Privacy Impact Assessment Summary - Charities - Public Safety and Anti-Terrorism

Privacy Impact Assessment (PIA) summary - Individual Returns Directorate, Assessment, Benefit, and Service Branch

Overview & PIA Initiation

Government institution

Canada Revenue Agency

Government official responsible for the PIA

Clément Bouchard
Director General, Individual Returns Directorate, Assessment, Benefit, and Service Branch

Head of the government institution or Delegate for section 10 of the Privacy Act

Marie-Claude Juneau
ATIP Coordinator

Name of program or activity of the government institution

Individual Returns and Payment Processing\

Description of the class of record and personal information bank

Standard or institution specific class of record:
Individual Returns and Payment Processing Program (CRA ABSB 217) - previously (CRA ABSB 126)

Standard or institution specific personal information bank:
Individual Returns and Payment Processing (CRA PPU 005)

Legal authority for program or activity

The Minister of National Revenue has a mandate (the words used in subsection 220(1) of the Income Tax Act are: "The Minister shall") to administer and enforce the Income Tax Act and Part IX of the Excise Tax Act. It is implicit that the Minister must collect information to carry out this mandate. While there are specific reporting obligations for taxpayers and others such as, for example, financial institutions and employers, in the two Acts, and while there are specific audit and inspection powers in the two acts, (e.g., section 231.1 of the Income Tax Act provides the authority for the CRA to inspect the books and records of an individual) there is no generally worded provision in either statute that authorizes the Minister to collect the information needed to carry out the Minister's mandate. But, in cases of non-compliance with the statutes, it is clear that the Minister will need information from other sources to carry out his mandate with the tax laws and the authority of the Minister to collect such information is therefore implicit and flows from the mandate itself.

Note: Section 7 of the Federal-Provincial Fiscal Arrangements Act, provides the authority for the Minister or the Minister of National Revenue, with the approval of the Governor in Council, to enter into an administration agreement with the government of a province or an aboriginal government on behalf of the Government of Canada. Section 67 of the Newfoundland and Labrador Income Tax Act specifies that section 220 of the federal Income Tax Act applies for the purpose of the provincial Act.

Summary of the project / initiative / change

The CRA administers tax, credits and benefit programs on behalf of the agreeing provinces and territories to provide better service to taxpayers and governments. The responsibility of the provincial compliance activities is shared by several branches with the CRA.

The Supplementary Examination and Programs Analysis Section (SEPAS), Assessment Reviews and Adjustments Division (ARAD), Individual Returns Directorate, Assessment and Benefits Services Branch, is functionally responsible for the T1 Province of Residency Review workload.

The T1 Province of Residence Review involves the examination of a number of assessed T1 returns that meet certain criteria.

Goals:

To increase voluntary compliance of residents;

• To determine the extent of income tax leakage out of province;
• To identify additional review areas that require further analysis with respect to residents of a specific province filing tax returns in other provinces.

Objectives:

• To identify taxpayers who file in a different province from their residence in an attempt to benefit from lower provincial tax rates;
• To review taxable income and determine the correct amount of provincial/territorial tax payable; and
• To examine provincial/territorial tax credits and claims to determine validity;
• To ensure that individuals who are resident in a province on the last day of taxation year, or had income earned in the taxation year in a province as determined in accordance with Regulation 2600 of the Income Tax Act, filed an income tax return in that province.

Current process:

The SEPA Section in Headquarters (HQ) provides each tax centre with two different types of account listings (i.e., cyclical and non-cyclical listings) containing files that have been pre-selected for provincial residency review. The accounts on the listings are selected based on a set of criteria developed by HQ to identify files with indications of potential provincial residency issues. The field staff selects a prescribed number of files to be reviewed from among those shown on the lists for their tax centre (TC).

The cyclical listings are paper generated and sent to the TCs by Information Technology Branch (ITB) HQ after each Daily Assessing System (DAS) run. There are approximately 55 cyclical lists generated per TC for review each year. There are certain exclusions built into the criteria to filter out any returns filed in the correct province which have circumstances that would otherwise cause them to be unnecessarily selected for review.

The non-cyclical listing is electronically generated only once per year. This listing is created by ITB HQ and identifies potential cases on a national basis. This list is sorted by TC and sent electronically to HQ for distribution to the appropriate offices. Once received, the field staff in each TC selects the prescribed number of files to be reviewed. Similar to the cyclical listing, certain exclusions are built into the criteria to filter out any returns filed in the correct province which have circumstances that would otherwise cause them to be unnecessarily selected for review.

Additional process:

The province of Newfoundland and Labrador has expressed a growing concern with the residency status of some Canadian taxpayers, who may file their return as a resident of one province, but get their services from another province. The Tax Collection Agreements commit the CRA to making a reasonable effort to counter false claims of residency.

This PIA is meant to address a new arrangement whereby the Province of Newfoundland and Labrador would provide us with additional information that the CRA would use in conjunction with our existing processes. The CRA does not have the resources to review all cases and risk assessment techniques are used to identify cases that represent the highest non-compliance risk. The information received from the province will greatly enhance the efficiency of the T1 residency review program and will allow the CRA to more effectively utilize its financial resources on cases where the risk of non-compliance is higher. This information is not currently available to the CRA.

If an individual is on the list from the province and indicated on their tax return that they were a resident of another province that could lead the CRA to contact the individual for clarification.

Only the Compliance Business Solutions Section (CBSS), Technology Support Division (TSD), Business Transformation and Corporate Management Directorate (BTCMD), Compliance Programs Branch, (also known as the Compliance Lab) will have access to the information provided by the province of Newfoundland and Labrador (NL). SEPAS will receive the result of the Compliance Lab’s analysis of the information received from NL, as a list of social insurance numbers of taxpayers to be potentially reviewed to assist in determining the correct province of residence for tax purposes.

The PIA was initiated because the CRA will receive personal information from the province of Newfoundland and Labrador.

The province of Newfoundland and Labrador will provide the CRA (the Compliance Lab) with identification information for all NL public health insurance registrants who used their NL health cards in a specific period of time (year), and who were still registrants at the end the corresponding period (year). The NL will provide the information in Excel format on an encrypted CD.

The Compliance Lab will compare the names of taxpayers provided by NL with the CRA T1 assessment system to identify each individual by his/her social insurance number and thus enable comparison of the use of the NL healthcare system with the province of residence identified on the T1 Income Tax and Benefits Returns.

The result of the Compliance Lab data analysis will be a list of social insurance numbers of taxpayers that may have incorrectly identified and reported their province of residence in a specific fiscal year. The list will be in Excel format and it will be saved in a SEPAS shared drive. Once this list has been compiled, the Compliance Lab will delete from the original information received from the province, all data that relates to taxpayers who have correctly identified their province of residence in their income tax return.

The access to the SEPAS shared drive containing the national list (the result of CPB Lab analysis will be a list of SINs) will be restricted to 2-3 SEPAS officers, as well as 2 officers in each applicable tax centre in order to risk assess, open, and monitor the T1 Provincial Residency review cases. The tax centre officers will have access only to their regional list, on a need to know basis.

To facilitate the Compliance Lab analysis, the NL Department of Finance will provide the following identification information to the CRA:

• Registrant’s first name, middle name, surname and maiden name(if applicable);
• Registrant’s date of birth;
• Registrant’s gender;
• Registrant’s home and mailing address (street and postal code); and

An indication (a YES/NO indicator) of whether the NL medical card was used in NL during the year(s).  The CRA will take all the necessary steps to protect the security and confidentiality of information provided by the NL Department of Finance against unauthorized access, use or disclosure. The information will be used only for the purpose identified in the Letter of Intent between the CRA and the province of Newfoundland and Labrador, in accordance with existing CRA security and privacy standards. Furthermore, after an initial data match has identified taxpayers who may have incorrectly identified their province of residence in their income tax return, all information related to other taxpayers will be deleted by the Compliance Lab.

The province will provide the registrant identification information at no charge to the CRA, and the province will be responsible for the security and confidentiality of this information while in transit to the Compliance Lab.

The province will share registrant identification information with CRA in order to:

• Enable the CRA to better identify the Newfoundland and Labrador residents who may have incorrectly reported another province as their province of residency at the end of a specific tax year.
• Enable the CRA to better identify the tax at risk and residency issues, develop a strategy to enhance compliance through appropriate mix of enforcement activities and education of the taxpayers, and maintain high levels of service in protecting the interests of an agreeing province for which the CRA administers programs.

Since the determination of residency is a question of fact, and all the facts and the circumstances surrounding a particular situation have to be examined before a final determination can be made, any individual selected for review will be contacted and provided the opportunity to provide documentation and explanations to support the province of residence indicated on the income tax return.

"In" scope:

Based on the resources available, we anticipate a limited number of restricted reviews. For future years, we anticipate increasing the number of reviews. The number of reviews will be dependent on observed compliance patterns of the population.

"Out" of scope:

SEPAS will not conduct a 100% review of all taxpayers identified as potential residency mismatches by the Compliance Lab.

Reporting to the Province of Newfoundland and Labrador

Through the CRA Commissioner’s Annual Report, the province has been and will continue to receive aggregate data from CRA as follows:

• Number of T1 Residency reviews completed
• Number of adjustments into the NL jurisdiction
• Total Tax Credited
• Adjustments out of the NL jurisdiction
• Total Tax Debited
• Net Tax.

The above information will not contain personally identifiable data nor will the province receive any further personal data as a result of CRA’s T1 Provincial Residency Review.

Stakeholders include:

• Ministry of Finance of Newfoundland and Labrador; and
• Canada Revenue Agency.

Critical Assumptions include:

• The Supplementary Examination and Programs Analysis Section (SEPAS – ABSB) will retain the functional responsibility of the T1 Province of Residency Review workload;
• The Compliance Lab will accept to analyze the identification information provided by the province, and consider this analysis as one of their priorities;
• The CRA will determine the provincial residency of individuals based on available data and additional information provided by the taxpayer via a standard questionnaire designed for that purpose (a copy of the questionnaire is attached along with an income tax folio that justifies this collection of personal information; a privacy notice will also be added to the form); and
• The SEPAS T1 Province of Residency Review is subject to possible taxpayer’s objections and appeals to the Canadian Tax Court system.

Constraints:

• Lack of the SIN number from the identification information provided by the province of NL which complicates the matching and analysis process to be performed in the Compliance Lab; and
• The SEPAS and Compliance Lab budget

Risk identification and categorization

A) Type of program or activity

Compliance or regulatory investigations and enforcement

Level of risk to privacy: 3

Details: Personal information is used for purposes of detecting fraud or investigating possible abuses within programs where the consequences are administrative in nature (i.e., a fine, discontinuation of benefits, audit of personal income tax file or deportation in cases where national security and/or criminal enforcement is not an issue).

B) Type of personal information involved and context

The personal information by association indirectly reveals information on the health, financial situation, religious or lifestyle choices of the individual.

Level of risk to privacy: 3

Details:

• Registrant’s first name, middle name, surname and maiden name(if applicable);
• Registrant’s date of birth;
• Registrant’s gender;
• Registrant’s home and mailing address (street and postal code); and
• An indication (a YES/NO indicator) of whether the NL medical card was used in NL during the year(s).

C) Program or activity partners and private sector involvement

With other institutions or a combination of federal, provincial or territorial, and municipal governments.

Level of risk to privacy: 3

Details: Province of Newfoundland and Labrador Department of Finance

D) Duration of the program or activity

Short-term program or activity

A program or an activity that supports a short-term goal with an established "sunset" date.

Level of risk to privacy: 2

Details: The initial Memorandum of Understanding with the province of Newfoundland and Labrador is to cover two years but may be extended if it proves worthwhile.

E) Program population

The program affects certain individuals for external administrative purposes

Level of risk to privacy: 3

Details: Although CRA will initially verify the province of residency identified on the T1 returns for all Newfoundland and Labrador health care registrants, only those where there is a discrepancy between the two provinces, may be subject to a review. Moreover, the only personal information obtained from the province of Newfoundland and Labrador that will be retained is that which relates to taxpayers identified as mismatches that require further review. In other words, no personal information received from the province will be retained about any individual who has reported their province of residence as Newfoundland.

F) Technology & privacy

Does the new or modified program or activity involve the implementation of a new electronic system, software or application program including collaborative software (or groupware) that is implemented to support the program or activity in terms of the creation, collection or handling of personal information?

Risk to privacy: No

Is the new or modified program or activity a modification of a legacy IT systems and services?

Risk to privacy: No

The new or modified program or activity involves the implementation of one or more of the following technologies:

Enhanced identification methods - this includes biometric technology (i.e. facial recognition, gait analysis, iris scan, fingerprint analysis, voice print, radio frequency identification (RFID), etc...) as well as easy pass technology, new identification cards including magnetic stripe cards, "smart cards" (i.e. identification cards that are embedded with either an antenna or a contact pad that is connected to a microprocessor and a memory chip or only a memory chip with non-programmable logic).

Risk to privacy: No

Details: N/A

Use of Surveillance - this includes surveillance technologies such as audio/video recording devices, thermal imaging, recognition devices , RFID, surreptitious surveillance / interception, computer aided monitoring including audit trails, satellite surveillance etc.

Risk to privacy: No

Details: N/A

Use of automated personal information analysis, personal information matching and knowledge discovery techniques - for the purposes of the Directive on PIA, government institutions are to identify those activities that involve the use of automated technology to analyze, create, compare, identify or extract personal information elements. Such activities would include personal information matching, record linkage, personal information mining, personal information comparison, knowledge discovery, information filtering or analysis. Such activities involve some form of artificial intelligence and/or machine learning to uncover knowledge (intelligence), trends/patterns or to predict behavior.

Risk to privacy: Yes

Details: The identification information on registrants with the NL medical healthcare system provided by the province of Newfoundland and Labrador will be matched by the Compliance Lab with the CRA T1 assessment system to create a list of taxpayers to potentially be reviewed.

G) Personal information transmission

Used within a closed system (i.e. no connections to the Internet, Intranet or any other system and the circulation of hardcopy documents is controlled).

Level of risk to privacy: 1

Details: The Compliance Lab will keep the information received from the province in its own closed systems. The Supplementary Examination and Program Analysis section and the Tax Centres will keep the lists generated from the Lab in a shared drive, with controlled access.

H) Risk impact to the individual or employee

Details: 3 - Financial harm