Canada Revenue Agency gave personal information to a third party without consent

A woman complained that the Canada Revenue Agency (CRA) disclosed her personal information to a third party without her consent. The complainant, who had not updated her family name in the CRA system, was applying for an adjustment. A CRA employee, attempting to locate her in the system, sent a letter containing the complainant's Social Insurance Number and other personal information to her niece, who shared a similar name and address. The OPC found that this disclosure was due to human error, as the employee failed to follow established procedures for verifying addresses. The CRA acknowledged its mistake and implemented measures to prevent similar incidents. The complaint was found to be well-founded.