do not know all the employers. In the federal government, it would be done manually. As I said, we have only done it a few times. There is a risk of errors. I am just mentioning this to the committee.Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers60134366013437MatthewDubéBeloeil—ChamblyMatthewDubéBeloeil—Chambly//www.ourcommons.ca/Parliamentarians/en/members/88404AlupaClarkeAlupa-ClarkeBeauport—LimoilouConservative CaucusQuebec//www.ourcommons.ca/Content/Parliamentarians/Images/OfficialMPPhotos/42/ClarkeAlupa_CPC.jpgInterventionMr. Alupa Clarke: (1635)[Translation]Fine.In your introduction, you mentioned very humbly and respectfully that you had some questions. Personally, I would have liked to know your answers as an expert in your field. I don't remember your first question very well, but it was still interesting. You were wondering if Canada had an adequate system for social insurance numbers, for example. I would like to know your perspective on this. Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers60137326013733GuyCormierGuyCormierGuyCormierGuy-CormierInterventionMr. Guy Cormier: (1635)[Translation]The first question was whether Canada is well equipped to manage technological development, which is full of promise, but also involves new risks.Do we need to adapt our identification systems?Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers60137346013735AlupaClarkeBeauport—LimoilouAlupaClarkeBeauport—Limoilou//www.ourcommons.ca/Parliamentarians/en/members/88404AlupaClarkeAlupa-ClarkeBeauport—LimoilouConservative CaucusQuebec//www.ourcommons.ca/Content/Parliamentarians/Images/OfficialMPPhotos/42/ClarkeAlupa_CPC.jpgInterventionMr. Alupa Clarke: (1635)[Translation]I have a supplementary question, which will probably be the last one. I am addressing Mr. Cormier, the citizen.You made a very important announcement this morning. You said that the protection applies to all members, whether or not they are affected by this unfortunate event. You said all they have to do is call you and you can take care of them. You will establish contacts, take action and take the necessary steps.Do you think that's exactly the kind of attitude that the government, the federal state, should have right now towards the 2.9 million Canadian citizens?Citizens are being asked to contact us, and I think it is the federal government that should contact citizens. Let's say that citizens are communicating with the federal government, shouldn't the federal government have the same approach as you and say that it takes care of everything?The representative of Employment and Social Development Canada said that, if citizens' social insurance numbers were changed, they would have to call all their former employers. That's not what you're doing. You, incredibly, say you're going to take care of everyone at the last minute.As a citizen, would you like the federal government to act in the same way towards the affected members?Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers601374060137416013742601374360137446013745GuyCormierGuyCormierGuyCormierGuy-CormierInterventionMr. Guy Cormier: (1640)[Translation]As a citizen, I would say that elected officials are elected to provide a framework and adopt laws. In the current digital age, regulatory parameters must be put in place to protect citizens in this regard. That's my message, as a citizen.This is also why, despite the fact that we found this meeting premature, we still made the decision to be present. We feel that this situation is sounding the alarm and that there is an awareness and a real willingness on the part of elected officials to address this issue. We wanted to provide our point of view on this subject. Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers60137466013747AlupaClarkeBeauport—LimoilouJohnMcKayHon.Scarborough—Guildwood//www.ourcommons.ca/Parliamentarians/en/members/88504David de BurghGrahamDaviddeBurgh-GrahamLaurentides—LabelleLiberal CaucusQuebec//www.ourcommons.ca/Content/Parliamentarians/Images/OfficialMPPhotos/42/GrahamDavid_Lib.jpgInterventionMr. David de Burgh Graham: (1650)[Translation]Thank you.Ms. Boisjoly, earlier you heard the people from Desjardins talk about the need to rethink the social insurance number system. Is research being done on the future of the social insurance number?Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers60137926013793JohnMcKayHon.Scarborough—GuildwoodEliseBoisjolyEliseBoisjolyElise-BoisjolyInterventionMs. Elise Boisjoly: (1650)[Translation]Thank you for your question. As you know, the social insurance number is one identifier among many. As we have already mentioned, on our website, we are advising citizens that they should only give their social insurance number in very limited circumstances. This is explained to them. We tell them not to give their social insurance numbers to organizations that cannot legally request them. However, from what we hear, citizens often give it voluntarily to organizations that are not authorized to take it.We are certainly aware of the discussions. We are still looking at what we can do to improve the protection of our systems and practices related to the social insurance number.We want to hear the recommendations or see the report that this committee will publish, as well as other reports.I can assure you that work on improving the security of our systems is ongoing. I know that Treasury Board is also very actively working on digital identity projects. We are participating in these discussions to see how we can improve the digital identity of citizens in Canada.Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers60137946013795601379660137976013798David de BurghGrahamLaurentides—LabelleDavid de BurghGrahamLaurentides—Labelle//www.ourcommons.ca/Parliamentarians/en/members/88504David de BurghGrahamDaviddeBurgh-GrahamLaurentides—LabelleLiberal CaucusQuebec//www.ourcommons.ca/Content/Parliamentarians/Images/OfficialMPPhotos/42/GrahamDavid_Lib.jpgInterventionMr. David de Burgh Graham: (1655)[Translation]Among the data that was taken, we know that there was a lot of information, not just social insurance numbers. There were also addresses, phone numbers, and so on. You have spoken several times about additional information to authenticate the social insurance number. Is all this information included in the data that was taken?Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers6013799EliseBoisjolyEliseBoisjolyEliseBoisjolyElise-BoisjolyInterventionMs. Elise Boisjoly: (1655)[Translation]The social insurance number is an identifier that provides access to federal programs and services, as well as to income and tax systems. In the case involving the federal government, with respect to benefits, for example, my colleague explained that at the Canada Revenue Agency you have to ask an additional, secret question to identify individuals, such as the amount entered on a certain line of the tax return. In the case of employment insurance, participants are given a program access code, and must give two digits of this code in order to access private information related to the employment insurance program.The social insurance number is an identifier, but it is accompanied by other questions to validate the identity of the person with whom we do business. Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers60138006013801David de BurghGrahamLaurentides—LabelleDavid de BurghGrahamLaurentides—LabelleEliseBoisjolyElise-BoisjolyInterventionMs. Elise Boisjoly: (1655)[Translation]As I was saying, despite the number of leaks detected in recent years, there are about 60 cases per year requiring a change in the social insurance number.Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers6013806David de BurghGrahamLaurentides—LabelleDavid de BurghGrahamLaurentides—Labelle//www.ourcommons.ca/Parliamentarians/en/members/88504David de BurghGrahamDaviddeBurgh-GrahamLaurentides—LabelleLiberal CaucusQuebec//www.ourcommons.ca/Content/Parliamentarians/Images/OfficialMPPhotos/42/GrahamDavid_Lib.jpgInterventionMr. David de Burgh Graham: (1655)[Translation]Is there a way to indicate somewhere that the social insurance number is no longer valid and then remove the liability associated with it?If I change my social insurance number and I am still responsible for the old one, in my opinion, it doesn't make sense. Can you tell us more about this?Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers60138076013808EliseBoisjolyEliseBoisjolyEliseBoisjolyElise-BoisjolyInterventionMs. Elise Boisjoly: (1655)[Translation]One of the reasons is that we do not know to whom citizens have given their social insurance number. The social insurance number should only be used as an identifier to link certain information to provide benefits. Individuals are the only ones who know to whom they have given their social insurance number and for what purpose. You can give your social insurance number for private pensions, insurance and car rentals or purchases, for example. The social insurance number should not be used to identify the person. This is a number that allows you to link certain files. We need this number to link the information. We now link the two social insurance numbers in our systems, but the first should never again be used by the individual.Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers60138096013810David de BurghGrahamLaurentides—LabelleJohnMcKayHon.Scarborough—Guildwood//www.ourcommons.ca/Parliamentarians/en/members/88605RhéalFortinRhéal-FortinRivière-du-NordBloc Québécois CaucusQuebec//www.ourcommons.ca/Content/Parliamentarians/Images/OfficialMPPhotos/44/FortinRhéal_BQ.jpgInterventionMr. Rhéal Fortin: (1705)[Translation]Thank you, Mr. Chair.I'll start with Ms. Boisjoly.If we consider that the social insurance number was created in 1964 to govern employer-employee and government-to-government relations, we see that it is used in every way now, but in any case, much more widely than before.Wouldn't it be necessary to review the security regulations concerning its use? For example, there could be a PIN that matches the health card, fingerprints or other data, for example.In your opinion, can anything be done with this? Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers60138446013845601384660138476013848JohnMcKayHon.Scarborough—GuildwoodEliseBoisjolyEliseBoisjolyElise-BoisjolyInterventionMs. Elise Boisjoly: (1705)[Translation]That is an excellent question.As I always say, it is important, when you have situations like this, to review and rethink certain things.As far as the social insurance number is concerned, as I said, it is one of several identifiers. At the federal level—and, of course, in many places— people are invited to add secret questions that only they can answer. It is not a PIN, but it is an additional way to ensure security and identify the right person. Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers601384960138506013851RhéalFortinRivière-du-NordRhéalFortinRivière-du-Nord//www.ourcommons.ca/Parliamentarians/en/members/88605RhéalFortinRhéal-FortinRivière-du-NordBloc Québécois CaucusQuebec//www.ourcommons.ca/Content/Parliamentarians/Images/OfficialMPPhotos/44/FortinRhéal_BQ.jpgInterventionMr. Rhéal Fortin: (1705)[Translation]Correct me if I'm wrong, but the social insurance number is valid, regardless of whether or not we have matching questions.I am asked for my social insurance number for a transaction, whatever it is, with a bank, or whatever. I don't have a PIN. I just have the number. Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers60138526013853EliseBoisjolyEliseBoisjolyEliseBoisjolyElise-BoisjolyInterventionMs. Elise Boisjoly: (1705)[Translation]You are absolutely right. You do not have a PIN.Is this something we could consider? Maybe. What is important to say is that, to access a service, you must give other identifiers such as the line...Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers60138546013855RhéalFortinRivière-du-NordRhéalFortinRivière-du-Nord//www.ourcommons.ca/Parliamentarians/en/members/88605RhéalFortinRhéal-FortinRivière-du-NordBloc Québécois CaucusQuebec//www.ourcommons.ca/Content/Parliamentarians/Images/OfficialMPPhotos/44/FortinRhéal_BQ.jpgInterventionMr. Rhéal Fortin: (1705)[Translation]It depends on the companies we request services from, but, I agree, you're right.Wouldn't a penalty be appropriate? We see that retailers or banks frequently ask for social insurance numbers, and this is not always necessary. Shouldn't there be a system of penalties for those who ask for a social insurance number when they don't need it? Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers60138566013857EliseBoisjolyEliseBoisjolyEliseBoisjolyElise-BoisjolyInterventionMs. Elise Boisjoly: (1710)[Translation]That is an interesting question. I don't know if any predecessors have addressed this issue.Currently, we have a very clear list of who can do so. We have very clear instructions for citizens. When someone asks them for a social insurance number and they are not on the list of people who should ask them for it, they can seek redress with the Privacy Commissioner of Canada.Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers60138586013859RhéalFortinRivière-du-NordRhéalFortinRivière-du-Nord//www.ourcommons.ca/Parliamentarians/en/members/88605RhéalFortinRhéal-FortinRivière-du-NordBloc Québécois CaucusQuebec//www.ourcommons.ca/Content/Parliamentarians/Images/OfficialMPPhotos/44/FortinRhéal_BQ.jpgInterventionMr. Rhéal Fortin: (1710)[Translation]Couldn't we include criminal provisions in the act for this, whether it be a fine or some other sanction? Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers6013860EliseBoisjolyEliseBoisjolyEliseBoisjolyElise-BoisjolyInterventionMs. Elise Boisjoly: (1710)[Translation]Yes, it would be something to check, but I don't have any information on that today.Computer crimeDesjardins GroupPrivacy and data protectionSocial insurance numbers6013861RhéalFortinRivière-du-NordRhéalFortinRivière-du-NordIanLeeIan-LeeInterventionDr. Ian Lee: (1735)[English] Thanks for inviting me to appear on this important subject. First, I want to run through my disclosures very quickly. I do not consult to anyone, anything, or anybody anywhere in the world: not corporations, not governments, not lobbyists, not unions, not NGOs, and not people. Secondly, I don't belong to any political party, nor do I donate funds to any political party or candidate. Thirdly, in 2014, I researched and authored an op-ed on identification systems that was published in The Globe and Mail. I believe everyone has a copy.After spending quite a bit of time—that was in the spring of 2014—researching identification systems in Canada only, public and private, and the rules legislated concerning identification systems federally and provincially, it became clear to me that it is legally and factually impossible to be invisible in terms of identity in Canada in the 21st century, so I'm putting caveats around that. In a post-modern sophisticated society, multiple large public and private organizations— from governments to military, to banks, universities, tax authorities, and health care authorities—have been forced to develop systems of identification over the years to authenticate identity before ID is issued or access is allowed to the system, such as seeing a doctor. Thus, it is more useful to think of our systems—plural—of identification in Canada as a gigantic Venn diagram of interlocking circles, for those who can remember Venn diagrams from their university days, wherein each circle of the 40 or 50 systems of identification represents merely one identification system in Canada: OHIP health card, or driver's licence, or passport, or credit card.But each identification system overlaps many but not all of the other identification systems in Canada. In plain English, millions of Canadians simultaneously, as does everyone in this room, carry an employee identification card, often a driver's licence, a social insurance card, a health care card, an automobile ownership certificate, an auto insurance certificate on the automobile or truck, a passport or a permanent resident card, a credit card, and a debit card, not to mention other forms of identification.This leads to two critical points. Number one, the mistake of critics in claiming that there is inadequate identification in Canada amongst some Canadians is to focus on only one of the multiple systems of identification and, upon finding some voters who may lack that particular ID—e.g., a passport—then conclude that some Canadians lack any ID to vote, and that's not true. I may not have a passport, but I may have a driver's licence. I may not have a driver's licence, but I may have a passport, and so on and so on. Restated, it is necessary to examine the totality of our national, provincial, and municipal banking, education, and health care et al. identification systems—not any one system in isolation. Secondly, some critics claim that many identification systems do not disclose much information and thus are inadequate. This fails to recognize the elaborate and very sophisticated systems and rules of primary identification, driven, I would point out, by many of you parliamentarians and past parliamentarians in legislating the systems of identification in a myriad of statutes on the books passed by Parliament over the years, including the tax act, the pensions act, and so forth, which make the secondary identification more valuable.This may sound very abstract. Let me very concrete. It can be argued that a bank debit card, an ATM card—I have one in my pocket, and I'm sure everyone here does—is pretty useless. All it has on it is my name and long line of multiple digits. What use is that? Except that Canada's Bank Act, passed by you, the parliamentarians, mandates that any person who opens a bank account must—not could, ought to, or should, but must—produce two pieces of primary identification issued by government, and defined as a driver's licence, a passport, or a birth certificate, in order to open a bank account.(1740)Now the FCAC reports—of course, this is established by Parliament—that 96% of Canadians possess a bank account, those little debit cards, which means that 96% of Canadians have a minimum of two forms of government-issued primary ID. Now I'll quickly review some of the important identification systems that are allowing me to say it's impossible to be digitally or identifiably invisible. One, per the Vital Statistics Act, passed by every province and territory—I did check that—this is just from Ontario, “The Registrar General shall, upon receipt, cause the registrations of births, marriages, deaths, still-births, adoptions and changes of name occurring in Ontario....” That becomes the database that issues birth and death certificates.Two, by law, Canadian citizens, newcomers to Canada or temporary residents must have a social insurance number—as you know, because it's been passed by Parliament—to work in Canada or to receive benefits and services from government programs. What a lot of people don't realize is even student loans must be recorded. A social insurance number must be disclosed by the student to get a student loan. That also applies to the myriad of benefits, not just federally but provincially and municipally. Three, schools record and report to education ministries when a student starts elementary and then secondary school, including immunization.Four, provincial health ministries issue health care photo ID cards. If you go to the website of any province, it states you must provide two forms of government-issued primary ID. In Ontario, a person has to first show proof of citizenship, then provide separate primary ID establishing residency address before getting a health card to access health care, including doctors or even doing blood tests at the hospital here. Five, provincial DOT ministries' licensed drivers: per Transport Canada's latest report, 25 million Canadians have driver's licences. They issue ownership certificates mandating the owner name and address for the 33 million cars, trucks, and SUVs registered in Canada. That's 33 million pieces of identification. Of course, there is the insurance, the corresponding mandatory insurance that is necessary. Six, the bureaucracy that collects and records more data on individuals than anything else is the CRA. In 2015, per the CRA, 29.2 million people filed tax returns. This is more than the 25 million people who were eligible to vote, according to Elections Canada, in 2015. On every tax return, we are required to provide our social insurance number and our address.Seven, and this is the last on my itemized list, by law, all land titles must be in writing—in English common law systems—and record the name and address of the owner, while under provincial landlord and tenancy laws, rental tenancies must be in writing and record the name and address of the tenant. At the airport, as we all know, every one of the 133 million passengers in Canada in 2015 had to provide photo ID not once but three times: once to get the boarding pass, once to go through security, and once at the gate, just to get on the plane. Over two million students in post-secondary education, according to Statistics Canada, are provided photo ID by every college and every university in Canada, because it is mandatory. I've supervised every exam in every course I have taught for one-third of a century. They must bring their photo ID or I will send them home and they cannot write the exam. That is standard practice across universities and colleges because we can't possibly memorize and know all of the people sitting in that class. It's been argued that the requirement for voter ID negatively affects low-income people much more, yet when you examine Ontario Works—that's the bureaucracy that administers social welfare—you will quickly realize it is vastly more onerous to obtain social welfare because of the identification. They want bank accounts. They want tax returns. They want driver's licences. They want tenancy agreements. It is vastly more onerous to obtain social assistance or welfare than it is to vote because of the identification requirements.It is likewise for those who have looked at the OAS requirements, GIS requirements, and the Canada Pension Plan requirements to identify yourself in order to be paid a pension under those systems. In conclusion, in a large, sophisticated society, it is widely recognized that we need rigorous systems of identification to ensure confidence in the integrity of our tax system, our health care system, our election voting system, our student records system, our banking system, and all our other identification systems. Thank you.Air transportationBirth certificatesC-76, An Act to amend the Canada Elections Act and other Acts and to make certain consequential amendmentsCarleton UniversityColleges and universitiesDeath certificatesDriving permitsElectoral systemGovernment billsHealth care systemIdentity cardsIncome tax returnsLand registrationRental housingSchoolsSocial insurance numbersVoter identification5491474LarryBagnellHon.YukonLarryBagnellHon.YukonMaataliiOkalikMaatalii-OkalikInterventionMs. Maatalii Okalik: (2035)[English]Qujannamiik. Thank you very much.My name is Maatalii Aneraq Okalik, and I sit, as Elizabeth May has indicated, as the president of the National Inuit Youth Council within Inuit Tapiriit Kanatami, so I represent Inuit youth across Canada.I have the opportunity now to share a bit about who Inuit youth are and what their priorities are in relation to your standing committee as you review electoral reform.As you are aware, there are 60,000 Inuit who live across Canada, and the majority of our population is made up of Inuit youth. It's very different from the realities of the southern Canadian population. We are situated across four Inuit regions, and that is reflected in four provinces and territories. Definitely, representation is one of the highest issues with respect to elections and federal representation. As Elizabeth May indicated, I testified before some of your counterparts on the standing committee on aboriginal affairs, specifically on suicide prevention, and at that time, I indicated the social inequities that Inuit face in Canada. I think that as we address the question on electoral reform, these inequities should be taken into consideration.Inuit Canadians do not have the same quality of life as the majority of our fellow citizens: 39% of Inuit and Inuit Nunangat live in crowded homes, versus 4% of all Canadians; 29% of Inuit aged 25 to 64 successfully complete a high school diploma, versus 85% of all Canadians; 70% of Inuit households in Nunavut alone do not have enough food to eat, versus 8.3% of all Canadian households. The number of positions per 100,000 people in Nunavut is 30 in terms of access, versus 119 in urban health authorities across Canada, and 70.8 years is the average life expectancy for Inuit, versus 80.6 years for all Canadians. Not only are we dying younger due to the aforementioned social inequities, but the leading cause of death is suicide. Across regions, we have a five to 25 times higher rate than the rest of Canada. These are really important social inequities that we face on a daily basis. They have implications on our day-to-day lives, our quality of life, and they have a significant impact on how we are engaging in elections and how we're engaging with the federal government as a whole.Compared to other jurisdictions with representation in the House of Commons or in the Senate, we are not represented accordingly. In relation to the Nunavut legislature, a lot of you, I noted, had a number of questions with respect to how the consensus-style government works, as well as representation. We are aware that there are 26 communities in Nunavut, with 22 representatives. Some of the communities that we have in Nunavut are multi-constituency communities by virtue of the unique needs and realities within smaller communities compared to some of your respective ridings. There are 30 standing committees in the House of Commons alone, in contrast to those that sit in the Senate. When you have one MP for a region that is facing a number of social inequities that would be discussed on the standing committees, how are we to ensure that the basic needs of the population, who are supposed to be represented as equal Canadians, are being addressed effectively and are reflective of our realities and our culture?When you make formal recommendations to the House, as well as ensuring accountability in spending, legislation, and issues related to departments and their respective mandates, how are we being represented when we have one MP trying to sit on all 30 of these committees when faced with these issues on a daily basis? I sit on the board of directors for an Inuit organization and I lead the youth contingent. Inuit organizations like this one are required to work and lobby with a number of the departments that you work with through your standing committee to deal with these social inequities and the lack of an Inuit-to-crown relationship. In order to attack some of these issues, we need more representation.(2040) A lot of you have indicated interest in the youth perspective on voting. In my position, I had the experience of helping create awareness and excitement about the last federal election, and I'd like to share some of my findings with you.As a volunteer president with a day job working with the National Inuit Youth Council, I felt the responsibility to create basic awareness among Inuit youth, as Canadians, about the process of voting. They need to be aware of the way in which they can vote by having identification, as well as the locations where they have to show up in person to vote if they are students. Nunavut and the other Inuit regions don't have a university setting in southern Canada where they can vote outside their constituency and know that their voice is being heard. Actually, that's not my responsibility. Inuit youth don't necessarily see themselves reflected in the materials that are being disseminated. Some of our regions have legislation in place, because we have the Inuit language here in Canada. We have official languages acts, as well as protection acts, but when the material reflective of that reality isn't being disseminated, Inuit youth don't see themselves in the process and don't have the appropriate information to be able to make their vote count. However, because of the composition of our population, Inuit youth can essentially decide the vote.People are able to vote by going to an Elections Canada office. Are there many offices in our 53 communities in Canada? How many Service Canada offices are available for individuals to be able to attain the identification required to exercise their suffrage? I made a call on behalf of an Inuit youth interested in attaining a social insurance number in order to get a passport. This was in Pangnirtung. This youth was told to go to the Gatineau office. That's a $3,000 cost for airfare, which is not an essential service in Canada. Our communities are fly-in only, and it's a two-day trek.When only 1% of the Canadian population has been to our homeland and the issues that we're facing on a daily basis are not reflected in the House of Commons, I worry that the social inequities we face in this developed country will not be addressed accordingly.Qujannamiik. Thank you very much for affording me the time to share my reflections.CommitteesElectoral reformGovernment policyGovernment servicesInuitInuktitutLanguage other than official languageMembers of ParliamentNunavut TerritoryPolitical programsQuality of lifeSocial insurance numbersSocial marginalityStatisticsSuicidesTerritorial governmentVoter identificationVoting and votersYoung people4583068FrancisScarpaleggiaLac-Saint-LouisFrancisScarpaleggiaLac-Saint-LouisINTERVENTIONParliament and SessionDiscussed TopicProcedural TermCommitteePerson SpeakingProvince / TerritoryCaucusParticipation TypeSearchResults per pageOrder byTarget search languageSide by SideMaximum returned rowsPagePUBLICATION TYPE