Income Verification Services v4.0

Service, Innovation and Integration Branch
Partnerships Directorate

On this page

• Overview & Privacy Impact Assessment Initiation (PIA)
• Summary of the project, initiative or change
• Risk identification and categorization

Overview & Privacy Impact Assessment (PIA) Initiation 

Government institution

Canada Revenue Agency

Government official responsible for the PIA

Frank Pagnotta
Director General
Partnerships Directorate
Service, Innovation and Integration Branch

Head of the government institution or Delegate for section 10 of the Privacy Act

Lia Jackson
Director
Access to Information and Privacy Directorate
Public Affairs Branch

Name of program or activity of the government institution

Tax Services and Processing
Benefits

Standard or institution specific class of record

Individual Returns and Payment Processing Program - CRA ABSB 217
Benefit Programs - Canada Child Benefits (CCB) and other Federal, Provincial and Territorial Programs and Supplements - CRA ABSB 646
Benefit Programs - Working Income Tax Benefit Program - CRA ABSB 346
Benefit Programs - Goods and Services Tax / Harmonized Sales Tax Credit (GST/HST credit) and Related Benefits and Credits - CRA ABSB 648

Standard or institution specific personal information bank

Individual Returns and Payment Processing (CRA PPU 005)
Canada Child Benefits (CRA PPU 063)
Working Income Tax Benefit (CRA PPU 178)
Goods and Services Tax / Harmonized Sales Tax Credit (GST/HST credit) and related benefits and credits (CRA PPU 140)

Legal authority for program or activity

Section 241 of the Income Tax Act allows the Canada Revenue Agency (CRA) to provide certain taxpayer information to any person (including a federal or provincial/territorial official, as well as a municipal employee).

Paragraph 241(4)(n) of the Income Tax Act allows a Canada Revenue Agency (CRA) official to provide taxpayer information to any person solely for the purposes of the administration or enforcement of a law of a province that provides for workers' compensation benefits.

Subparagraph 241(4)(d)(viii) of the Income Tax Act allows the CRA to provide certain taxpayer information to an official of the Department of Veterans Affairs Canada solely for the purposes of the administration of the War Veterans Allowance Act, the Veterans Well-being Act or Part XI of the Civilian War-related Benefits Act.

Subsection 241(5) of the Income Tax Act allows a CRA official to provide taxpayer information to any person (including a federal, provincial/territorial, and municipal official), with the consent of the taxpayer. A federal, provincial/territorial, or municipal partner provides the CRA with information to validate the identity of an individual within the CRA’s databanks: first name, last name, social insurance number and date of birth. In order for the CRA to get a high accuracy rating, a combination of the social insurance number and two of the three other criteria must match before any personal information is disclosed.

The legal authority which allows a federal, provincial/territorial, or municipal government organization to collect personal information, and enter into an agreement with the CRA, is stipulated in each written collaborative arrangement.

Summary of the project, initiative or change

Overview of the Program or Activity

The Income Verification Program is a partnership with other government organizations to allow the CRA to send personal information directly to a partnered entity for the purpose of administering a local government’s program or service. Government agencies across Canada administer programs and services to support the economic and social well-being of Canadians. Examples of program benefits include: drug cost assistance, housing assistance, and student loans and grants. Since the last PIA update, programs such as the Ontario Seniors Dental Care Program, the Fertility Treatment Program, and the Oil to Electric Incentive Program were added.

To access income-based programs and services, an individual (applicant), must apply directly to the government organization responsible for the federal, provincial/territorial, or municipal program. The eligibility and/or entitlement value of the income-tested benefit or service is often based on the applicant’s family status (married, children, etc.), geographical location (province/territory of residence, mailing address, etc.), and financial status (total income, employment income, etc.).

The income verification process provides an opportunity for federal, provincial/territorial, and municipal partners to electronically verify real-time eligibility and entitlement requirements for their income-tested programs. This real-time automated verification allows benefits to reach eligible Canadians faster, by significantly shortening the local processing time frames.

In addition, automation decreases the CRA’s paper output by eliminating potential taxpayer requests for more paper copies of a CRA document, such as a notice of assessment or proof of income.

The other government organization’s application process requires an applicant seeking benefits or services to provide its program administrators with details of the applicant’s income and biographical data, such as family composition, to determine eligibility and/or entitlement. Eligibility and entitlement information related to the Canada child benefit, goods and services tax / harmonized sales tax credit, and advanced Canada workers benefit may also be shared as required. An example of income data may include, but is not limited to: working income, tuition claims, disability tax credit claims, and rent or property tax claimed.

CRA role

The CRA acts as administrator and information holder for the following:

• Individual Returns and Payment Processing Program
• Canada Child Benefits Program
• Advanced Canada Workers Benefit Program
• Goods and Services Tax / Harmonized Sales Tax Credit Program

The CRA has partnered with federal, provincial/territorial, and municipal government entities to streamline the external partners applicants’ processing timelines by providing an automated income verification process.

Process

The applicant is the individual seeking benefits or services from another government partner’s program.

When applying under a program administered by one of the partner entities, the applicant may choose to provide the requested income and biographical data directly to the other government program administrator.

Or

The applicant provides consent to allow the other government entity to obtain the information directly from the CRA through the automated income verification process.

Note

On occasion, a program’s legislation, such as that for workers compensation benefits, does not require the signed consent of the applicant to request data from the CRA for the administration of the program.

CRA partners

The CRA partners are federal, provincial/territorial, and municipal government entities.

When using the income verification process, the other government partner electronically identifies an applicant and asks for specific tax and benefit data from the CRA to administer one or more programs.

CRA

The CRA electronically provides requested income and biographical data directly to a partner program, shortening the application process and preventing the need for an applicant to provide more paper documentation.

There are over 100 partner programs that have entered into agreements with the CRA to use its income verification process. The personal information provided by the CRA is customized to ensure that only the minimum number of data elements required to calculate the other government programs’ eligibility and entitlements are provided to each partner entity by the CRA.

No new information is collected or stored in the CRA’s information holdings through the Income Verification Program.

Written collaborative arrangements are in place with each government entity to which the CRA provides income verification services. Each agreement includes:

• the legislation that provides for the exchange
• security standards for the handling, storage, and destruction of information
• a copy of the CRA-approved consent
• the listing of data fields that will be provided to the partner
• the conditions and procedures for the provision of taxpayer information
• conditions regarding retention and security
• financial arrangements
• the designated officials of each partner and their roles and responsibilities

There is an internal audit and review clause included in each agreement. The clause states in which situation a partner may do a review, on a risk-based approach, at a mutually agreed time, should the partner believe an internal audit is required.

What’s New

New income verification partners have been added to the program at the federal and municipal levels, and some exchanges with provincial partners have sunset.

Administrative changes resulting from external organization restructuring have resulted in amendments to partner government organization titles, as well as amendments to written collaborative agreements.

The goods and services tax / harmonized sales tax (GST/HST) credit quarterly entitlement amount is now disclosed to the Northwest Territories Department of Education, Culture and Employment to determine eligibility and entitlement for their income assistance program. The GST/HST credit is a tax-free quarterly payment that helps individuals and families with low and modest incomes offset the GST/HST that they pay. 

Scope of the Privacy Impact Assessment

This privacy impact assessment (PIA) focuses on the automated income verification service provided by the CRA to federal, provincial/territorial, and municipal government entities with whom the CRA has entered into a written agreement, allowing the other entity to use the income verification process to administer their income-tested program or service. Most recently, the CRA has developed income verification written collaborative agreements with municipalities that have approached the CRA to participate in the income verification process.

Excluded from the scope of this PIA are the established CRA programs that are the source of the information shared. These CRA source programs, such as the Individual Returns and Payment Processing Program, Canada Child Benefits Program, Working Income Tax Benefit Program, and Goods and Services Tax / Harmonized Sales Tax Credit Program are covered under separate individual PIAs. The administration of the other government partner programs and services the CRA supports through the income verification process is not within the scope of this PIA. That administration is in other PIAs specific to their programs.

Other government programs and initiatives that focus on income-based benefits and services are constantly evolving. So when a new partner or program is identified, this PIA will be reviewed and updated accordingly.

Risk identification and categorization

A) Type of program or activity

Administration of Programs / Activity and Services 

Level of risk to privacy: 2

Details:

Personal information is provided to partners with whom the CRA has entered into a written collaborative agreement to establish eligibility for benefits or assistance.

B) Type of personal information involved and context

Social insurance number, medical, financial or other sensitive personal information and/or the context surrounding the personal information is sensitive. Personal information of minors or incompetent individuals or involving a representative acting on behalf of the individual.

Level of risk to privacy: 3

Details:

Most of the information used in the context of income verification would fit into category 3 since it is personal information relating to an individual’s tombstone data (that is, social insurance number, date of birth, address, marital status, etc.) and financial information.

C) Program or activity partners and private sector involvement

With provincial and/or territorial and/or indigenous and/or municipal government(s)

Level of risk to privacy: 3

Details:

The exchange of taxpayer information occurs between the CRA and other federal, provincial, territorial, and municipal government organizations, the details of which are outlined in a written collaborative agreement.

D) Duration of the program or activity

Long-term program

Level of risk to privacy: 3

Details:

The exchange of taxpayer information occurs between the CRA and other federal, provincial, territorial, and municipal government organizations with the consent of the taxpayer or as authorized by legislation. The duration of other government partnership programs varies by organization. The CRA Income Verification Services Program is a long-term program with no established end date.

E) Program population

The program affects certain individuals for external administrative purposes.

Level of risk to privacy: 3

Details:

The program affects the applicants of the applicable federal, provincial, territorial, and municipal programs.

F) Technology & privacy

1. Does the new or modified program or activity involve the implementation of a new electronic system, software or application program including collaborative software (or groupware) that is implemented to support the program or activity in terms of the creation, collection or handling of personal information?
   Risk to privacy: No
2. Does the new or modified program or activity require any modifications to IT legacy systems and/or services?
   Risk to privacy: No
3. Does the new or modified program or activity involve the implementation of one or more of the following technologies?
4. Enhanced identification methods - this includes biometric technology (i.e. facial recognition, gait analysis, iris scan, fingerprint analysis, voice print, radio frequency identification (RFID), etc.) as well as easy pass technology, new identification cards including magnetic stripe cards, "smart cards" (i.e. identification cards that are embedded with either an antenna or a contact pad that is connected to a microprocessor and a memory chip or only a memory chip with non-programmable logic).
   Risk to privacy: No
5. Use of Surveillance - this includes surveillance technologies such as audio/video recording devices, thermal imaging, recognition devices, RFID, surreptitious surveillance/interception, computer aided monitoring including audit trails, satellite surveillance etc.
   Risk to privacy: No
6. Use of automated personal information analysis, personal information matching and knowledge discovery techniques - for the purposes of the Directive on PIA, government institutions are to identify those activities that involve the use of automated technology to analyze, create, compare, identify or extract personal information elements. Such activities would include personal information matching, record linkage, personal information mining, personal information comparison, knowledge discovery, information filtering or analysis. Such activities involve some form of artificial intelligence and/or machine learning to uncover knowledge (intelligence), trends/patterns or to predict behavior.
   Risk to privacy: Yes

G) Personal information transmission

The personal information is transmitted using wireless technologies.  

Level of risk to privacy: 4

Details:

Personal information is pulled from the CRA’s mainframe system and is sent to the partner organization electronically using Government of Canada-approved encryption technologies.

Personal information can be used in a system that has access to other systems and can be transferred to a secure portable device encrypted using CRA approved encryption.

Some employees work on the CRA issued laptops and utilize agency-issued cell phones. Laptops and cell phones comply to the government of Canada’s encryption and security standards. Any telework done is through secure remote access (SRA).

H) Potential risk that in the event of a privacy breach, there will be an impact on the individual or employee

Details:

If the personal information is compromised, it has the potential to cause financial harm and embarrassment to the affected individual. The affected individual may also become a victim of identity theft, and their information may be used without their knowledge or consent.