Language selection

Government of Canada / Gouvernement du Canada

Search

Sign in

Sign in

COVID-19 Subsidy Initiatives for Business Entities

Business Returns Directorate
Assessment, Benefit, and Service Branch

On this page

Overview & Privacy Impact Assessment (PIA) Initiation 

Government institution

Canada Revenue Agency

Government official responsible for the PIA

Gillian Pranke
Assistant Commissioner
Assessment, Benefit, and Service Branch

Head of the government institution or Delegate for section 10 of the Privacy Act

Anne Marie Laurin
Acting Director General
Access to Information and Privacy Directorate

Name of program or activity of the government institution

Core Responsibility – Tax

Standard or institution specific class of record:

COVID-19 Subsidy Initiatives for Business Entities (formerly Canada Emergency Wage Subsidy)

Record Number: CRA ABSB 230

Standard or institution specific personal information bank:

Subsidy Initiatives for Business Entities

TBS Registration Number 20240001

CRA PPU 231

Legal authority for program or activity

The Canada Revenue Agency Act (CRAA), section 61, authorizes the CRA to enter into contracts, agreements or other arrangements with governments, public or private organizations and agencies or any person in the name of His Majesty in right of Canada or in its own name.

All COVID-19 Emergency Subsidy Initiatives for Business Entities are authorized under the same section of the Income Tax Act (ITA):

A legislative amendment to accept late-filed claims was added under subsection 125.7(16) of the ITA and included in Bill C-19, which received royal assent on June 23, 2022. This amendment gives discretionary power to the Minister of National Revenue to decide whether to accept a late-filed application for COVID-19 business subsidies retroactive to April 11, 2020, the date when the Canada Emergency Wage Subsidy was introduced.

Summary of the project, initiative or change

Overview of the Program or Activity

To assist with the Canadian economy, particularly businesses impacted by the COVID-19 pandemic, the Government of Canada implemented a number of subsidy initiatives to temporarily support wage and rent expenses for certain businesses, charities, and non-profits in Canada between March 15, 2020, and May 7, 2022. These initiatives are the Canada Emergency Wage Subsidy, the Canada Recovery Hiring Program, the Canada Emergency Rent Subsidy, the Hardest-Hit Business Recovery Program for wage and rent subsidies, and the Tourism and Hospitality Recovery Program for wage and rent subsidies. These seven subsidies will be referred to as the subsidy initiatives throughout this document.

In addition to submitting an application for a subsidy, business entities must also print, sign and maintain in their internal files an attestation form attesting that the business meets the eligibility requirements of the subsidy. This attestation form may be requested by the CRA during validations and verification activities.

The business number or Payroll Account Number was used to ensure that only business entities that met eligibility criteria could apply.

Subsidies are taxable and the business must report them on the personal income tax or corporate tax return for the tax year received.

The Canada Emergency Wage Subsidy was a wage subsidy program for employers who have seen a drop in revenue due to COVID-19 restrictions. The program was amended and updated several times since its launch on March 15, 2020, and completed on October 23, 2021. Qualifying businesses (employers) that experienced a decline in revenue were able to apply to receive a subsidy amount of their employees’ wages. The amount of the subsidy is based on the business’ revenue drop.

The Canada Emergency Wage Subsidy was meant to prevent more job losses by helping businesses keep their employees on payroll, enabling them to re-hire workers, and facilitating a return to normal operations.

Eligible employers were able to apply for the subsidy initiatives through the Agency’s My Business Account or Represent a Client portals, or through an external web form application using a web access code. The wage subsidy application included fields such as: number of employees, eligible remuneration, revenue drop and subsidy amount. The applications could only be submitted electronically; they could not be mailed or faxed. Eligible business entities wishing to file a wage subsidy claim outside of the MyBusiness Account or the Represent a Client portals could contact the CRA and, after confirming their business identity, obtain a web access code. This unique web access code was then used to submit an electronic application through the Canada.ca website and links the application to the business account. In rare cases, a business could contact CRA to file an offline application through the contact centre.

Approved Canada Emergency Wage Subsidy applicants were published in the Canada Emergency Wage Subsidy Registry. The Registry is an online public search tool used to determine if a particular employer had been approved for the wage subsidy. This public-facing registry was deemed to be the most practical and efficient manner to achieve transparency. In addition, the registry of recipients increases the likelihood that non-compliance will be identified and actioned in a timely manner. The Canada Emergency Wage Subsidy Registry disclosed the legal name and, if available, trade or operating name of employers in receipt of the subsidy. Partnerships, sole proprietors, or trusts that are not registered charities are not disclosed. A Privacy Compliance Evaluation was completed on the program, including the registry, in 2021, called the Canada emergency wage subsidy program. 

What’s New

The Canada Recovery Hiring Program was introduced in the federal government’s 2021 budget plan (Budget 2021) and was available from June 6, 2021, to May 7, 2022. The Canada Recovery Hiring Program was a hiring subsidy which supported eligible employers with a subsidy of up to 50% on incremental remuneration paid to eligible working employees (i.e., the portion of remuneration exceeding the remuneration of the baseline period). Employers were required to meet a minimum revenue reduction threshold in order to qualify.

The Canada Recovery Hiring Program was meant to encourage businesses to (re)hire, increase employee hours or provide an increase in salary in order to help the businesses to grow as the economy recovered.

Eligible employers were able to apply for the subsidy initiatives through the Agency’s My Business Account or Represent a Client portals, or through an external web form application using a web access code. The wage subsidy application included fields such as: number of employees for the active and base periods, amount of eligible remuneration for the active and base periods and revenue drop. The applications could only be submitted electronically; they could not be mailed or faxed. The individual who has principal responsibility for the financial activities must attest that the application is complete and accurate in all material respects.

During the periods where an applicant was eligible for both the Canada Emergency Wage Subsidy and the Canada Recovery Hiring Program, the applicant had the choice of benefiting from either the Canada Recovery Hiring Program or the Canada Emergency Wage Subsidy, whichever subsidy yielded the highest amount.

Canada Emergency Rent Subsidy

The Canada Emergency Rent Subsidy provided simple and easy-to-access rent and mortgage support from September 27, 2020, until October 23, 2021, for qualifying business entities affected by the COVID-19 pandemic. Business entities could apply for a subsidy amount up to a maximum of 65% of eligible commercial rent or property expenses for affected Canadian businesses, charities, and non-profits who experienced a drop in revenues. Changes to the program were announced in June 2021, where the maximum subsidy rate started to decline from 60% in period 11 to 20% by the last period. A top-up of 25% was also available for organizations temporarily shut down for a week or more by a mandatory public health order issued by a qualifying public health authority.

Eligible business entities were able to apply for the rent subsidy through the Agency’s My Business Account or Represent a Client portals. Approved subsidy payments were issued directly to qualifying business entities. The rent subsidy applications included information such as details on affiliated entities, property address, rent or mortgage expenses, and revenue drop. The applications could only be submitted electronically; they could not be mailed or faxed. The individual who has principal responsibility for the financial activities must attest that the application is complete and accurate in all material respects.

Tourism and Hospitality Recovery Program

The Tourism Hospitality Recovery Program was available from October 24, 2021, to May 7, 2022. The program delivered targeted support payments to businesses in the tourism and hospitality industry that had been deeply affected since the outset of the pandemic. The subsidy was available as either a wage or a rent subsidy to business entities such as hotels, tour operators, travel agencies, and restaurants. The same supports were also made available to businesses that were subject to either a qualifying public health restriction or a qualifying partial (capacity-limiting) public health restriction who suffered a specified decline in revenues over a 12-month period.

Eligible business entities were able to apply for the Tourism Hospitality Recovery Program subsidy through the Agency’s My Business Account or Represent a Client portals. Businesses could also apply for wage subsidies through an external web form application using a web access code. The rent subsidy applications included information such as details on affiliated entities, property information, rent or mortgage expenses, revenue drop and lockdown support. The wage subsidy applications included fields such as: number of employees, amount of eligible remuneration, revenue drop and subsidy amount. The individual who has principal responsibility for the financial activities must attest that the application is complete and accurate in all material respects.

Hardest-Hit Business Recovery Program

The Hardest-Hit Business Recovery Program was available from October 24, 2021, to May 7, 2022. This program provided support through wage and rent subsidies to business entities that faced deep losses, suffering at least a 50% average decline in revenues over a 12-month period. The Hardest-Hit Business Recovery Program was designed to target businesses that felt the largest impact from the pandemic, without being specific to any industry. These measures helped Canadian businesses protect the jobs that Canadians depended on and paid their workers and bills during difficult times.

Eligible business entities were able to apply for the Hardest-Hit Business Recovery Program through the Agency’s My Business Account and Represent a Client portals. For the Hardest-hit Business Recovery Program wage subsidy, businesses could also apply through an external web form application using a web access code. The Hardest-Hit Business Recovery Program rent subsidy applications included information such as details on affiliated entities, property information, rent or mortgage expenses, revenue drop and lockdown support. The wage subsidy applications included fields such as: number of employees, amount of eligible remuneration, revenue drop and subsidy amount. The individual who has principal responsibility for the financial activities must attest that the application is complete and accurate in all material respects.

Existing authentication processes to confirm the identity of an applicant were used to make sure that only those entitled have access to information through the secure online portals. A calculator on the Canada.ca site helped potential applicants to determine subsidy eligibility and amounts before sending an application. No personal information was collected or retained in the online calculator.

Scope of the Privacy Impact Assessment

This Privacy Impact Assessment (PIA) identifies and assesses privacy risks to personal information relating to the subsidy initiatives: Canada Emergency Wage Subsidy, Canada Emergency Rent Subsidy, Canada Recovery Hiring Program, Hardest-Hit Business Recovery Program, and Tourism and Hospitality Recovery Program. Activities include:

Post payment verification, integrity, compliance and enforcement activities are out of scope for this PIA. These activities are assessed in the Canada Emergency Subsidies Validation and Compliance (for businesses) PIA (IC-129723).

Risk identification and categorization

A) Type of program or activity

Compliance / Regulatory investigations and enforcement

Level of risk to privacy: 3

Details:

Personal information was used by CRA to administer the subsidy initiatives. The administration of the initiatives is within scope of this PIA.

In certain circumstances additional details on a business entity’s personnel or financial status may be requested to approve an application.

Information is also used to determine whether an individual knowingly participated in or made a false statement or omission. The consequences can include verification reviews, which may result in termination and/or recoup of benefits and possibly levying civil penalties under section 163 of the Income Tax Act.

B) Type of personal information involved and context

Social insurance number, medical, financial or other sensitive personal information and/or the context surrounding the personal information is sensitive. Personal information of minors or incompetent individuals or involving a representative acting on behalf of the individual.

Level of risk to privacy: 3

Details:

Limited personal information will be collected during a subsidy initiative’s application process.

Personal information includes: employer/claimant names, business numbers, representative names, financial information, contact information, Internet protocol address, attestation, and signatures. Where the employer/claimant is an individual (for example a sole-proprietor or a partner in a partnership), the business entity’s information is considered personal.

The Social Insurance Number (SIN) is not collected as part of the application process for the subsidy initiatives.

This information will be matched against existing information within the Agency’s data holdings, in order to validate the business entity and process the subsidy initiative applications.

To determine eligibility and identify flow through reporting, the CRA Business Number (BN) system will also be cross-referenced (data matching) with the business number and authorized representative.

C) Program or activity partners and private sector involvement

With other or a combination of federal/provincial and/or municipal government(s)

Level of risk to privacy: 3

Details:

Personal information will be used by other CRA programs for a consistent purpose, such as by the Collections and Verification Branch for the collection of outstanding balances.

The Service, Innovation and Integration Branch provides statistical reporting services to the agency for research and analysis. The Compliance Programs Branch administers the online Canada Emergency Wage Subsidy Registry.

CRA shares personal information with Public Services and Procurement Canada (PSPC) for the issuance of payments.

CRA shares personal information with Finance Canada and Statistics Canada for policy and program evaluation.

D) Duration of the program or activity

Short-term program

Level of risk to privacy: 2

Details:

The Subsidy Initiatives were urgent COVID-19-related initiatives that had established “sunset” dates.

Note: Applicants had 180 days from the claim period end date to file an application. The last date to file a subsidy claim was November 3, 2022, midnight PST.

In limited circumstances the Agency has the discretion to accept late-filed subsidy applications on a case-by-case basis.

E) Program population

The program affects certain individuals for external administrative purposes.

Level of risk to privacy: 3

Details:

The subsidy initiatives affect businesses and individuals (if the employer/claimant is an individual such as a sole-proprietor, individual partner in a partnership, etc.) who have submitted an application.

F) Technology & privacy

  1. Does the new or modified program or activity involve the implementation of a new electronic system, software or application program including collaborative software (or groupware) that is implemented to support the program or activity in terms of the creation, collection or handling of personal information?
    Risk to privacy: Yes
  2. Does the new or modified program or activity require any modifications to IT legacy systems and/or services?
    Risk to privacy: Yes
  3. Does the new or modified program or activity involve the implementation of one or more of the following technologies?

Enhanced identification methods - this includes biometric technology (i.e. facial recognition, gait analysis, iris scan, fingerprint analysis, voice print, radio frequency identification (RFID), etc.) as well as easy pass technology, new identification cards including magnetic stripe cards, "smart cards" (i.e. identification cards that are embedded with either an antenna or a contact pad that is connected to a microprocessor and a memory chip or only a memory chip with non-programmable logic).

Risk to privacy:No

Use of Surveillance - this includes surveillance technologies such as audio/video recording devices, thermal imaging, recognition devices, RFID, surreptitious surveillance/interception, computer aided monitoring including audit trails, satellite surveillance etc.

Risk to privacy: No

Use of automated personal information analysis, personal information matching and knowledge discovery techniques - for the purposes of the Directive on PIA, government institutions are to identify those activities that involve the use of automated technology to analyze, create, compare, identify or extract personal information elements. Such activities would include personal information matching, record linkage, personal information mining, personal information comparison, knowledge discovery, information filtering or analysis. Such activities involve some form of artificial intelligence and/or machine learning to uncover knowledge (intelligence), trends/patterns or to predict behavior.

Risk to privacy: Yes

G) Personal information transmission

The personal information is transmitted using wireless technologies.

Level of risk to privacy: 4

Details:

All subsidy initiative application information was transmitted through secure CRA channels.

Businesses provide their personal information in their subsidy initiative’s applications to the CRA electronically through the Canada Revenue Agency’s (CRA’s) My Business Account or Represent a Client portals, or through a web form application using a web access code.

Personal information (business name, business number, address, and banking information) is sent to Procurement and Services Canada (PSPC) to issue payments via Managed Secure File Transfer (MSFT).

The Agency’s Service, Innovation and Integration Branch (SIIB) sends microdata to the Department of Finance and Statistics Canada (the payroll number, business number [BN9], and program account number [BN15]) via managed secure file transfer.

Existing CRA agreements with the Department of Finance, Statistics Canada, and Public Services and Procurement Canada were evaluated and updated, as required.

CRA employees can use a laptop computer with access controls. Access to the Agency network from remote locations must be done with full disk encryption and standard Secure Remote Access. The Information Technology Branch has developed an enterprise-wide telecommuting platform that offers users secure access to the network.

H) Potential risk that in the event of a privacy breach, there will be an impact on the individual or employee

Details:

If the personal information is compromised, it has potential to cause financial harm and embarrassment to the effected business.

In August 2020, the Government of Canada took action to stop credential stuffing attacks against the Government of Canada Branded Credential Service (“GCKey”) and CRA My Account for individuals. The Office of the Privacy Commissioner was investigating these attacks in which taxpayer and personal information was compromised. The CRA became aware of a sophisticated fraud involving the Canada Emergency Wage Subsidy that is linked to these credential stuffing attacks and unauthorized access to Represent a Client. The CRA informed all affected taxpayers and suspended access to any Represent a Client ID that was suspected to be linked to the attacks.

The CRA continues to monitor for suspicious activities resulting from credential stuffing attacks. Safeguards have been placed on affected accounts. The CRA put measures in place to identify high-risk accounts in order to prevent potentially suspicious applications from being made.

Page details

Date modified: