EFILE Online Services
Individual Returns Directorate
Assessment, Benefit, and Service Branch
On this page
- Overview & Privacy Impact Assessment Initiation (PIA)
- Summary of the project, initiative or change
- Risk identification and categorization
Overview & Privacy Impact Assessment Initiation (PIA)
Government institution
Canada Revenue Agency
Government official responsible for the PIA
Frank Vermaeten
Assistant Commissioner
Assessment, Benefit, and Service Branch
Head of the government institution or Delegate for section 10 of the Privacy Act
Steven Morgan
Director General
Access to Information and Privacy Directorate
Name of program or activity of the government institution
Tax Services and Processing
Standard or institution specific class of record:
EFILE Online services
CRA ABSB 216
Standard or institution specific personal information bank:
EFILE Online Services
CRA PPU 211
TBS Registration Number: 20170136
Legal authority for program or activity
The legislative authority to evaluate prospective and existing electronic filers is subsection 150.1(2) of the Income Tax Act (ITA).
The legislative authority regarding mandatory electronic filing of individual income tax returns is subsection 150.1(2.3) of the ITA.
The legislative authority for the declaration for electronic filing is subsection 150.1(4) of the ITA.
Personal information is collected under the authority of section 220 of the ITA and the social insurance number (SIN) of each electronic filing applicant is collected pursuant to section 237 of the ITA and is used for identification purposes.
Summary of the project, initiative or change
Overview of the Program or Activity
EFILE is an automated web service that allows approved tax preparation service providers and discounters to send income tax return information to the Canada Revenue Agency (CRA) directly from EFILE-certified tax preparation software. The certification of software products takes place every year. Software products that will be used by electronic filing applicants to transmit returns using the EFILE web service are verified and tested to ensure they are compatible with the EFILE service, as well as to ensure any legislative changes are included in the final certified products.
Taxpayers may take their tax slips and supporting documents to a certified tax preparer, and for a fee, the tax preparer will prepare their return and send it to the CRA electronically using the EFILE web service. In addition, taxpayers can use the services available through the CRA’s Community Volunteer Income Tax Program to have their return prepared and sent to the CRA for free.
Suitability screening is the process of verifying the reliability of prospective and existing electronic filing applicants. It is conducted by the CRA every year before applicants are permitted to electronically file income tax returns on behalf of their clients. An EFILE applicant who meets and continues to meet the EFILE screening criteria may electronically file returns.
We also monitor the activities of electronic filers to ensure that they comply with our requirements.
Scope of the Privacy Impact Assessment
The scope of this Privacy Impact Assessment (PIA) covers the EFILE Online Services program for prospective and existing electronic filing applicants.
This PIA excludes the following:
- Discounters Program (as that is separate program from the EFILE Online Services program)
- NETFILE Service
- T1 Processing Program (the actual processing and assessment of T1 returns sent electronically)
- T2 Processing Program (the actual processing and assessment of T2 returns sent electronically)
- T3 Processing Program (the actual processing and assessment of T3 returns sent electronically)
- Certification of EFILE and NETFILE software products
Risk identification and categorization
A) Type of program or activity
Administration of Programs/Activity and Services
Level of risk to privacy: 2
Details:
The annual Screening of prospective and existing electronic filing applicants involves ensuring certain requirements are met and criteria are passed before access to EFILE Online services is granted. We use personal information provided by the electronic filing applicants on their online EFILE registration, account renewal and/or maintenance requests to determine if they meet these requirements and pass the Screening criteria.
B) Type of personal information involved and context
SIN, medical, financial or other sensitive personal information and/or the context surrounding the personal information is sensitive. Personal information of minors or incompetent individuals or involving a representative acting on behalf of the individual.
Level of risk to privacy: 3
Details:
Personal information collected during the EFILE Online registration, renewal or account maintenance processes includes sensitive personal informal information.
C) Program or activity partners and private sector involvement
With other or a combination of federal/provincial and/or municipal government(s).
Level of risk to privacy: 3
Details:
Information regarding electronic filing applicants may be solicited from and/or shared with other programs within the CRA.
As per signed information sharing agreements, limited personal information regarding electronic filing applicants located in the province of Québec may be shared with the province of Québec.
D) Duration of the program or activity
Long-term program
Level of risk to privacy: 3
Details:
The EFILE Online Services program is a long-term well-established program and thus has no expected end date in the foreseeable future.
E) Program population
The program affects certain individuals for external administrative purposes.
Level of risk to privacy: 3
Details:
This program affects the tax preparation community who use the suite of EFILE Online services, and by extension, their clients, taxpayers.
F) Technology & privacy
- Does the new or modified program or activity involve the implementation of a new electronic system, software or application program including collaborative software (or groupware) that is implemented to support the program or activity in terms of the creation, collection or handling of personal information?
Risk to privacy: No
- Does the new or modified program or activity require any modifications to IT legacy systems and/or services?
Risk to privacy: No
- Does the new or modified program or activity involve the implementation of one or more of the following technologies?
Enhanced identification methods - this includes biometric technology (i.e. facial recognition, gait analysis, iris scan, fingerprint analysis, voice print, radio frequency identification (RFID), etc.) as well as easy pass technology, new identification cards including magnetic stripe cards, "smart cards" (i.e. identification cards that are embedded with either an antenna or a contact pad that is connected to a microprocessor and a memory chip or only a memory chip with non-programmable logic).
Risk to privacy: No
Use of Surveillance - this includes surveillance technologies such as audio/video recording devices, thermal imaging, recognition devices, RFID, surreptitious surveillance/interception, computer aided monitoring including audit trails, satellite surveillance etc.
Risk to privacy: No
Use of automated personal information analysis, personal information matching and knowledge discovery techniques - for the purposes of the Directive on PIA, government institutions are to identify those activities that involve the use of automated technology to analyze, create, compare, identify or extract personal information elements. Such activities would include personal information matching, record linkage, personal information mining, personal information comparison, knowledge discovery, information filtering or analysis. Such activities involve some form of artificial intelligence and/or machine learning to uncover knowledge (intelligence), trends/patterns or to predict behavior.
Risk to privacy: Yes
Details:
We have the ability to track activities of electronic filing applicants with regard to the registration, renewal or account maintenance functions.
Use of automated personal information analysis, personal information matching and knowledge discovery techniques - for the purposes of the Directive on PIA, government institutions are to identify those activities that involve the use of automated technology to analyze, create, compare, identify or extract personal information elements. Such activities would include personal information matching, record linkage, personal information mining, personal information comparison, knowledge discovery, information filtering or analysis. Such activities involve some form of artificial intelligence and/or machine learning to uncover knowledge (intelligence), trends/patterns or to predict behavior.
Risk to privacy: Yes
Details:
Personal information matching and knowledge discovery techniques are used to ensure the correct account is updated, quality assurance, security, and trend analysis.
G) Personal information transmission
The personal information is transmitted using wireless technologies.
Level of risk to privacy: 4
Details:
Electronic filing applicants must register for, renew, and maintain their account information online.
Information received from electronic filing applicants during one of the available online options is stored securely in our computers and can only be accessed by CRA employees who have the approved access to those databases.
Employees working remotely access the CRA system using a secure connection.
H) Potential risk that in the event of a privacy breach, there will be an impact on the individual or employee
Details:
A privacy breach could expose individuals to identity theft, financial fraud, misuse of personal information, reputational damage, and emotional distress.