Disability Tax Credit Program

Privacy Impact Assessment (PIA) summary – Benefit Programs Directorate, Assessment, Benefit, and Service Branch

Overview & PIA Initiation

Government institution

Canada Revenue Agency (CRA)

Government official responsible for the PIA

Frank Vermaeten
Assistant Commissioner, Assessment, Benefit, and Service Branch

and

Michael Snaauw
Assistant Commissioner, Collections and Verification Branch

Head of the government institution or Delegate for section 10 of the Privacy Act

Marie-Claude Juneau
ATIP Coordinator

Name of program or activity of the government institution

Benefit Programs Administration

Description of the class of record and personal information bank

Standard or institution specific class of record:
Benefit Programs - Disability Tax Credit (DTC) Program (CRA ABSB 647)

Standard or institution specific personal information bank:
Disability Tax Credit (DTC) Program (CRA PPU 218)

Legal authority for program or activity

Section 118.3 of the Income Tax Act

Section 220 of the Income Tax Act (ITA) provides for the Minister’s Duty to collect information for the purpose of the administration and enforcement of any program covered under the ITA.

Section 61 of the Canada Revenue Agency Act allows CRA to implement agreements with other federal, Provincial and Territorial Governments for the purpose of carrying out an activity or program administered by the CRA.　

Summary of the project / initiative / change

Disability Tax Credit

The Disability Tax Credit (DTC) is a non-refundable tax credit that helps persons with disabilities or their supporting persons reduce the amount of income tax they may have to pay. An individual may claim the disability amount on their personal Income Tax and Benefit Return once they are approved by CRA as eligible for the DTC.

The purpose of the DTC is to provide for greater tax equity by allowing some relief for disability costs, since these are unavoidable additional expenses that other taxpayers don’t have to face.

To be eligible for the DTC, a medical practitioner must certify that the individual has a severe and prolonged impairment in physical or mental functions and describe its effects. Individuals can apply for the DTC and related benefits by completing the "T2201 Disability Tax Credit Certificate" and having the form certified by an acceptable medical practitioner.

The Child Disability Benefit (CDB) is a tax-free monthly benefit for families who care for children under age 18 when the child or children have a severe and prolonged impairment in physical or mental functions. The CDB is added as a supplement to the Canada Child Benefits.

Individuals and families with an approved T2201 Disability Tax Credit Certificate on file may also be eligible for the disability supplement when applying for the Working Income Tax Benefit advanced payments.

Scope of the privacy impact assessment

This privacy impact assessment is an application process to determine if a person with a disability is eligible for the Disability Tax Credit, including the compliance activities for enforcement purposes such as detecting fraud or investigating possible abuses within the benefit program.

Certain compliance activities such as audits and criminal investigations are separate programs and therefore are not included within the scope of this PIA. In addition, the process of calculating and claiming the DTC and applicable tax credits and benefits on the Income Tax and Benefit return are not within scope of this PIA. .

Programs and initiatives that focus on family benefits and credits are constantly changing. Therefore, when a new initiative or a change to an existing benefit under the Disability Tax Credit umbrella is identified, this PIA will be reviewed and updated accordingly.

Risk identification and categorization

A) Type of program or activity

Compliance / Regulatory investigations and enforcement

Level of risk to privacy: 3

Details: The personal information is used for the identification, determination, validation and payment of benefits and credits. Information is also used to determine whether an individual knowingly participated in or made a false statement or omission. The consequences can include reviews which may result in termination and/or recoup of benefits, and possibly levying civil penalties under section 163(2) of the Income Tax Act.

Also in limited cases, information obtained during the course of a validation or compliance review could be used to refer the matter to the Criminal Investigations Program of the CRA for further investigation which could result in the laying of criminal charges under section 238 or section239 of the Income Tax Act against a particular individual

B) Type of personal information involved and context

Social Insurance Number, medical, financial or other sensitive personal information and/or the context surrounding the personal information is sensitive. Personal information of minors or incompetent individuals or involving a representative acting on behalf of the individual.

Level of risk to privacy: 3

Details: Personal information collected includes details such as name, contact information, gender, social insurance number (SIN) and signature, marital status and medical information on physical or mental impairments, biographical information, medical practitioner signature and contact information. In addition, some of the information includes the personal information of minors.

C) Program or activity partners and private sector involvement

With other or a combination of federal/ provincial and/or municipal government(s)

Level of risk to privacy: 4

Details:The program includes the application process to determine if a person with a disability is eligible for the Disability Tax Credit. Information on credits and benefits that rely on the approved DTC Certificate for eligibility are passed to federal, provincial/territorial and municipal partners for the purpose of accurate calculation of programs and/or program evaluation and forcasting.

The information is also used internally within CRA for audit activities, appeals, statistical gathering, and call centre enquiry responses.

Paper copies containing personal information are stored by a third party in the private sector.

D) Duration of the program or activity

Long-term program

Level of risk to privacy: 3

Details: The Disability Tax Credit is a long term program, however, each individual T2201 certification varies in length and some may have an established end date.

E) Program population

The program affects certain individuals for external administrative purposes.

Level of risk to privacy: 3

Details: The program affects individuals who apply for the Disability Tax Credit, their spouse or common-law partner, dependants, and eligible children under 18 years of age.

F) Technology & privacy

Does the new or modified program or activity involve the implementation of a new electronic system, software or application program including collaborative software (or groupware) that is implemented to support the program or activity in terms of the creation, collection or handling of personal information?

Risk to privacy: No

Is the new or modified program or activity require any modifications to IT legacy systems and/or services?

Risk to privacy: No

The new or modified program or activity involves the implementation of one or more of the following technologies:

Enhanced identification methods - this includes biometric technology (i.e. facial recognition, gait analysis, iris scan, fingerprint analysis, voice print, radio frequency identification (RFID), etc...) as well as easy pass technology, new identification cards including magnetic stripe cards, "smart cards" (i.e. identification cards that are embedded with either an antenna or a contact pad that is connected to a microprocessor and a memory chip or only a memory chip with non-programmable logic).

Risk to privacy: No

Details: N/A

Use of Surveillance - this includes surveillance technologies such as audio/video recording devices, thermal imaging, recognition devices , RFID, surreptitious surveillance / interception, computer aided monitoring including audit trails, satellite surveillance etc.

Risk to privacy: No

Details: The program does not involve the use of surveillance on individuals associated with the Disability Tax Credit.

However, as part of CRA security program, CRA employees that will have access to personal information will be monitored. The information is used to verify that only authorized users have accessed personal information and to ensure that access can be linked to specific individuals to support the investigation of suspected or alleged misuse.

Every time CRA employees log in on their computers, a notice pops up requiring employees to acknowledge that they are aware that all access to CRA networks is monitored and that access is on a need-to-know basis. This information is already described in the standard personal information bank Electronic Network Monitoring Logs PSU 905.

Use of automated personal information analysis, personal information matching and knowledge discovery techniques - for the purposes of the Directive on PIA, government institutions are to identify those activities that involve the use of automated technology to analyze, create, compare, identify or extract personal information elements. Such activities would include personal information matching, record linkage, personal information mining, personal information comparison, knowledge discovery, information filtering or analysis. Such activities involve some form of artificial intelligence and/or machine learning to uncover knowledge (intelligence), trends/patterns or to predict behavior.

Risk to privacy: Yes

Details: The Benefit Data Mart is a subset of the Agency Data Warehouse (ADW); it collects data from the Individual Credit Database (ICD) and an authorized employee can run queries to find trends, statistics or other required information. Reports are created from the Benefit Data Mart on a set identified parameters and filters that are then used for analysis. A privacy impact assessment for the Agency Data Warehouse (ADW) including the Benefit Data Mart was published in 2007; it provides a broader privacy risk analysis of the ADW and the related data marts.

Data matching techniques are used to ensure the accuracy of the personal information and to ensure applicants continue to meet the eligibility and entitlement requirements for benefits and credits. Therefore, information is matched between the individual’s income tax account and benefits account. In addition, information that was provided by the individual is verified with other sources.

G) Personal information transmission

The personal information is transmitted using wireless technologies. It may also be transferred to a portable device or is printed.

Level of risk to privacy: 3

Details: Personal information can be used in a system that has access to other systems and can be transferred to a secure portable device encrypted using CRA approved encryption.

Some employees workstations are composed of CRA issued laptops in docking stations. Laptops comply to the Security for the Computing Environment Policy and utilize encryption technologies and access control. Any telework done is through Secure Remote Access (SRA).

H) Risk impact to the individual or employee

Financial harm

Details: If the personal information was compromised, it has the potential to cause financial harm and embarrassment to the affected individual. The affected individual may also become a victim of identity theft, and their information may be used without their knowledge or consent.

I) Risk impact to the institution

Reputation harm, embarrassment, loss of credibility

Details: Should this information be accidentally or deliberately disclosed or compromised, it could reasonably be expected to cause the CRA embarrassment, loss of credibility and decrease of public confidence.