Annual Report to Parliament

Transcription

1 Aual Report to Parliamet o the Admiistratio of the Privacy Act RC4415-1(E) Rev. 15

2

3 Foreword Each fiscal year, the head of every govermet istitutio prepares ad submits a report to Parliamet o the admiistratio of the Privacy Act. This aual report is tabled i Parliamet i accordace with sectio 72 of the Privacy Act uder the directio of the Miister of Natioal Reveue ad the Commissioer of the Caada Reveue Agecy (CRA). It describes how the CRA admiistered ad fulfilled its obligatios uder the Privacy Act betwee April 1, 2014, ad March 31, It also discusses emergig treds, program delivery, ad areas of focus for the year ahead. The Privacy Act The Privacy Act came ito force o July 1, It protects the privacy of idividuals by outliig strog requiremets for collectig, retaiig, usig, disclosig, ad disposig of persoal iformatio held by govermet istitutios. It provides idividuals (or their authorized represetatives) with a right of access to their ow persoal iformatio, with limited ad specific exceptios ad with rights of correctio or aotatio or both. Idividuals who are dissatisfied with ay matter related to a formal request made uder the Privacy Act are etitled to complai to the Privacy Commissioer of Caada. The Privacy Act s formal processes do ot replace other meas of obtaiig govermet iformatio. The CRA ecourages idividuals ad their represetatives to cosider requestig iformatio through the followig iformal methods: topical idexes o the CRA Web site: idividual icome tax equiries (icludig for forms ad publicatios): uiversal child care beefit, Caada child tax beefit ad related provicial ad territorial programs, child disability beefit, ad childre s special allowaces equiries: TTY (teletypewriter for persos who are deaf or hard of hearig or who have a speech impairmet): The Admiistratio of the Privacy Act

4

5 Table of Cotets Overview of the Caada Reveue Agecy... 4 Chief Privacy Officer... 5 The Access to Iformatio ad Privacy Directorate... 5 The Access to Iformatio ad Privacy Oversight Review Committee... 6 Delegatio of resposibilities uder the Privacy Act... 6 Schedule Privacy Act... 8 Statistical report (Appedix A) Iterpretatio ad explaatio... 9 Operatioal eviromet Moitorig request ivetories Maagig privacy breaches Privacy impact assessmets Policies, guidelies, ad procedures Complaits, ivestigatios, ad Federal Court cases Collaboratio with oversight bodies ad other orgaizatios Coclusio Appedix A Statistical report The Admiistratio of the Privacy Act

6 Overview of the Caada Reveue Agecy The Caada Reveue Agecy (CRA) admiisters tax laws for the Govermet of Caada ad for most provices ad territories. It also admiisters various social ad ecoomic beefit ad icetive programs delivered through the tax system. I additio, the CRA has the authority to eter ito ew parterships with the provices, territories, ad other govermet bodies at their request ad o a cost-recovery basis to admiister o-harmoized taxes ad other services. Overall, the CRA promotes compliace with Caada s tax legislatio ad regulatios ad plays a importat role i the ecoomic ad social well-beig of Caadias. The Miister of Natioal Reveue is accoutable to Parliamet for all of the CRA s activities, icludig admiisterig ad eforcig the Icome Tax Act ad the Excise Tax Act. The Caada Reveue Agecy Act provides for the establishmet of a Board of Maagemet cosistig of 15 directors appoited by the Goveror i Coucil. They iclude the Chair, the Commissioer ad Chief Executive Officer, a director omiated by each provice, oe director omiated by the territories, ad two directors omiated by the federal govermet. Uder the provisios of the Caada Reveue Agecy Act, the Board of Maagemet oversees the orgaizatio ad admiistratio of the CRA, icludig the maagemet of its resources, services, property, persoel, ad cotracts. I fulfillig this role, the Board of Maagemet brigs a forward-lookig strategic perspective to the CRA s operatios, fosters soud maagemet practices, ad is committed to efficiet ad effective service delivery. As the CRA s chief executive officer, the Commissioer is resposible for the day-to-day admiistratio ad eforcemet of the program legislatio that falls uder the Miister s delegated authority. The Commissioer is accoutable to the Board of Maagemet for maagig the CRA, supervisig employees, ad implemetig policies ad budgets. Moreover, the Commissioer must assist ad advise the Miister with respect to legislated authorities, duties, fuctios, ad Cabiet resposibilities. The CRA is made up of 12 braches ad 5 regioal offices across the coutry. Braches Appeals Assessmet ad Beefit Services Audit, Evaluatio, ad Risk Compliace Programs Fiace ad Admiistratio Huma Resources Regios Atlatic Otario Pacific Iformatio Techology Legal Services Legislative Policy ad Regulatory Affairs Public Affairs Strategy ad Itegratio Taxpayer Services ad Debt Maagemet Prairie Quebec Aual Report to Parliamet

7 Chief Privacy Officer The Assistat Commissioer, Public Affairs Brach, is the CRA s Chief Privacy Officer. The Chief Privacy Officer has a broad madate for overseeig privacy at the CRA. To fulfill this madate, the Chief Privacy Officer: oversees decisios related to privacy, icludig privacy impact assessmets; champios persoal privacy rights, icludig maagig iteral privacy breaches, accordig to legislatio ad policy; ad reports to the CRA s seior maagemet o the state of privacy maagemet at the CRA at least twice a year. The Access to Iformatio ad Privacy Directorate The Access to Iformatio ad Privacy (ATIP) Directorate helps the CRA meet its requiremets uder the Access to Iformatio Act ad the Privacy Act. To fulfill this madate, the ATIP Directorate: respods to ad equiries uder the Access to Iformatio Act ad the Privacy Act; provides advice ad guidace to CRA employees o for, ad the proper maagemet ad protectio of, persoal iformatio uder the CRA s cotrol; coordiates privacy impact assessmet processes withi the CRA, icludig givig expert advice to CRA employees o privacy implicatios, risks, ad optios for avoidig or reducig risks; gives traiig ad awareess sessios o the Access to Iformatio Act ad the Privacy Act ad the practices ad requiremets for maagig persoal iformatio; commuicates with the Treasury Board Secretariat of Caada ad the offices of the iformatio ad privacy commissioers of Caada about complaits, audits, ad policy or legislative requiremets; ad fulfills corporate plaig ad reportig obligatios such as the CRA s aual reports to Parliamet o the admiistratio of the Access to Iformatio Act ad the Privacy Act. The Director of the ATIP Directorate has the full delegated authority of the Miister of Natioal Reveue uder the Access to Iformatio Act ad Privacy Act, maages ad coordiates the ATIP program, leads strategic plaig ad developmet iitiatives, ad supports the Assistat Commissioer, Public Affairs Brach, ad Chief Privacy Officer. The ATIP Directorate is made up of two mai divisios: process; ad, program support ad traiig (withi the Directorate ad CRA wide). I additio to its headquarters office i Ottawa, the ATIP Directorate has a office i Vacouver ad a office i Motréal. I , 117 full-time ATIP Directorate employees admiistered the Access to Iformatio Act ad the Privacy Act. The Admiistratio of the Privacy Act 5

8 Director, Access to Iformatio ad Privacy Directorate Assistat Director, ATIP Productios Corporate & Complex Case Divisio Assistat Director, ATIP Productios Strategic Compliace Divisio Assistat Director, ATIP Productios Legislative & HQ Operatioal Case Divisio Assistat Director, ATIP Productios Regioal Operatios Case Divisio Motreal Assistat Director, ATIP Productios Regioal Operatios Case Divisio Vacouver Assistat Director, Program Support ad Traiig Divisio Tax Compliace Sectio Operatios Traiig Maual Complaits Project Legislative Case Sectio HQ Operatios Sectio Goverace & Corporate Reportig Sectio Busiess Process Sectio The Access to Iformatio ad Privacy Oversight Review Committee The Access to Iformatio ad Privacy Oversight Review Committee is a assistat commissioer level committee, chaired by the Chief Privacy Officer. The committee was established to esure horizotal cosultatio, collaboratio, ad decisio-makig o emergig ATIP issues at the CRA. Amog other resposibilities, the committee reviews high-risk privacy impact assessmets, idetifies measures to support more effective admiistratio of ATIP-related matters, ad champios ATIP related activities. Delegatio of resposibilities uder the Privacy Act As head of the CRA, the Miister of Natioal Reveue is resposible for how the CRA admiisters the Privacy Act ad complies with the Privacy Regulatios ad Treasury Board Secretariat of Caada policy istrumets. Sectio 73 of the Privacy Act gives the Miister of Natioal Reveue the authority to desigate oe or more officers or employees of the CRA to exercise or perform all, or part, of the Miister s powers, duties, ad fuctios uder the Act. The CRA s curret delegatio order for the Privacy Act was siged by the Miister of Natioal Reveue o March 6, It idetifies specific provisios of the Privacy Act ad its regulatios that the Miister has delegated to various positios withi the CRA. The Access to Iformatio ad Privacy Director ad assistat directors, as well as the maagers of the processig uits, approve resposes to uder the Privacy Act. Delegatios are also exteded to the Commissioer, the Deputy Commissioer, ad the Assistat Commissioer ad Chief Privacy Officer, Public Affairs Brach Aual Report to Parliamet

9 Miister of Natioal Reveue Miistre du Reveu atioal Ottawa, Caada K1A 0A6 Privacy Act Delegatio Order Arrêté sur la délégatio e vertu de la Loi sur la protectio des reseigemets persoels I, Kerry-Lye D. Fidlay, Miister of Natioal Reveue, do hereby desigate, pursuat to sectio 73 of the Privacy Act, the officers or employees of the Caada Reveue Agecy who hold the positios set out i the attached Schedule to exercise or perform the powers, duties, or fuctios that have bee give to me as head of a govermet istitutio uder the provisios of the Privacy Act as set out i the Schedule. This desigatio replaces all previous delegatio orders. Je, Kerry-Lye D. Fidlay, miistre du Reveu atioal, délègue par les présetes, e vertu de l article 73 de la Loi sur la protectio des reseigemets persoels, aux cadres ou employés de l Agece du reveu du Caada déteteurs des postes metioés das l aexe ci joite les attributios dot je suis, e qualité de resposable d ue istitutio fédérale, ivestie par les dispositios de la Loi sur la protectio des reseigemets persoels qui sot metioées das l aexe. Le préset documet remplace et aule tout arrêté atérieur. La miistre du Reveu atioal, Kerry-Lye D. Fidlay Miister of Natioal Reveue Siged i Ottawa, Otario, Caada this 6th day of March, 2014 Sigé à Ottawa, Otario, Caada le 6 e jour de mars 2014 The Admiistratio of the Privacy Act 7

10 Schedule Privacy Act The CRA positios authorized to perform the powers, duties, ad fuctios give to the Miister of Natioal Reveue as head of a govermet istitutio uder the provisios of the Privacy Act ad its regulatios are the followig: Commissioer Full authority Deputy Commissioer Full authority Assistat Commissioer, Public Affairs Brach (PAB) ad Chief Privacy Officer Full authority Director, Access to Iformatio ad Privacy (ATIP) Directorate, PAB Full authority Assistat directors, ATIP Directorate, PAB Full authority Maagers, ATIP Directorate, PAB Paragraphs 8(2)(j) ad (m); subsectios 8(5) ad 9(1); sectios 14 to 16; paragraphs 17(2)(b) ad 17(3)(b), subsectios 19(1) ad 19(2); sectios 20 to 22 ad 23 to 28; subsectios 33(2), 35(1) ad 35(4) of the Privacy Act; ad sectio 9 the Privacy Regulatios Aual Report to Parliamet

11 Statistical report (Appedix A) Iterpretatio ad explaatio Appedix A provides a statistical report o the CRA s activities uder the Privacy Act for the reportig period. The followig explais ad iterprets the statistical iformatio. Requests uder the Privacy Act Durig this reportig period (April 1, 2014, to March 31, 2015), the CRA received 2,533 ew privacy. This is a icrease of 986 (64%) over last year s total of 1,548. With the 225 carried forward from , there were 2,758 active. Although there was a sigificat icrease i the privacy received durig the year compared with the previous year, the umber of received i was the third-lowest i the past te years. The followig table shows the umber of privacy the CRA received ad completed i the past five fiscal years. Fiscal year Requests received Requests completed Pages processed ,600 2, , ,362 1, , ,980 1, , ,548 1, , ,533 2, ,207 Other Requests I , the ATIP Directorate closed 14 cosultatio from other govermet istitutios ad orgaizatios. A total of 730 pages were reviewed to respod to these. (For more details o the cosultatios received from other govermet istitutios ad orgaizatios, icludig dispositio ad completio times, see Part 6 of Appedix A.) The ATIP Directorate s Program Support ad Traiig Divisio respoded to 2,333 s ad 704 telephoe equiries from iside ad outside the CRA. The resposes icluded givig advice ad guidace o processes ad procedures related to the Access to Iformatio Act ad the Privacy Act ad providig cotact iformatio. Completio time ad extesios The followig chart shows the completio times for the 2,313 closed i Extesios were take for 874 (38%) of these because meetig the origial 30 day time limit would have iterfered ureasoably with operatios or because there was a eed to cosult others (for example, other idividuals or other govermet departmets). The Admiistratio of the Privacy Act 9

12 The ATIP Directorate completed 2,121 (91.7%) withi the time frame required by law. This meas that resposes were provided withi 30 caledar days or, if a time extesio was take, withi the exteded deadlie. Deemed refusals ad complexities A deemed refusal is a request that was closed after the deadlie of 30 days set by law. Of the 2,313 closed durig the reportig period, 192 were closed after the deadlie, resultig i a deemed refusal rate of 8.3%. Although the CRA cotiues to work toward a deemed refusal rate of zero, as the Office of the Privacy Commissioer recommeded, the large volume of records that must be processed makes achievig this goal a cotiuig challege. The Treasury Board Secretariat developed criteria to determie if a request is complex. These criteria are: the umber of pages to process; ad the ature ad sesitivity of the subject matter. The CRA cotiues to hadle a large umber of that are cosidered complex based o the umber of pages. For closed i , the CRA reviewed 636,207 pages. Of the 1,788 for which records were disclosed, 873 (49%) ivolved processig more tha 100 pages, ad 143 of these ivolved processig a average of 1,928 pages. Other were cosidered complex because of the ature ad sesitivity of the subject matter. (See table of Appedix A for details.) Aual Report to Parliamet

13 Dispositios of Durig the reportig period, the ATIP Directorate completed 2,313 related to the Privacy Act. 729 were fully disclosed (31.52%) 1,059 were partially disclosed (45.78%) 6 were exempted i their etirety (0.26%) 0 were excluded i their etirety (0%) 49 resulted i o existig records (2.12%) 470 were abadoed by requesters (20.32%) 0 were either cofirmed or deied (0%) There was a otable icrease i the abadoed this year (470) compared to last year (156). 262 of the abadoed were received olie was the first year that requesters could submit a CRA Privacy Act request olie. Of the 262 abadoed olie, 110 were were for a social isurace umber; these were abadoed because they should have bee set to Service Caada ad ot the CRA. Aalysis will cotiue i to determie the reasos why such a high umber of olie were abadoed i For more details, see table 2.1 of Appedix A. Exemptios The Privacy Act allows a istitutio to sometimes refuse access to certai iformatio. For example, iformatio about idividuals other tha the requester caot be disclosed if the idividual has ot give his or her coset. These types of refusals are called exemptios. They must be limited ad relate to specific sectios of the Privacy Act. The CRA used the followig sectios of the Act to refuse access to iformatio i full or i part for 1,065 (46%) of the 2,313 closed durig the reportig period. Sectio 19 persoal iformatio obtaied i cofidece (40 ) Sectio 22 law eforcemet ad ivestigatio (467 ) Sectio 22.3 Public Servats Disclosure Protectio Act (1 request) Sectio 25 safety of idividuals (1 request) Sectio 26 iformatio about aother idividual (912 ) Sectio 27 solicitor-cliet privilege (117 ) Exclusios The Privacy Act does ot apply to iformatio that is already publicly available, such as govermet publicatios ad material i libraries ad museums. It also excludes material such as Cabiet cofideces. There were o exclusios durig the reportig period. The Admiistratio of the Privacy Act 11

14 Format of iformatio released Requesters ca choose to receive their respose package i paper, CD, or DVD format. Providig documets electroically sigificatly reduces maual processes ad paper cosumptio. I , of the 1,788 for which iformatio was disclosed i full or i part, 1,308 (73%) were released i electroic format. This is a 17% icrease over the previous reportig period. Of the 551,338 pages fully or partially disclosed i , 486,415 (88%) pages were released i electroic format. Requests for traslatio Oe request required the traslatio of records i Records are ormally released i the laguage i which they exist; however, records may be traslated i a particular official laguage whe requested ad where the istitutio cosiders a traslatio or iterpretatio to be ecessary to help the requester uderstad the iformatio. Disclosures uder paragraph 8(2)(m) of the Privacy Act Durig the reportig period, there were o disclosures made uder paragraph 8(2)(m) of the Privacy Act. Paragraph 8(2)(m) provides that persoal iformatio may be disclosed for ay purpose where, i the opiio of the head of a istitutio, the public iterest i disclosure clearly outweighs ay ivasio of privacy that could result from the disclosure, or disclosure would clearly beefit the idividual to whom the iformatio relates. Correctios ad otatio The CRA did ot receive ay to correct persoal iformatio i Costs Durig , the ATIP Directorate s estimated total cost to admiister the Privacy Act was $4,329,167. This excludes sigificat support ad resources from the braches ad regios. For more details, see Appedix A. Operatioal eviromet As the chief admiistrator of federal, provicial, ad territorial tax laws, the CRA maitais oe of the Govermet of Caada s largest repositories of persoal iformatio, secod oly to Employmet ad Social Developmet Caada. I additio, the CRA collects ad maages the persoal iformatio for its workforce of more tha 40,000 idividuals Aual Report to Parliamet

15 The trust Caadias place i the CRA to safeguard the privacy of their persoal iformatio is a corerstoe of the CRA s work. I , the CRA worked o may projects to ehace its privacy maagemet framework. Chief Privacy Officer Actio Pla The Chief Privacy Officer (CPO) oversees privacy maagemet at the CRA. I , to support the CPO i achievig her madate, the ATIP Directorate developed a actio pla to make sure accoutabilities, resposibilities, ad activities related to privacy are reiforced ad commuicated across the CRA. The actio pla recogizes that all employees i all parts of the orgaizatio share the resposibility for maagig privacy. The pla idetifies key goals ad assigs accoutability for achievig them to specific areas withi the CRA. I , the ATIP Directorate worked with specific braches to set performace measures that ca be used to moitor ad report o progress agaist the goals ad iitiatives outlied i the actio pla. The goals ad iitiatives are liked to requiremets of the Treasury Board Secretariat, recommedatios i the Privacy Commissioer s 2013 audit of the CRA s privacy maagemet framework, ad the actio plas developed followig the CRA s risk assessmet i 2013 of uitetioal privacy breaches. These performace measures give the CPO a performace dashboard to cotiually assess ad report twice yearly to seior maagemet o the state of privacy maagemet at the CRA. ATIP actio pla As a result of a sigificat privacy breach withi the ATIP Directorate i November 2014, the Directorate developed a actio pla to ehace their privacy safeguards. See page 17 for more details. Raisig Awareess To ehace employees awareess of their privacy-related roles ad resposibilities, the ATIP Directorate participated i two awareess evets: Data Privacy Day ad Security Awareess Week. For the fourth cosecutive year, the CRA joied the Office of the Privacy Commissioer ad may other istitutios across Caada ad the world to promote Data Privacy Day. This iitiative highlights the effect that techology has o privacy rights ad uderlies the importace of valuig ad protectig persoal iformatio. The CRA s activities focused o the role all CRA employees play i safeguardig persoal iformatio i their day to day jobs. Over a week-log period, the ATIP Directorate highlighted these resposibilities across the CRA ad promoted the may tools available to support employees i fulfillig them. The ATIP Directorate also participated i the CRA s Security Awareess Week activities. Security Awareess Week was origially lauched by the Treasury Board Secretariat ad has become a The Admiistratio of the Privacy Act 13

16 aual opportuity for govermet departmets to discuss security topics, icludig those related to persoal privacy (for example, idetity theft). As part of Security Awareess Week, the Fiace ad Admiistratio Brach orgaized activities for employees, icludig a evet at Library ad Archives Caada. The ATIP Directorate set up a iformatio kiosk o may privacy-related topics, such as privacy impact assessmets, privacy breaches, ad the role of the CPO at the CRA. The ATIP Directorate also developed more targeted commuicatios to help staff fulfil their ATIP related resposibilities. ATIP cotacts: These employees i the braches ad regios respod to ATIP. They play a sigificat role i makig sure the ATIP Directorate receives all the iformatio it eeds to process o time. I , the ATIP Directorate cotiued to support ATIP cotacts by providig mothly s ad quarterly telecoferece calls to share sigificat iformatio with them ad to let them seek clarificatio, ad share challeges ad solutios with their colleagues. Project maagers: These employees eed to be aware of their privacy-related obligatios whe it comes to desigig ad implemetig projects. To help them do this, the ATIP Directorate updated the privacy practices toolkit to make sure project maagers have the tools to maage privacy properly at all times. Traiig The ATIP Directorate provides traiig to CRA employees about the requiremets of, ad their resposibilities uder, the Access to Iformatio Act ad the Privacy Act. This traiig is tailored to the eeds of specific audieces. For istace, employees who have little or o kowledge of the subject take course ATIP 101. Subject matter experts take more specific traiig, such as o how to respod to for records. I , ATIP traiig was give to 1,908 participats i 69 sessios across Caada. Also, 144 maagers received olie ATIP traiig uder the CRA s maagemet learig program. The ATIP Director also preseted awareess sessios to two CRA seior maagemet committees ad gave several presetatios at ATIP Oversight Review Committee meetigs. The CRA s Legal Services Brach also provided eight traiig sessios to 90 employees. These sessios focused o preparig documets for release i CRA readig rooms, o ATIP legal awareess, ad o ATIP iformatio for techology specialists. Also durig the fiscal year, all employees i the ATIP Directorate completed the madatory CRA security awareess course. Privacy projects I , the ATIP Directorate cotiued to stregthe privacy maagemet through two projects: privacy otices ivestigative bodies desigatio Aual Report to Parliamet

17 Privacy otices The Privacy Act requires that istitutios use a privacy otice to tell idividuals from whom they collect persoal iformatio why the iformatio is beig collected. The privacy otice must be iserted every time persoal iformatio is collected, whether it is o a paper or electroic form, a olie applicatio, or by ay other method. Treasury Board Secretariat policies set out the cotet that the otices must cotai. I , the ATIP Directorate bega reviewig CRA forms to make sure the CRA is followig all legislative ad Treasury Board policy requiremets. Sigificat progress has bee made ad full privacy otices have bee icorporated o the majority of the CRA s idividual taxpayer returs ad forms. A workig group has bee set up to develop a pla for all other CRA forms that collect persoal iformatio, such as those that relate to corporatios, GST, ad beefit programs. Ivestigative bodies desigatio I , the ATIP Directorate cotiued to work with stakeholders to provide ew ad revised submissios to the Departmet of Justice Caada for ivestigative body desigatios uder Schedules II ad III of the Privacy Regulatios. These schedules list ivestigative bodies of the federal govermet to which persoal iformatio ca be disclosed for ivestigative purposes. Fial submissios were provided to the Departmet of Justice Caada i Oce the ivestigative body submissios receive official approval from the Departmet of Justice, Schedule II of the Privacy Regulatios will be updated. Moitorig request ivetories The CRA s ATIP Directorate produces a mothly report that captures key statistical iformatio about the CRA s ivetory of ATIP. This report shows the average times for each of the key phases of request processig (for example, itake, search ad locate records, ad aalysis). The report also provides statistical iformatio about the umber of extesios take, completio times, pages processed, complaits, ad complait dispositio. The ATIP Director uses this report to moitor treds, measure ATIP Directorate performace, ad determie ay process chages required to improve performace. The ivetory is a regular ageda item for seior maagemet meetigs withi the ATIP Directorate. Maagig privacy breaches The CRA has may cotrols i place to safeguard taxpayer iformatio, icludig its Itegrity Framework, iformatio techology, ad security cotrols. Despite these cotrols, privacy breaches sometimes occur. Whe they do, the CRA ivestigates ad reports material breaches to the Office of the Privacy Commissioer ad the Treasury Board Secretariat of Caada. Affected idividuals are also otified if eeded ad measures are take to prevet breaches from occurrig agai. The Admiistratio of the Privacy Act 15

18 Effectively maagig privacy breaches is a resposibility that the ATIP Directorate ad the Security ad Iteral Affairs Directorate i the Fiace ad Admiistratio Brach share through a iformatio-sharig protocol. Uder the protocol, the Security ad Iteral Affairs Directorate must iform the ATIP Directorate of sigificat privacy breaches through its early otificatio process. It also must advise the ATIP Directorate that it is lauchig a ivestigatio ito a alleged privacy breach as a result of employee miscoduct ad withi 30 days of the ed of a ivestigatio. The Agecy Security Officer decides whether affected idividuals should be otified accordig to Treasury Board Secretariat requiremets, ad the ATIP Directorate must cofirm that it agrees with this decisio. Whe the ATIP Directorate disagrees with a decisio about otifyig affected idividuals, the ATIP Director has to refer the case to the CPO for a fial decisio. Durig , the CRA otified the Office of the Privacy Commissioer ad the Treasury Board Secretariat of 37 material privacy breach icidets. Privacy breaches ivolvig taxpayer iformatio geerally fall ito three broad categories: employee miscoduct (such as uauthorized access, use, or disclosure of taxpayer iformatio); uitetioal breaches (such as huma error, egligece, or procedural or mechaical issues); or breaches stemmig from iformatio techology vulerabilities. Of the 37 material privacy breach icidets reported to the Office of the Privacy Commissioer ad the Treasury Board Secretariat i : 32 ivolved uauthorized access to taxpayer iformatio by a CRA employee 2 ivolved uauthorized disclosure of taxpayer iformatio 2 ivolved misdirected mail 1 stemmed from the theft of iformatio Two of these breaches geerated sigificat public attetio durig the year: a icidet ivolvig the theft of iformatio from the CRA s systems through the Heartbleed vulerability ad a icidet ivolvig the iadvertet release of persoal iformatio to the Caadia Broadcastig Corporatio. Itegrity i the workplace is the corerstoe of the CRA s culture. The CRA supports its employees i doig the right thig by providig clear guidelies ad tools to esure privacy, security, ad the protectio of CRA programs ad data. This icludes: refreshig the Code of ethics ad coduct; icreasig itegrity awareess through commuicatios ad tools; updatig the CRA Itegrity Framework aually; lauchig the aoymous iteral fraud ad misuse reportig lie; moderizig the Natioal Audit Trail System; ad itroducig the ew Reliability + Persoel Security Screeig Aual Report to Parliamet

19 Heartbleed vulerability (theft of iformatio) I April 2014, there was a malicious breach of CRA s systems as a result of the Heartbleed vulerability. The CRA quickly closed dow e-services, icludig My Accout ad My Busiess Accout, for five days to cotai the vulerability. While public cofidece i the CRA s olie services remaied strog, a extesive lessos-leared exercise across govermet followig the icidet has resulted i ew protocols for detectig ad sharig iformatio o iformatio techology vulerabilities. Iadvertet release of iformatio to the Caadia Broadcastig Corporatio (misdirected mail) I November 2014, a CRA employee iadvertetly set the wrog package of iformatio to a access to iformatio requester who was a Caadia Broadcastig Corporatio (CBC) jouralist. A ivestigatio cofirmed that taxpayer iformatio had bee disclosed as a result of huma error. I spite of the CRA s efforts to retrieve the iformatio, the CBC chose to publish some of the iformatio i a article. The CRA immediately addressed the icidet by coductig a iteral ivestigatio ad implemetig a pla to ehace cotrols withi the CRA s ATIP operatios. The pla s ehacemets focus o three broad areas: operatioal processes, commuicatios ad traiig, ad accoutabilities. May of these activities have already bee implemeted, icludig the followig: completio of role-specific traiig ad madatory security traiig by all ATIP Directorate staff; itroductio of additioal quality assurace measures at the mail-out stage of the process for preparig ad sedig request resposes; ad additioal trackig system gates to reiforce critical steps i processig a request. The CRA also iitiated a third-party idepedet review of its access to iformatio ad privacy maagemet frameworks. The recommedatios from that review will be implemeted i Privacy impact assessmets I its 2013 audit of the CRA s privacy maagemet framework, the Office of the Privacy Commissioer recommeded that the CRA complete ad approve privacy impact assessmets (PIAs) before implemetig ay ew program or iitiative that might cause privacy risks to taxpayer iformatio. I respose, the CRA created a risk-based PIA pla that aligs with its program activity architecture. The pla, which is reewed ad updated periodically, icludes 40 PIAs. New PIAs will be added to the pla as required. Durig the reportig period, the CRA completed six PIAs ad set them to the OPC ad the Treasury Board Secretariat for review. A additioal 88 iitiatives were reviewed to assess potetial privacy cocers. This ivolved reviewig documets such as privacy assessmet determiatio questioaires, threat ad risk assessmets, ad memoradums of uderstadig. The Admiistratio of the Privacy Act 17

20 The ATIP Directorate also cotracted PIA specialists to help program areas complete their PIAs, ad has adopted a portfolio approach to support program braches. I lie with the Treasury Board Secretariat s Directive o Privacy Impact Assessmet, the CRA releases summaries of completed PIAs o its website ( The followig are the summaries of the six PIAs completed i : GST/HST Returs ad Rebates Processig Program This PIA covers the workload withi the Busiess Returs Directorate for GST/HST tax returs, rebate applicatios ad various electios that are filed by busiesses, third parties ad idividuals. It pertais to the GST/HST that busiesses ad third parties collect ad submit ad to GST/HST that idividuals ad busiesses pay where a rebate applies. It also covers various electios that busiesses ca make to amed certai aspects of their GST/HST accout, for example, chagig a filig frequecy. This PIA does ot iclude the GST/HST credit program, which is available to idividuals based o icome thresholds ad is issued every three moths. This program is admiistered by the Beefit Programs Directorate. Recet chages to the program iclude: 1. Admiisterig the Price Edward Islad harmoized sales tax. As with several other provices, PEI reached a agreemet with the Govermet of Caada to harmoize its provicial sales tax with the GST effective April 1, The CRA admiisters all aspects of the PEI HST, icludig processig HST returs, rebates, ad electios. 2. Admiisterig the GST ad the Quebec Sales Tax (QST) for selected listed fiacial istitutios that have a permaet establishmet i Quebec ad those that have a permaet establishmet outside Quebec but do busiess i Quebec. 3. Effective April 13, 2015, collectig ad storig the Iteret protocol address used to file a electroic GST/HST retur. Scietific Research ad Experimetal Developmet (SR&ED) Icetive Program (Ehaced Expeditures Claim, Form T661) Budget 2013 itroduced measures to give the CRA admiistrative tools to improve risk assessmet. Form T661, the SR&ED expeditures claim form, was revised to ask for more detailed iformatio about claim preparers ad billig arragemets. I particular, if oe or more third parties helped to prepare a claim, the busiess umber of each third party ow has to be icluded. The form also asks for details about the billig arragemets, icludig whether cotigecy fees were used ad the amout of the fees payable. If o third party was ivolved, the claimat ow has to certify that o third party helped i ay way to prepare the SR&ED claims. The CRA will carefully aalyze the additioal iformatio required to see if there is ay correlatio with a higher risk of o-compliace i SR&ED claims Aual Report to Parliamet

21 Telephoe Equiries Program The CRA s telephoe equiries program provides support to idividuals, beefit recipiets, busiesses, ad trusts. It helps them meet their tax obligatios, make them aware of their beefit etitlemets, ad helps them with their geeral or accout-specific equiries. The program ecourages compliace because callers ca address ay issues or get iformatio they eed to meet their obligatios ad receive their beefit etitlemets. The telephoe equiries program itroduced the Lik Maagemet System, which allows call cetre agets to sed a to a taxpayer that cotais a lik to a form or publicatio. Autheticatio ad Credetial Maagemet Services The CRA has bee a major stakeholder i the Govermet of Caada Cyber-Autheticatio Reewal Iitiative. As part of the iitiative, the CRA provides its ow autheticatio ad credetial maagemet service for idividuals, busiess owers, ad represetatives to use whe they access the CRA s olie services. T1 Residecy Project The CRA admiisters tax, credits, ad beefit programs o behalf of certai provices ad territories to provide better service to taxpayers. The provice of Newfoudlad ad Labrador has expressed growig cocer with the residecy status of some Caadia taxpayers who file their retur as residets of oe provice but get their services from aother provice. The tax collectio agreemets commit the CRA to makig a reasoable effort to couter false claims of residecy. The CRA is establishig a ew arragemet whereby Newfoudlad ad Labrador would give the CRA more iformatio, i order to allow the CRA to more effectively use its fiacial resources o cases where the risk of o-compliace is higher. Iteratioal Electroic Fuds Trasfers Busiess Itelligece Ecoomic Actio Pla 2013 highlighted that iteratioal tax evasio ad aggressive tax avoidace cost govermets ad taxpayers worldwide ad are ufair to the busiesses ad idividuals who do play by the rules. It itroduced measures to address iteratioal tax evasio ad aggressive tax avoidace. These measures icluded a requiremet for some fiacial itermediaries to report iteratioal electroic fuds trasfers of $10,000 or more to the CRA. The mai objective is to geerate itelligece ad leads that are relevat to tax o-compliace, particularly offshore tax ocompliace. Fiacial istitutios bega reportig o Jauary 1, Reportig etities must provide iformatio o the perso coductig the trasactio, the recipiet of the fuds, the trasactio itself, ad the fiacial itermediaries facilitatig the trasactio. The Admiistratio of the Privacy Act 19

22 Policies, guidelies, ad procedures Procedures o the disclosure of persoal iformatio uder subsectio 8(2) of the Privacy Act Subsectio 8(2) of the Privacy Act outlies circumstaces where persoal iformatio ca be disclosed. I , after extesive cosultatios, the CRA fialized procedures o disclosig persoal iformatio. They will be formally approved i The procedures will esure cosistecy ad accoutability i how persoal iformatio is disclosed across the CRA. They will help CRA employees ad maagers determie whe disclosure uder the Privacy Act is warrated, based o limited ad specific criteria, ad who should approve the disclosures. CRA privacy policy suite I its 2013 audit of the CRA s privacy maagemet framework, the Office of the Privacy Commissioer recommeded that the CRA defie fully the role of the CPO ad moitor how the CPO s madate is implemeted i terms of awareess of employee privacy, reductio of privacy risk, ad overall CRA compliace with the Privacy Act. The CRA privacy policy suite was revised to clarify the CPO role. These chages will be formally approved ad commuicated to employees i Complaits, ivestigatios, ad Federal Court cases Durig , the CRA received 31 complaits uder the Privacy Act ad closed 35 complaits. The followig chart details the dispositio of the complaits closed durig the fiscal year. (For defiitios of the dispositio categories, go to Oe case wet to Federal Court Aual Report to Parliamet

23 There were o complaits with a dispositio of settled durig the course of ivestigatio durig the reportig period. The ATIP Directorate also received 164 complaits about alleged improper access, collectio, use, or disclosure of persoal iformatio by the CRA. Complaits came from a variety of areas icludig the Office of the Privacy Commissioer, idividuals, ad the CRA s Security ad Iteral Affairs Directorate. Outstadig from previous fiscal year Received durig fiscal year Completed Closig ivetory Effectively maagig privacy breaches is critical i maitaiig public cofidece i the itegrity of the CRA. The CRA takes all breaches very seriously ad is stregtheig its cotrols ad sactios for uauthorized access ad disclosure. (See Privacy breach maagemet for details.) Collaboratio with oversight bodies ad other orgaizatios The CRA cotiues to work closely with the Office of the Privacy Commissioer, the Treasury Board Secretariat of Caada, ad other orgaizatios to stregthe privacy maagemet at the CRA. Office of the Privacy Commissioer audit I , the Office of the Privacy Commissioer completed a audit of the CRA s privacy maagemet framework as a follow up to its February 2009 audit, Privacy Maagemet Frameworks of Selected Federal Istitutios. The CRA is o track to complete six of the ie audit recommedatios i Other activities will be fully implemeted by because they require the developmet ad deploymet of ew Agecy-wide IT systems ad cotrols. The Admiistratio of the Privacy Act 21

24 Recommedatio The Caada Reveue Agecy should defie fully the role of the Chief Privacy Officer ad moitor the implemetatio of the positio s madate i terms of employee privacy awareess, privacy risk reductio ad overall Agecy compliace with the Privacy Act Cosistet with the Treasury Board Directive o Privacy Impact Assessmets, the CRA should complete, review ad approve privacy impact assessmets prior to the implemetatio of ay ew program or iitiative that may raise privacy risks to taxpayer iformatio; ad esure that its ATIP Directorate is otified of all breaches as they are discovered. The Caada Reveue Agecy should implemet a Certificatio ad Accreditatio process that clearly assigs accoutability ad resposibility for the maagemet of the process, as well as oversight to esure CRA documetatio is approve o time. The Caada reveue Agecy should also prioritize critical systems ad all related applicatios to esure they udergo the Certificatio ad Accreditatio process ad Treat ad Risk Assessmets. CRA progress Established performace measures to moitor ad report o progress agaist the goals ad iitiatives outlied i the CPO actio pla. Drafted iteral commuicatios policy to promote the madate of the CPO. The CPO preseted a update o the state of privacy at the CRA to seior maagemet at least twice durig the fiscal year. This recommedatio was fully implemeted i Implemeted a CRA-wide PIA pla. The pla is cotiually updated. At the ed of the fiscal year, there were 40 PIAs i the pla. Full implemetatio i Lauched a revised security assessmet ad authorizatio process for future eterprise applicatios. Cotiued to coduct aual status updates for all security evaluatios completed sice Cotiued to address missig threat ad risk assessmets for high-priority applicatios. Esured local applicatio repository Web applicatio is i place so that proper security evaluatios are completed ad tracked. Full implemetatio i Aual Report to Parliamet

25 Recommedatio The Caada Reveue Agecy should: esure that its policies, practices ad procedures are followed to maage local applicatios ad adequate safeguards are used to protect the taxpayer iformatio they cotai; esure that its Local Applicatio Repository is reviewed regularly for completeess, accuracy ad currecy; ad follow up at each stage of the review ad quality assurace processes ad esure that all local applicatios are approved by delegated officials before implemetatio. The Caada Reveue Agecy should cotiue to ehace its Idetity ad Access Maagemet System cotrols to esure that employee access is limited to oly that iformatio required to carry out their job fuctios, based o the eed-tokow priciple. CRA progress Coducted a review of the existig procedures ad safeguards, together with a curret-state assessmet of the local applicatio repository. Developed a actio pla to close gaps i the local applicatio repository. Ehaced the goverace process to iclude a madatory review ad approval process focusig o cofirmatio that PIAs ad techical security reviews are completed before they are deployed to make sure they are complete, accurate, ad curret. This recommedatio was fully implemeted i Ogoig review of the roles ad profiles maagers use to provide accesses for their employees with the highest-priority applicatios. Cotiued to implemet a ehaced aual verificatio process of the CRA systems access roles ad profiles. Cotiued to implemet the idetity ad access maagemet program: Phase 3 (password maagemet) (implemetatio plaed for March 2016). Phase 4 (access maagemet) (implemetatio plaed for March 2017). Full implemetatio i The Admiistratio of the Privacy Act 23

26 Recommedatio The Caada Reveue Agecy should review existig geeric user IDs, oes shared by several idividuals workig o the same project or activity, to determie whether they are required, authorized ad cotrolled; ad should delete all IDs that are ot i use. The Caada Reveue Agecy should also esure that all geeric user IDs are subject to established review ad approval processes. Cosistet with Treasury Board Guidelies for Privacy Breaches, the Caada Reveue Agecy should esure that the Access to Iformatio ad Privacy Directorate is otified of all breaches as they are discovered. The Caada Reveue Agecy should cotiue to stregthe its audit loggig system ad process ad the Agecy should icorporate risk assessmet tools to flag potetially iappropriate employee activities o its systems. The Caada Reveue Agecy should esure adequate measures are i place to mitigate the risks associated with developer access to taxpayer iformatio i test eviromets. The Caada Reveue Agecy should also rigorously cotrol, track ad moitor trasfers of taxpayer iformatio from operatioal to test eviromets. CRA progress Ehaced cotrols to reduce the umber of geeric accouts. Cotiued to leverage the authoritative idetity store implemeted i May 2013 to review existig geeric accouts, delete those ot i use, ad assig accoutability for each accout to desigated idividuals. Cotiued to ehace security awareess ad accoutability for geeric accouts. Full implemetatio i Implemeted the ew audit trail record aalysis tool to help maagemet review employee accesses. Cotiued to ehace techological tools ad associated busiess processes to aalyze user trasactios ad idetify issues ad questioable patters. Awarded the cotract for the Eterprise Fraud Maagemet System. Testig of the system cotiues ad implemetatio is plaed for March Full implemetatio i Updated ad commuicated the policy suite cocerig populatig ad accessig taxpayer data i test eviromets. Developed a optios aalysis to idetify the most effective method to cotrol, track, ad moitor trasfers of taxpayer iformatio from operatioal to test eviromets. Full implemetatio i Aual Report to Parliamet

27 Recommedatio Cosistet with Treasury Board Guidelies for Privacy Breaches, the Caada Reveue Agecy should esure that the Access to Iformatio ad Privacy Directorate is otified of all breaches as they are discovered. CRA progress The Security ad Iteral Affairs Brach esures that the ATIP Directorate is otified of all breaches as they are discovered. Reviewed iformatio-sharig protocol betwee Security ad Iteral Affairs Directorate ad the ATIP Directorate to esure cosistecy with Treasury Board guidelies for privacy breaches. Reviewed ad revised existig corporate policy istrumets ad resposibilities to reflect the appoitmet of the Chief Privacy Officer. Security ad Iteral Affairs Directorate s corporate policy istrumets approved, CRA privacy policy istrumets scheduled to be approved i Full implemetatio i Treasury Board Secretariat of Caada The CRA cosulted with the Treasury Board Secretariat s Iformatio ad Privacy Policy Divisio o umerous occasios. CRA officials also participated i ATIP commuity meetigs that the Treasury Board led throughout the fiscal year. The CRA s ATIP Coordiator participated i three pael discussios durig these meetigs. The CRA also participated i the Treasury Board Secretariat s director geeral-level ATIP Traiig Workig Group. The group established six priorities for to moderize ATIP traiig i the Govermet of Caada: privacy basics, icludig PIAs prevetig, maagig, ad reportig privacy breaches ATIP awareess traiig for the executive cadre i govermet Cabiet cofideces ad the revised cosultatio process most-frequetly ivoked exemptios ATIP geeral awareess Several ATIP Directorate employees participated o the sub workig groups to develop traiig products for these six priorities. The Admiistratio of the Privacy Act 25

28 I April 2014, the CRA joied the ATIP request ad pay olie iitiative. This iitiative has sigificatly decreased the umber of ATIP received by mail. The CRA is also a member of the Request ad pay olie desig workig group. The CRA provides ogoig feedback to the group o the olie request iitiative to improve its fuctioality. The CRA also tracks the umber of olie received compared to the total umber of received from all other methods to assess whether the public is receptive to this ew method of access. House Stadig Committee o Access to Iformatio, Privacy ad Ethics I April 2014, three seior CRA officials, icludig the Chief Privacy Officer, appeared before the House Stadig Committee o Access to Iformatio, Privacy ad Ethics. The CRA was oe of several istitutios ivited to appear before the Committee to support its study o the growig problem ad impact of idetity theft Aual Report to Parliamet

29 Coclusio The CRA takes privacy ad the safeguardig of persoal iformatio very seriously. I , the CRA will cotiue to stregthe its operatios ad privacy goverace by: deliverig targeted commuicatios ad traiig to key iteral ad exteral audieces with a emphasis o iformal ad proactive disclosure ad privacy maagemet moitorig ad evaluatig performace to address ATIP challeges promptly icreasig quality assurace ad process improvemets implemetig the Chief Privacy Officer Actio Pla to make sure privacy accoutabilities, resposibilities, ad activities are formalized ad commuicated The Admiistratio of the Privacy Act 27

30 Appedix A Statistical report Statistical Report o the Privacy Act Name of istitutio: Caada Reveue Agecy Reportig period: April 1, 2014 to March 31, 2015 PART 1 Requests uder the Privacy Act Received durig reportig period 2,533 Outstadig from previous reportig period 225 Total 2,758 Closed durig reportig period 2,313 Carried over to ext reportig period 445 PART 2 Requests closed durig the reportig period 2.1 Dispositio ad completio time Dispositio of 1 to 15 days 16 to 30 days 31 to 60 days Completio time 61 to 120 days 121 to 180 days 181 to 365 days More tha 365 days All disclosed Disclosed i part All exempted All excluded No records exist Request abadoed Neither cofirmed or deied Total ,313 Total Aual Report to Parliamet