Canada Revenue Agency gave personal information to a third party without consent
The Canada Revenue Agency (CRA) disclosed personal information to a third party without consent, a contravention of the Privacy Act. An employee mistakenly sent a letter containing the complainant's Social Insurance Number and details about her husband to her niece, who shares a similar name. While the CRA corrected the error and implemented measures to prevent recurrence, the Office found the complaint to be well-founded due to the failure to follow established procedures.
- Disclosure of personal information without consent
- Failure to follow internal procedures for information disclosure
- Adequacy of corrective measures
Complaint well-founded — corrective measures implemented
The Agency disclosed personal information to a third party without consent, violating the Privacy Act, because an employee failed to follow established procedures for verifying recipient identity.
AI-generated summary for reference only. Always verify against the official decision ↗
The Canada Revenue Agency implemented measures to prevent future incidents of unauthorized disclosure.
This summary is informational only and not legal advice.