Annual Report to Parliament

Transcription

1 Aual Report to Parliamet o the Admiistratio of the Privacy Act RC4415-1(E) Rev. 14

2

3 Foreword Each fiscal year, the head of every govermet istitutio has to prepare ad submit to Parliamet a report o the admiistratio of the Privacy Act. This aual report is tabled i Parliamet i accordace with sectio 72 of the Privacy Act uder the directio of the Miister of Natioal Reveue ad the Commissioer of the Caada Reveue Agecy (CRA). It describes how the CRA admiistered ad fulfilled its obligatios uder the Privacy Act durig the April 1, 2013, to March 31, It also discusses issues of iterest related to program delivery, emergig treds, areas of focus for the year ahead. The Privacy Act The Privacy Act came ito force o July 1, It protects the privacy of idividuals by outliig strog requiremets for collectig, retaiig, usig, disclosig, ad disposig of persoal iformatio held by govermet istitutios. It also provides idividuals (or their authorized represetatives) with a right of access to their ow persoal iformatio, with limited ad specific exceptios ad with rights of correctio or aotatio or both. Idividuals who are dissatisfied with ay matter related to a formal request made uder the Privacy Act are etitled to complai to the Privacy Commissioer of Caada. The Privacy Act s formal processes do ot replace other meas of obtaiig govermet iformatio. The CRA ecourages idividuals ad their represetatives to cosider gettig iformatio through the followig iformal methods: topical idexes o the CRA Web site: idividual icome tax equiries (icludig requests for forms ad publicatios): uiversal child care beefit, Caada child tax beefit ad related provicial ad territorial programs, child disability beefit, ad childre s special allowaces equiries: TTY (teletypewriter for persos who are deaf or hard of hearig or who have a speech impairmet): The Admiistratio of the Privacy Act

4

5 Table of Cotets Overview of the Caada Reveue Agecy... 4 Chief Privacy Officer... 5 The Access to Iformatio ad Privacy Directorate... 5 The Access to Iformatio ad Privacy Oversight Review Committee... 6 Delegatio of resposibilities uder the Privacy Act... 6 Schedule Privacy Act... 8 Statistical report (Appedix A) Iterpretatio ad explaatio... 9 Operatioal eviromet Moitorig request ivetories Privacy Breach Maagemet Privacy impact assessmets Policies, guidelies, ad procedures Complaits ad ivestigatios Collaboratio with oversight bodies Coclusio Appedix A Statistical report The Admiistratio of the Privacy Act

6 Overview of the Caada Reveue Agecy The Caada Reveue Agecy (CRA) admiisters tax laws for the Govermet of Caada ad for most provices ad territories. It also admiisters various social ad ecoomic beefit ad icetive programs delivered through the tax system. I additio, the CRA has the authority to eter ito ew parterships with the provices, territories, ad other govermet bodies at their request ad o a cost-recovery basis to admiister o-harmoized taxes ad other services. Overall, the CRA promotes compliace with Caada s tax legislatio ad regulatios ad plays a importat role i the ecoomic ad social well-beig of Caadias. The Miister of Natioal Reveue is accoutable to Parliamet for all of the CRA s activities, icludig admiisterig ad eforcig the Icome Tax Act ad the Excise Tax Act. The Caada Reveue Agecy Act provides for the establishmet of a Board of Maagemet cosistig of 15 directors appoited by the Goveror i Coucil. They iclude the Chair, the Commissioer ad Chief Executive Officer, a director omiated by each provice, oe director omiated by the territories, ad two directors omiated by the federal govermet. Uder the provisios of the Caada Reveue Agecy Act, the Board of Maagemet oversees the orgaizatio ad admiistratio of the CRA, icludig the maagemet of its resources, services, property, persoel, ad cotracts. I fulfillig this role, the Board of Maagemet brigs a forward-lookig strategic perspective to the CRA s operatios, fosters soud maagemet practices, ad is committed to efficiet ad effective service delivery. As the CRA s chief executive officer, the Commissioer is resposible for the day to day admiistratio ad eforcemet of the program legislatio that falls uder the Miister s delegated authority. The Commissioer is accoutable to the Board of Maagemet for maagig the CRA, supervisig employees, ad implemetig policies ad budgets. Moreover, the Commissioer must assist ad advise the Miister with respect to legislated authorities, duties, fuctios, ad Cabiet resposibilities. The CRA is made up of 12 braches ad 5 regioal offices across the coutry. Braches Appeals Assessmet ad Beefit Services Audit, Evaluatio, ad Risk Compliace Programs Fiace ad Admiistratio Huma Resources Regios Atlatic Otario Pacific Iformatio Techology Legal Services Legislative Policy ad Regulatory Affairs Public Affairs Strategy ad Itegratio Taxpayer Services ad Debt Maagemet Prairie Quebec Aual Report to Parliamet

7 Chief Privacy Officer I March 2013, the Caada Reveue Agecy (CRA) appoited its first chief privacy officer (CPO), a title held by the Assistat Commissioer of the Public Affairs Brach. The CPO has a broad madate for privacy oversight at the CRA. To fulfill this madate, the CPO: oversees decisios related to privacy, icludig privacy impact assessmets (PIAs); champios persoal privacy rights accordig to legislatio ad policy, icludig maagig iteral privacy breaches; ad reports to the CRA s seior maagemet o the state of privacy maagemet at the CRA at least twice a year. The Access to Iformatio ad Privacy Directorate The ATIP Directorate supports the CRA i meetig its requiremets uder the Access to Iformatio Act ad the Privacy Act. To fulfill this madate, the ATIP Directorate: respods to requests ad equiries uder the Access to Iformatio Act ad the Privacy Act; provides advice ad guidace to CRA employees o requiremets related to requests for, ad the proper maagemet ad protectio of, persoal iformatio uder the CRA s cotrol; coordiates privacy impact assessmet processes withi the CRA, icludig givig expert advice to CRA employees o privacy implicatios, risks, ad optios for avoidig or reducig risks; gives traiig ad awareess sessios o the Access to Iformatio Act ad the Privacy Act ad the practices ad requiremets for maagig persoal iformatio; commuicates with the Treasury Board Secretariat ad the offices of the iformatio ad privacy commissioers of Caada about complaits, audits, ad policy or legislative requiremets; ad fulfills corporate plaig ad reportig obligatios such as the CRA s aual reports to Parliamet o the admiistratio of the Access to Iformatio Act ad the Privacy Act. The Director of the ATIP Directorate has the full delegated authority of the Miister of Natioal Reveue, maages ad coordiates the ATIP program, leads strategic plaig ad developmet iitiatives, ad supports the Assistat Commissioer, Public Affairs Brach, ad Chief Privacy Officer. The ATIP Directorate is made up of two mai divisios: processig, ad program support ad traiig (withi the Directorate ad CRA-wide). I additio to its Headquarters office i Ottawa, the ATIP Directorate has a office i Vacouver ad a office i Motreal. I , 130 full time employees were resposible for admiisterig the Access to Iformatio Act ad the Privacy Act. The Admiistratio of the Privacy Act 5

8 Director, Access to Iformatio ad Privacy Directorate Assistat Director, ATIP Productios Corporate & Complex Case Divisio Assistat Director, ATIP Productios Strategic Compliace Divisio Assistat Director, ATIP Productios Legislative & HQ Operatioal Case Divisio Assistat Director, ATIP Productios Regioal Operatios Case Divisio Motreal Assistat Director, ATIP Productios Regioal Operatios Case Divisio Vacouver Assistat Director, Program Support ad Traiig Divisio Tax Compliace Sectio Operatios Traiig Maual Complaits Project Legislative Case Sectio HQ Operatios Sectio Goverace & Corporate Reportig Sectio Busiess Process Sectio The Access to Iformatio ad Privacy Oversight Review Committee The Access to Iformatio ad Privacy (ATIP) Oversight Review Committee is a executive level committee with represetatives from all CRA braches ad regios. The Committee was established to esure horizotal cosultatio, collaboratio, ad decisio-makig o emergig ATIP issues at the CRA. Amog other resposibilities, the Committee reviews high-risk privacy impact assessmets, idetifies measures to support more effective admiistratio of ATIP-related matters withi the CRA, ad champios ATIP related activities withi the CRA. I , the membership of this committee was raised to assistat commissioer-level ad the Assistat Commissioer, Public Affairs Brach, ad Chief Privacy Officer was appoited the Chair. These chages make sure ATIP matters are at the forefrot for seior maagemet at the CRA. Delegatio of resposibilities uder the Privacy Act As head of the CRA, the Miister of Natioal Reveue is resposible for how the CRA admiisters the Privacy Act ad complies with the Privacy Regulatios ad Treasury Board Secretariat policy istrumets. Sectio 73 of the Privacy Act gives the Miister of Natioal Reveue the authority to desigate oe or more officers or employees of the CRA to exercise or perform all, or part, of the Miister s powers, duties, ad fuctios uder the Act. The CRA s curret delegatio order for the Privacy Act was siged by the Miister of Natioal Reveue o March 6, It idetifies specific provisios of the Privacy Act ad its regulatios that the Miister has delegated to various positios withi the CRA. The Access to Iformatio ad Privacy Director ad assistat directors, as well as the maagers of the processig uits, approve resposes to requests uder the Privacy Act. Delegatios are also exteded to the Commissioer, the Deputy Commissioer, ad the Assistat Commissioer ad Chief Privacy Officer, Public Affairs Brach Aual Report to Parliamet

9 Miister of Natioal Reveue Miistre du Reveu atioal Ottawa, Caada K1A 0A6 Privacy Act Delegatio Order Arrêté sur la délégatio e vertu de la Loi sur la protectio des reseigemets persoels I, Kerry-Lye D. Fidlay, Miister of Natioal Reveue, do hereby desigate, pursuat to sectio 73 of the Privacy Act, the officers or employees of the Caada Reveue Agecy who hold the positios set out i the attached Schedule to exercise or perform the powers, duties, or fuctios that have bee give to me as head of a govermet istitutio uder the provisios of the Privacy Act as set out i the Schedule. This desigatio replaces all previous delegatio orders. Je, Kerry-Lye D. Fidlay, miistre du Reveu atioal, délègue par les présetes, e vertu de l article 73 de la Loi sur la protectio des reseigemets persoels, aux cadres ou employés de l Agece du reveu du Caada déteteurs des postes metioés das l aexe ci joite les attributios dot je suis, e qualité de resposable d ue istitutio fédérale, ivestie par les dispositios de la Loi sur la protectio des reseigemets persoels qui sot metioées das l aexe. Le préset documet remplace et aule tout arrêté atérieur. La miistre du Reveu atioal, Kerry-Lye D. Fidlay Miister of Natioal Reveue Siged i Ottawa, Otario, Caada this 6th day of March, 2014 Sigé à Ottawa, Otario, Caada le 6 e jour de mars 2014 The Admiistratio of the Privacy Act 7

10 Schedule Privacy Act The positios authorized to perform the powers, duties, ad fuctios give to the Miister of Natioal Reveue as head of a govermet istitutio uder the provisios of the Privacy Act ad its regulatios. Commissioer Full authority Deputy Commissioer Full authority Assistat Commissioer, Public Affairs Brach (PAB) ad Chief Privacy Officer Full authority Director, Access to Iformatio ad Privacy (ATIP) Directorate, PAB Full authority Assistat directors, ATIP Directorate, PAB Full authority Maagers, ATIP Directorate, PAB Paragraphs 8(2)(j) ad (m); subsectios 8(5) ad 9(1); sectios 14 to 16; paragraphs 17(2)(b) ad 17(3)(b), subsectios 19(1) ad 19(2); sectios 20 to 22 ad 23 to 28; subsectios 33(2), 35(1) ad 35(4) of the Privacy Act; ad sectio 9 the Privacy Regulatios Aual Report to Parliamet

11 Statistical report (Appedix A) Iterpretatio ad explaatio Appedix A provides a statistical report o the CRA s activities uder the Privacy Act for the reportig period. The followig explais ad iterprets the statistical iformatio. Requests uder the Privacy Act Durig this reportig period (April 1, 2013, to March 31, 2014), the CRA received 1,548 ew privacy requests. This represets a decrease of 433 requests (21.8%) from last year s total of 1,980. Sice 228 requests were carried forward from , there was a total of 1,776 active requests. The followig table shows the umber of privacy requests the CRA received ad completed i the past five fiscal years. Fiscal year Requests received Requests completed Pages processed ,083 1, , ,600 2, , ,362 1, , ,980 1, , ,548 1, ,430 Other Requests I , the ATIP Directorate closed 9 cosultatio requests from other govermet istitutios ad orgaizatios. A total of 557 pages were reviewed to respod to these requests. (For more details o the cosultatios received from other govermet istitutios ad orgaizatios, icludig dispositio ad completio times, see Part 6 of Appedix A.) I additio, the ATIP Directorate s Program Support ad Traiig Divisio respoded to 2,987 s ad 515 telephoe equiries from iside ad outside the CRA. The resposes to these equiries icluded givig advice ad guidace o processes ad procedures relatig to the Access to Iformatio Act ad the Privacy Act ad providig alterate cotact iformatio. Completio time ad extesios The chart that follows shows the completio time frames for the 1,553 requests completed i For 561 (36.2%) of these requests, time extesios were take, because meetig the origial 30-day time limit would have iterfered ureasoably with operatios or because there was a eed to cosult others (for example, other idividuals) or to traslate the iformatio requested. The Admiistratio of the Privacy Act 9

12 The ATIP Directorate completed 1,434 (92.3%) requests withi the time frame required by law. This meas that resposes were provided withi 30 caledar days or, if a time extesio was take, withi the exteded deadlie. Deemed refusals ad complexities Of the 1,553 requests closed durig the reportig period, 119 were closed past the statutory deadlie, resultig i a deemed refusal rate of 7.7%. Although the CRA cotiues to strive toward a deemed refusal rate of zero, as has bee recommeded by the Offices of the Privacy Commissioer ad the Iformatio Commissioer, operatioal pressures make achievig this goal a challege. Based o complexity criteria developed by the Treasury Board Secretariat, the CRA cotiues to hadle a large umber of requests that are cosidered to be complex based o the volume of pages to be processed. For the requests closed i , the CRA reviewed 624,430 pages. Of the 1,351 requests for which records were disclosed, 756 (55.96%) ivolved processig 100 pages or more, ad 231 of these requests ivolved processig a average of 1,721 pages. Other requests were deemed complex because of the ature ad sesitivity of the subject matter. (See table 2.5 of Appedix A for details.) Aual Report to Parliamet

13 Dispositios of requests Durig the reportig period, the ATIP Directorate completed 1,553 requests followig the provisios of the Privacy Act. 399 were fully disclosed (25.69%) 952 were partially disclosed (61.30%) 4 were exempted i their etirety (0.26%) 0 were excluded i their etirety (0%) 42 resulted i o existig records (2.70%) 156 were abadoed by requesters (10.05%) For more details, see table 2.1 of Appedix A. Exemptios The Privacy Act allows ad sometimes requires the refusal of access to iformatio requested (for example, iformatio about idividuals other tha the requester if coset is ot provided). These types of refusals are called exemptios ad they must be limited ad specific to sectios of the Privacy Act. I , the CRA used the followig sectios of the Act to refuse access to iformatio i full or i part for 956 (87%) of the 1,553 requests closed durig the reportig period. Sectio 19 persoal iformatio obtaied i cofidece (applied to 36 requests) Sectio 22 law eforcemet ad ivestigatio (applied to 377 requests) Sectio 22.2 Public Servats Disclosure Protectio Act (applied to 1 request) Sectio 25 safety of idividuals (applied to 5 requests) Sectio 26 iformatio about aother idividual (applied to 825 requests) Sectio 27 solicitor-cliet privilege (applied to 161 requests) Exclusios The Privacy Act does ot apply to iformatio that is already publicly available, such as govermet publicatios ad material i libraries ad museums. It also excludes material such as Cabiet cofideces. There were o cosultatios o Cabiet cofideces i Format of iformatio released The ATIP Directorate allows requesters to choose to receive their respose package o CD or DVD. Providig documets electroically sigificatly reduces maual processes ad paper cosumptio. I , of the 1,351 requests for which iformatio was disclosed i full or i part, 55.7% (752 requests) were released i electroic format. This is a 4% icrease over the previous reportig period. I total, 528,847 pages were reviewed, ad 460,198 pages were released i electroic rather tha paper format i The Admiistratio of the Privacy Act 11

14 The CRA respected the prefereces of other requesters by providig 597 (44.2%) resposes i paper format ad 2 (0.2%) i other ways, such as viewig the iformatio i a CRA readig room. Requests for traslatio The CRA traslated records i respose to five requests i Correctios ad otatio The CRA received oe request to correct persoal iformatio, but this request was deied because o details or documets were provided to support the request. Costs Durig , the ATIP Directorate s estimated total cost to admiister the Privacy Act was $3,001,038, excludig sigificat coordiatio support from the braches ad regios. For more details, see Appedix A. Operatioal eviromet As the chief admiistrator of federal, provicial, ad territorial tax laws, the CRA maitais oe of the Govermet of Caada s largest repositories of persoal iformatio, secod oly to Employmet ad Social Developmet Caada. I additio, the CRA collects ad maages the persoal iformatio for its workforce of approximately 40,000 idividuals. The trust Caadias place i the CRA to safeguard the privacy of their persoal iformatio is a corerstoe of the Agecy s work. I , may projects were iitiated to ehace the CRA s privacy maagemet framework. Chief Privacy Officer Actio Pla The Chief Privacy Officer (CPO) acts as a cetral locus for oversight of privacy maagemet at the CRA. I , to support the CPO i achievig her madate, the ATIP Directorate developed a CPO actio pla to make sure accoutabilities, resposibilities, ad activities related to privacy are reiforced ad commuicated across the CRA. The CPO actio pla recogizes that privacy maagemet is a resposibility shared by all employees i all parts of the orgaizatio. It idetifies key goals ad assigs accoutability for achievig these goals to specific areas withi the CRA. I , the ATIP Directorate will cotiue to work with the braches ad regios to establish performace measures that ca be used to moitor ad report o progress agaist the goals ad iitiatives outlied i the actio pla. These performace measures will be used to provide the CPO with a performace dashboard to cotiually assess the state of privacy maagemet at the CRA Aual Report to Parliamet

15 Raisig Awareess The ATIP Directorate took steps to ehace CRA employees awareess of their privacy related roles ad resposibilities by participatig i two awareess evets: Data Privacy Day ad Security Awareess Week. For the third cosecutive year, the CRA joied the Office of the Privacy Commissioer ad may other istitutios across Caada ad the world to promote Data Privacy Day. This iitiative highlights the effect that techology is havig o privacy rights ad uderlies the importace of valuig ad protectig persoal iformatio. The CRA s activities focused o the role all CRA employees play i safeguardig persoal iformatio i their day to day jobs. Over a week-log period, the ATIP Directorate highlighted these resposibilities across the CRA ad promoted the may tools available to support CRA employees i this regard. The ATIP Directorate also participated i the CRA s Security Awareess Week activities. Security Awareess Week was origially lauched by the Treasury Board Secretariat ad has become a aual opportuity for govermet departmets to raise awareess about security topics, icludig those related to persoal privacy (for example, idetity theft). I February 2014 as part of the CRA s participatio i Security Awareess week, the Fiace ad Admiistratio Brach orgaized activities for CRA employees, icludig a evet at Library ad Archives Caada. The ATIP Directorate cotributed to this evet by settig up a iformatio kiosk o may privacy-related topics such as privacy impact assessmets, privacy breaches, ad the role of the Chief Privacy Officer at the CRA. The ATIP Director also had a opportuity to address the more tha 400 participats who atteded the evet. Her presetatio, Thik Privacy, was desiged to ehace employee uderstadig of how their everyday actios cotribute to soud privacy maagemet at the CRA. Beyod these egagemet opportuities, the ATIP Directorate also developed more targeted commuicatios to support staff i fulfillig their ATIP-related resposibilities. ATIP cotacts: These are CRA employees i the braches ad regios who are tasked with respodig to ATIP requests. They play a sigificat role i makig sure the ATIP Directorate receives all the iformatio it eeds to process requests o time. I , the ATIP cotacts were give more support to help them carry out this importat role. Mothly s ad a quarterly telecoferece were lauched to share sigificat iformatio with them ad to let them seek clarificatio, voice their challeges, ad share solutios with their colleagues. Project maagers: May CRA employees support projects ad program activities through plaig, moitorig, ad reportig. These employees eed to be aware of their privacy related obligatios whe it comes to project desig ad implemetatio. Toward this ed, the ATIP Directorate created ad promoted the Chief Privacy Officer corer o the CRA itraet. This corer icludes a wide rage of iformatio, icludig a privacy toolkit. The Admiistratio of the Privacy Act 13

16 Traiig The ATIP Directorate provides targeted traiig to CRA employees about the requiremets of, ad their resposibilities uder, the Access to Iformatio Act ad the Privacy Act. This traiig is tailored to respod to the eeds of specific audieces. For istace, ATIP 101 traiig is give to those who have little or o kowledge of ATIP, ad more specific traiig is give to subject matter experts (for example, traiig o how to respod to taskig requests for records). I , ATIP traiig was give to 1,621 participats i 116 sessios across Caada. A additioal 61 maagers received traiig uder the CRA s maagemet learig program. The ATIP Director ad the Assistat Commissioer, Public Affairs Brach, ad Chief Privacy Officer also preseted ATIP awareess sessios to 11 seior maagemet committees across the CRA durig the reportig period. The CRA s Legal Services Brach also provided 17 traiig sessios to 124 CRA employees. These sessios focused o preparig documets for release i CRA readig rooms, o ATIP legal awareess, ad o ATIP for iformatio techology specialists. Privacy projects I , the ATIP Directorate cotiued to stregthe privacy maagemet through two projects: oe o privacy otices ad aother cocerig ivestigative body desigatios. The Privacy Act requires that istitutios use a privacy otice to tell idividuals from whom they collect persoal iformatio why the iformatio is beig collected. The privacy otice must be iserted every time persoal iformatio is collected, whether it is o a paper or a electroic form, a olie applicatio, or aother such medium. Treasury Board Secretariat policies set out the cotet such otices must cotai. I , the ATIP Directorate bega reviewig CRA forms to determie the ext steps to make sure the CRA is followig all legislative ad Treasury Board Secretariat policy requiremets. Durig this reportig period, the ATIP Directorate cotiued to work with the Electroic ad Prit Media Directorate (the CRA s publisher) ad with program areas to make sure all CRA published documets cotai the required privacy otice. Curretly, the ATIP Directorate reviews all forms iteded for publicatio to make sure the persoal iformatio bak umber is correctly aotated. The ATIP Directorate also cotiued its work with stakeholders to review ad, if applicable, provide ew or revised submissios to the Departmet of Justice Caada for ivestigative body desigatios uder Schedules II ad III of the Privacy Regulatios. These schedules list ivestigative bodies of the federal govermet to which persoal iformatio may be disclosed for ivestigative purposes. Fial submissios will be provided to the Departmet of Justice Caada i Aual Report to Parliamet

17 ATIP request ad pay olie I , the CRA cotiued to participate i Treasury Board Secretariat-led discussios o the ATIP request ad pay olie iitiative. This project delivers o a key commitmet of the Govermet of Caada s Ope Govermet Actio Pla: the moderizatio of access to iformatio. It provides coveiet way for idividuals to sed ad, whe applicable, to pay for requests made uder the Access to Iformatio Act or the Privacy Act usig the Iteret. The first phase of the project was lauched i April 2011 with the Treasury Board Secretariat, Citizeship ad Immigratio Caada, ad Shared Services Caada participatig. I , the CRA udertook the ecessary steps to be icluded i the ext phase of the pilot project to be lauched i April The CRA sees this as a opportuity to give requesters a additioal optio for makig requests that is cost-effective ad sustaiable. Moitorig request ivetories The CRA s ATIP Directorate produces a mothly dashboard report that captures key statistical iformatio about the CRA s ivetory of ATIP requests. This report shows the average times for each of the key phases of request processig (for example, itake, search ad locate, ad aalysis). The report also provides statistical iformatio about the umber of time extesios take, completio times, pages processed, complaits, ad complait dispositio. The ATIP Director uses this report to moitor treds, measure ATIP Directorate performace, ad determie ay process chages required to improve performace. The ivetory is a regular ageda item for seior maagemet meetigs withi the ATIP Directorate. As well, the ATIP Director keeps the Assistat Commissioer, Public Affairs Brach, ad Chief Privacy Officer iformed about the ivetory. The CRA respods to requests for correctio withi the 30 days stipulated i the Privacy Regulatios. The CRA received oe request for correctio i Privacy Breach Maagemet Effectively maagig privacy breach icidets is a resposibility that is shared by the ATIP Directorate ad the Security ad Iteral Affairs Directorate (SIAD) withi the Fiace ad Admiistratio Brach. I , the existig iformatio-sharig protocol betwee these directorates was revised to clarify resposibilities related to maagig privacy breach icidets. This revised protocol respods to a recommedatio from the Office of the Privacy Commissioer to ehace the CRA s privacy breach maagemet process. Uder the revised protocol, SIAD must iform the ATIP Directorate of sigificat privacy breach icidets through its early otificatio process (as defied i the protocol). SIAD also must advise the ATIP Directorate that it is lauchig a ivestigatio ito a alleged privacy breach at the outset of ivestigatios of employee miscoduct ivolvig privacy breaches, ad withi 30 days of a ivestigatio beig completed. The Admiistratio of the Privacy Act 15

18 The Agecy Security Officer is resposible for decidig whether affected idividuals should be otified, ad the ATIP Directorate must cofirm that it agrees with this decisio. Whe the ATIP Directorate disagrees with a decisio about otifyig affected idividuals, the ATIP Director has to refer the case to the Chief Privacy Officer for a fial decisio. The ATIP Directorate is resposible for otifyig the Office of the Privacy Commissioer of CRA privacy breach icidets, ad it does so accordig to the Treasury Board Secretariat s Guidelies for Privacy Breaches. Durig , the CRA otified the Office of the Privacy Commissioer of 30 material privacy breach icidets related to uauthorized access ad disclosure. As a result of these icidets, the CRA revised its processes for hadlig misdirected mail ad the Security ad Iteral Affairs Directorate ehaced commuicatio with the ATIP Directorate o its evaluatio of privacy breach icidets. These chages were made to support stregtheed privacy breach maagemet at the CRA. Privacy impact assessmets The CRA s program areas are required to cosult with the ATIP Directorate i the plaig stages of ew or ameded iitiatives ivolvig persoal iformatio i order to determie if a privacy assessmet is ecessary. I , the ATIP Directorate reviewed 77 iitiatives ad, as of March 31, 2014, there were 31 privacy assessmets (PIAs or protocol assessmets) i various stages of productio. Five PIAs were completed ad set to the Office of the Privacy Commissioer for review. I lie with the Treasury Board Secretariat s Directive o Privacy Impact Assessmet, the CRA releases summaries of completed PIAs o its website ( The followig are summaries of the PIAs completed i : Foreig Icome Verificatio Statemet (Form T1135) The T1135, Foreig Icome Verificatio Statemet, filed by Caadia residet taxpayers who held specified foreig property durig the year, will be expaded to iclude additioal fields for ew iformatio, ad as a result, additioal data capture will be required for iclusio i the stad aloe Foreig Reportig Requiremets Maagemet System (FRRMS). Persoel Security Screeig - Reliability Status + Persoel Security Screeig plays a vital role withi the CRA s security program by ascertaiig that all employees are appropriately screeed based o the access to iformatio ad CRA premises required for the performace of their duties. All CRA employees must udergo security screeig ad must meet the security requiremets of their positio prior to beig hired. Curretly, there are two types of persoel screeig: a assessmet of reliability (which results i a Reliability Status), ad a assessmet of loyalty to Caada (which results i a security clearace at the Secret or Top Secret level) Aual Report to Parliamet

19 While the CRA s security screeig program is robust ad i lie with all applicable legislatio ad Govermet of Caada policies ad stadards, a opportuity has bee idetified to further stregthe the program. As such, i additio to the curret reliability status, the CRA s Security ad Iteral Affairs Directorate is puttig improvemets ito place through the developmet of a ew level of security screeig, Reliability Status +. Reliability Status + would apply to desigated positios, as approved by the Commissioer, demadig a high level of public trust ad/or providig sigificat authority to make decisios or ruligs that could impact o the efficiecy or itegrity of Agecy operatios ad regulatio, such as those that ivolve the performace of duties that relate to the admiistratio or eforcemet of tax related legislatio (e.g. Icome Tax Act). A valid Reliability Status would be a pre-requisite to Reliability Status +. The additioal verificatios are as follows: Madatory Figerpritig Madatory Credit Check Madatory Law Eforcemet Records Check Madatory Tax Compliace Verificatios Subject Iterview, for cause i the case that the verificatios ucover adverse iformatio I accordace with Treasury Board Secretariat policy istrumets, the CRA iitiated a privacy impact assessmet (PIA) for the Reliability Status + security screeig as its implemetatio will result i a substatial modificatio to CRA s curret security screeig process. Idetity ad Access Maagemet The CRA s Security ad Iteral Affairs Directorate is curretly establishig a Idetity ad Access Maagemet (IAM) Program, ad cocurretly maagig a multi-phased, multi-year project to optimize IAM busiess processes. Idetity ad Access Maagemet will stadardize ad automate eforcemet of the rules ad busiess processes used to maage employee access to CRA data. This will improve moitorig, auditig, ad reportig to help esure compliace with relevat legislatio, security-related policies, stadards, ad best practices. Cotractig Itegrity Verificatio Program The program will help the CRA to decide whether or ot to award or termiate CRA cotracts with idividual or compaies. This will be doe through verificatio checks usig the Public Works ad Govermet Service Caada s itegrity assessmet database ad, i some cases, through crimial record checks with the Royal Caadia Mouted Police. The Admiistratio of the Privacy Act 17

20 Offshore Tax Iformat Program The 2013 Budget aouced a iitiative to ecourage idividuals to provide relevat iformatio to CRA about istaces of iteratioal tax evasio ad avoidace. Through this ew paid iformat program, lauched i Jauary 2014 as the Offshore Tax Iformat Program (OTIP), the CRA will eter ito cotracts with iformats to provide fiacial rewards whe the iformatio that they provide to CRA leads to the assessmet ad collectio of sigificat additioal federal taxes (excludig pealties ad iterest) arisig from iteratioal tax o compliace. The program s primary objective is to ecourage the participatio of the public i the idetificatio of major iteratioal tax o-compliace. The program will do this by offerig graduated icetive rewards of from 5% to 15% of the federal tax assessed ad collected to idividuals who come forward with credible iformatio that leads directly to the assessmet ad collectio of additioal federal taxes i such cases. Amog other requiremets, there is a basic threshold; to qualify for a reward, the lead must result i the collectio of more tha $100,000 i additioal taxes. The PIA for this iitiative covers the activities that relate to the collectio ad assessmet of iformatio from iformats, eligibility for rewards, ad related reviews ad moitorig by a Oversight Committee. Iformatio provided by iformats uder this program may or may ot culmiate i assessmets, appeals, or collectio activities. Policies, guidelies, ad procedures ATIP maual I October 2013, the ATIP maual was completed ad released to employees of the ATIP Directorate. Its release represeted the first major update ad revisio to the maual sice The maual captures all of the major request processes ad procedures ad icludes templates, guidace sheets, ad other tools. The primary goal of the maual is to make sure aalysts ad maagers follow a cosistet approach whe processig ATIP requests. It also supports the quality of processig ad reduces the time spet traiig ew employees. The maual is the primary resource tool for all aalysts. The maual will be updated formally each year, ad supplemeted by iterim techical bulletig, to make sure it cotiues to meet the eeds of the ATIP Directorate. Procedures o the disclosure of persoal iformatio uder subsectio 8(2) of the Privacy Act Subsectio 8(2) is the provisio of the Privacy Act that outlies circumstaces where disclosure of persoal iformatio may be made without coset. Recogizig the importace of cosistet privacy practices at the CRA, the ATIP Directorate formed a workig group to develop procedures for disclosig persoal iformatio uder subsectio 8(2). I , members represetig all CRA braches ad two CRA regios completed writte procedures that outlie the steps to follow for disclosig persoal iformatio related to employees ad to o tax iformatio. For tax iformatio, employees will be asked to follow the CRA s existig Guidelies o the Use ad Disclosure of Cliet Aual Report to Parliamet

21 Iformatio. They will also be remided that they should take ito accout geeral privacy policy priciples whe they disclose ay persoal iformatio. Cosultatios o the procedures are plaed with the Office of the Privacy Commissioer, the Treasury Board Secretariat, ad the Departmet of Justice Caada for These procedures are expected to be fialized by the Agecy i CRA Access to Iformatio Policy I , the ATIP Directorate bega work o a access to iformatio policy, as part of the CRA s iformatio maagemet policy suite reewal strategy led by the Strategy ad Itegratio Brach. I , the ATIP Directorate cotiued to develop this policy. By clearly outliig roles ad resposibilities related to iformal disclosure, the policy reiforces ad respods to recommedatios of the Office of the Iformatio Commissioer ad the Office of the Taxpayers Ombudsma to ehace ad expad the CRA s use of iformal disclosure mechaisms. Durig the reportig period, the policy was circulated to the ATIP Oversight Review Committee for feedback, ad it was preseted to the Public Affairs Advisory Committee i February I , the ATIP Directorate will cotiue workig o this policy istrumet ad will work with stakeholders o additioal measures that could be take to support the CRA i fulfillig its obligatios related to iformal disclosure. CRA privacy policy suite The CRA Access to Iformatio Policy will complemet the CRA s privacy policy suite, which has bee i effect sice April 4, 2012, ad icludes the CRA Privacy Policy, the CRA Privacy Practices Directive, ad the CRA Procedures for Privacy Assessmets. This policy suite was established to make sure the CRA s privacy practices are fair ad cosistet with the goverig requiremets set out i the Privacy Act, the Privacy Regulatios, ad related policies of the Treasury Board Secretariat. Complaits ad ivestigatios Durig , the CRA received 21 complaits about requests made uder the Privacy Act, which is a reductio of 51 (29.17%) from the 72 complaits received i the previous reportig period. As well, the CRA closed 49 complaits, 11 (28.95%) more tha the 38 complaits closed i The followig chart details the dispositio of the complaits closed durig the fiscal year. (For defiitios of the dispositio categories, go to The Admiistratio of the Privacy Act 19

22 The ATIP Directorate also received 125 complaits about alleged improper access, collectio, use, or disclosure of persoal iformatio by the CRA. A breakdow of these complaits is outlied i the followig table. Outstadig from previous fiscal year Received durig fiscal year Completed Closig ivetory The CRA is aware that effectively maagig privacy breaches is critical i maitaiig public cofidece i the itegrity of the CRA. The CRA takes all breaches very seriously ad is stregtheig its cotrols ad sactios for uauthorized access ad disclosure. (See Privacy breach maagemet for details.) Collaboratio with oversight bodies The CRA cotiues to work closely with the Office of the Privacy Commissioer ad the Treasury Board Secretariat to stregthe privacy maagemet at the CRA. Office of the Privacy Commissioer audit I , the Office of the Privacy Commissioer completed a audit of access cotrols at the CRA as a follow up to its February 2009 audit, Privacy Maagemet Frameworks of Selected Federal Istitutios Aual Report to Parliamet

23 I issuig the report, the Office of the Privacy Commissioer recogized the improvemets that the CRA has made over the past five years: Sice our last audit report i 2009, the CRA has made progress to stregthe its privacy ad security policies ad procedures, ad to commuicate its expectatios to employees about the safeguardig of persoal iformatio. Agecy plas are also uderway to improve access rights maagemet ad to more closely moitor employee access to taxpayer iformatio. The OPC also issued the followig recommedatios to cotiue ehacig the Agecy s persoal iformatio sharig practices: 1. The Caada Reveue Agecy should defie fully the role of the Chief Privacy Officer ad moitor the implemetatio of the positio s madate i terms of employee privacy awareess, privacy risk reductio ad overall Agecy compliace with the Privacy Act; 2. Cosistet with the Treasury Board Directive o Privacy Impact Assessmets, the CRA should complete, review ad approve privacy impact assessmets prior to the implemetatio of ay ew program or iitiative that may raise privacy risks to taxpayer iformatio; ad esure that its ATIP Directorate is otified of all breaches as they are discovered. 3. The Caada Reveue Agecy should implemet a Certificatio ad Accreditatio process that clearly assigs accoutability ad resposibility for the maagemet of the process, as well as oversight to esure CRA documetatio is approve o time. The Caada reveue Agecy should also prioritize critical systems ad all related applicatios to esure they udergo the Certificatio ad Accreditatio process ad Treat ad Risk Assessmets. 4. The Caada Reveue Agecy should: esure that its policies, practices ad procedures are followed to maage local applicatios ad adequate safeguards are used to protect the taxpayer iformatio they cotai; esure that its Local Applicatio Repository is reviewed regularly for completeess, accuracy ad currecy; ad follow up at each stage of the review ad quality assurace processes ad esure that all local applicatios are approved by delegated officials before implemetatio. 5. The Caada Reveue Agecy should cotiue to ehace its Idetity ad Access Maagemet System cotrols to esure that employee access is limited to oly that iformatio required to carry out their job fuctios, based o the eed-to-kow priciple. 6. The Caada Reveue Agecy should review existig geeric user IDs, oes shared by several idividuals workig o the same project or activity, to determie whether they are required, authorized ad cotrolled; ad should delete all IDs that are ot i use. The Caada Reveue Agecy should also esure that all geeric user IDs are subject to established review ad approval processes. The Admiistratio of the Privacy Act 21

24 7. The Caada Reveue Agecy should cotiue to stregthe its audit loggig system ad process ad the Agecy should icorporate risk assessmet tools to flag potetially iappropriate employee activities o its systems. 8. The Caada Reveue Agecy should esure adequate measures are i place to mitigate the risks associated with developer access to taxpayer iformatio i test eviromets. (A o operatioal test eviromet is used by iformatio techology staff to develop ad test systems before they are used to process tax returs i the regular busiess or operatioal eviromet.) The Caada Reveue Agecy should also rigorously cotrol, track ad moitor trasfers of taxpayer iformatio from operatioal to test eviromets. 9. Cosistet with Treasury Board Guidelies for Privacy Breaches, the Caada Reveue Agecy should esure that the Access to Iformatio ad Privacy Directorate is otified of all breaches as they are discovered. The CRA agreed with all of the Office of the Privacy Commissioer s recommedatios, ad created actio plas to address each of the recommedatios. May of the iitiatives outlied withi these plas have already bee completed. For istace, the CRA has reviewed its Local Applicatios Repository, ad the procedures ad safeguards associated with it, ad ehaced cotrols to reduce the umber of geeric accouts i the Agecy. Privacy breach maagemet has also bee ehaced through stregtheed commuicatio betwee the Security ad Iteral Affairs Directorate ad the ATIP Directorate. (See Privacy breach maagemet for details.) Overall, the CRA remais o target to complete all activities by As part of her reportig requiremets, the Chief Privacy Officer will give regular updates o progress agaist these deliverables i her biaual reports to the Agecy Maagemet Committee. Coclusio The CRA takes privacy ad the safeguardig of persoal iformatio very seriously. I , the CRA will cotiue to stregthe its operatios ad privacy goverace by: deliverig targeted commuicatios ad traiig to key iteral ad exteral audieces with a emphasis o iformal ad proactive disclosure ad privacy maagemet; moitorig ad evaluatig performace to address ATIP challeges promptly; implemetig the Chief Privacy Officer Actio Pla to make sure privacy accoutabilities, resposibilities, ad activities are formalized ad commuicated; ad implemetig more efficiecy measures Aual Report to Parliamet

25 Appedix A Statistical report Statistical Report o the Privacy Act Name of istitutio: Caada Reveue Agecy Reportig period: April 1, 2013, to March 31, 2014 PART 1 Requests uder the Privacy Act Number of requests Number of requests Received durig reportig period 1,548 Outstadig from previous reportig period 228 Total 1,776 Closed durig reportig period 1,553 Carried over to ext reportig period 223 PART 2 Requests closed durig the reportig period 2.1 Dispositio ad completio time Dispositio of requests 1 to 15 days 16 to 30 days 31 to 60 days Completio time 61 to 120 days 121 to 180 days 181 to 365 days More tha 365 days All disclosed Disclosed i part All exempted All excluded No records exist Request abadoed Total ,553 Total The Admiistratio of the Privacy Act 23

26 2.2 Exemptios Sectio Number of requests Sectio Number of requests Sectio Number of requests 18(2) 0 22(1)(a)(i) 13 23(a) 0 19(1)(a) 9 22(1)(a)(ii) 16 23(b) 0 19(1)(b) 1 22(1)(a)(iii) 0 24(a) 0 19(1)(c) 24 22(1)(b) (b) 0 19(1)(d) 2 22(1)(c) (1)(e) 0 22(2) (1)(f) Exclusios Sectio Number of requests Sectio Number of requests Sectio Number of requests 69(1)(a) 0 70(1)(a) 0 70(1)(d) 0 69(1)(b) 0 70(1)(b) 0 70(1)(e) (1)(c) 0 70(1)(f) Format of iformatio released Dispositio Paper Electroic Other formats All disclosed Disclosed i part Total Aual Report to Parliamet

27 2.5 Complexity Relevat pages processed ad disclosed Dispositio of requests Number of pages processed Number of pages disclosed Number of requests All disclosed 23,834 23, Disclosed i part 594, , All exempted 2, All excluded Request abadoed 5,880 5, Total 626, ,484 1, Relevat pages processed ad disclosed by size of requests Dispositio of requests Less tha 100 pages processed Number of requests Pages disclosed pages processed Number of requests Pages disclosed pages processed Number of requests Pages disclosed pages processed Number of requests Pages disclosed More tha 5000 pages processed Number of requests Pages disclosed All disclosed 338 9, , , , Disclosed i part , , , , ,312 All exempted All excluded Abadoed , Total , , , , , Other complexities Dispositio Cosultatio required Legal advice sought Iterwove iformatio Other All disclosed Disclosed i part All exempted All excluded Abadoed Total Total The Admiistratio of the Privacy Act 25

28 2.6 Deemed refusals Reasos for ot meetig statutory deadlie Number of requests closed past the statutory deadlie Workload Pricipal reaso Exteral cosultatio Iteral cosultatio Other Number of days past deadlie Number of days past deadlie Number of requests past deadlie where o extesio was take Number of requests past deadlie where a extesio was take Total 1 to 15 days to 30 days to 60 days to 120 days to 180 days to 365 days More tha 365 days Total Requests for traslatio Traslatio Requests Accepted Refused Total Eglish to Frech Frech to Eglish Total Aual Report to Parliamet

29 Part 3 Disclosures uder subsectio 8(2) Disclosures uder subsectio 8(2) Paragraph 8(2)(e) Paragraph 8(2)(m) Total Part 4 Requests for correctio of persoal iformatio ad otatios Requests for correctio of persoal iformatio ad otatios Number Requests for correctio received 1 Requests for correctio accepted 0 Requests for correctio refused 1 Notatios attached 0 Part 5 Extesios 5.1 Dispositio of requests where a extesio was take Dispositio of requests where a extesio was take 15(a)(i) Iterferece with operatios 15(a)(ii) Cosultatio Sectio 70 Other 15(b) Traslatio or coversio All disclosed Disclosed i part All exempted All excluded No records exist Request abadoed Total Legth of extesios Legth of extesios 15(a)(i) Iterferece with operatios 15(a)(ii)Cosultatio Sectio 70 Other 15(b)Traslatio purposes 1 to 15 days to 30 days Total The Admiistratio of the Privacy Act 27

30 Part 6 Cosultatios received from other istitutios ad orgaizatios 6.1 Cosultatios received from other govermet istitutios ad orgaizatios Cosultatios Other govermet istitutios Number of pages to review Other orgaizatios Number of pages to review Received durig reportig period Outstadig from the previous reportig period Total Closed durig the reportig period Pedig at the ed of the reportig period Recommedatios ad completio time for cosultatios received from other govermet istitutios Recommedatio 1 to 15 days Number of days required to complete cosultatio requests 16 to 30 days 31 to 60 days 61 to 120 days 121 to 180 days 181 to 365 days More tha 365 days Disclose etirely Disclose i part Exempt etirely Exclude etirely Cosult other istitutio Other Total Total Aual Report to Parliamet