Unlike previous years, the Canada Revenue Agency will simply require a person’s Social Insurance Number and date of birth, similar to paper filing, when using NETFILE, the web service for filing personal income tax returns.
The agency did not consult with the Office of the Privacy Commissioner of Canada before making the change, and now Jennifer Stoddart’s office wants information “to determine if there’s a need to go further,” said Scott Hutchinson, a spokesman for the office.
“We want to see what information they provide to us and we will proceed from there.”
At this point, the office doesn’t have the necessary details to make a determination, Hutchinson added.
“Lacking details, we have not had an opportunity to examine the changes made from a privacy standpoint. While it doesn’t appear on the surface that CRA is collecting new information from tax filers that it already hadn’t been in the past, one important question for the agency to answer would be: how is the security of personal information being upheld, and specifically whether there is the potential for fraudulent filers to access an individual’s personal information under the changes to NETFILE.”
In a statement Tuesday, the revenue agency said it consulted with the Treasury Board before making the decision, and is now working with the privacy commission’s office and “will provide all information requested.” In the meantime, the agency defended the decision.
“As the Web Access Code did not allow Canadians to access or change their personal information with CRA, its elimination has no adverse effect on the previously established CRA security of private taxpayers’ information.”
The statement also reiterated that the agency “performs a number of identification validations, including validating your SIN and date of birth with the CRA information on file. If any discrepancy is found, the system will automatically stop processing your return. Along with these validations, the system does not permit changes to address or banking information. NETFILE is, and will continue to be, safe and secure.”
The news of the NETFILE change at the Canada Revenue Agency follows the admission earlier this month by Human Resources and Skills Development Canada (HRSDC) that it had lost a hard drive with the personal information of about 583,000 Canada Student Loans borrowers. The unencrypted, unprotected hard drive included names, social insurance numbers, dates of birth, addresses and loan balances — more than enough information for criminals to steal someone’s identity.
The investigation into the data breach at HRSDC by Stoddart’s office is ongoing.
In another move to encourage people to file their taxes online, the revenue agency will no longer mail personalized income-tax packages to Canadians, but people will still be able to file using paper forms. Revenue Canada, meanwhile, has eliminated its Telefile service, which permitted people to submit their tax information via the telephone.
Last year, about 35 per cent, or 9.7 million people, filed using paper forms, compared to about 65 per cent, or over 17.6 million people, who filed electronically. About one per cent (321,033 people) filed using Telefile.
In its statement, the revenue agency said it is constantly refining its business processes “to make sure it uses its resources responsibly and remains efficient and effective in delivering services to Canadians,” noting it costs about four times more to process a paper return than an electronic return.
