Privacy Statement

Our Chief Privacy Officer (CPO) has a broad mandate for privacy oversight at the CRA and is responsible for:

• overseeing decisions related to privacy, including assessing the privacy impacts of our programs
• championing personal privacy rights according to legislation and policy, including managing privacy breaches
• reporting to our senior management on the state of privacy management at the CRA, at least twice a year

As defined under the Privacy Act, personal information is information about an identifiable individual that is recorded in any form.

We have the authority to collect personal information related to our mandate and the legal authority given to us by our enabling legislation, such as the Income Tax Act, the Excise Tax Act, and the Canada Revenue Agency Act. We also administer a number of social benefit and tax credit programs for the federal government, as well as provincial, territorial, and First Nations governments. We collect personal information such as financial information, social insurance number, and contact information, as well as human resource information about CRA employees. For a full description of the types of personal information we collect, please see our personal information banks.

We collect personal information where it is lawful and directly related to fulfilling our mandate: to administer tax, benefits, and related programs; and to ensure compliance for governments across Canada. Our work helps protect Canada's tax base and supports the delivery of a number of important government programs that are essential to the economic and social well-being of Canadians. For a full description of our function, programs, and activities, see Info Source.

We collect your personal information directly from you or indirectly through other means as permitted by law, such as from:

• other governments in information-sharing agreements
• your authorized representative
• your employer
• a financial institution
• open sources

When we collect your personal information from you, we inform you at the point of collection as to why we are collecting it, our legal authority to do so, and how your information will be used. We will ask for your consent when required, including for additional uses or disclosures of your information. Note that, contrary to the private sector, consent is (more often than not) in fact not required for the bulk of the personal information collected at the CRA.

We manage and protect your personal information by having all parts of the CRA work together and by adopting the Privacy by Design principles, as outlined in our Privacy Management Framework. We focus on measures that provide a set of mechanisms to protect your personal information.

We take the security of all taxpayer information very seriously. We keep a close watch to prevent unlawful attempts to get your tax information and to make sure that your privacy rights are protected. Personal information is kept physically and digitally secure, and all of our forms and documents containing taxpayer information are marked “Protected.” This helps us to make sure that sensitive information is handled securely. More information on protection of personal information is at Integrity and security at the CRA: Keeping taxpayer information safe and in our Privacy Commitment, which is part of our Privacy Management Framework.

We keep your personal information for as long as necessary to fulfill the purposes for which we collected it. When we no longer need your information, we dispose of it according to Library and Archives Canada disposition authorities. Information is securely deleted or shredded or, if deemed of archival value, sent to Library and Archives Canada. For more details on program-specific retention and disposal standards, please see our related personal information banks.

To reduce risks to privacy, we do privacy impact assessments to determine how our programs and services using personal information could affect the privacy of an individual and propose measures to reduce these risks.

We share your personal information with you; with your authorized representative; as necessary, within our program areas if they have a need to know; and with other parties as legally necessary and duly documented. We may also disclose your personal information if it is authorized by law, for example, with other governments (federal, provincial, territorial), authorized third-party service providers, and / or law enforcement agencies.

When we share information, we abide by robust privacy protective measures and safeguards, such as:

• stringent privacy and security clauses in our contracts with third-parties and with partners in information-sharing agreements (that is, with domestic or foreign governments)
• where applicable, removing identification details in personal information before sharing it for instance, in aggregate statistical information, and employing stringent controls to prevent re-identification
• ongoing monitoring of our information-sharing agreements and contracts

All authorized sharing is outlined in the “Consistent Uses” section of our personal information banks.

Our employees have to report any detected or suspected unauthorized access or disclosure of information, misconduct, or fraud, and any processes that appear to be vulnerable to fraud. We take seriously, and thoroughly investigate all allegations or suspicions of:

• improper or unauthorized handling and/or exposure of personal information under our control: by any of our employees, or by a third-party including external threat actors
• external incidents that indirectly affect taxpayer personal information or taxpayer interactions with us

If we confirm a privacy breach, we act quickly to deal with the incident. If a breach is deemed  “material” we inform any affected individuals and the Office of the Privacy Commissioner and the Treasury Board of Canada Secretariat. We are committed to reducing all risks in order to prevent breaches from occurring. If criminal activity is suspected, we co-operate fully with law enforcement authorities.

To report a suspected privacy breach, please contact us immediately at 1-800-959-8281.

You have the right to ask for a copy of the personal information we have about you. For information on sending a request, please visit Access to information and privacy at the Canada Revenue Agency.

When you visit the web pages of any Government of Canada organization, most web servers automatically collect information about that visit. We safeguard the privacy of users of our web pages, in accordance with the Standard on Privacy and Web Analytics.

IP addresses

Web servers may automatically collect information about a visit to a website, including the visitor's Internet Protocol (IP) address. The IP address is collected to identify unauthorized attempts to upload information, change information, or otherwise cause damage. 

Digital markers (including cookies)

We may use sessional and persistent digital markers on some web pages to better understand your preferences and provide you with the best possible web experience. A digital marker is a resource created by your browser to reference certain pieces of information during the same or a later visit to a web page. During your online session with the CRA, your browser exchanges data with our web server.

You can adjust your browser settings to reject digital markers, including cookies. However, doing so may affect your ability to interact with our web pages. For example, if you are accessing any secure services that require a username and password and if you disable any cookies, you may need to re-insert your username and password at every visit to a website.

Examples of digital markers are cookies and HTML5 web storage. Among other functions, digital markers:

• let a website recognize a previous visit each time a visitor accesses a site. 
• track the information viewed on a site, to help website administrators make sure visitors find what they are looking for. For example, the number of mouse clicks made by an individual can indicate whether or not content was easy to find.

Web analytics

Web analytics is the collection, analysis, measurement, and reporting of data about web visits to understand web usage and to maintain and improve web service. When your computer asks for a CRA web page, we collect information under the authority of section 5 of the Canada Revenue Agency Act, for analytics purposes, which may be used for IT related audits, evaluations, research, planning, and reporting, as well as communications and information technology statistics. The following types of information will be collected during a visit to our web pages:

• part of the originating IP address
• the date and time of a request
• the type of browser used
• the page(s) visited

We do web analysis with services from third-party service providers.

Information used for the purpose of web analytics is collected following the Treasury Board of Canada Secretariat’s Standard on Privacy and Web Analytics.

Social media

Our use of social media is an extension of our presence on the web. Our social media account is not hosted on Government of Canada servers. If you choose to interact with us through social media, you should consult the terms of service and privacy policies of the third-party service provider and those of any applications you use, so that you understand how personal information is used. We use the social media platforms Twitter, YouTube, LinkedIn, and Facebook.