Disability Tax Credit Program v2.0

Assessment, Benefit, and Service Branch
Disability, Indigenous, and Benefits Outreach Services Directorate 

On this page

• Overview & Privacy Impact Assessment Initiation (PIA)
• Summary of the project, initiative or change
• Risk identification and categorization

Overview & Privacy Impact Assessment (PIA) Initiation 

Government institution

Canada Revenue Agency

Government official responsible for the PIA

Gillian Pranke
Assistant Commissioner
Assessment, Benefit, and Service Branch

Head of the government institution or Delegate for section 10 of the Privacy Act

Lia Jackson
Director
Access to Information and Privacy Directorate

Name of program or activity of the government institution

Benefits

The Assessment, Benefit, and Service Branch (ABSB)  delivers a range of ongoing benefits, credits, and one-time payment programs that support the economic and social well-being of Canadians. Through processing and validation activities, ABSB makes sure that Canadians receive their rightful benefits and credits in a timely manner. We offer benefit recipients and taxpayers timely and accessible information on their entitlements and obligations through our call centres and securely online, which helps Canadians become more aware of the benefits and credits they are eligible for and how to receive them.

Standard or institution specific class of record:

Disability Tax Credit (DTC) Program
CRA ABSB 647

Standard or institution specific personal information bank:

Disability Tax Credit (DTC) Program
CRA PPU 218
TBS Registration Number: 20090478

Legal authority for program or activity

Income Tax Act

• Sections 118.3 and 118.4 establish the framework for the DTC.
• Section 220(1) states that the Minister will administer and enforce this Act and the Commissioner of Revenue may exercise all the powers and perform the duties of the Minister under this Act.
• Personal information is collected under the authority of section 220.
• Section 237 provides the authority to collect and use the social insurance number for identification purposes.

Canadian dental dare plan

• The CRA will provide personal taxpayer information to Employment and Social Development Canada so that department can administer and enforce the Canadian dental care plan as authorized through section 241(4)(d)(xx.1) of the Income Tax Act.

Canada Revenue Agency Act

• Section 61 states that subject to sections 63 and 65, the Agency may enter into contracts, agreements, or other arrangements with governments, public or private organizations, and agencies, or any person in the name of His Majesty in right of Canada or in its own name.

Summary of the project, initiative or change

Overview of the Program or Activity

The disability tax credit (DTC) is a non-refundable tax credit that helps people with disabilities or their supporting family member reduce the amount of income tax they may have to pay.

Individuals who have a severe and prolonged impairment may apply for the credit. Once approved, they may claim the credit at tax time.

By reducing the amount of income tax that people with disabilities may have to pay, the DTC aims to offset some of the extra costs related to the impairment.

Individuals may be eligible for the DTC if a medical practitioner certifies they have a severe and prolonged impairment in physical or mental functions or receive therapy to support a vital function.

The person with the impairment or their legal representative can apply for the DTC by completing Form T2201, Disability Tax Credit Certificate, and having it certified by one of the following medical practitioners: medical doctor, nurse practitioner, optometrist, audiologist, occupational therapist, physiotherapist, psychologist, or speech-language pathologist.

DTC eligibility opens the door to other programs, such as the registered disability savings plan, Canada workers benefit disability supplement, and child disability benefit. 

What’s New

One-time payment

The CRA sent identification and contact information for individuals eligible for the DTC in the 2020 tax year to Employment and Social Development Canada (ESDC). It did this so ESDC could administer the one-time payment to persons with disabilities. This payment is a COVID-19 relief measure authorized through section 241(4) h.1 of the Income Tax Act.

Canadian dental care plan

The Canadian dental care plan (CDCP) is intended to help ease financial barriers to accessing oral health care for eligible Canadian residents who:

• have an annual adjusted family net income of less than $90,000, and
• don’t have access to dental insurance

As of May 2024, individuals with a valid DTC are eligible for the CDCP.

ESDC administers the CDCP on behalf of Health Canada. The CRA will help ESDC administer the plan by confirming the applicants’ DTC eligibility for the tax year through a secure data exchange.

Enrolment for the CDCP will be expanded to the full population in 2025 so the CRA will no longer share DTC eligibility indicators after that.

Fully digital DTC application

The CRA launched a fully digital DTC application process in May 2023 that allows the applicant and medical practitioner to digitally submit their portion of the application.

Applicants can fill out Part A in the My Account or Represent a Client secure portals. They can also fill it out with the support of a CRA contact centre agent or by using the automated interactive voice response service. Once they complete it, the individual will receive a reference number to give to their medical practitioner.

The DTC database (within the Agency Data Warehouse) stores the Part A information until the medical practitioner fills out Part B. Individuals can view the status of their application using the progress tracker in My Account.

Using the individual’s reference number, medical practitioners can complete Part B through the digital application for medical practitioners on Canada.ca. Once the medical practitioner certifies the form, the digital application automatically submits the form to the CRA. Once submitted, the information from Part B is matched to Part A in the DTC database. The combined information is converted into a single PDF that is stored in FileNet.

The current retention period for paper and electronic copies of completed T2201 forms and related disability information is 10 years past the date of death. At this time, there is no specified retention period for the DTC database. The database was created to house the information submitted through the digital application process. It stores biographical data collected about the person with the disability, claimants, and the medical practitioner.

Scope of the Privacy Impact Assessment

This PIA assesses the privacy implications for the application and determination process for the DTC program. It includes the:

• information and processes involved in determining whether a person is eligible for the DTC, and
• compliance activities for enforcement purposes, such as working with the Leads program in the Compliance Programs Branch to detect fraud or investigate possible abuses within the program

These activities are not included in the scope of this program:

• certain compliance activities, such as audits and criminal investigations, since they are separate programs. and
• the process of calculating and claiming the disability amount on the tax return 

The ABSB will review this PIA annually.

Risk identification and categorization

A) Type of program or activity

Compliance / Regulatory investigations and enforcement 

Level of risk to privacy: 3

Details:

The CRA uses personal information to identify, determine, and validate, of the payment of benefits and credits. It also uses the information to determine whether an individual knowingly participated in or made a false statement or omission. The consequences can include reviews that may result in terminating the benefits or recovering them and possibly charging civil penalties under section 163(2) of the Income Tax Act.

Also, in limited cases, the CRA could use the information obtained during the course of a validation or compliance review to refer the matter to the CRA’s Criminal Investigations Program for further investigation. An investigation could result in criminal charges under section 238 or section 239 of the Income Tax Act against a particular individual. We did not include the activities of the CRA’s Criminal Investigations Program in the scope of this PIA.

B) Type of personal information involved and context

Social insurance number, medical, financial or other sensitive personal information and/or the context surrounding the personal information is sensitive. Personal information of minors or incompetent individuals or involving a representative acting on behalf of the individual. 

Level of risk to privacy: 3

Details:

Personal information collected includes details such as name, contact information, gender, social insurance number (SIN), signature, marital status, medical information on physical or mental impairments, and a medical practitioner’s signature and contact information.

In addition, the information may include the personal information of minors and other vulnerable populations (in care of the Public Guardian and Trustee or a Child Services Agency).

C) Program or activity partners and private sector involvement

Private sector organizations or international organizations or foreign governments

Level of risk to privacy: 4

Details:

The program includes the application process to determine if a person with a disability is eligible for the disability tax credit. The CRA passes information on eligibility for the disability tax credit to federal, provincial and territorial, and municipal partners so those partners can accurately calculate or evaluate programs.

Also, the CRA uses the information internally for audit activities, appeals, statistical gathering and analysis, and responses to call centre enquiries.

A private-sector third party under contract with the CRA stores any paper copies containing personal information.

D) Duration of the program or activity

Long-term program 

Level of risk to privacy: 3

Details:

The disability tax credit is a long term program with no sunset date.

E) Program population

The program affects certain individuals for external administrative purposes.

Level of risk to privacy: 3

Details:

The program affects individuals who apply for the disability tax credit as well as their spouse or common-law partner, dependents, supporting family members, authorized representatives, and eligible children under 18 years of age.

F) Technology & privacy

1. Does the new or modified program or activity involve the implementation of a new electronic system, software or application program including collaborative software (or groupware) that is implemented to support the program or activity in terms of the creation, collection or handling of personal information?

   Risk to privacy: Yes

2. Does the new or modified program or activity require any modifications to IT legacy systems and/or services?

   Risk to privacy: Yes

3. Does the new or modified program or activity involve the implementation of one or more of the following technologies?

Enhanced identification methods - this includes biometric technology (i.e. facial recognition, gait analysis, iris scan, fingerprint analysis, voice print, radio frequency identification (RFID), etc.) as well as easy pass technology, new identification cards including magnetic stripe cards, "smart cards" (i.e. identification cards that are embedded with either an antenna or a contact pad that is connected to a microprocessor and a memory chip or only a memory chip with non-programmable logic).

Risk to privacy: No

Use of Surveillance - this includes surveillance technologies such as audio/video recording devices, thermal imaging, recognition devices, RFID, surreptitious surveillance/interception, computer aided monitoring including audit trails, satellite surveillance etc.

Risk to privacy: No

Use of automated personal information analysis, personal information matching and knowledge discovery techniques - for the purposes of the Directive on PIA, government institutions are to identify those activities that involve the use of automated technology to analyze, create, compare, identify or extract personal information elements. Such activities would include personal information matching, record linkage, personal information mining, personal information comparison, knowledge discovery, information filtering or analysis. Such activities involve some form of artificial intelligence and/or machine learning to uncover knowledge (intelligence), trends/patterns or to predict behavior.

Risk to privacy: Yes

G) Personal information transmission

The personal information is transmitted using wireless technologies.

Level of risk to privacy: 4

Details:

Personal information can be used in a system that has access to other systems and can be transferred to a secure portable device encrypted using CRA approved encryption.

The CRA assigns its employees a CRA-issued laptop and docking station.  Laptops comply with the Security for the Computing Environment Policy and use encryption technologies and access control. Employees working from a designated workplace and any telework is done through secure remote access.

The applicant submits Part A of the digital application in My Account. The medical practitioner submits Part B online through the web. The practitioner uses a unique code to fill out Part B online and, once submitted, the DTC database links Part B to Part A.

H) Potential risk that in the event of a privacy breach, there will be an impact on the individual or employee

Details:

If the personal information and medical information about the individual’s impairment was compromised, the information has the potential to cause financial harm and embarrassment to the affected individual. The affected individual may also become a victim of identity theft and their information may be used without their knowledge or consent.