2024-2025 Annual Report to Parliament on the Administration of the Privacy Act

Introduction

In keeping with section 72 of the Privacy Act, each year the head of every federal government institution prepares and submits a report to Parliament on how their institution administered the Privacy Act.

The following report is tabled in Parliament under the direction of the Minister of National Revenue. It describes how the Canada Revenue Agency (CRA) administered and fulfilled its obligations under the Privacy Act between April 1, 2024, and March 31, 2025. The report also discusses emerging trends, program delivery, and areas of focus for the year ahead.

The Privacy Act

The Privacy Act protects the privacy of individuals by outlining strong requirements on how government institutions collect, retain, use, dispose of, and disclose individuals’ personal information. As well, it gives individuals or their authorized representatives the right to access (with a few specific exceptions), request a correction to, and add notes to their information.

Individuals who are not satisfied with the way an institution handles their personal information or a Privacy Act request are entitled to complain to the Privacy Commissioner of Canada.

The Act’s formal processes do not replace other ways of getting federal government information. The CRA encourages individuals and their representatives to get proactively disclosed taxpayer information through online self-service channels, such as My Account and Represent a Client. The CRA also promotes other informal channels, such as the CRA’s automated and toll-free phone lines.

 

Table of contents

About the Canada Revenue Agency

Performance

Initiatives and projects to improve privacy

Training and awareness

Privacy management

Summary of key issues and actions taken on complaints

Monitoring compliance

Public interest disclosure

Conclusion

Appendix A: Summaries of completed privacy impact assessments

Appendix B: Delegation order

 

ISSN 2563-3465

About the Canada Revenue Agency

The CRA promotes and ensures compliance with Canada’s tax legislation and regulations and plays an important role in the economic and social well‑being of Canadians. The CRA does this by administering tax programs for the Government of Canada and for provinces and territories. It also administers various social and economic benefit and incentive programs delivered through the tax system.

In addition, the CRA has the authority to partner with other federal departments and the provinces, territories, and other government bodies to share information. It can also administer services at their request for a fee.

The CRA governance structure is more complex than most departments given its status as an Agency with unique authorities. It includes a minister, a commissioner and chief executive officer, and a deputy commissioner, similar to other government departments. In addition, the CRA also has a Board of Management and a Taxpayers’ Ombudsperson.

The minister of national revenue is accountable to Parliament for all the CRA’s activities, including administering and enforcing the Income Tax Act and the Excise Tax Act.

The Board of Management, which the Canada Revenue Agency Act established, is made up of 15 directors appointed by the Governor in Council. Each province nominates one director, and the territories take turns nominating one director. The other four directors include the chair, the commissioner of the CRA, and two directors nominated by the Government of Canada.

The Board is responsible for overseeing the:

• organization and the administration of the CRA
• management of the CRA’s resources, services, property, personnel, and contracts

This responsibility includes developing the corporate business plan and approving the CRA’s departmental results report and its audited financial statements.

In fulfilling its role, the Board:

• brings a forward‑looking, strategic perspective to the CRA’s administration
• fosters sound management practices
• commits to delivering efficient and effective services

As the CRA’s chief executive officer, the commissioner is responsible for the day‑to‑day administration and enforcement of the program legislation that falls under the minister of national revenue’s delegated authority. The commissioner is accountable to the minister and must assist and advise them about the legislated authorities, duties, functions, and Cabinet responsibilities. The commissioner is also an ex‑officio member of the Board and is accountable to it for the:

• daily administration of the CRA
• supervision of its employees
• implementation of management policies

The commissioner is supported by the deputy commissioner, and together they make sure operations are guided by the CRA’s vision to be a world‑class tax and benefits administration that is trusted, fair, and helpful.

The CRA is made up of 14 functional branches and 4 regional offices across the country:

Branches

• Appeals
• Assessment, Benefit, and Service
• Audit, Evaluation, and Risk
• Collections and Verification
• Compliance Programs
• Digital Transformation Program
• Finance and Administration
• Human Resources
• Information Technology
• Legal Services
• Legislative Policy and Regulatory Affairs
• Public Affairs
• Security
• Service, Innovation and Integration

Regions

• Atlantic
• Ontario
• Quebec
• Western

Chief privacy officer

The assistant commissioner of the Public Affairs Branch is the CRA’s chief privacy officer. The chief privacy officer has a broad mandate of overseeing privacy at the CRA. To fulfill this mandate, the chief privacy officer:

• oversees decisions related to privacy, including privacy assessments
• champions personal privacy rights (for example, by managing internal privacy breaches) according to legislation and policy
• reports quarterly to the CRA’s senior management on the state of privacy management at the CRA

Agency Security and Privacy Executive Council

The Agency Security and Privacy Executive Council includes 18 key senior executives. The chief privacy officer and the agency security officer are joint chairs. During the reporting period, the Council met five times.

The mandate of the Council is to:

• facilitate a horizontal approach to oversee the governance, management, and risk mitigation activities relating to security and privacy at the CRA
• function as a steering committee, consulting on the direction of privacy and security matters
• recommend courses of action to regions, branches, the Commissioners’ Office and the Board of Management

Director General Security and Privacy Committee

The Director General Security and Privacy Committee is a director general level committee, co-chaired by the Public Affairs Branch and the Security Branch. During the fiscal year, eight meetings were held.

The mandate of the Committee is to:

• support the Agency Security and Privacy Executive Council
• provide oversight and guidance on security and privacy risks and issues

Access to Information and Privacy Directorate

The Access to Information and Privacy (ATIP) Directorate helps the CRA meet its requirements under the Access to Information Act and the Privacy Act. To fulfill this mandate, the ATIP Directorate:

• responds to requests under the Access to Information Act and the Privacy Act
• responds to enquiries, consultations, complaints, and informal disclosure requests
• offers advice and guidance the CRA employees on how to properly manage and protect personal information under the CRA’s control
• reviews and, if needed, publishes information to be proactively disclosed, including briefing note titles and committee material
• gives ATIP training and awareness sessions
• coordinates the privacy assessment process within the CRA, including giving expert advice to CRA employees on privacy implications and how to avoid and reduce risks
• responds to and manages privacy breaches, enquiries, and complaints
• develops corporate policy instruments, procedures, and practices related to the Access to Information Act and the Privacy Act
• communicates with the Treasury Board of Canada Secretariat and the offices of the information and privacy commissioners of Canada about policy and legislative requirements, complaints, and investigations
• fulfills corporate planning and reporting obligations, such as the CRA’s annual reports to Parliament on the administration of the Access to Information Act and the Privacy Act
• produces multiple reports that capture key statistics about the CRA’s inventory of ATIP requests and key privacy performance indicators to assess, monitor, and improve the CRA’s access to information and privacy programs.

The director general and deputy chief privacy officer of the ATIP Directorate has the full delegated authority of the minister of national revenue under the Access to Information Act and the Privacy Act. As well, their responsibilities include:

• managing and coordinating the ATIP program
• leading strategic planning and development initiatives
• supporting the assistant commissioner of the Public Affairs Branch and chief privacy officer of the CRA in the role of ATIP governance

Directorate employees are mainly located in Ottawa, Montréal, and Vancouver. In 2024–2025, an equivalent of 228 full‑time employees and 9 consultants administered the Access to Information Act and the Privacy Act at the CRA.

The following chart shows the structure of the ATIP Directorate.

Figure 1: Organizational structure of the ATIP Directorate

Delegating responsibilities under the Privacy Act

As head of the CRA, the minister of national revenue is responsible for how the CRA administers and complies with the Privacy Act, the Privacy Regulations, and related Treasury Board of Canada Secretariat policies. Subsection 73(1) of the Privacy Act gives the minister the authority to designate one or more CRA officials to perform all or part of the minister’s powers, duties, and functions under the Act.

The Honourable Élisabeth Brière, Minister of National Revenue, signed the CRA’s current delegation order for the Privacy Act on March 5, 2025. The order identifies specific provisions of the Act and its regulations that the Minister delegated to various positions within the CRA.

The ATIP Directorate’s direct general, directors, assistant directors, managers, technical reviewers/advisors, analysts and senior analysts have been delegated to exercise certain powers, duties, and functions of the minister under the Act and related regulations set out in the delegation order’s schedule.

For the delegation order and schedule, see Appendix B: Delegation order.

Performance

Note: Some totals may add up to more than 100% due to rounding.

Operational environment

As the chief administrator of federal, provincial, and territorial tax laws, the CRA maintains one of the largest repositories of personal information in the Public Service of Canada. In addition, the CRA collects and manages the personal information of its workforce of over 50,000 individuals. Canadians trust the CRA with their personal information, and the CRA takes the protection of that information very seriously.

The ATIP Directorate processes one of the largest volumes of requests and pages of any federal institution. According to the latest statistics from the Treasury Board of Canada Secretariat, in 2023–2024 the CRA processed the fourth-largest number of requests and the fifth-largest volume of pages of any federal institution that responds to Privacy Act requests.

The number of requests the CRA received under the Privacy Act in 2024–2025 (10,027) was 20% lower than in 2023–2024 (12,502). The number of requests completed (10,728) was 12% lower than in 2023–2024 (12,194). This decrease in requests received and completed can likely be attributed to the launch of the Fast Track Redirect Project in 2024–2025, which redirected simpler Level 1 requests for information to the CRA’s secure My Account online service. As a result of this project, CRA’s remaining requests were more complex and took longer to process.

The Directorate also redirected 593 requests received formally to other channels: these requests were counted as informal requests. Additionally, further pressures likely came from the transition to the Directorate’s new operating system, ATIPXpress. For more information on the Fast Track Redirect Project and other initiatives that impacted our operational environment during the fiscal year, please see the initiatives and projects to improve privacy section.

The chart below shows the trend of requests received, requests completed, and pages processed under the Privacy Act over the past five years.

Figure 2: Privacy Act request trend

Compliance and completion times

Of the 10,728 requests completed in 2024–2025, the ATIP Directorate completed 9,646 (90%) requests within the timelines required by law—that is, within 30 calendar days or within an extended deadline. This is a 4% decrease compared to 2023–2024. The following chart shows the completion time for the 10,728 requests completed in 2024–2025.

Figure 3: Completion time for Privacy Act requests

Disposition of completed requests

The table below shows the disposition of the 10,728 requests completed under the Privacy Act.

Open requests and complaints from previous reporting periods

At the end of the fiscal year, the CRA had 1,385 Privacy Act requests outstanding. Of these requests, 586 were completed within legislated timelines, and 799 were completed beyond legislated timelines. The CRA received 28% of these requests before 2024–2025, many of which will be processed as part of its backlog elimination plan. The table below shows the number of requests the CRA carried over to the next reporting period.

At the end of the fiscal year, the CRA had 77 open complaints with the Office of the Privacy Commissioner of Canada. The table below shows the number of complaints the CRA carried over to the next reporting period. The CRA continues to maintain a collaborative relationship with the Office of the Privacy Commissioner of Canada and has submitted its representations regarding the oldest complaints shown in the table.

For more information on complaints, see the Summary of key issues and actions taken on complaints section.

Reasons for extensions

The Privacy Act sets the timelines for responding to requests for personal information. The Act allows time extensions when:

• meeting the original time limit would unreasonably interfere with operations
• there is a need to consult with a government institution or another third party
• there is a need to translate or convert records into another format

Of the 10,728 requests completed in 2024–2025, the CRA applied extensions to 1,188 (11%) of them. In 1,166 (98%) of these cases, CRA applied extensions due to the workload, and meeting the original 30-day time limit would have interfered unreasonably with CRA operations. The CRA applied the remaining 22 extensions to translate records or convert them into other formats.

Consultations completed for other institutions

In 2024–2025, the ATIP Directorate received and completed six consultation requests from other Government of Canada institutions. To respond to these requests, the Directorate reviewed 356 pages. The table below shows the number of days the CRA took to complete these consultations.

Internal consultations

In 2024–2025, the CRA completed 341 internal privacy consultation requests, a 29% increase from the previous reporting period. To respond to these requests, the Directorate reviewed 5,829 pages. These internal reviews are considered informal and do not fall under the Privacy Act.

The chart below shows the trends for internal privacy consultation requests received over the past five years.

Figure 4: Internal privacy consultation trends

Initiatives and projects to improve privacy

Fast Track Redirect Pilot

The ATIP Directorate implemented a plan to redirect requests to CRA’s secure My Account online service when requesters are seeking the following information:

• proof-of-income statements from the past ten assessed years
• notices of assessment
• benefits information

By doing this, the CRA was able to redirect over 1,000 requests to My Account, increase efficiency, and reduce processing times, thereby improving service to requesters. The CRA will continue to redirect these types of requests in 2025–2026 and look for further opportunities for proactive disclosure through informal service channels.

Backlog elimination plan

Through its ATIP backlog elimination plan, the CRA has been working diligently to reduce its ATIP backlog inventory.

Since starting the plan in 2021–2022, the CRA:

• eliminated 762 aged backlog files
• reduced the average age of late files from 429 days late to 311 days late

ATIP case management modernization

During the reporting period, the CRA launched a new ATIP case management system. The new system, ATIPXpress:

• allows the CRA to keep handling ATIP requests when their old system is no longer usable
• reduces processing times and administrative work using automation features (including AI)
• facilitates communication and collaboration between offices of primary interest and the ATIP Directorate through the ATIPXpress Collaboration Portal

The CRA developed and executed a robust project management plan to enable a gradual approach to the roll out of the system. The onboarding took place gradually through the fiscal year, starting in June 2024. This process involved strategic communications, training, change management strategies, and the collaborative engagement of system users across the CRA.

This new system is in line with other government departments’ practices and will improve production over the coming years as its benefits are fully realized.

ATIP Directorate Strategic Plan 2024–2027

The ATIP Directorate Strategic Plan 2024–2027 outlines the Directorate’s guiding principles and strategic priorities.

The four priorities outlined are to:

• continue to meet Access to Information Act and Privacy Act legislative obligations for requests for information through enhanced productivity
• improve the ATIP program through the implementation of digital technologies and continuous improvement initiatives, including artificial intelligence
• ensure the safety and security of Canadian’s personal information while upholding our commitment to fostering a transparent and open government
• enhance leadership and shift our culture to create a strong and engaged, cross‑country workforce, built to sustain a diverse, healthy, and inclusive workplace

Training and awareness

Training

The following is a summary of ATIP training activities the CRA completed in 2024–2025.

Mandatory training

In 2023, the CRA introduced a requirement that employees must complete the Canada School of Public Service course COR502, Access to Information and Privacy Fundamentals. Employees must take the course every five years to retain the knowledge. This ensures that all CRA employees receive the required access to information and privacy training to properly respond to ATIP requests and protect and manage personal information.

This mandatory training supports the Treasury Board of Canada Secretariat’s policy requirement that all federal government employees must receive training on their obligations related to the Access to Information Act and the Privacy Act.

Since 2023, 52,900 employees completed the course, with 12,597 completing it in 2024–2025. In total, over 93% of the CRA workforce has received the training.

Quarterly ATIP awareness information sessions

During the reporting period, the ATIP Directorate gave 8 quarterly information sessions in English and French to a total of 2,024 participants.

Quarterly teleconferences with the office of primary interest

During the reporting period, 872 CRA employees participated in quarterly teleconferences with the office of primary interest to help them in their roles as ATIP contacts. These teleconferences ensured continued awareness and consistency in how the CRA applied processes across the organization and provided information on the new ATIPXpress Collaboration Portal.

Targeted training

The ATIP Directorate provided targeted access to information training to over 3,000 participants, in 11 separate CRA areas. This training is tailored to address the specific challenges faced by a CRA area, improving their ability to process ATIP requests and ultimately strengthening transparency and compliance.

The training varied depending on their needs and included topics such as how to:

• conduct a reasonable search
• give complete responsive records in a timely manner
• give recommendations in response to a request

International Association of Privacy Professionals AI Governance training

During the reporting period, 33 CRA executives and privacy professionals participated in the AI governance certificate training course offered by the International Association of Privacy Professionals. This course was designed to establish foundational knowledge of AI systems, responsible AI principles, and governance frameworks.

Raising awareness

Privacy awareness plan

The CRA implemented its third annual privacy awareness plan to foster a culture of privacy and educate employees on their responsibilities regarding institutional policies and processes. This plan included 25 activities, such as publishing a privacy breach infographic with tips on identifying and reporting breaches.

ATIP News Flash

The CRA launched the ATIP News Flash which highlights the latest information on access to information and privacy policies, regulations, and upcoming changes from the Treasury Board of Canada Secretariat, the Office of the Information Commissioner of Canada, and the Office of the Privacy Commissioner of Canada. The ATIP News Flash also shares best practices for managing access to information and privacy requests, keeping subscribers informed about relevant changes.

Data Privacy Week

Every year, the CRA celebrates Data Privacy Week, an international initiative which promotes awareness of the effects of technology on privacy rights and the importance of valuing and protecting personal information. This year, the CRA revamped and promoted its Data Privacy Week intranet page, making it more interactive and accessible to employees.

Privacy Awareness Week

The Privacy Awareness week is a global effort to promote awareness of privacy issues and the importance of protecting personal data. In celebration of the Privacy Awareness Week, CRA employees were encouraged to attend the Canada School of Public Service event on navigating privacy in the digital workplace.

Privacy management

Strengthening the Privacy Management Framework

The privacy landscape continues to evolve significantly with ever‑expanding digital technologies and automated decision‑making.

In 2024–2025, the CRA continued to improve its privacy management framework^{Footnote 1}  by:

• building on the CRA‑wide privacy training and awareness strategy by developing a multi‑year, comprehensive learning strategy for privacy practitioners being rolled out in 2025–2026
• facilitating compliance and bringing awareness to new requirements mandated by the new Treasury Board of Canada Secretariat Standard on Privacy Impact Assessment
• providing guidance and advice on numerous privacy initiatives, including clauses to facilitate an individual’s right of access to their personal information in contracts, agreements, and arrangements

Privacy breach management

One of the corner stones of Canada’s tax system is the trust taxpayers place in the CRA to safeguard their personal information. The CRA takes the integrity and protection of taxpayers’ information very seriously and has strong controls in place to prevent privacy breaches. Despite the effectiveness of those controls, privacy breaches sometimes occur. Effectively managing privacy breaches is critical to maintaining public confidence in the integrity of Canada’s tax system.

The CRA investigates all internal and external incidents involving potentially compromised information. When a privacy breach occurs, the ATIP Directorate works closely with stakeholders to contain and manage the breach, assess the impacts to affected individuals, and identify and apply corrective measures to prevent reoccurrence.

When warranted, the CRA proactively protects taxpayer accounts, notifies individuals affected by a privacy breach, and offers credit protection services to help further protect their personal information.

The CRA follows Treasury Board of Canada Secretariat policy instruments to determine which privacy breaches meet the threshold of a material breach. The CRA must notify the Office of the Privacy Commissioner of Canada and the Treasury Board of Canada Secretariat of material privacy breaches after it completes an investigation.

This year, the CRA reported 35,642 material privacy breaches. Of these:

• 27 involved unauthorized access or disclosure of taxpayer information by CRA employees
• 4 involved misdirected mail
• 40 involved security incidents, including loss and the improper disclosure of personal information
• 35,571 involved the unauthorized use of taxpayer information by a third party

An increase in the number of material privacy breaches the CRA reported to the Office of the Privacy Commissioner of Canada and the Treasury Board of Canada Secretariat in 2024–2025 can be attributed to the retroactive reporting of 31,393 privacy breaches resulting from the unauthorized use of taxpayer information by a third party, between May 2020 to November 2023. For more information on unauthorized use of taxpayer information by a third party privacy breaches, see the Unauthorized use of taxpayer information by a third party section.

The number of reported breaches is expected to decrease slightly in the coming year because the CRA has completed its retroactive reporting of confirmed breaches resulting from the unauthorized use of taxpayer information by a third party.

That said, the number of breaches reported is still expected to exceed that of previous years as the CRA continues to implement processes and improve its systems and security measures to detect, confirm, and report these types of incidents.

Unauthorized access or disclosure by CRA employees

This year, the CRA’s Security Branch informed the ATIP Directorate of 59 incidents of improper handling of personal information by CRA employees.

The CRA treats incidents involving the mishandling or unauthorized access of sensitive information with the highest level of seriousness. In addition to responding to these incidents, the CRA has robust preventative measures in place, including employee training, the CRA’s Electronic Fraud Management System, and strict access controls to reduce the risk of breaches before they occur.

When incidents do occur, the CRA deals with confirmed employee misconduct promptly and appropriately and refers any incident involving suspected criminal activity to the proper authorities. Furthermore, CRA employees are subject to its strict Code of Integrity and Professional Conduct. Employees who breach the Code can face disciplinary measures, such as a review of their security clearance or termination of employment.

Misdirected mail and security incidents

In 2024–2025, the CRA recorded 861 privacy breaches as a result of misdirected mail, which is mail that was incorrectly addressed or sent to the wrong person in error. Misdirected mail incidents occur for only 0.003% of the 92 million pieces of mail the CRA handles each year.

In addition, 326 CRA privacy breaches resulted from security incidents including loss, theft, or improper disclosure of personal information.

Unauthorized use of taxpayer information by a third party

Breaches caused by the unauthorized use of taxpayer information by a third party occur when an external threat actor uses elements of personal information (names, social insurance numbers, etc.) likely obtained from external sources, to attempt to access, alter, or create personal taxpayer information.

In 2024–2025, the CRA recorded 35,571 privacy breaches as a result of the unauthorized use of taxpayer information by a third party. This sharp increase can be attributed to the retroactive reporting of 31,393 privacy breaches between May 2020 to November 2023.

Since 2020, the CRA implemented various system improvements, security measures, processes, and governance and organizational changes to better detect, analyse, and mitigate incidents resulting from the unauthorized use of taxpayer information by a third party.

As soon as suspicious account activity is identified, affected individuals are advised and their accounts are appropriately protected. Once a breach has been confirmed, individuals are formally notified and provided with credit protection, when required.

Exception to the section 4.2.8 of the Policy on Privacy Protection

During the fiscal year, the CRA was granted an exception to section 4.2.8 of the Treasury Board of Canada Secretariat’s Policy on Privacy Protection which requires Government of Canada institutions to report material privacy breaches to the Secretariat and the Office of the Privacy Commissioner of Canada no later than seven days after the institution determines that the breach is material. Given the volume of confirmed cases and significant and ongoing nature of this workload, meeting this reporting timeline was not feasible. Receipt of this exception allowed the CRA to report privacy breaches resulting from individual cases of unauthorized use of taxpayer information by a third‑party on a quarterly basis.

The exception applies only to individual breaches involving the unauthorized use of taxpayer information by a third party, that cannot be linked to a specific scheme or event by threat actors uncovered by the CRA. In all cases where the privacy breach can be connected to a specific scheme or event, the CRA continued to report the breaches within the parameters outlined in the policy as these cases were less frequent and more manageable in volume.

Privacy breach mitigation measures

The CRA continually strives to monitor and improve its internal processes and systems to further protect taxpayer information. It limits employees’ access permissions to only the information they need to do their job and regularly reviews employee access to CRA systems.

In addition, the CRA has implemented additional security measures, such as multifactor authentication, to protect the personal information of taxpayers and make sure they can use the CRA’s online services with confidence and safety.

Taxpayers’ vigilance in protecting account information is also an essential layer of security. The CRA reminds all taxpayers to change their passwords regularly and to monitor their online accounts for any signs of suspicious activity, such as unsolicited changes to contact and banking information, changes of representative or directors, or tax returns filed on their behalf and resulting in refunds.

Office of the Privacy Commissioner of Canada investigations

On February 15, 2024, the Office of the Privacy Commissioner of Canada released a special report to Parliament on the findings and recommendations from its investigation into the unauthorized disclosure and modification of personal information held by the CRA and Employment and Social Development Canada resulting from cyberattacks.

The CRA has one remaining action to complete in its management action plan submitted to the Office of the Privacy Commissioner of Canada to respond to its recommendations. It is on track to be completed by September 2025.

The special report to Parliament can be found at priv.gc.ca/en/opc-actions-and-decisions/ar_index/202324/sr_pa_20240215_gckey.

On October 29, 2024, the Office of the Privacy Commissioner of Canada launched an investigation into the CRA related to cyberattacks that led to more than 30,000 privacy breaches dating back to 2020. The CRA is committed to working closely and collaboratively with their office on this investigation.

Privacy impact assessments

The CRA completed 27 privacy impact assessments during the 2024–2025 reporting period.

As well, the CRA reviewed a significant number of initiatives to assess potential privacy impacts. These reviews looked at documents such as privacy checklists, Treasury Board of Canada Secretariat submissions, threat‑and‑risk assessments, local application solutions, contracts, and written collaborative arrangements.

The CRA published summaries of completed privacy impact assessments at canada.ca/en/revenue-agency/services/about-canada-revenue-agency-cra/protecting-your-privacy/privacy-impact-assessment.

For summaries of the privacy impact assessments completed during the 2024–2025 reporting period, see Appendix A: Summaries of completed privacy impact assessments.

Summary of key issues and actions taken on complaints

The CRA regularly communicates with the offices of the information and privacy commissioners of Canada to simplify processes and apply continuous improvement Lean methods to close complaint files as soon as possible. During the reporting period, the CRA worked with these offices by focusing on resolving complaints at the early resolution stage.

The CRA specifically addressed complaints by:

• sharing a new reasonable commitment date for responses with the applicable commissioner’s office when the CRA failed to respond to a request within the prescribed delays
• developing proper processes and procedures to ensure that CRA offices of primary interest will fulfill their responsibilities to provide records to the ATIP Directorate in a timely fashion
• conducting thorough investigations to confirm reasonable searches for records were completed and providing a rationale to the applicable commissioner’s office detailing the searches and whether those searches were successful or whether the records did not exist
• reviewing the analysis of the records to see if it should maintain an exemption or release the information (following the review, in cases where the CRA determines it improperly applied an exemption, the CRA will provide a supplemental disclosure package to the applicable commissioner’s office and the complainant)
• reviewing the process of a refused request to give further direction about what information or actions would be required to proceed with the initial request
• providing a new copy of the records in the requested format

In 2024–2025, the CRA received 34 complaints under the Privacy Act and completed 71 complaints. At the end of the fiscal year, 77 complaints were still active. The following chart shows the number of complaints received and completed since 2022–2023.

Figure 5: Complaints received and completed under the Privacy Act

The following chart shows the disposition of the complaints completed during the fiscal year.

Figure 6: Disposition of complaints completed during the fiscal year

Additionally, the ATIP Directorate received four early resolution complaints and one formal privacy‑related complaint from the Office of the Privacy Commissioner of Canada on behalf of individuals. These complaints were related to privacy management and not Privacy Act requests, and they concerned the following issues:

• loss of information (1)
• unauthorized access (1)
• unauthorized access and disclosure (1)
• unauthorized use and disclosure of personal information (1)
• unauthorized disclosure (1)

Of these complaints:

• two are still in progress
• three were resolved

For the definitions and disposition categories from the Office of the Privacy Commissioner of Canada, go to priv.gc.ca/en/opc-actions-and-decisions/investigations/def-cf.

Monitoring compliance

Reports

The ATIP Directorate produces several reports that capture key statistics about the CRA’s inventory of ATIP requests. The reports show:

• active and closed requests
• the status of requests by branch and region
• the carry‑forward inventory
• complaints
• deemed refusal volumes

Management regularly uses the reports to:

• ensure timely processing of ATIP requests
• monitor trends of frequently requested types of information
• measure the Directorate’s performance
• promote the availability of information by other means

The Directorate presents the reports monthly to senior management at the commissioner‑chaired Agency Management Committee.

ATIP quality assurance program

The ATIP quality assurance program identifies trends in file processing and fixes gaps in business processes. Its findings have helped develop training and awareness material to improve the quality of the service provided.

In 2024–2025, training on the consistent application of procedures, such as conducting a reasonable search, assisting the requester throughout the ATIP process, and documenting decisions, was presented to ATIP Directorate employees and offices of primary interest.

Contracts

In response to the October 2022 updates to the Treasury Board of Canada Secretariat Directive on Privacy Practices, the ATIP Directorate continued to collaborate with the Finance and Administration Branch and the Service, Innovation and Integration Branch. Together, they are developing a process to include privacy protections, such as clauses that facilitate an individual’s right of access to their personal information in contracts, agreements, and arrangements. They also ensure summaries are published annually in InfoSource.

Public interest disclosure

In 2024–2025, the CRA made no disclosures under paragraph 8(2)(m) of the Privacy Act and sent no written notifications to the Office of the Privacy Commissioner under subsection 8(5). 

Conclusion

Despite growing demands on the ATIP program and the ever‑changing privacy landscape, the CRA continued to make significant progress in addressing the challenges of protecting personal information and in processing Privacy Act requests.

The CRA did this by:

• processing ATIP requests using Lean methodology
• addressing the backlog through the CRA backlog elimination plan
• providing mandatory ATIP training for all CRA employees
• launching the fast track redirect pilot project to redirect requesters to the CRA’s secure My Account online service when requesters sought:
  • proof of income statements from the past ten assessed years
  • notices of assessment
  • benefits information

In 2025–2026, the ATIP Directorate will focus on the priorities in its strategic plan, and continue to:

• identify opportunities to increase the use of proactive disclosure and divert requesters to informal channels,
• improve the ATIP program by implementing digital technologies and continuous improvement initiatives, including artificial intelligence 
• integrate data analytics to enhance inventory management and use of available resources to enable efficient decision making and reduce production times
• identify and develop new privacy gates by embedding Privacy by Design
• continue to work closely and collaboratively with the Office of the Privacy Commissioner regarding their investigation into the cyberattacks that led to more than 30,000 privacy breaches dating back to 2020
• support the CRA’s Audit, Evaluation, and Risk Branch in their two internal audits on contracting and privacy breaches

Appendix A: Summaries of completed privacy impact assessments

The 27 completed privacy impact assessments can be found at canada.ca/en/revenue-agency/services/about-canada-revenue-agency-cra/protecting-your-privacy/privacy-impact-assessment.

Assessment, Benefit and Service Branch Contact Centre Operations V3

This privacy impact assessment focuses on the enquiries and programs handled by the contact centres in support to individuals, benefits, and business enquiries. It was updated to include an online chat service to taxpayers who seek an alternative channel to communicate with the CRA.

Authentication and Credential Management V4

This privacy impact assessment evaluates CRA’s external secure online program services and applications, including services from other government departments that use the CRA’s authentication services. It was updated to include the digital identity validation option, the Identity Validation Service to Innovation, Science and Economic Development Canada, and multi-factor authentication.

Canada Emergency Benefits, Canada Recovery Benefits, and Canada Worker Lockdown Benefit Validation and Compliance V1

This privacy impact assessment evaluates the temporary income support administered to individuals between March 15, 2020, and May 7, 2022, ensuring that eligible applicants received the appropriate benefits while also addressing any overpayments.

Canada Child Benefit and Related Benefits V2

This privacy impact assessment covers the administration of the Canada child benefit and related federal, provincial, and territorial benefits and credits. It was updated to include various new and modified benefits and initiatives.

Canada Pension Plan and Employment Insurance Appeals to the Minister and Appeals to the Courts V1

This privacy impact assessment evaluates when an employer, individual, or Employment and Social Development Canada appeals a CPP or EI decision to the minister of national revenue. It also covers cases where an employer, individual, or Employment and Social Development Canada disagrees with a decision and wants to challenge it in the Tax Court or Federal Court of Canada.

Charities Program V1

This privacy impact assessment examines the Charities Program, focusing specifically on the registration and oversight of qualified donees for income tax purposes. It replaces the 2009 privacy impact assessment for Form T3010B (09), Registered Charities Information Return, and the 2008 preliminary privacy impact assessment for Form T2050, Charities registration application.

Community Volunteer Income Tax Program V2

This privacy impact assessment evaluates the Community Volunteer Income Tax Program’s role as coordinator and overseer of the participation of organizations and volunteers in the program. It was updated to include the auto‑fill my return service available to all volunteers and a new management tool.

Corporation Returns and Payment Processing Program V4

This privacy impact assessment focuses on the T2 assessment program, including the processing of business returns (T2 returns and special elections and returns) and payments. It was updated to assess amendments and expansion of the program including the addition of the Canada carbon rebate for small businesses.

Disability Tax Credit Program V2

This privacy impact assessment examines the disability tax credit, which is a non‑refundable tax credit designed to help individuals with disabilities or their supporting family members reduce the amount of income tax they may need to pay. It was updated to include the COVID‑19 relief measure one-time payment, the Canadian Dental Care Plan, and the digital application process.

Enhanced Financial Account Information Reporting Part XVIII V3

This privacy impact assessment focuses on the enhanced financial account information reporting between tax administrations. It was updated to include the compliance activities of financial institutions, the sharing of intergovernmental agreement information, and system improvements.

Employer Accounts Program V3

This privacy impact assessment covers the Employer Accounts Program activities, which includes ensuring that the Canada Pension Plan contributions and employment insurance premiums are deducted, remitted, and reported as required by legislation. It was updated to include new softwares and applications (generic electronic document, filing application, record management software, national inventory management system) Canada Pension Plan improvements, representative identifiers, and reporting for the Canadian dental plan.

Employer Compliance Audit V3

This privacy impact assessment covers the activities related to ensuring that employers comply with reporting requirements. It was updated to include the mandatory representative identifier, and a new form to authenticate a representative.

Excise and Specialty Tax Program Phase II V1

This privacy impact assessment covers the Excise and Specialty Tax Program which is responsible for the licensing and registration of clients; rulings and interpretations, audits, compliance reviews; and the enforcement of assistance programs. The privacy impact assessment for this program was completed in two phases. The current phase includes activities related to the Select Luxury Items Tax Act, the Air Travellers Security Charge Act, the non‑GST provisions of the Excise Tax Act, the Softwood Lumber Products Export Charge Act, 2006, and the Importation of Intoxicating Liquors Act.

Goods and Services Tax / Harmonized Sales Tax (GST/HST) Audit and Examination V2

This privacy impact assessment examines the reviews, examinations, and audits conducted at the domestic and international levels to determine the correct excise taxes and GST/HST owed, and to prevent unwarranted refunds and rebates. It was updated to include a comprehensive compliance strategy aimed at enhancing the detection and management of non-compliance within the platform economy for GST/HST and the use of the new tool.

Good and Services Tax / Harmonized Sales Tax (GST/HST) Returns and Rebates Processing Program V4

This privacy impact assessment examines the processing and assessing of rebate applications for government entities. It was updated to include a web form on Canada.ca that allows non‑residents to register for the GST/HST as digitals suppliers, a solution to allow the CRA to convert returns received in some foreign currencies into Canadian funds, and improvements to the CRA’s online services.

Human Resources Business Intelligence V1

This privacy impact assessment covers the business intelligence activities used to improve the delivery and increase the effectiveness of the human resources program.

Identity Protection Services V1

This privacy impact assessment examines the Identity Protection Services Program, which includes verifying the identity of a taxpayer whose information is suspected of being used by an unauthorized third party and taking corrective actions on the accounts of identity theft victims.

National Security Disclosures Program V1

This privacy impact assessment focuses on the disclosure of information to a designated group of departments and agencies with recognized national security mandates or responsibilities.

Offshore Tax Informant Program V3

This privacy impact assessment examines the Offshore Tax Informant Program, which allows for financial rewards to individuals who provide information related to major international tax non-compliance that result in the collection of at least $100,000 in additional taxes. It was updated to reflect changes to the program retention rules and procedures for open‑source research.

Online Staffing Assessment Platform – VidCruiter V2

This privacy impact assessment focuses on the use of the online platform VidCruiter in staffing processes. It was updated to include the use of various VidCruiter functions by a select number of Human Resources Branch employees. These functions include pre‑recorded and live video interviewing, skills testing, interview scheduling, and reference checking.

Objections Program V1

This privacy impact assessment covers the Objections Program, which reviews notices of objection about a specific notice of assessment, notice of reassessment, notice of determination, or notice of redetermination issued by the CRA.

Office of the Taxpayers’ Ombudsperson V3

This privacy impact assessment examines the Office of the Taxpayers’ Ombudsperson Program which reviews service‑related complaints and issues that can affect one person or a part of the population. It was updated to include the use of a secure online portal for communication with taxpayers and a telephone system that facilitates efficient communication between agents and taxpayers.

Registered Deferred Income and Savings Plans Program V1

This privacy impact assessment covers 11 registered deferred income and savings plans by way of employment, personal savings, or both. The information from the previously completed privacy impact assessments for the Registered Disability Savings Plans Program and the Pooled Registered Pension Plans Program were amalgamated into this privacy impact assessment.

Service Feedback Program V1

This privacy impact assessment covers the Service Feedback Program, which is a formalized complaint and problem resolution process that allows the CRA to gather, track, and analyze taxpayers’ feedback with the goal of improving service to taxpayers and resolving issues.

Taxpayer Relief Program V1

This privacy impact assessment examines the Taxpayer Relief Program which reviews requests for penalties and interest relief received from taxpayers who cannot meet their tax obligations.

Tax‑Free Savings Initiatives V2

This privacy impact assessment focuses on the tax‑free savings initiatives, such as the Tax‑free Savings Account Program and the First Home Savings Account Program. It was updated to include the First Home Savings Account Program and the CRA’s service and compliance activities to support both initiatives.

Trust Accounts Examination V3

This privacy impact assessment covers the activities related to ensuring that Canada Pension Plan contribution and employment insurance premiums are deducted, remitted, and reported as required by legislation. It was updated to include changes to filing and amendments to T4 and T4A slips during the course of reviews or exams as required, in line with the new legislative policies.

Appendix B: Delegation order

Schedule – Privacy Act

The positions authorized to perform the powers, duties, or functions given to the minister of national revenue as head of the Canada Revenue Agency under the provisions of the Privacy Act and its regulations.

Commissioner

• Full authority

Deputy Commissioner

• Full authority

Assistant Commissioner, Public Affairs Branch and Chief Privacy Officer

• Full authority

Director General, Access to Information and Privacy Directorate, Public Affairs Branch

• Full authority

Director, Access to Information and Privacy Directorate, Public Affairs Branch

• Full authority

Assistant directors, Access to Information and Privacy Directorate, Public Affairs Branch

• Full authority except for paragraph 8(2)(j), paragraph 8(2)(m), subsection 8(5), and subsection 72(1)

Managers, technical reviewers / advisors, Access to Information and Privacy Directorate, Public Affairs Branch

• Full authority except for paragraph 8(2)(j), paragraph 8(2)(m), subsection 8(5), subsection 9(1), subsection 9(4), section 10, subsection 33(2), and subsection 72 (1)

Analysts, senior analysts, Access to Information and Privacy Directorate, Public Affairs Branch

• Authority only under paragraph 14(a), section 15, subsection 16(1), paragraph 17(2)(b), and paragraph 17(3)(b)