Taxpayer Relief Program v1.0

Appeals Branch
Program Management Directorate

On this page

Overview & Privacy Impact Assessment (PIA) Initiation 

Government institution

Canada Revenue Agency

Government official responsible for the PIA

Tammy Branch
Assistant Commissioner
Appeals Branch

Head of the government institution or Delegate for section 10 of the Privacy Act

Anne Marie Laurin
Director General
Access to Information and Privacy Directorate

Name of program or activity of the government institution

Taxpayer Relief Program

Standard or institution specific class of record:

Taxpayer Relief Program
Record Number CRA APP 585

Standard or institution specific personal information bank:

Taxpayer Relief Program
Bank number CRA PPU 580
TBS Registration Number 003943

Legal authority for program or activity

Excise Tax Act: Subsections 88(1), 281.1(1), 281.1(2), 284.1(3)

Excise Act, 2001

Air Travellers Security Charge Act

Softwood Lumber Products Export Charge Act, 2006

Greenhouse Gas Pollution Pricing Act

Tax Administration Act

Customs Act

Underused Housing Tax Act

Select Luxury Items Tax Act

Digital Services Tax Act

Global Minimum Tax Act (draft legislation)

Summary of the project, initiative or change

Overview of the Program or Activity

The Minister may grant relief from penalties and interest when the following types of situations prevent a taxpayer from meeting their tax obligations:

Program activities:

Scope of the Privacy Impact Assessment

The scope of the Taxpayer Relief Program includes requests for penalties and interest relief received from taxpayers. The CRA can also waive or cancel penalties and interest without a taxpayer-initiated request when it is clear and evident that the taxpayer’s situation warrants relief. Revenu Québec employees who access CRA systems for processing GST/HST relief requests are regulated by agreements and security protocols for information sharing. These activities are in scope of the Taxpayer Relief Program but will be assessed in the next update of the PIA.

In addition, certain specialized penalties and interest workloads, such as requests associated with a voluntary disclosure, are outside the scope of this PIA.Requests for a refund or reduction in amounts payable beyond the normal three-year period and requests to accept late, amended, or revoked elections are also outside the scope of this PIA. 

Risk identification and categorization

A) Type of program or activity

Administration of Programs / Activity and services 

Level of risk to privacy: 2

Details:

The CRA administers legislation, commonly called the taxpayer relief provisions, that give the CRA discretion to cancel or waive penalties and interest when taxpayers cannot meet their tax obligations due to circumstances beyond their control. These can include financial hardship, actions of the CRA such as delays, extraordinary circumstances such as illness, and other circumstances beyond the taxpayer’s control.

B) Type of personal information involved and context

Social insurance number, medical, financial or other sensitive personal information and/or the context surrounding the personal information is sensitive. Personal information of minors or incompetent individuals or involving a representative acting on behalf of the individual. 

Level of risk to privacy: 3

Details:

The completion of a taxpayer relief file could involve reviewing personal information including medical or financial information for a spouse, child, other dependent, other relative, director of a corporation, or an authorized representative.

C) Program or activity partners and private sector involvement

With provincial and/or territorial and/or indigenous and/or municipal government(s) 

Level of risk to privacy: 3

Details:

For the most part, the information within the CRA is collected [GL1] [HS(i2] from other programs and activities such as the income tax returns programs.  

The Taxpayer Relief Program shares request[GL3] [HS(i4] s for relief on GST/HST accounts located in the province of Quebec with Revenu Québec since they administer those cases on behalf of the CRA.

Procedures to eventually share personal information with the Canada Border and Services Agency to address relief requested under the Customs Act are in development.

The taxpayer relief program is expected to eventually become paperless. However, if paper documents containing personal information are created, they will be stored by a third party in the private sector. The third-party request for proposal and contract was reviewed to clearly identify and address privacy related requirements.

D) Duration of the program or activity

Long-term program

Level of risk to privacy: 3

Details:

The Taxpayer Relief Program will continue as long as the sections for taxpayer relief provisions are included in law. It is a long-term program with no end date.

E) Program population

The Taxpayer Relief Program affects certain individuals for external administrative purposes.

Level of risk to privacy: 3

Details:

The Taxpayer Relief Program is available to taxpayers who are unable to comply with their tax obligations due to circumstances beyond their control.

F) Technology & privacy

  1. Does the new or modified program or activity involve the implementation of a new electronic system, software or application program including collaborative software (or groupware) that is implemented to support the program or activity in terms of the creation, collection or handling of personal information?

Risk to privacy: Yes

  1. Does the new or modified program or activity require any modifications to IT legacy systems and/or services?

Risk to privacy: No

  1. Does the new or modified program or activity involve the implementation of one or more of the following technologies?

Enhanced identification methods - this includes biometric technology (i.e. facial recognition, gait analysis, iris scan, fingerprint analysis, voice print, radio frequency identification (RFID), etc.) as well as easy pass technology, new identification cards including magnetic stripe cards, "smart cards" (i.e. identification cards that are embedded with either an antenna or a contact pad that is connected to a microprocessor and a memory chip or only a memory chip with non-programmable logic).

Risk to privacy: No

Use of Surveillance - this includes surveillance technologies such as audio/video recording devices, thermal imaging, recognition devices, RFID, surreptitious surveillance/interception, computer aided monitoring including audit trails, satellite surveillance etc.

Risk to privacy: No

Use of automated personal information analysis, personal information matching and knowledge discovery techniques - for the purposes of the Directive on PIA, government institutions are to identify those activities that involve the use of automated technology to analyze, create, compare, identify or extract personal information elements. Such activities would include personal information matching, record linkage, personal information mining, personal information comparison, knowledge discovery, information filtering or analysis. Such activities involve some form of artificial intelligence and/or machine learning to uncover knowledge (intelligence), trends/patterns or to predict behavior.

Risk to privacy: No

G) Personal information transmission

The personal information is transmitted using wireless technologies. 

Level of risk to privacy: 4

Details:

Most employees of the Taxpayer Relief Program work in a hybrid work environment which requires the use of wireless technologies to connect to local home-based networks and then to the CRA secure Virtual Private Network (VPN).

Taxpayers and/or their representatives can submit their relief request electronically using the My Account, My Business Account, and Represent a client secure online portals by completing form RC4288 and sending it by mail. In the event of a natural or human-made disaster, they can request relief by calling a CRA contact centre. The CRA stores the protected information in various secure CRA systems and databases. 

Taxpayers may request information in alternate formats. Acceptable formats include electronic versions and accessible media such as disk, CD, and USB key. Visually impaired persons may register with the CRA to receive their mail in alternate format such as braille, electronic text, large print, and digital audio.

When the Taxpayer Relief Program communicates with Revenu Québec, encrypted emails are always used to ensure proper protection of the information.

H) Potential risk that in the event of a privacy breach, there will be an impact on the individual or employee

Details:

The sensitivity of information used in the taxpayer relief process is considered high (Protected B). Unauthorized use or disclosure of this information could result in a security breach, loss of privacy, misuse of personal information by unauthorized parties, identity theft, personal financial harm and/or embarrassment to the taxpayer.

 

Page details

Date modified: