Your tax info at heightened risk, experts say

The CRA can now share tax filings with 16 government agencies



Online only.

bill c-51

(Getty Images / Julie Marshall)

— Updated on May 14 at 5:15 p.m. to include additional information from the Canada Revenue Agency. —

Critics denounced the passing of the Anti-Terrorism Act in the House of Commons last week, saying the legislation will impede on Canadians’ freedom of expression and religion. With all the uproar, a key change in the Income Tax Act went largely unnoticed.

Under Bill C-51, the Canada Revenue Agency (CRA) has been given permission to share your income tax filings with 13 additional government agencies.

Experts say this could render your personal financial information less secure than it already is in today’s electronic age.

Until now, the CRA has only had permission to share this information with three other agencies (CSIS, RCMP and FINTRAC) and only under very specific conditions. That list has grown to 16 in total and now includes Canada Border Services, the Canadian Armed Forces and Citizenship and Immigration among others.

The more people that have access to taxpayer information under Bill C-51, the higher the risk of leaks, hacks and other foul play, according to Avner Levin, the director of Ryerson University’s Privacy Institute.

The change in legislation is “unprecedented,” he says. “It’s snooping and meddling of the worst kind.”

Anyone who has filed their taxes in recent years should recall the little box asking whether they’re willing to share their home address with Elections Canada. This small request for consent served as a reminder that, to date, the government has been respectful of taxpayers’ privacy. But amendments to the Income Tax Act under Bill C-51 changes all that. The CRA can now share not only your home address, but all of your financial information within the government, without any form of consent or a warrant.

All the CRA needs is to believe “there are reasonable grounds to suspect that the information would be relevant to an investigation of whether the activity of any person may constitute threats to the security of Canada.”

What’s more, the CRA can distribute these private details “on its own initiative,” possibly spurring what Levin calls a “wide-scale fishing expedition.”

The CRA has always been able to send your financial information to the Canadian Security Intelligence Service (CSIS) and the RCMP if it was considered blatantly suspicious or relevant to an ongoing investigation.

But the vague wording of the new bill is problematic, according to Levin. Just about anything in your tax return could be categorized as nefarious. If, for example, you donated to a religious charity that the government deems suspicious, you could be investigated without your knowledge.

Tamir Israel, a technology lawyer with the Canadian Internet Policy and Public Interest Clinic says that the standard for what constitutes as suspicious will be considerably lowered now that the bill has passed. This means that the CRA will not only be able to share more information with additional people, but likely more often as well, resulting in a “heightened risk of financial information being leaked,” according to Israel.

The ways in which this information exchange will happen is unclear, he adds. But he suspects there is a possibility that the CRA could dump relevant categories of information about Canadian individuals into a central pool that the CSIS or any of the other 15 agencies can sift through at will. This eliminates the gatekeeping abilities of the CRA, Israel said. No longer will they have the discretion to only share information they deem relevant.

This centralized database of sensitive financial details could be a prime target for hackers, he adds. The more the data is replicated, the less secure it is, leaving “a few more holes in the dam.”

The CRA is currently held to a high standard when it comes to protecting the privacy of the 27 million Canadians that file tax returns. But the agency is no stranger to hacks, leaks and compromised information.

An October 2013 audit by the then privacy commissioner states that between 2011 and 2012, more than 50 privacy breaches involved the inappropriate disclosure of taxpayer information. At a parliamentary hearing earlier this year, it was revealed that the CRA had experienced more data breaches in the past two years than all other government agencies combined in the past 10 years.

Last year’s widely publicized Heartbleed fiasco saw 900 social insurance numbers jeopardized. Then a few months later, several prominent Canadians’ detailed tax information was unintentionally released to CBC News.

Apart from the CRA, Israel warns that the other departments that will be able to access your information may not be held to the same privacy standards as the CRA or be equipped with strong enough cyber security.

Then there’s human error and the prying eyes of public servants to consider. The 2013 audit of the CRA stated that not enough measures were taken by the agency to prevent unauthorized individuals from viewing sensitive taxpayer details.

A spokesperson for the CRA said in an email that the protection of Canadians’ tax information is a priority for the agency. “Should the Bill be passed into law, the CRA will implement the necessary procedures and controls to ensure that sharing of taxpayer information under the new provisions meets all legal requirements. Information would only be shared as permitted by law.”

If you are uncomfortable with the heightened risk of your privacy being breached, there’s unfortunately not much you can do about it, other than stop filing your tax returns, which we don’t recommend.

To Levin, the heightened risk of privacy breaches is not as problematic as the bigger issue of government surveillance in general.

Technically, our information in the hands of the government is as safe as it is in banks, he says. The difference is that banks will compensate for any losses you may experience because of hackers or fraudsters. With the passing of Bill C-51, it’s the government that may be using your information against you.

“The major point is the system we’re creating now, in which our information is going to be used by the government and by all these agencies to build profiles on us, to conduct surveillance on us,” says Levin.

“And that to me is what’s more worrisome because that’s not why we’re giving the government our income tax information…I don’t consider that a democracy.”

12 comments on “Your tax info at heightened risk, experts say

  1. Why is this provision not being challenged in court either by the privacy commissioner or as a charter challenge?


  2. Please let us know what have the other Canadian Political Parties have said on this very important problem.
    Thank you very much.


  3. If you are doing nothing wrong then let them investigate.


    • It’s about your right to privacy which is enshrined in the charter of rights, the government should not be spying on its citizens period. This isn’t cold-war East Germany it’s Canada.


    • @ caazone — That’s an over-used, knee-jerk statement to which Edward Snowden has given this reply: “Arguing that you don’t care about the right to privacy because you have nothing to hide is no different than saying you don’t care about free speech because you have nothing to say.”


  4. The change re: CRA in Bill 51 is outrageous to all Canadians. How can the Federal Government make such an error. I surely hope that CRA will tighten up on its secrecy of not providing anyone with a taxpayers critical information without a legal court order. Here’s hoping the Senate with change the Bill before it is passed into law or the Privacy Commissioner will request the change.


  5. I agree, if you are following the law and not partaking in questionable activities, you should not need to be worried.


  6. I donate to several registered charities each year – the Salvation Army being one of them, the Canadian Wildlife organization another. If the Salvation Army or one of their staff is suddenly considered a suspect organization then I and thousands of other taxpayers are suddenly deemed to be terrorists. I have long contended Bill C-51 to be a solution looking for a problem.


  7. I agree, I do not file my Taxes to give them the right to share ANY of my personal information. We need to stop this or at least have it amended.


  8. It seems to me with all the breaches they are trying to fix it so they will never be responsible for ANY problems, nor have to fix them.


  9. It is not a question of whether you have anything to hide or not. That is far too simplistic. What is at issue here is a Canadian’s right to privacy, with respect to their financial affairs, and whether that information is leaked into the public domain, or, indeed, whether such information is hacked and then used for all sorts of nefarious purposes. Bill C-51 should have been squashed at source. The fact that it hasn’t been suggests malaise by us, the Canadian people. We should have been more vigilant, and made representations to our MLA’s earlier in the piece.


  10. The conservatives can not leave any factor of our lives alone, these unwanted, unqualified jerks will be gone this year, hopefully…


Leave a comment

Your email address will not be published. Required fields are marked *