Questions and responses 42nd Parliament, 1st session December 3, 2015, to September 11, 2019

With regard Statistics Canada’s plan to harvest financial transaction data and the claim by the Minister of Innovation, Science and Economic Development that he found out about the plan through the media: (a) on what date did Statistics Canada begin developing the plan; (b) on what date did Statistics Canada notify banks or financial institutions about the plan; (c) on what date did Statistics Canada notify the Minister of Innovation, Science and Economic Development about the plan; and (d) on what date did Statistics Canada notify the Privacy Commissioner about the plan?

With regard to Statistics Canada’s plan to collect financial transaction data on Canadians: (a) by what means will data be anonymized; (b) which employee classification will have access to data that has not been anonymized; and (c) what cyber security protection measures have been put in place to protect this sensitive data?

With regard to reports of a data breach at Public Services and Procurement Canada in August 2018, after a device containing personal information was stolen: (a) on what date did the theft occur; (b) on what date was the theft reported to the law enforcement agencies, and to which agencies was the theft reported; (c) on what date was the Office of the Privacy Commissioner notified; (d) how many employees were affected by the data breach, broken down by department or agency; (e) on what date were the affected employees notified; (f) why was there a delay between the breach and the notification date for employees; (g) how are affected employees being compensated for the breach; (h) what type of information was contained on the stolen device; (i) has the government recovered the device; (j) how many data breaches have occurred since January 1, 2016, broken down by department, agency, Crown corporation or other government entity; and (k) for each data breach in (j), what are the details, including (i) how many people were affected, (ii) date of breach, (iii) date those affected were notified, (iv) summary of incident?

With regard to the CBC report in November 2018 showing that the privacy of at least 10,000 Canadians was compromised by Canada Revenue Agency (CRA) employees “snooping” on their information and accessing taxpayers private financial data without authorization: (a) how many Canadians were affected by CRA employees accessing data without authorization since November 4, 2015; (b) of the Canadians in (a) whose data was compromised by CRA employees, as of today, how many have received notification from the government that their data was compromised; (c) for each instance in (a), but where Canadians were not notified that their data was compromised, for what reason were they not notified; (d) how many CRA employees accessed data without authorization since November 4, 2015; and (e) of the CRA employees in (d), how many were disciplined, broken down by type of disciplinary actions (reprimand, termination, etc.)?

With regard to cyber attacks, broken down by month, and by department, agency, and crown corporation, since January 1, 2016: (a) how many cyber attacks have occurred, either against a department, agency or crown corporation or on one of their servers or networks; (b) how many of the attacks referred to in (a) resulted in government information being stolen; (c) how many of the attacks referred to in (b) resulted in classified government information being stolen; (d) how many of the attacks referred to in (a) resulted in individuals' personal information being stolen; (e) for each of the attacks referred to in (d), how many individuals' personal information were stolen; (f) were the individuals from whom information was stolen informed of the theft, and, if so, how were they informed; and (g) for each case where individuals' information was stolen, was the Privacy Commissioner notified?