Income Verification Services v 3.0

Policy, Planning, Partnerships and Reporting Directorate Service, Innovation and Integration Branch

On this page

Overview & Privacy Impact Assessment Initiation (PIA)

Government institution

Canada Revenue Agency

Government official responsible for the PIA

Maxime Guénette
Assistant Commissioner
Service, Innovation and Integration Branch

Head of the government institution or Delegate for section 10 of the Privacy Act

Lia Jackson
Access to Information and Privacy Directorate

Name of program or activity of the government institution

Tax Services and Processing

Standard or institution specific class of record:

Individual Returns and Payment Processing Program - CRA ABSB 217

Benefit Programs - Canada Child Benefits (CCB) and other Federal, Provincial and Territorial Programs and Supplements - CRA ABSB 646

Benefit Programs - Working Income Tax Benefit Program - CRA ABSB 346

Benefit Programs - Disability Tax Credit (DTC) Program Class of Record CRA ABSB 647

Standard or institution specific personal information bank:

Individual Returns and Payment Processing - CRA PPU 005

Disability Tax Credit - CRA PPU 218

Canada Child Benefits- CRA PPU 063

Working Income Tax Benefit - CRA PPU 178

Legal authority for program or activity

Section 241 of the Income Tax Act (ITA) allows the Canada Revenue Agency (CRA) to provide certain taxpayer information to any person (including a federal/provincial/territorial official) with the consent of the taxpayer.

Section 241(4)(n) of the ITA allows a CRA official to provide Taxpayer Information to any person for the purposes of the administration or enforcement of a law of a province that provides for workers' compensation benefits.

Section 241(4)(d)(viii) of the Income Tax Act (Canada) allows the CRA to provide certain taxpayer information to Veterans Affairs Canada for the purposes of the administration of the Canadian Forces Members and Veterans Re-establishment and Compensation Act;

The legal authority which allows the provincial/territorial/federal government department to collect personal information, and enter into an agreement with the CRA, is stipulated in each written collaborative arrangement.

Summary of the project, initiative or change

Overview of the Program or Activity

The Income Verification program is a partnership with other government departments to allow the CRA to send personal information directly to the partnered entity for the purpose of administering a local government’s benefit program or service. Government agencies across Canada administer programs and services to support the economic and social well-being of Canadians. Examples of programs may include: drug cost assistance, housing assistance, student loans and grants.

To access these income based programs and services an individual, known as an applicant, must apply directly with the other government department responsible for the provincial/territorial or federal program. Eligibility and/or entitlement value of the benefit or service is often based on the applicant’s family status (married, children, etc.), geographical location, and financial status.

The income verification process provides an opportunity for these federal, provincial/territorial, and municipal partners to electronically verify real-time eligibility and entitlement requirements for their income-tested programs. This real-time electronic verification allows benefits to reach vulnerable Canadians faster by significantly shortening the local processing timeframes.

In addition, the electronic verification decreases the CRA’s paper output by eliminating a taxpayer’s request for additional paper copies of CRA correspondence, such as the income tax and benefit return’s Notice of Assessment.

The other government department’s application process requires applicants seeking benefits or services to provide the other government program administrators details of their income and biographical data, such as family composition, to determine eligibility and/or entitlement. An example of income data may include, but is not limited to: working income, tuition claims, rent or property tax claimed.  

The CRA role:

As administrators and information holders of both the personal income tax and benefit return and the Canada Child Benefit, the CRA has partnered with provincial/territorial, municipal and federal government entities to streamline the applicants’ processing timelines by developing the electronic Income Verification process.     

The Process

The Applicant

The individual seeking benefits from another government partners program.

When applying for a program administered by one of these partner entities, the Applicant may choose to provide the requested income and biographical data directly to the other government program administrators.


the applicant provides consent to allow the other government entity to obtain the information direct from the CRA through the electronic Income Verification process.

Note: On occasion, a program’s legislation, such as that for Workers Compensation benefits, does not require the signed consent of the Applicant to request data from CRA for the administration of the program.

CRA Partners

A combination of provincial/territorial, municipal, and federal government entities.

When utilizing the Income Verification process, the other government partner entity electronically identifies the applicant and requests specific tax data from the CRA.


Electronically provides the requested income and biographical data directly to the partner program, shortening the application process and preventing the need for the applicant to provide additional paper documentation.

There are over 100 partner programs that have entered into agreement with the CRA to utilize the Income Verification process. The personal information provided by the CRA is customized to ensure that only the minimum number of data elements required to calculate the other government programs’ eligibility and entitlements are provided to each partner entity by the CRA.

No new information is collected or stored in CRA’s information holdings through the Income Verification program. 

Written collaborative arrangements are in place with each government entity to which the CRA provides income verification. Each agreement includes the legislation which allows the exchange, security standards for the handling, storage, and destruction of information, a copy of the CRA-approved consent, the listing of data fields which will be provided to the partner, the conditions and procedures for the provision of taxpayer information, conditions regarding retention and security, financial arrangements, and the designated officials from each partner and their roles and responsibilities. There is an internal audit and review clause included in each agreement, which stipulates that a periodic review must be conducted by the partner with respect to confidentiality and security of information provided by the CRA at least every ten years.

What’s New

New Income Verification partners have been added to the PIA to reflect new Provincial and Territorial programs to which the CRA has entered into agreement with to allow the program to utilize the Income Verification process.

Scope of the Privacy Impact Assessment

This Privacy Impact Assessment (PIA) focuses on the electronic income verification service provided by the CRA to federal, provincial, territorial, and municipal government departments with whom the agency has entered into partnership, allowing the other government entity to utilize the Income Verification process to administer a benefit program or service.

Excluded from the scope of this PIA are the established CRA programs that are the source of the information shared. These CRA source programs, such as the Individual Returns and Payment Processing, the Canada Child Benefit and Working Income Tax Benefit are covered under separate individual PIAs. The administration of the other government partner programs and services the CRA supports through the Income Verification process is not within the scope of this PIA.

Other government programs and initiatives that focus on income-based benefits and services are constantly evolving. Therefore, when a new partner or program is identified, this PIA will be reviewed and updated accordingly.

Risk identification and categorization

A) Type of program or activity

Administration of Programs / Activity and Services

Level of risk to privacy: 2


Personal information is provided to partners with whom the CRA has entered into a written collaborative agreement to establish eligibility for benefits or assistance.

B) Type of personal information involved and context

Social insurance number, medical, financial or other sensitive personal information and/or the context surrounding the personal information is sensitive. Personal information of minors or incompetent individuals or involving a representative acting on behalf of the individual. 

Level of risk to privacy: 3


Most of the information used in the context of income verification would fit into category 3 since it is personal information relating to an individual’s tombstone data (i.e., SIN, date of birth, address, marital status, etc.) and financial information.

C) Program or activity partners and private sector involvement

With other or a combination of federal/provincial and/or municipal government(s) 

Level of risk to privacy: 3


The exchange of taxpayer information occurs between the CRA and other provincial/territorial/federal government departments, the details of which are outlined in a written collaborative agreement.

D) Duration of the program or activity

Long-term program 

Level of risk to privacy: 3


The Income Verification process is a long term service. There is no clear “sunset” of the process, however individual transfers are terminated when a partners program or service ceases.

E) Program population

The program affects certain individuals for external administrative purposes.

Level of risk to privacy: 3


The program affects the applicants of the applicable provincial/territorial and federal income assistance programs.

F) Technology & privacy

  1. Does the new or modified program or activity involve the implementation of a new electronic system, software or application program including collaborative software (or groupware) that is implemented to support the program or activity in terms of the creation, collection or handling of personal information?

    Risk to privacy: No
  2. Does the new or modified program or activity require any modifications to IT legacy systems and/or services?

    Risk to privacy: No
  3. Does the new or modified program or activity involve the implementation of one or more of the following technologies?
    • Enhanced identification methods - this includes biometric technology (i.e. facial recognition, gait analysis, iris scan, fingerprint analysis, voice print, radio frequency identification (RFID), etc.) as well as easy pass technology, new identification cards including magnetic stripe cards, "smart cards" (i.e. identification cards that are embedded with either an antenna or a contact pad that is connected to a microprocessor and a memory chip or only a memory chip with non-programmable logic).

      Risk to privacy: No
    • Use of Surveillance - this includes surveillance technologies such as audio/video recording devices, thermal imaging, recognition devices, RFID, surreptitious surveillance/interception, computer aided monitoring including audit trails, satellite surveillance etc.

      Risk to privacy: No
    • Use of automated personal information analysis, personal information matching and knowledge discovery techniques - for the purposes of the Directive on PIA, government institutions are to identify those activities that involve the use of automated technology to analyze, create, compare, identify or extract personal information elements. Such activities would include personal information matching, record linkage, personal information mining, personal information comparison, knowledge discovery, information filtering or analysis. Such activities involve some form of artificial intelligence and/or machine learning to uncover knowledge (intelligence), trends/patterns or to predict behavior.

      Risk to privacy: Yes

G) Personal information transmission

The personal information is transferred to a portable device or is printed.

Level of risk to privacy: 3


Personal information is pulled from the CRA’s mainframe system and is sent to the partner organization using file transfer protocol with Entrust encryption software.

Personal information can be used in a system that has access to other systems and can be transferred to a secure portable device encrypted using CRA approved encryption.

H) Potential risk that in the event of a privacy breach, there will be an impact on the individual or employee


If the personal information is compromised, it has the potential to cause financial harm and embarrassment to the affected individual. The affected individual may also become a victim of identity theft, and their information may be used without their knowledge or consent.

Page details

Date modified: