GST/HST Returns Rebates Processing Program - Privacy impact assessment summary

Business Returns Directorate
Assessment, Benefit, and Service Branch

Overview & PIA initiation

Government institution

Canada Revenue Agency

Government official responsible for the PIA

Frank Vermaeten
Assistant Commissioner
Assessment, Benefit, and Service Branch (ABSB)

Head of the government institution or Delegate for section 10 of the Privacy Act

Marie-Claude Juneau
Director
Access to Information and Privacy Directorate

Name of program or activity of the government institution

Tax Services and Processing

We give taxpayers the accurate and timely information they need to comply with Canada’s tax laws and modernize our services, including expanding our digital services, making it easier for taxpayers to meet their tax obligations. In addition to the individual returns program, we register businesses for a business number and administer T2, T3, GST/HST, excise, and other levies programs. We help businesses and individuals to voluntarily comply with Canada’s tax laws by processing their information and payments as quickly and accurately as possible and telling them the results of their assessment or reassessment. We also encourage and process voluntary disclosures by taxpayers and their representatives who want to correct inaccurate or incomplete information and pay their fair share.

Description of the class of record and personal information bank

Standard or institution specific class of record:
Administration of GST/HST Returns and Rebates
CRA ABSB 246

Standard or institution specific personal information bank:
GST/HST Returns and Rebates Program
TBS Registration: 000013
PIB number: CRA PPU 241

Legal authority for program or activity

• Part IX of the Excise Tax Act (ETA)
• Title I of the Act Respecting the Québec Sales Tax, chapter t-0.1 (ARQST)
• Tax Administration Act (Québec)
• Subsection 63(1) of the Canada Revenue Agency Act
• Section 7 of the Federal-Provincial Fiscal Arrangements Act
• The SIN is collected and used under the authority of Part IX of the Excise Tax Act. The SIN number is used for the purpose of validating the identity of individuals.

Summary of the project / initiative / change

Overview of the program or activity

The Goods and Services Tax (GST) is a commodity tax that applies to the supply of most property and services in Canada. The provinces of Nova Scotia, New Brunswick, Newfoundland and Labrador, Ontario, and Prince Edward Island (PEI), referred to as the participating provinces, harmonized their provincial sales tax with the GST to create the Harmonized Sales Tax (HST). Generally, the HST applies to the same base of property and services as the GST. Although a separate GST and provincial sales tax continues to be administered by the province of Quebec, CRA is responsible for administering any GST/HST and/or Quebec Sales Tax (QST) requirements for all selected listed financial institutions (SLFIs).

Consumers and businesses have to pay the GST/HST on purchases of taxable supplies of property and services (other than zero-rated supplies). A limited number of sales or supplies are exempt or zero-rated from GST/HST.

Although the consumer is the last in the supply chain that pays the tax, businesses are responsible for collecting and remitting the GST/HST on behalf of the government. Businesses that have a GST/HST registration number are called registrants.

Registrants collect/remit the GST/HST on applicable sales or purchases they make to operate their business. They can claim input tax credits to recover the GST/HST paid or payable on the purchases they use in their commercial activities.

GST/HST registrants must meet certain responsibilities. Generally, they must file returns on a regular basis, collect the tax on taxable supplies they make in Canada, and remit any resulting net tax owing.

There are various situations that entitle resident and non-resident individuals or businesses to a GST/HST rebate. In some cases, it is not necessary to be registered for the GST/HST. For instance, one may have paid the GST/HST in error on an exempt or zero-rated supply like on imported goods that will not be used or consumed in a participating province.

The CRA supports the GST/HST Returns and Rebates Program (GST/HST program) by performing the following activities:

• Ensures businesses who are required or elect to be registered for GST/HST are registered and that registration information is kept current
• Ensures selected listed financial institutions (SLFIs) who are required or elect to be registered for GST/HST and/or QST are registered, and that registration information is kept current
• Protects revenue and processes GST/HST and QST returns, rebates, elections, and remittances
• Processes payments , collects accounts receivable of overdue taxes, interest, and penalties
• Assesses entitlement to refund/rebate claims

The Business Returns Directorate (BRD) of the Assessment, Benefit, and Service Branch is responsible for the following activities related to the GST/HST program:

• Ensuring all business clients are registered accurately and efficiently, minimizing the burden of voluntary compliance
• Assessing and validating information filed for GST/HST returns, rebates and elections
• Accounting for all business programs including GST/HST
• Ensuring all GST/HST client data has been accurately captured
• Developing electronic processes to further ease the tax burden on Canadian businesses

The GST/HST Returns and Rebates Processing Division (GRRPD) of Business Returns Directorate (BRD) provides the central management framework for planning, processing, monitoring and reporting on the annual program activities in two tax centres (TCs). This functional support role includes, but is not limited to, providing policy development, program enhancements, system specifications, operational procedures, field communications, financial and budget oversight, quality assurance and program monitoring. The division is also involved in the analysis, design, development, and delivery of projects, and technological innovations including new and/or improved electronic services for GST/HST returns and rebates.

GRRPD works regularly with Revenu Québec and other areas of the CRA to ensure consistent GST/HST program delivery for Canadian businesses, organizations and individuals who claim rebates, including applicable GST/HST elections.

The GST/HST Returns Processing section within the GRRPD is responsible for ensuring that GST/HST returns are accurately processed, recorded, and assessed. Every year, our TCs receive over 7.5 million GST/HST returns that are filed by registrants to report the GST/HST for any given reporting period. GST/HST registrants have five methods to file a return: GST/HST NETFILE, GST/HST TELEFILE, GST/HST Electronic Data Interchange (EDI), GST/HST Internet File Transfer (GIFT), and paper.

The GST/HST Rebates Processing section is responsible for ensuring accurate processing and assessing of domestic rebates and foreign convention and tour operator rebates. Under Excise Tax legislation, certain individuals, foreign convention organizers, tour operators, businesses, federal government departments and Public Service Bodies (PSB) are eligible to submit a rebate claim for the recovery of the GST/HST paid on certain goods and services that have been purchased or leased.

The major rebate categories are new housing, new residential rental property, Public Service Bodies (PSBs), government, generals, foreign conventions, and tour operators. All GST/HST rebates are currently processed at the Sudbury and Summerside TCs with the exception of rebates for claimants in the Province of Québec, which are processed by Revenu Québec (RQ).

GST/HST Returns Processing and GST/HST Rebates Processing sections are also responsible for the processing of returns and rebates of QST. Under the Act Respecting the Québec Sales Tax (ARQST), SLFIs and businesses that would be SLFIs if Quebec was a harmonized province, are eligible to submit a return or claim a rebate for the recovery of the QST paid on certain goods and services that have been purchased or leased. A Memorandum of Understanding is in place between the federal government and the Government of Québec regarding CRA administration of these returns and rebates.

What’s new

• Given that Revenu Québec (RQ) administers the GST/HST in Quebec on behalf of the Canada Revenue Agency (CRA), Revenu Québec Administered GST accounts are currently not permitted to use My Business Account (MyBA) and Represent a client (RAC) for GST related services; this puts businesses in the province of Quebec at a disadvantage compared to those in the rest of the country.  In collaboration with CRA, Revenu Québec has expended their public facing application Mon Dossier to offer the same “view” and “update” services for the GST accounts they administer.  Also, Revenue Quebec has expanded their internal portals so that RQ employees can “view” accurate and up to date GST/HST information.  Existing data transfers between the CRA and Revenu Québec were insufficient therefore a web interface was developed using struts framework (controller).   The project will be implemented in the following stages:
  • For businesses (Phase #1 - November 2018)
    • Allow businesses to view the following GST/HST information online via RQ portals: business profile, returns filed, elections, account statements, rebates, payments and their breakdowns, information regarding objections and appeals, etc.
    • Create an internal portal for RQ officers, which displays the data viewed by the client, in order to provide better client service.
  • For businesses and individuals (Phase #2 - Target date: May 2020)
    • Allow businesses and individuals to generate their (initial and amended) GST/HST rebate applications online via the RQ portals.
    • Allow businesses and individuals to monitor the status of their rebate applications.
    • Update the internal RQ portal.
  • For businesses (Phase #3 - Target date: November 2021)
    • Allow businesses to generate their amended GST/HST returns online via the RQ portals.
    • Allow businesses monitor the status of their returns.
    • Update the internal RQ portal.
• CRA will be capturing the IP address for e-filed GST rebates, similar to the way that it is captured for GST34 returns for audit purposes.
• As part of promoting CRA’s web services, the GST/HST Rebates Processing section has expanded the existing electronic rebate filing options for individuals, by enhancing My Account (MyA) services to include an option to file the GST191 – New Housing Rebate for Owner-Built Houses rebate application.  This rebate application can now be submitted by individuals through MyA and Represent a Client (RAC). Once the data is entered in MyA it is transmitted to Rebates Document Capture (RBCAP) and the Rebates Processing System (RPS) for processing.

Scope of the privacy impact assessment

This privacy impact assessment (PIA) identifies and assesses privacy risks to personal information relating to the Goods and Services Tax / Harmonized Sales Tax Returns and Rebates Program (GST/HST program) activities. The following activities are administered by the Business Returns Directorate of the Assessment, Benefit, and Service Branch (ABSB): 

• GST/HST account registration
• Processing of GST/HST returns, rebate applications and various elections that are filed by businesses, organizations, third parties and individuals in regards to GST/HST collected and submitted by businesses and third parties and GST/HST paid by individuals and businesses where a rebate is applicable
• The administration of the GST and the Québec Sales Tax (QST) for selected listed financial institutions (SLFI) that have a permanent establishment in Québec as well as those that have a permanent establishment outside Québec, but do business in Québec
• Support web interface in order to action Revenu Québec web service requests to both GST suite of systems and other systems supporting GST program as per the various phases of the project.

This PIA does not cover activities pertaining to the GST/HST credit program that is available to individuals based on income thresholds and is issued every three months; those activities are administered by the Benefit Programs Directorate and are reflected in a separate PIA entitled GST/HST Credit and Related Benefits and Credits (file IC-080311).

This PIA also does not cover compliance activities either, those activities are administered by the Collections and Verification Branch and will be reflected in a separate PIA (PIA in progress).

Risk identification and categorization

A) Type of program or activity

Compliance / Regulatory investigations and enforcement

Level of risk to privacy: 3

Details: The personal information collected is used mainly for the administration of the GST/HST program (e.g. identification purposes, processing returns, rebates, and elections, collecting revenue, issuing payments, and providing support to clients) in order to determine the correct amount of GST/HST owing on the account and to prevent the issuance of unwarranted refunds and rebates.

During our select processes we link information from other revenue lines and/or programs to the information on a registrant’s GST/HST return. For example, when looking at a sole proprietor’s account, we gather the SIN and/or names to match from the T1 data, in order to compare them to the individual’s GST/HST account. In addition, the GST/HST program conducts limited reviews, and verifications/validations, and reassesses files (returns, rebate claims).

B) Type of personal information involved and context

Social insurance number, medical, financial or other sensitive personal information and/or the context surrounding the personal information is sensitive. Personal information of minors or incompetent individuals or involving a representative acting on behalf of the individual.

Level of risk to privacy: 3

Details: The GST/HST program relies on information collected to assess files (returns, rebate claims, and elections). Personal information collected from taxpayers includes details such as name, contact information, financial information and signature, in order to validate a person’s identity. Information is also collected verbally with questions in order to ensure the confidentiality test is passed, before discussing individual tax matters.

The SIN is used for identification purposes. For example, to properly identify a claimant in order to ensure eligibility for rebates such as: 

• Form GST191, New Housing Rebate Application for Owner-Built Houses
• Form GST524, New Residential Rental Rebate and
• Form GST189, General Rebate Application for GST/HST

The GST/HST program also collects financial information to complete requests for direct deposit of approved refund/rebate amounts. Direct deposit of credits owed is a service offered to clients.

C) Program or activity partners and private sector involvement

Private sector organizations or international organizations or foreign governments 

Level of risk to privacy: 4

Details: Information may be collected from and shared with participating provincial partners and other federal institutions. For example, Global Affairs Canada (GAC) provides monthly arrival/departure reports which lists the name, diplomat number, date of entry/exit, and country. We need this information to determine eligibility of GST/HST Rebate Applications for Foreign Representatives, Diplomatic Missions, Consular Posts, International Organizations, or Visiting Forces Units. For example, we need the date of entry/exit in the event the applicant submits a claim outside the eligibility period. We also require the applicant's country of origin as the reciprocal agreement varies, depending on the country. Global Affairs Canada (GAC) also validates/verifies addresses and spouse/dependants. If a client has a problem with their assessment, they often contact Global Affairs Canada (GAC) as an intermediary between themselves and CRA.

Information and procedures are also shared with Revenu Québec as they are responsible for administering the GST within the province of Quebec. 

Private sector involvement includes external third parties that may be used to identify or clarify missing information on GST/HST rebate applications. For example, a builder who credits a rebate amount to the home purchaser (claimant) at the time of purchase may be contacted to clarify details on the application that is subsequently submitted.

D) Duration of the program or activity: Long-term program

Long-term program

Level of risk to privacy: 3

Details: GST was established in 1991. The GST/HST program is an existing long-term program with no anticipated sunset date. Although certain return, rebate, or election types processed by CRA may be transitional in nature with an established sunset date, the program as a whole is long-term. 

E) Program population

The program affects certain individuals for external administrative purposes. 

Level of risk to privacy: 3

Details: The GST/HST program affects businesses and individuals, both registrants and non-registrants, who have filed or not filed (but may be required to) a return, rebate, or election related to the GST/HST program. 

F) Technology & privacy

Does the new or modified program or activity involve the implementation of a new electronic system, software or application program including collaborative software (or groupware) that is implemented to support the program or activity in terms of the creation, collection or handling of personal information?

Risk to privacy: No

Details: N/A

Does the new or modified program or activity require any modifications to IT legacy systems and/or services? 

Risk to privacy: Yes

Details: Following CRA standards, expansion of the GST NetFile application was required to provide aggregation services to action “view” and “update” web service request to both GST suite of systems and other systems supporting GST program using struts frameworks (controller). No updates to the GST Netfile TRA are necessary as a completed SA&A was done for RQ Webservices.

The new or modified program or activity involves the implementation of one or more of the following technologies: 

Enhanced identification methods

This includes biometric technology (i.e. facial recognition, gait analysis, iris scan, fingerprint analysis, voice print, radio frequency identification (RFID), etc...) as well as easy pass technology, new identification cards including magnetic stripe cards, "smart cards" (i.e. identification cards that are embedded with either an antenna or a contact pad that is connected to a microprocessor and a memory chip or only a memory chip with non-programmable logic).

Risk to privacy: No

Details: N/A

Use of Surveillance

This includes surveillance technologies such as audio/video recording devices, thermal imaging, recognition devices , RFID, surreptitious surveillance / interception, computer aided monitoring including audit trails, satellite surveillance etc.

Risk to privacy: Yes

Details: Audit trails were created for Revenu Québec’s users accessing CRA data via Revenu Québec’s internal user application.  Detailed activity logs were also created for all web services invoked by Revenu Québec.

Use of automated personal information analysis, personal information matching and knowledge discovery techniques

For the purposes of the Directive on PIA, government institutions are to identify those activities that involve the use of automated technology to analyze, create, compare, identify or extract personal information elements. Such activities would include personal information matching, record linkage, personal information mining, personal information comparison, knowledge discovery, information filtering or analysis. Such activities involve some form of artificial intelligence and/or machine learning to uncover knowledge (intelligence), trends/patterns or to predict behavior.

Risk to privacy: Yes

Details: GST/HST rebates processing activities involve an automated matching process via the rebate Claimant Selection List. This list is maintained in the mainframe rebates system to identify possible discrepancies or abuses within the program by matching Business Number, SIN, name, or postal code information.

Systems with algorithms are in place to identify accounts and perform matching exercises for the non-registrant workload.

The GST/HST program works with the Technology and Business Intelligence Directorate to complete the data matching selects in order to create work inventory.

This includes matching the sales amount reported on the registrant's GST/HST return to specified income reported on a person’s T1, T2, or T5018 slips. For example, match a sole proprietor’s GST/HST sales and other revenue information to the professional, commission, and/or business income reported on that individual’s T1 return.

G) Personal information transmission

The personal information is transmitted using wireless technologies.

Level of risk to privacy: 4

Details: Information received from taxpayers via hard copies is keyed directly into our mainframe system. Electronically filed returns, rebates and elections involve an Internet connection and information is transferred to our mainframe via a secure connection. Within the mainframe, there is an exchange of information between systems (e.g. Business Number, Standardized Accounting, and Audit systems). Headquarters staff have access to the mainframe on laptops encrypted with Secure Remote Access (SRA).

Specific to Revenu Québec Web service, infrastructure enhancements were completed in order to integrate the CRA and Revenu Québec systems to include a new method of secure data transfer for both view and update services (accurate and up-to-date GST/HST information to the Revenu Québec internal and external users and information (updates) from Revenu Québec external users). 

H) Risk impact to the individual or employee

Details: There could be a significant risk of financial harm to the individual should there be a breach of personal information. 

Impacts: 

• Loss (identify theft or fraud)
• Health (physiological and psychological)
• Reputation (hurt, humiliation or embarrassment)