Part XIII Non-Resident Withholding Program

Individual Compliance Directorate
Collections and Verification Branch

On this page

• Overview & Privacy Impact Assessment Initiation (PIA)
• Summary of the project, initiative or change
• Risk identification and categorization

Overview & Privacy Impact Assessment Initiation (PIA)

Government institution

Canada Revenue Agency

Government official responsible for the PIA

Marc Lemieux
Assistant Commissioner
Collections and Verification Branch

Head of the government institution or Delegate for section 10 of the Privacy Act

Steven Morgan
Director General
Access to Information and Privacy Directorate

Name of program or activity of the government institution

Returns Compliance

Standard or institution specific class of record:

Part XIII Non-Resident Withholding Program
CRA CVB 189 

Standard or institution specific personal information bank:

Part XIII Non-Resident Withholding Program
CRA PPU 094
TBS Registration Number: 004464

Legal authority for program or activity

Part XIII (sections 212 through 218.1) of the Income Tax Act (ITA) provides for the administration of the Part XIII program.

Subsection 212(1) of the ITA states:

“… 212(1) Every non-resident person shall pay an income tax of 25% on every amount that a person resident in Canada pays or credits, or is deemed by Part I to pay or credit, to the non-resident person as, on account or in lieu of payment of, or in satisfaction of,…”

Subsection 212(1) lists all types of income that are taxable under Part XIII as well as the exceptions to the 25% tax rate. The social insurance number (SIN) is collected pursuant to section 237 of the ITA and is used for identification purposes.

Summary of the project, initiative or change

Overview of the Program or Activity

The Part XIII Non-Resident Withholding Program is responsible for ensuring the proper withholding, remitting, and reporting of Part XIII tax on eligible Canadian income paid to non-resident recipients. The Part XIII Non-Resident Withholding Program runs various year-to-year activities that include, but are not limited to; the reporting and filing of NR4 Statement of Amounts Paid or Credited to Non-Residents of Canada information returns; assessments & reassessments; receipt of correspondence; account updates such as address changes and changes to authorized representatives; processing of refunds through NR7-R Application for Refund of Part XIII Tax Withheld; processing of NR5 Application by a Non-Resident of Canada for a Reduction in the Amount of Non-Resident Tax Required to be Withheld; processing of NR6 Undertaking to File an Income Tax Return by a Non-Resident Receiving Rent from Real or Immovable Property or Receiving Timber Royalty applications; compliance programs to verify that proper withholding, remitting, and reporting of Part XIII tax were applied on the NR4, and that proper procedures were followed for the NR6. 

What’s New

The Non-Resident Source Deduction Identification Project connected the Non-Resident Source Deduction system with the corresponding T1 Ident system for individuals, T2 Business Number system for corporations, and T3 Automated Trust System for estates and trusts, through Canada Revenue Agency (CRA) Primary Identifiers. These CRA Primary Identifiers are the non-resident account holders’ SIN/individual tax numbers, business numbers, and/or trust/subsidiary ledger numbers and are now connected to their non-resident accounts. This will allow for the retention of necessary data, previously only available The Non-Resident Source Deduction Identification Project connected the Non-Resident Source Deduction system with the corresponding T1 Ident system for individuals, T2 Business Number system for corporations, and T3 Automated Trust System for estates and trusts, through CRA Primary Identifiers. These CRA Primary Identifiers are the non-resident account holders’ SIN/individual tax numbers, business numbers, and/or trust/subsidiary ledger numbers and are now connected to their non-resident accounts. This will allow for the retention of necessary data, previously only available in the other corresponding systems, to better service taxpayers. The implementation of the CRA Primary Identifiers also makes the withholding, remitting, and reporting of Part XIII tax easier and more efficient for the Part XIII Non-Resident Withholding Program. 

Furthermore, this linkage between accounting systems allows officers to perform a search to find accounts in the Non-Resident Source Deduction system and in other revenue lines cross-referenced to the same CRA Primary Identifier to see a taxpayer’s complete tax liability. The implementation of the project allows for automated refund offsetting between systems that prevents revenue leakage and ensures all debts are paid before refunds are released to a taxpayer.

The online registration capability for non-resident accounts was also implemented to allow non-resident individuals, corporations and estates/trusts and their representatives to create non-resident accounts online through their MyAccount, MyBA or Represent a Client platforms. Changes to the account cannot be done online after creation and can only be done over the phone or in writing. 

The Non-Resident Source Deduction system now includes options that capture Authorized Representative information and Rental Property Records. Effective February 2020 non-resident taxpayers were able to authorize third party individuals to act as their representative by filing form AUT-01 Authorize a Representative for Offline Access. Previously, non-residents authorized their representatives by filing form NR95 Authorizing or Cancelling a Representative for a Non-Resident Tax Account. Prior to the NR95 form, which was introduced on May 14, 2018, non-resident authorization was completed by mailing a certified written note to the CRA. The authorization was noted in the diary of the non-resident tax account. Similarly, rental property records were previously noted in the diary of the non-resident tax account upon receipt of a written note. Non-residents can also cancel authorizations by completing the new AUT-01X Cancel Authorization for a Representative form.

Scope of the Privacy Impact Assessment

This privacy impact assessment (PIA) covers the workload within the Part XIII Non-Resident Withholding Program, actioned primarily at the Sudbury Tax Center. Within the scope are the withholding, remitting, reporting, and filing obligations under Part XIII of the ITA as well as the various elections, processing of applications and requests for refunds and assessments that are submitted by businesses, third parties and individuals.

Outside of the scope of this PIA are collections, audit, appeals and other functions separate from the Part XIII Non-Resident Withholding Program. There are non-resident sections for these areas but any related activities undertaken fall under the corresponding collections, appeals and audit programs, and are assessed under those programs’ PIA.

Risk identification and categorization

A) Type of program or activity

Administration of Programs / Activity and Services

Level of risk to privacy: 2

Details:

Personal information is solely used to administer programs and services and to provide assistance with the withholding, remitting, and reporting of Part XIII tax to Canadian payers and to non-residents of Canada receiving income from Canadian sources.

The activities administered under the Non-Resident Withholding Program, requiring the use of personal information, include, but are not limited to, the creation of non-resident accounts, updates to non-resident accounts (e.g. address changes, authorized representative updates, legal name changes, etc.), revision of account transactions (e.g. proper allocation of remittances, transfers of payments between accounts, etc.), assessments or reassessments of amounts owing (e.g. tax, penalty, and/or interest), issuance of refunds through non-resident accounts or through NR7-R, and the processing of NR5 & NR6 applications.

B) Type of personal information involved and context

SIN, medical, financial or other sensitive personal information and/or the context surrounding the personal information is sensitive. Personal information of minors or incompetent individuals or involving a representative acting on behalf of the individual.

Level of risk to privacy: 3

Details:

The types of personal information required for the administration of these programs, activities and services include, but are not limited to, the non-resident taxpayer’s country of residence and home/mailing address, the Canadian payer or agent/representative’s phone number and home/mailing address, the non-resident account number, SIN/individual tax number, business number, trust/subsidiary ledger number, an authorized signature, and details of the non-resident taxpayer’s income (e.g. gross income, net income, expenses, property addresses for rental income, etc.).

Some activities (e.g. processing NR5 elections, processing taxpayer relief requests) require additional personal information such as medical information regarding the taxpayer, dependants, or incompetent individuals.

C) Program or activity partners and private sector involvement

Private sector organizations or international organizations or foreign governments

Level of risk to privacy: 3

Details:

To ensure the proper administration of activities and services, personal information is shared amongst other areas within the Agency. These other areas may include, but are not limited to, audit, collections and appeals. These areas have access to information that is not available to the Non-Resident Withholding Section and that help administer the section’s activities and services. For some activities (e.g. NR5 administration) personal information is shared with other federal and provincial government agencies such as Service Canada for Canada Pension Plan & Old Age Security and Quebec Pension Plan. The personal information shared with these government agencies is solely regarding incomes received from these areas and approved tax rates on said incomes.  

D) Duration of the program or activity

Long-term program

Level of risk to privacy: 3

Details:

The programs, activities and services are established with no “sunset”.

E) Program population

The program affects certain individuals for external administrative purposes.

Level of risk to privacy: 3

Details:

The affected program population is non-residents of Canada who are receiving or expect to receive income from Canadian sources and Canadian payers who are sending or expect to send payments to non-residents. The affected program population is also classified as individuals, businesses, and/or third parties who withhold and remit income tax payable under Part XIII of the ITA.

F) Technology & privacy

1. Does the new or modified program or activity involve the implementation of a new electronic system, software or application program including collaborative software (or groupware) that is implemented to support the program or activity in terms of the creation, collection or handling of personal information?

   Risk to privacy: No

2. Does the new or modified program or activity require any modifications to IT legacy systems and/or services?

   Risk to privacy: Yes

3. Does the new or modified program or activity involve the implementation of one or more of the following technologies?

Enhanced identification methods - this includes biometric technology (i.e. facial recognition, gait analysis, iris scan, fingerprint analysis, voice print, radio frequency identification (RFID), etc.) as well as easy pass technology, new identification cards including magnetic stripe cards, "smart cards" (i.e. identification cards that are embedded with either an antenna or a contact pad that is connected to a microprocessor and a memory chip or only a memory chip with non-programmable logic).

Risk to privacy: No

Use of Surveillance - this includes surveillance technologies such as audio/video recording devices, thermal imaging, recognition devices, RFID, surreptitious surveillance/interception, computer aided monitoring including audit trails, satellite surveillance etc.

Risk to privacy: Yes

Use of automated personal information analysis, personal information matching and knowledge discovery techniques - for the purposes of the Directive on PIA, government institutions are to identify those activities that involve the use of automated technology to analyze, create, compare, identify or extract personal information elements. Such activities would include personal information matching, record linkage, personal information mining, personal information comparison, knowledge discovery, information filtering or analysis. Such activities involve some form of artificial intelligence and/or machine learning to uncover knowledge (intelligence), trends/patterns or to predict behavior.

Risk to privacy: Yes

G) Personal information transmission

The personal information is transmitted using wireless technologies  

Level of risk to privacy: 4

Details:

The personal information is entered into the various CRA computer systems used by the Agency and shared via secure email, when necessary. Information is only used for Part XIII Non-Resident Withholding Program purposes at all times and emails are encrypted using Entrust security software. Information is not transferred to any portable devices (i.e. CD/DVD, USB) but is printed for the provision of programs, activities and services, when necessary.

Officers can use a laptop computer with access control. Access to the Agency network from remote locations must be done with full disk encryption and standard Secure Remote Access. The Information Technology Branch has developed an enterprise-wide telecommuting platform that offers users secure access to the network.

H) Potential risk that in the event of a privacy breach, there will be an impact on the individual or employee

Details:

In the event of a privacy breach, the individual may experience the following impacts:

• financial loss (e.g. identity theft or fraud, inconvenience due to changing financial arrangements, potential loss of business opportunities, potential increase in the cost of insurance or potential loss of insurance), and,
• impact on health (e.g. psychological impact such as stress and physiological impact such as loss of sleep).