The Agency Data Warehouse (ADW)

Privacy Impact Assessment (PIA) summary

What is the ADW and BIDS?

The Canada Revenue Agency (CRA) is implementing an Agency Data Warehouse (ADW) as part of its Business Intelligence Decision Support (BIDS) Program. BIDS aims to enhance the quality of decision-making in support of program management and delivery. By capitalizing on the Agency's data resources and utilizing state-of-the-art analytical tools and software, the CRA will provide improved services, enhance its risk management capabilities, and be better equipped to identify efficiencies in its processes. The ADW is central to improving access to timely integrated data required to support a robust decision support environment.

The ADW provides a secure, central repository for data and enables a corporate approach to data management, technological infrastructure, and tools. Appropriate safeguards, access controls, and processes protect the privacy and security of that data. The ADW will facilitate decision-making by enabling authorized employees to make better and more strategic use of the Agency data resources in an effective and efficient way.

How it is used

CRA data is collected and/or generated by a multitude of systems that were developed over many years to support specific CRA operations or processes. The Agency's computer systems were not designed to take full advantage of modern decision support and analytical tools.

As a result, access to data from various sources can be cumbersome, inefficient, and costly. The ADW will become the single source of consistent, reliable information. By capitalizing on state-of-the-art analytical tools and technology, the CRA can perform the analysis required to support the enhanced delivery and improved management of its programs and services.

This will lead to better, more informed decisions and intelligence in areas ranging from examining trends or changes in tax compliance, evaluating the impact of compliance activities, or analysing the effectiveness of program approaches. The ADW will not replace existing processing systems but will instead enhance the Agency's analytical capacity by organizing data from a myriad of sources in one place.

Protecting Personal Privacy

The protection of personal information is paramount to the CRA. Our obligation to protect taxpayer information is established by the many acts we administer such as the Income Tax Act, Excise Tax Act, etc. and is also governed by the Privacy Act. The CRA is committed to ensuring that information is protected according to the legislation. To accomplish this, internal assessments were conducted on the ADW to identify and address all privacy and security risks.

Furthermore, a Privacy Impact Assessment (PIA) was undertaken to ensure that the CRA is compliant with privacy requirements as outlined in the Privacy Act and other relevant legislation. The ADW PIA was submitted to the Office of the Privacy Commissioner (OPC) in August 2004 for evaluation. The OPC determined that the ADW provides a level of protection that reflects CRA's requirements under the Privacy Act as well as other relevant legislation.

Summary of the ADW PIA

The privacy analysis examined the ADW's adherence to the ten privacy principles provided in the PIA Guidelines. The Agency Data Warehouse involves the use, internal disclosure, and retention of personal information. A legal review of relevant aspects of the Agency Data Warehouse was conducted and it confirmed that the CRA has the authority to use personal taxpayer information in the manner proposed. Furthermore, the CRA recognized the importance of ensuring the public's continued confidence in the tax system and will guard against acquiring more personal information than it requires to perform its duties under the Income Tax Act and Excise Tax Act.

To increase awareness of the importance of safeguarding personal information, the CRA will enhance its employees' knowledge of relevant policies regarding breaches of security and privacy. To this end, a Security and Privacy Awareness session has been developed and is being made available to CRA employees. As an additional safeguard, personal, identifiable information will be segregated within the ADW to ensure that only authorized individuals have access to this type of data. Additionally, audit trails are being refined to track access to personal information.

Finally, the PIA recommended that guidelines adapted to the unique circumstances of the differing user needs be developed. In this regard, procedures have been created to access personal information according to CRA information management, privacy, and security policies. View access profiles will also limit the type of data an end user can access. New access guidelines and controls are being developed as required.

Given that the construction of the ADW is a multi-year project that is being built in stages, CRA will amend this assessment and communicate to the Office of the Privacy Commissioner any new privacy concerns that arise from future stages of the ADW.