Digital Mailroom Project

Administration Directorate
Finance and Administration Branch
Canada Revenue Agency

Privacy Protocol Assessment for Non-Administrative Purposes

Government institution

Canada Revenue Agency

Government official responsible for the PIA

Janique Caron

Chief Financial Officer and Assistant Commissioner

Finance and Administration Branch

Head of the government institution or Delegate for section 10 of the Privacy Act

Steven Morgan

Director General

Access to Information and Privacy Directorate

Description of the class of record and personal information bank

Administrative Services – PRN 901

Standard or institution specific personal information bank:

• Business Number and Program Account Registration - CRA PPU 223
• Service Complaints - CRA PPU 571
• Registered Deferred Income and Savings Plans - CRA PPU 226

Summary of the project / initiative / change

The goal of the DMP is to provide an enterprise-wide digital content delivery solution that program areas can leverage to transition from a paper-based process or enhance existing digital processes. The solution will offer the following integrated capabilities: Receive, Digitize, Extract, Store, and Internal Notification. The project will leverage the services of a managed service provider (MSP), specifically within the Receive, Digitize, Extract, and Store capabilities. Internal Notification will be managed internally by CRA.

Today, work is done in various control areas across the organization. In the future, incoming correspondence would be received, digitally imaged, data extracted, and captured by the MSP. This would facilitate the processing, sharing, and accessing of images across the Agency and transmit required business process data to the CRA. The solution would also make this information available to multiple users across the Agency according to predefined business rules and user access requirements.

The digital mailroom solution will include correspondence received both in paper format and digital, such as through the Submit Documents service.

Through an agile procurement process, a contract was awarded to a MSP named Nimble Information Strategies Inc. (hereinafter referred to as the MSP) in July 2019. 

PPA scope

The Agency Resource Management Committee has approved the DMP to proceed with the onboarding of three initial areas as a part of the project scope: 

1. Business Number Program – Business Returns Directorate - Assessment, Benefit, and Service Branch
2. Service Complaints Program - Chief Service Officer Secretariat - Service, Innovation, and Integration Branch
3. Registered Plan Program – Registered Plans Directorate - Legislative Policy and Regulatory Affairs Branch

The solution is being built at an enterprise level to allow for other programs within the Agency to be able to leverage the Receive, Digitize, Extract (for metadata and indexing) and Store capabilities. The project anticipates this enterprise wide solution will be available to additional on-boarders beginning in Q2 2020-21. Full data extraction and the notification capabilities can be phased in based on on-boarder program requirements and in alignment with the Agency’s release management timeframes.

Part I – Alternatives to the Collection, Use or Disclosure of Personal Information

Before collecting, using, or disclosing any personal information for a non-administrative purpose, the Canada Revenue Agency, hereinafter referred to as “CRA”, commits to the following undertakings:

1.  Defining objectives, exploring alternatives and assessing benefits vs. privacy risks

1.1  CRA will define the objectives of the non-administrative program or activity and determine whether these can be achieved with alternative sources of data, such as depersonalized or aggregate data that do not identify and cannot be used to identify an individual. 

State the objectives:

The DMP will create an enterprise-wide digital mailroom solution that converts paper and electronic documents to a digital format and feeds data directly into the appropriate CRA applications, increasing efficiencies in existing business processes. The project will leverage services of a managed service provider (MSP) and its relevant technologies, processes, and policies in accordance with the CRA’s requirements. The solution will offer five integrated business capabilities:

1. Receive: Paper and digital documents are received and opened;
2. Digitize: Paper and digital documents are converted to digital images;
3. Extract: Data from images is extracted through automation and/or manual keying and is made available in a format ingestible by a CRA system;
4. Store: Images are stored so that program areas can access them, and disposed of according to the associated disposition requirements; and
5. Internal Notification: Program areas are notified when data is available.  

The MSP will store the digitized images in their network and provide access to appropriate users in CRA to access those images. The MSP will extract the data from those documents and apply metadata that can be used to correctly route content to appropriate IT Applications of the onboarding program areas. This extracted data with metadata will be securely sent to CRA over an encrypted channel and stored in CRA's network. CRA’s Information Technology Branch will develop functionality to capture the required data sent by the MSP and deliver it to the appropriate IT applications of the onboarding program areas. An automatic notification would then be sent to the relevant program areas informing them of the receipt of the relevant data.

If the objectives cannot be achieved without the use of personal data, provide the reasons:

The data that is extracted by the MSP will have personal information of the taxpayers/ benefit recipients and cannot be omitted from the images and will be used by CRA to correctly deliver it to the IT applications of the onboarding program areas.

1.2  Where it's determined that the objectives of the non-administrative program or activity cannot reasonably be accomplished unless the information is collected, used or disclosed in a form that identifies the individual(s) to whom it relates (i.e., personal information), CRA will weigh the benefits of the program or activity against the invasion of privacy (see Annex A) that would occur before deciding whether to proceed with it.

The benefits of this program or activity have been considered against the invasion of privacy that may occur before deciding whether to proceed. The outcome of this consideration and decision to proceed are explained as follows:

In the absence of an Agency-wide approach to scanning initiatives, many programs/regions have created independent, locally-driven processes. These initiatives have a variety of standards and methods to store and manage information, exposing the Agency to a number of high risk practices in the area of security, privacy and information management (IM). Digitized taxpayers records are less available than their paper counterparts. Finding and retrieving digitally-filed information is challenging in the absence of an enterprise IM architecture and the associated rules for managing information through its life cycle.

There is a risk that the Agency continues to operate its existing independent scanning operations, and continues to invest in additional localized scanners. Implementing the DMP solution provides an enterprise wide solution that addresses these concerns.

The MSP is based in and operates in Canada and will be governed by CRA's strict IT Security and Information Management policy specifications to safeguard the information, images, data that it stores and transmits to CRA. ATIP has been engaged to provide and vet privacy related requirements of the contract, as per Treasury Board (TBS) guidance.

The DMP will implement the solution in a phased-in approach, beginning with the onboarding of three initial areas: 

1. Business Number Registration - estimated yearly volumes: 77,000 packages
   • Anticipated go-live in Q3 2020-21 (Receive, Digitize, Full Data Extraction, Store, Internal Notification)
2. Service Complaints - estimated yearly volumes: 12,000 packages
   • Anticipated go-live in Q2 2020-21 (Receive, Digitize, Metadata and indexing Extraction, Store)
   • Anticipated go-live in Q4 2020-21 (Full Data Extraction, Internal Notification)
3. Registered Plans – estimated yearly volumes: 10,792 packages
   • Anticipated to go live in Q2 2020-21 (Receive, Digitize, Metadata and indexing Extraction, Store)
   • Anticipated go-live in Q3 2020-21 (Full Data Extraction, Internal Notification)

Each adopting program area is advised to develop new or update existing program-level PIAs in order to identify, assess, and mitigate privacy risks to the CRA. This is a DMP project requirement and part of the programs onboarding to the DMP.