Woman fails in attempt to return personal information to Canada Revenue Agency

When a B.C. woman tried to return another taxpayers’ personal information that was mistakenly sent to her, the Canada Revenue Agency (CRA) only took action after the matter was brought to the media.

The story began when a woman asked the CRA in late March 2013 for information needed to complete the tax return of her deceased daughter. About eight weeks later she received a thick package from the Surrey Tax Centre.

Her daughter’s requested information slips were inside, but so was the confidential personal information of five other strangers. Included were names, income and benefits, SINs, date of birth, marital status, employment details, etc.

In an interview with CBC, the woman explained that she had tried several times to report the data breach by telephoning the main CRA toll-free number but could not get through. (The CRA says that the “service target for caller accessibility on the general inquiries line” is 85 per cent, meaning that the Agency accepts that one in seven callers would not be answered).

She then tried to deliver the confidential records in person by driving to the tax centre in Surrey. The centre wasn’t open to the public however, and a security guard suggested she put the unsealed, unlabelled package of confidential personal information in a drop box outside the building.

Rejecting that idea as unsuitable, she again phoned the main CRA number from her car. She was told she could either seal the information in another envelope marked with the appropriate security designation and place it in the drop box or wait 10 days for the CRA to send her a specially-labelled envelope.

Not satisfied with the choices, the woman suggested she personally hand over the information to someone from the tax centre, but was told this was not possible.

Following this, she got in touch with a CBC news reporter who contacted the CRA. The next day an employee from the B.C. tax office picked up the taxpayers’ records at her home.

A report from the CRA confirmed the key details of the incident. Upon learning about this situation, our Office launched a Commissioner-initiated complaint.  Our investigation concluded that the privacy rights of the taxpayers had been breached by the CRA and therefore the complaint was well founded.

The CRA promised remedial measures to reduce the chance of similar incidents, including by offering to courier pre-stamped envelopes.

The Agency has now improved its internal procedures regarding client service and misdirected mail. While we are satisfied with the measures taken, we would have liked the CRA to take further steps towards better facilitating breach reporting by the public, particularly during peak periods.