Criminal Investigations Program

Privacy Impact Assessment (PIA) summary – Criminal Investigations Directorate, Compliance Programs Branch

Overview & PIA Initiation

Government institution

Canada Revenue Agency

Government official responsible for the PIA

Ted Gallivan
Assistant Commissioner, Compliance Programs Branch

Head of the government institution or Delegate for section 10 of the Privacy Act

Marie-Claude Juneau
ATIP Coordinator

Name of program or activity of the government institution

Criminal Investigations Program

Description of the class of record and personal information bank

Standard or institution specific class of record:
Detection and Investigations Class of Record (CRA ILBIB 820) - previously (CRA CPB 820)

Standard or institution specific personal information bank:
Detection and Investigations (CRA PPU 095)

Legal authority for program or activity

The CRA’s Criminal Investigations Program’s mandate is to ensure significant cases of tax evasion are investigated and, where appropriate, referred to federal prosecutors. The major acts the Criminal Investigations Program enforces are the Income Tax Act and the Excise Tax Act. CRA investigators may also enforce other program legislation as it is defined in the Canada Revenue Agency Act.

Tax evasion is the commission or omission of an act, conspiracy to commit such an act, or accommodating someone else to commit such an act, which can result in criminal charges under sections 239 of the Income Tax Act, section 327 of the Excise Tax Act and/or section 380 of the Criminal Code.

CRA investigators are authorized to enforce the Income Tax Act under subsection 220(2) and correspondingly subsection 275(2) of the Excise Tax Act.

CRA investigators are public officers as defined by section 2 of the Criminal Code. They enforce the laws of Canada relating to revenue.  As public officers, CRA investigators can obtain evidence by way of search warrants and production orders pursuant to section 487 of the Criminal Code.

CRA investigators may disclose taxpayer information pursuant to subsection 241(4)(a) of the Income Tax Act and 295(5)(a) of the Excise Tax Act to the police, government officials and other persons who assist with a CRA investigation.

CRA investigators may disclose taxpayer information pursuant to 241(9.5) of the Income Tax Act and 295(5.04) of the Excise Tax Act to the police if the information would provide evidence of listed serious offences.

CRA investigators may also obtain a court order to compel a taxpayer who has been charged with criminal tax offences to be fingerprinted pursuant to paragraph 2(1)(c) of the Identification of Criminals Act.

Summary of the project / initiative / change

This PIA covers the Criminal Investigations Program, which plays a crucial role in protecting Canada’s tax base by investigating persons suspected of committing tax evasion. CRA investigators obtain information from CRA systems, interviews, surveillance, search warrants, production orders, exchanges with other government departments and public sources such as the internet, court records and the media. This PIA describes the Criminal Investigations Program in general and identifies the following new initiatives:

1. Serious Crime Measures: Bill C31 amended the Income Tax Act, the Excise Tax Act, and the Excise Act, 2001 that allow the CRA to disclose some taxpayer information to law enforcement agencies in certain circumstances if the information relates to serious criminal activity.
2. RCMP Public Safety Portal: The Criminal Investigations Directorate is seeking access to the RCMP’s Public Safety Portal (PSP) database. The PSP will provide CRA investigators with index information on offence names, event types, person involvements and vehicle involvements in offences. No CRA information will be exchanged through the Public Safety Portal. CRA investigators will only have query access to the portal.

Risk identification and categorization

A) Type of program or activity

Criminal investigation and enforcement 

Level of risk to privacy: 4

Details: The CRA’s Criminal Investigations Program enforces the laws of Canada relating to revenue by investigating persons involved in fraudulent schemes designed to evade payment of tax or generate false or fictitious tax refunds or credits. Investigations could result in the laying of criminal charges under section 239 of the Income Tax Act and/or section 327 of the Excise Tax Act against a particular individual.  CRA investigators may also enforce CRA program legislation as it is defined in the Canada Revenue Agency Act.

B) Type of personal information involved and context

Sensitive personal information, including detailed profiles, allegations or suspicions, biometrics, and/or the context surrounding the personal information is particularly sensitive.

Level of risk to privacy: 4

Details: CRA investigators collect or review information about the financial affairs of taxpayers under investigation and their relatives. This includes information about how much the taxpayer earned, how much his/her spouse earned, the types of expenses they incurred, spending habits and how many dependants they have.

CRA investigators review information from CRA systems and obtain personal information from external sources to use as evidence to prove the alleged offences. CRA investigators may interview witnesses and the taxpayer/registrant under investigation. These interviews are voluntary.

Pursuant to section 487 of the Criminal Code, CRA investigators can obtain search warrants and production orders to collect evidence.

CRA investigators may ask other law enforcement agencies and government departments for information about the taxpayer under investigation.

CRA investigators may also seek information from other countries pursuant to a tax treaty or a mutual legal assistance treaty to assist in gathering evidence of alleged tax offences.

CRA investigators may apply for a court order pursuant to the Identification of Criminals Act to compel the taxpayer under investigation to be fingerprinted once they have been charged with an offence.

C) Program or activity partners and private sector involvement

Private sector organizations or international organizations or foreign governments

Level of risk to privacy: 4

Details: CRA’s Criminal Investigations Program investigates offences that are often committed in conjunction with offences that fall under the responsibility of municipal, provincial or federal law enforcement agencies. For example, offences that relate to the possession and use of fraudulent identity documents, proceeds of crime and money laundering are often committed by organized crime groups because they generate significant amounts of income for the perpetrators. Like legitimate income, proceeds of crime are taxable.

Where appropriate, CRA investigators may coordinate their investigation with law enforcement partners to streamline an investigation and avoid compromising each agency’s investigation. In a joint forces operation, the CRA and the police may share personal information that either party collected about the person under investigation on a need to know basis and to the extent authorized by the Income Tax Act, Excise Tax Act and the Privacy Act.

CRA investigators interview witnesses to obtain information about the taxpayer under investigation.

CRA investigators may ask law enforcement agencies from other countries to collect evidence held in their respective country that is required for the CRA case. Such requests are made pursuant to international treaties and the admissibility of information received is governed by the Canadian laws of evidence.

CRA may disclose taxpayer information to an appropriate police organization when there are reasonable grounds to believe that the information would provide evidence of serious offences.

D) Duration of the program or activity

Long-term program

Level of risk to privacy: 3

Details: The Criminal Investigations Program will continue indefinitely.

E) Program population

The program affects certain individuals for external administrative purposes.

Level of risk to privacy: 3

Details: Individuals suspected of committing tax evasion, fraud, and other tax offences.

F) Technology & privacy

Does the new or modified program or activity involve the implementation of a new electronic system, software or application program including collaborative software (or groupware) that is implemented to support the program or activity in terms of the creation, collection or handling of personal information?

Risk to privacy: Yes

Details:  The Criminal Investigations Directorate is pursuing a virtual private network to allow better management of its forensics program.

Does the new or modified program or activity require any modifications to IT legacy systems and/or services?

Risk to privacy: No

The new or modified program or activity involves the implementation of one or more of the following technologies:

Enhanced identification methods - this includes biometric technology (i.e. fingerprint analysis, etc...)

Risk to privacy: Yes

Details: CRA investigators may obtain the fingerprints of the taxpayer under investigation upon the laying of a criminal charge. As part of the summons to the taxpayer to appear in court to answer the criminal charges, the court orders the taxpayer to appear at a police station and have their fingerprints taken. The CRA sends the fingerprints to the RCMP’s Identification Section in Ottawa.

Fingerprints can be used to link the taxpayer under investigation to the crime where latent prints are found on physical evidence, to determine if the taxpayer has been charged with, or convicted of other crimes in order to decide whether to proceed by way of indictment and assisting in the apprehension of the taxpayer under investigation should he/she fail to appear in court.

Use of Surveillance - this includes surveillance technologies such as audio/video recording devices.

Risk to privacy: Yes

Details: CRA investigators may drive by the taxpayer’s premises to confirm that the taxpayer still lives there or that the business is still in operation. Investigators will take notes of what they see or hear and may also take pictures. This information is required to support the investigator’s search warrant application.

If other types of surveillance are required, the CRA will ask the RCMP or another police force for assistance.

Use of automated personal information analysis, personal information matching and knowledge discovery techniques - for the purposes of the Directive on PIA, government institutions are to identify those activities that involve the use of automated technology to analyze, create, compare, identify or extract personal information elements. Such activities would include personal information matching, record linkage, personal information mining, personal information comparison, knowledge discovery, information filtering or analysis. Such activities involve some form of artificial intelligence and/or machine learning to uncover knowledge (intelligence), trends/patterns or to predict behavior.

Risk to privacy: No

Details: Any automated analysis is done by other CRA program areas before the file is referred to the Criminal Investigations Program.

G) Personal information transmission

The personal information is transferred to a portable device or is printed.

USB key, diskette, laptop computer, any transfer of the personal information to a different medium.

Level of risk to privacy: 3

Details: CRA investigator case files are considered Protected B and stored on CRA servers. Servers provide a higher level of security as they are required to be in a secure room or locked cabinet and regular backups of the data are provided. Electronic files are stored in accordance with the CRA Information and Systems Security Directive.

H) Risk impact to the individual or employee

Financial harm.

Details:  The risk to privacy for the individual if a breach of their personal information occurred is that another person will know that the individual is under investigation by the CRA for tax fraud. This could jeopardize the individual’s career and reputation. They may also become a victim of identity theft, and their information may be used without their knowledge or consent in ways that could result in a financial or reputational loss to that person, such as the misuse of their credit card information, debts being incurred on their behalf, etc.

I) Risk impact to the institution

Reputation harm, embarrassment, loss of credibility.

Details: The risk to the CRA for the improper collection, use and disposal of personal information by the Criminal Investigations Program includes civil and criminal litigation. There is a risk that the public would lose confidence in the integrity of the Criminal Investigations Program.