Language selection

Government of Canada / Gouvernement du Canada

Search

Sign in

Sign in

Business Refund Set-off Program v 2.0

Business Returns Directorate
Assessment, Benefit, and Service Branch

Overview & PIA Initiation

Government institution

Canada Revenue Agency

Government official responsible for the PIA

Frank Vermaeten
Assistant Commissioner
Assessment, Benefit, and Service Branch 

Head of the government institution or Delegate for section 10 of the Privacy Act

Lia Jackson
Director
Access to Information and Privacy Directorate

Name of program or activity of the government institution

Tax Services and Processing – Business Refund Set-off program 

Description of the class of record and personal information bank

Standard or institution specific class of record:
Business Refund Set-off program
CRA ABSB 229

Standard or institution specific personal information bank:
Business Refund Set-off program
CRA PPU 221

Legal authority for program or activity

The authority to set-off an income tax refund is contained in subsection 164(2) of the Income Tax Act, and under subsection 155(1) of the Financial Administration Act for the GST/HST and other levies (Excise Tax Act, the Excise Act, the Excise Act, 2001, the Air Travellers Security Charge Act and the Greenhouse Gas Pollution Pricing Act.)

The authority to disclose information for the purposes of setting off against any sum of money that may be due or payable by Her Majesty in right of Canada is contained in subsection 8(2) (b) and (l) of the Privacy Act, in subsection 241(4) (d) of the Income Tax Act, subsection 295 (5) (d) (vi) of the Excise Tax Act, subsection 211 (6) (e) (vi) of the Excise Tax Act 2001, subsection 107 (6) of the Greenhouse Gas Pollution Pricing Act, subsection 84(6) (d) (vi) of the Softwood Lumber Products Export Charge Act, 2006 and subsection 9 (3) of the Financial Administration Act.

Summary of the project / initiative / change

The Business Refund Set-off program is a Canada Revenue Agency (CRA) initiative under which business revenue lines refund amounts can be set-off against debts due to Her Majesty in right of Canada or Her Majesty in right of a province or territory. Any federal, provincial or territorial department, agency or Crown Corporation may participate in the program, subject to the CRA’s policy requirements and other obligations. The partners must enter into an official arrangement with the CRA to participate in the Business Refund Set-Off program, and these agreements take form of a Memorandum of Understanding.

The Business Accounting Division (BAD) is the functional authority for all business revenue lines (Corporate Income Tax, goods and services tax/harmonized sales tax (GST/HST), and Other Levies within the Standardized Accounting system. The Business Accounting Division is also responsible for providing support to the field for the administration of the Business Refund Set-off program. The program allows the CRA to set-off corporation income tax refunds, GST/HST refunds and specialty business return refunds to other federal government departments, Crown Corporations, or provincial and territorial departments that participate in the Business Refund Set-off program.  

In order to participate in the Business Refund Set-off program, other federal, provincial or territorial government departments, agencies or Crown Corporations must enter into an official arrangement with the CRA. The official arrangement takes form of a Memorandum of Understanding, which sets out the conditions and procedures under which refunds from business tax accounts will be set-off, and the exchange of information for the purposes of set-off. Once a Memorandum of Understanding is signed, the other federal, provincial or territorial government department, agency or Crown Corporation becomes a participant under the Business Refund Set-off program and can request a business refund set-off. Before setting off any refunds of a business against debts owed to a business refund set-off participant, the CRA will first satisfy debts the business has incurred with the CRA and ensure the business’s filing status is up to date with the various acts it administers.

In order to make a business refund set-off request, the participant must first have made a reasonable attempt to:

This must be done prior to making a business refund set-off request to the CRA, as per the Treasury Board of Canada Secretariat’s Directive on Public Money and Receivables and the Guideline on Collection of Receivables. 

To initiate a business refund set-off request, the participant must complete and submit to the CRA the following forms:

The participant can submit the forms to the CRA via the business refund set-off mailbox. The information shared in these forms is limited to sufficient information to identify the debtor and to process the set-off request. Annex E of the Memorandum of Understanding prescribes the information to be released to the CRA, which includes:

If additional information is required to identify the debtor, the participant may be asked to include:  

Once the forms are received, the CRA compares the name and address of the debtor provided by the participant with the information in the CRA mainframe to determine if there is a match. If the CRA is unable to identify the debtor’s business account(s), they will ask the participant for additional information, which may allow the CRA to make a match. If no match is found, no amounts will be set-off to that participant for that debtor and the participant will be informed. If a match is found, the CRA will hold any of the debtor’s refunds that may become available for set-off.

When a match is identified under the business number system, the CRA will issue an initial notification letter to the debtor. The letter explains that the CRA may set-off their corporation income tax refunds, GST/HST refunds, and specialty business return refunds to pay their outstanding debt with the requestor of the set-off. 

Business refund set-off participants are also required to send a similar letter to the debtor. The participant must advise the CRA immediately if the set-off is fully satisfied, if the debt has increased or decreased, or if other arrangements between the participant and the debtor have been made after sending the request for set-off.

When a refund becomes available, and if the debtor has filed all its returns and has no balance outstanding, the CRA will process the set-off and issue a notification letter to advise the debtor of the amount that has been set-off to the participant who requested the set-off.

What’s new

Since the first version of the PIA, new federal government departments, the province of British Columbia and the province of Ontario have signed a Memorandum of Understanding to participate under the Business Refund Set-off program. All prior interim agreements have been cancelled and some organisations renewed their participation under the Business Refund Set-off by signing a Memorandum of Understanding. No other changes occurred under the administration of the Business Refund Set-off program that may have an impact to the program’s privacy practices.

Effective January 1, 2019, fuel charge refunds under the Greenhouse Gas Pollution Pricing Act and Excise duty refunds on cannabis under Excise Act, 2001 were added to the Business Refund Set-off program.

Scope of the privacy impact assessment

The scope of this privacy impact assessment covers the administration of the Business Refund Set-off program, which includes the receipt of a set-off request, its registrations under the business refund set-off database, and the disbursement of a refund under the Standardized Accounting system to the requestor.

Written collaborative arrangements are in place with other federal, provincial or territorial government departments, agencies, or Crown Corporations to which the CRA provides the service of set-offs. Each agreement includes:

Each agreement is accompanied by a security questionnaire which is reviewed and approved by the Security and Internal Affairs Directorate. There is an internal audit clause included in each agreement, which stipulates that a periodic review must be conducted by the partner with respect to confidentiality and security of information provided by the CRA.

Risk identification and categorization

A) Type of program or activity

Administration of Programs / Activity and Services   

Level of risk to privacy: 2

Details:
The business refund set-off process affects the administration of program payments but not the calculation of those payments – just the issuance of them. Whatever refunds are available to be disbursed to the business from the CRA may be redirected to a business refund set-off participant. 

B) Type of personal information involved and context

Social insurance number, medical, financial or other sensitive personal information and/or the context surrounding the personal information is sensitive. Personal information of minors or incompetent individuals or involving a representative acting on behalf of the individual.   

Level of risk to privacy: 3

Details:
The Business Refund Set-off program relies on the business refund set-off database to administer its program. In order to request a set-off, the participant must submit to the CRA a Refund Set-off Application Form and a Declaration Form. The Refund Set-off Application Form provides the information needed to identify the debtor's business account(s) and to place an inhibition on the debtor's business account(s). The Declaration Form is a type of affidavit confirming that the business refund set-off participant has complied with the requirements to request a set-off. 

Whether or not a match is found, both forms are saved in the refund set-off folder in the CRA’s G: drive. The information used to update the business refund set-off database is the debtor's name, the amount of the set-off, the business number, the name of the participant who requested the set-off and their disbursement instructions. The information collected is solely used for the purposes of setting off a debt against a business refund amount. The information provided in the Refund Set-off Application Form is the prescribed information indicated in Annex E of the Memorandum of Understanding and includes the following:

If the CRA is having difficulty finding a match in their system, it may request the following additional information:

The CRA will not disclose any business information to the business refund set-off participant.   

C) Program or activity partners and private sector involvement
With other or a combination of federal, provincial and/or municipal government(s) 

Level of risk to privacy: 3

Details: 
The CRA will only accept other federal, provincial or territorial government departments, agencies or Crown Corporations as participants in the Business Refund Set-off program. The CRA only collects information to identify the business with outstanding debt to the business refund set-off participant. When a match has been found, a disbursement inhibition is set on the debtor’s business account(s). When a refund amount is identified, the funds are directed to the business refund set-off participant. The CRA does not share any other information under this program.

D) Duration of the program or activity
Long-term program

Level of risk to privacy: 3

Details: 
This program will continue indefinitely.

E) Program population
The program affects certain individuals for external administrative purposes.

Level of risk to privacy: 3

Details: 
The Business Refund Set-off  program administers the set-off in respect of corporate income tax (T2), GST/HST (RT), and Other Levies, which includes, excise taxes non-GST/HST accounts (RE, RN), excise duty (RD), air travellers security charge (RG), softwood lumber products export charge (SL) and Carbon tax (CT) under the Greenhouse Gas Pollution Pricing Act.  

F) Technology & privacy

  1. Does the new or modified program or activity involve the implementation of a new electronic system, software or application program including collaborative software (or groupware) that is implemented to support the program or activity in terms of the creation, collection or handling of personal information?

    2. Risk to privacy: No

  2. Does the new or modified program or activity require any modifications to IT legacy systems and/or services?

    3. Risk to privacy: No

  3. The new or modified program or activity involves the implementation of one or more of the following technologies:

Enhanced identification methods - this includes biometric technology (i.e. facial recognition, gait analysis, iris scan, fingerprint analysis, voice print, radio frequency identification (RFID), etc...) as well as easy pass technology, new identification cards including magnetic stripe cards, "smart cards" (i.e. identification cards that are embedded with either an antenna or a contact pad that is connected to a microprocessor and a memory chip or only a memory chip with non-programmable logic). 

Risk to privacy: No

Use of Surveillance - this includes surveillance technologies such as audio/video recording devices, thermal imaging, recognition devices , RFID, surreptitious surveillance / interception, computer aided monitoring including audit trails, satellite surveillance etc.

Risk to privacy: No

Details:

The program does not involve the use of surveillance on individuals associated with the Business Refund Set-off program.

However, as part of the CRA security program, CRA employees who have access to personal information are monitored through the Internal Affairs and Fraud Control Program, which includes the use of the Enterprise Fraud Management (EFM) solution. The EFM solution records information, such as user logon ID, date and time of logon, logout, user location, terminal identity, name and ID of client records accessed, including edits or changes made during each user session, etc. 

The information is used to verify that only authorized users have accessed personal information and to ensure that access can be linked to specific individuals to support the investigation of suspected or alleged misuse. 

Every time CRA employees log in on their computers, a notice pops up requiring employees to acknowledge that they are aware that all access to CRA networks is monitored and that access is on a need-to-know basis. This information is described in the CRA personal information bank Monitoring of Electronic Access to Taxpayer Information CRA PPU 718.

Use of automated personal information analysis, personal information matching and knowledge discovery techniques - for the purposes of the Directive on PIA, government institutions are to identify those activities that involve the use of automated technology to analyze, create, compare, identify or extract personal information elements. Such activities would include personal information matching, record linkage, personal information mining, personal information comparison, knowledge discovery, information filtering or analysis. Such activities involve some form of artificial intelligence and/or machine learning to uncover knowledge (intelligence), trends/patterns or to predict behavior.

Risk to privacy: No

Details: 

The CRA will use the information provided by the business refund set-off participant to determine the debtor’s business account(s) that may have refunds available to be set-off. CRA agents will search the CRA mainframe systems to identify the debtor`s business account(s). They will compare the name of the debtor, the debtor’s address, telephone number(s), and invoice number to the CRA mainframe records to identify the business account in question.

G) Personal information transmission

The personal information is used in a system that has connections to at least one other system.

Level of risk to privacy: 2

Details: 

The correspondence from  business refund set-off participants is received by encrypted emails. All of the information received from participants, and the information sent back to them from the CRA, is stored in a CRA database and on a CRA drive (the G: drive), organized by business number. A new file is opened for every account a match is identified for. In the file, PDFs of the application and declaration forms received from the participant are saved. The emails are saved in the Outlook mailbox under a tracking number. The mailbox, database and G: drive access is limited to CRA employees with a work-related need (certain agents in the Summerside Tax Centre and headquarters).

H) Risk impact to the individual or employee

Details:

As we rarely receive the client’s business number or social insurance number the risk is somewhat reduced. However, if the business’s name, address, contact information or the amount owing to another department is lost or stolen, the impact on the business could include identity theft and possibly embarrassment to the business if the amount owing was revealed. All communications are made via encrypted email.

Page details

Date modified: