Canada Child Benefits

Privacy Impact Assessment (PIA) summary – Benefit Programs Directorate, Assessment, Benefit, and Service Branch

Overview & PIA Initiation

Government institution

Canada Revenue Agency (CRA)

Government official responsible for the PIA

Frank Vermaeten
Assistant Commissioner, Assessment, Benefit, and Service Branch

and

Michael Snaauw
Assistant Commissioner, Collections and Verification Branch

Head of the government institution or Delegate for section 10 of the Privacy Act

Marie-Claude Juneau
ATIP Coordinator

Name of program or activity of the government institution

Benefit Programs Administration

Description of the class of record and personal information bank

Standard or institution specific class of record:
Benefit Programs - Canada Child Benefits and other Federal, Provincial, and Territorial Programs and Suppléments (CRA ABSB 646)

Standard or institution specific personal information bank:
Canada Child Tax Benefit (CCTB) Program - Personal Information Bank (CRA PPU 063)   

Legal authority for program or activity

The legislative authority that allows the CRA to collect information is covered by section 220 of the Income Tax Act (ITA) which provides for the Minister’s duty to collect information for the purpose of the administration and enforcement of any program covered under the ITA.

In this case, the Canada Child Tax Benefit and the upcoming Canada Child Benefit are both administered under section 122.61 of the ITA.

Section 61 of the Canada Revenue Agency Actallows CRA to implement agreements with other federal, provincial and territorial Governments for the purpose of carrying out an activity or program administered by the CRA.

The legal authority to collect the SIN is found under section 237 of the Income Tax Act and is used for identification purposes.

Summary of the project / initiative / change

The Canada Child Tax Benefit (CCTB) is a non-taxable amount paid monthly to help eligible families with the cost of raising children under 18 years of age. The CCTB may include the National Child Benefit Supplement (NCBS) and the Child Disability Benefit (CDB). The NCBS is the Government of Canada's contribution to the national child benefit initiative. It is a partnership among the federal, provincial and territorial governments as well as First Nations that aims to help prevent and reduce child poverty. The CDB is a tax-free monthly benefit for families who care for children under age 18 with a severe and prolonged impairment in physical or mental functions. Families who are eligible for the CCTB for a child will receive the CDB if the child is also eligible for the disability amount, also known as the Disability Tax Credit (DTC).

Individuals can apply for child benefits by using the "Apply for child benefits" service on My Account or by sending a completed Form RC66, Canada Child Benefits Application. Also, a mother of a newborn who lives in a participating province or territory can apply using the Automated Benefits Application (ABA) service. All the information needed to use the ABA service is included in the birth registration package provided by the participating province or territory.

What’s new

As part of the Federal government’s plan to give more Canadian families money to raise their children, the Canada Child Tax Benefit (CCTB), Universal Child Care Benefit (UCCB) and National Child Benefit Supplement (NCBS) programs are being replaced with an enhanced Canada Child Benefit (CCB) program as of July 2016 (2015 benefit year). However, for the July 2016 to June 2017 period the CRA will continue to support the NCBS initiative by calculating an NCBS Equivalent amount within the Canada Child Benefit.

Eligibility requirements for the new Canada Child Benefit will reuse the existing CCTB definitions and will enhance the eligibility rules.

No new collection of information will occur under the Canada Child Benefit. Individuals who have already applied for the UCCB or the CCTB do not need to apply for the new CCB. Benefits and credits that relied on CCTB information to determine eligibility and entitlement will now rely on the Canada Child Benefit information. CRA will continue to use the Canada child benefit application to determine eligibility for federal, provincial and territorial programs related to the Canada Child Benefits.

The Alberta child benefit will commence in July 2016 to provide an additional quarterly benefit for low income families living in Alberta with eligible children.

In addition, the CRA will use the Canada child benefit application to determine eligibility for the following federal, provincial and territorial programs related to the Canada Child Benefits:

Federal programs

• Universal child care benefit- valid until July 2016

Provincial and territorial programs

• Alberta Family Employment Tax Credit;
• Alberta Child Benefit;
• British Columbia Family Bonus including the earned income supplement;
• British Columbia Early Childhood Tax Benefit:
• New Brunswick Child Tax Benefit including the working income supplement and the school supplement;
• Newfoundland and Labrador Child Benefit including the Mother Baby Nutrition Supplement;
• Northwest Territories Child Benefit, including the Territorial workers supplement;
• Nova Scotia Child Benefit;
• Nunavut Child Benefit including the including the Territorial workers supplement;
• Ontario Child Benefit;
• Saskatchewan Child Benefit;
• Yukon Child Benefit.

If eligible, the amount of any payment will be automatically calculated using the information from the applicant, and his or her spouse or common-law partner’s, income tax and benefit returns.

Scope of the privacy impact assessment

This privacy impact assessment (PIA) covers the administration of the Canada Child Benefit including, the existing Canada Child Tax Benefit, and the related federal, provincial and territorial benefits and credits, including the compliance activities for enforcement purposes such as detecting fraud or investigating possible abuses within the benefit program.

Certain compliance activities such as audits and criminal investigations are separate programs and therefore are not included. In addition, the application process to determine if a person with a disability is eligible for the Disability Tax Credit is not included in this PIA.

Programs and initiatives that focus on child benefits and credits are constantly changing. Therefore, when a new initiative or a change to an existing benefit is identified, this PIA will be reviewed and updated accordingly.  

Risk identification and categorization

A) Type of program or activity

Compliance / Regulatory investigations and enforcement

Level of risk to privacy: 3

Details: The personal information is used for the identification, determination, validation and payment of benefits and credits.

Information is also used to determine whether an individual knowingly participated in or made a false statement or omission. The consequences can include reviews which may result in termination and/or recoup of benefits, and possibly levying civil penalties under section 163(2) of the Income Tax Act. 

Also in limited cases, information obtained during the course of a validation or compliance review may be referred to the Criminal Investigations Program of the CRA for further investigation against a particular individual. This may result in the laying of criminal charges under section 238 or section 239 of the Income Tax Act.   

B) Type of personal information involved and context

Social Insurance Number, medical, financial or other sensitive personal information and/or the context surrounding the personal information is sensitive. Personal information of minors or incompetent individuals or involving a representative acting on behalf of the individual.

Level of risk to privacy: 3

Details: Personal information collected includes details such as name, contact information, financial information, social insurance number (SIN) and signature, marital status and citizenship.
In addition, some of the information includes the personal information of minors.

C) Program or activity partners and private sector involvement

Information may be shared and/or verified with other federal, Provincial, or Territorial government institutions in accordance with legislation, including: Public Services and Procurement Canada; Employment and Social Development Canada, Immigration, Refugees and Citizenship Canada, Department of Finance Canada, and Statistics Canada for statistical analysis. 

Information may also be shared with third parties upon consent of the taxpayer for verification purposes. Information may also be shared with provincial, territorial and aboriginal governments (or parts thereof) in accordance with legislation for the administration of social and income assistance programs in addition to fiscal and policy analysis

Level of risk to privacy: 4

Details: The program includes the administration of benefit and tax credit programs on behalf of federal, provincial, and territorial partners. Information is disclosed by the CRA to our partners for the purpose of accurate calculation of programs and/or program evaluation, and to Public Services and Procurement Canada for the issuance of payments.

CRA obtains information from the Immigration, Refugees and Citizenship Canada web validation portal for the purposes of validating an individual’s citizenship/immigration status for the determination of eligibility for Benefit Program payments and to validate/authenticate citizenship/immigration documents provided by the taxpayer as proof of status.

CRA provides information to Employment and Social Development Canada in support of the Employment Insurance Family Supplement, the Canada Education Savings Program, Disability Savings Program, and Learning Bonds.

Under the national child benefit (NCB) initiative CRA sends and receives benefit information including eligibility, entitlement, payment and identification data to other provincial/territorial and First Nation departments for the administration of social and income assistance benefits administered by the other government departments.

While Quebec does not participate in the NCB initiative the province does acknowledge the NCB and participates in an exchange with CRA for the purposes of providing income assistance to families with children. Benefit information including eligibility, entitlement, payment and identification data is passed to Quebec for this purpose.

The information is also used internally within CRA for collection of outstanding balances, audit activities, appeals, statistical gathering, and call centre enquiry responses.
Paper copies containing personal information are stored by a third party in the private sector.

D) Duration of the program or activity

Long-term program

Level of risk to privacy: 3

Details:  Although some of the individual provincial/territorial benefits/credits may be short term most are not and the new Canada Child Benefit itself is a long term program with no established end date.

E) Program population

The program affects certain individuals for external administrative purposes.

Level of risk to privacy: 3

Details: The program affects individuals who apply for the new Canada Child Benefit, his or her spouse or common-law partner and their children under 18 years of age. This program also affects individuals who have applied for the Canada Child Tax Benefit or Universal Child Care Benefit prior to July 2016, his or her spouse or common-law partner, and their children under 18 years of age..

F) Technology & privacy

Does the new or modified program or activity involve the implementation of a new electronic system, software or application program including collaborative software (or groupware) that is implemented to support the program or activity in terms of the creation, collection or handling of personal information?

Risk to privacy: No

Is the new or modified program or activity require any modifications to IT legacy systems and/or services?

Risk to privacy: No

The new or modified program or activity involves the implementation of one or more of the following technologies:

Enhanced identification methods - this includes biometric technology (i.e. facial recognition, gait analysis, iris scan, fingerprint analysis, voice print, radio frequency identification (RFID), etc...) as well as easy pass technology, new identification cards including magnetic stripe cards, "smart cards" (i.e. identification cards that are embedded with either an antenna or a contact pad that is connected to a microprocessor and a memory chip or only a memory chip with non-programmable logic).

Risk to privacy: No

Details: N/A

Use of Surveillance - this includes surveillance technologies such as audio/video recording devices, thermal imaging, recognition devices , RFID, surreptitious surveillance / interception, computer aided monitoring including audit trails, satellite surveillance etc.

Risk to privacy: No

Details: The program does not involve the use of surveillance on individuals associated with the Canada Child Tax Benefits or the upcoming Canada Child Benefits.

However, as part of the CRA security program, CRA employees who have access to personal information are monitored by the use of the Online Audit Tracking System (OATS). OATS records information, such as user logon ID, date and time of logon, logout, user location, terminal identity, name and ID of client records accessed, including edits or changes made during each user session, etc.

The information is used to verify that only authorized users have accessed personal information and to ensure that access can be linked to specific individuals to support the investigation of suspected or alleged misuse. 

Every time CRA employees log in on their computers, a notice pops up requiring employees to acknowledge that they are aware that all access to CRA networks is monitored and that access is on a need-to-know basis. This information is already described in the standard personal information bank Electronic Network Monitoring Logs PSU 905.

Use of automated personal information analysis, personal information matching and knowledge discovery techniques - for the purposes of the Directive on PIA, government institutions are to identify those activities that involve the use of automated technology to analyze, create, compare, identify or extract personal information elements. Such activities would include personal information matching, record linkage, personal information mining, personal information comparison, knowledge discovery, information filtering or analysis. Such activities involve some form of artificial intelligence and/or machine learning to uncover knowledge (intelligence), trends/patterns or to predict behavior.

Risk to privacy: Yes

Details: Benefit Data Mart is a subset of the agency data warehouse (ADW).It collects data from the Individual Credit Database (ICD) and IDENT databases and an authorized employee can run queries against the data mart to identify trends, statistics or other required information. Reports are created from the Benefit Data Mart using a set of identified parameters and filters that are then used for analysis.  A privacy impact assessment for the ADW including the Benefit Data Mart was published in 2007; it provides a broader privacy risk analysis of the ADW and the related data marts.
Information provided on the income tax and benefit returns is used to calculate payments. Therefore, information is also matched between the individual’s income tax account and benefits account. Data matching techniques are also used to ensure applicants continue to meet the eligibility and entitlement requirements for the child benefits.   

In addition, information that was provided by the individual is verified with other sources. If they are benefit recipients the Benefits Validation & Compliance Section of the Collections & Verification Branch will further investigate to determine if these individuals are no longer eligible for benefits.

G) Personal information transmission

The personal information is transmitted using wireless technologies. It may also be transferred to a portable device or is printed.

Level of risk to privacy: 3

Details: Personal information can be used in a system that has access to other systems and can be transferred to a secure portable device.

H) Risk impact to the individual or employee

Financial harm

Details: If the personal information is compromised, it has the potential to cause financial harm and embarrassment to the affected individual. The affected individual may also become a victim of identity theft, and his/her information may be used without this/her knowledge or consent.

I) Risk impact to the institution

Reputation harm, embarrassment, loss of credibility

Details: Should this information be accidentally or deliberately disclosed or compromised, it could reasonably be expected to cause the CRA embarrassment, loss of credibility and trust with the public