Canada Revenue Agency and the Canadian Broadcasting Corporation (CRA) - 2015
The Office of the Privacy Commissioner of Canada investigated complaints following a privacy breach by the Canada Revenue Agency (CRA), where personal information of approximately 1,000 individuals was inadvertently sent to the Canadian Broadcasting Corporation (CBC). The investigation confirmed that a CRA employee switched cover letters for two different packages, resulting in a consultation package being sent to a CBC journalist instead of the intended recipient. Despite the CRA's efforts to retrieve the information and implement corrective measures, the information was not returned by the CBC, leading to a published article by the CBC.
- Unauthorized disclosure of personal information
- Adequacy of CRA's internal procedures and employee training
- Compliance with section 8 of the Privacy Act regarding disclosure
Complaint well-founded
The investigation found that the CRA disclosed personal information to a CBC journalist without consent, contravening section 8 of the Privacy Act. Although the CRA took immediate corrective actions and developed an Action Plan to prevent recurrence, the disclosure itself was a contravention.
AI-generated summary for reference only. Always verify against the official decision ↗
The OPC was satisfied with the CRA's comprehensive Action Plan and its implementation, which aimed to mitigate future risks. However, the finding of a contravention was made.
- s. 3 Privacy Act
- s. 7(a) Privacy Act
- s. 8 Privacy Act
This summary is informational only and not legal advice.