Back in November, some high-profile Canadian writers, artists and broadcasters had their private tax information made available to the public by the Canada Revenue Agency (CRA). Unsurprisingly, it triggered some very public complaints about the CRA’s practices. Author Time Wynne-Jones commented, “It does make you wonder what’s going on at the CRA. If they can make this kind of gaffe, what else are they doing wrong?”
In the last week of November, the agency accidentally sent a digital spreadsheet to the CBC, which contained the names of several hundred mostly prominent Canadians, as well as their home addresses and the value of charitable tax receipts they had been given for donating art, manuscripts, sculptures, photographs and other objects to museums, art galleries, archives and other cultural institutions.
While the CBC has not published any personal information, it has released the names of some of the individuals on the list.
The 18-page document covers financial information from 2008 to 2013, and includes information on donations made by high-profile Canadians, including author Margaret Atwood, former prime minister Jean Chrétien, grocery magnate Frank Sobey, cartoonist Lynn Johnston, pollster Allan Gregg, financier Stephen Bronfman, former CBC executive Richard Stursberg, Olympics chief Richard Pound and many others.
Donation values vary, from less than $5000 for some personal papers to a Reubens painting thought to be worth $200 million and donated to the Art Gallery of Ontario.
The Revenue Minister Kerry-Lynne Findlay later confirmed to the House of Commons that there had been a privacy breach, noting that the department reported it to the privacy commissioner and was attempting to reach all the individuals affected.
“This privacy breach is extremely serious and completely unacceptable. Measures are being taken to notify, support and protect individuals affected by this breach,” Findlay commented.
Not the First, but Unique
Previous privacy breaches under the Conservative government have involved confidential information of ordinary citizens, but this breach is unique in that it includes so many well-known, high-profile Canadians in the fields of politics, sports and culture.
The spreadsheet shows not only what the donors claimed their donations are worth, but what the government later determined was the true worth, sometimes well below their initial claimed value.
Cultural donations in Canada must first be approved by the Canadian Cultural Property Export Review Board, which normally receives applications from cultural institutions that have come to some arrangement with a donor. The board must then certify the donation as an “object of significance and national importance,” and ensure that the value attached is appropriate for the purposes of a tax break.
CRA Response Less than Stellar
CRA officials did not respond to questions following the breach, referring instead to a statement made by commissioner Andrew Treusch:
“The document was accidentally released to the CBC through human error. When CRA became aware of the breach, CRA officials immediately contacted the CBC to inform them of the error and retrieve the documents. Retrieval efforts continue.”
According to former Canadian Privacy Commissioner Jennifer Stoddard, there is a “significant trend” in complaints against the CRA:
“Over the years we had recurring complaints from people who thought, from what other people had told them, that somehow they must have been looking at their income tax files and they knew that these other people worked at the Canada Revenue Agency. This has been a pattern over the years.”
Canadian privacy law forbids disclosure of sensitive personal information that “could reasonably be expected to cause serious injury or harm to the individual and/or involves a large number of affected individuals. However, the Canada Revenue Agency is held to an even higher standard. It has a special duty to preserve confidential tax information of individuals and businesses – even protecting it from disclosure to other federal departments and police forces.
Former Ontario privacy commissioner Ann Cavoukian had a most scathing review, noting that she was “outraged” to learn of the breach. She said, “It’s completely unfathomable. Perhaps you need to discharge certain employees… You need a complete overhaul, top to bottom.”
This article discusses the recent Canada Revenue Agency (CRA) privacy breach, which disclosed personal information of many high-profile Canadians.
CIPP Exam Preparation
In preparation for the Certified Information Privacy Professional/Canada (CIPP/C) exam, a privacy professional should be comfortable with topics related to this post, including:
- Canadian government and legal system (I.A.a.)
- Privacy commissioners (I.A.c.i.1.)
- Types of personal information – private/sensitive information (I.B.a.iii.)