Investigation into the steps the Canada Revenue Agency took to ensure the accuracy of a taxpayer’s personal information that it used to make an administrative decision about them

1. 1Whether the CRA took all reasonable steps to ensure the accuracy of personal information used for administrative purposes under subsection 6(2) of the Privacy Act
2. 2Whether the safeguards in place at the time of the breach were adequate to prevent unauthorized access and modification of personal information
3. 3Whether the CRA's authentication processes were sufficient to prevent identity theft and fraudulent activity
4. 4Whether the CRA should have contacted Employment and Social Development Canada (ESDC) sooner regarding the complainant's identity theft
5. 5Whether the CRA provided timely notification of the privacy breach to the affected individual
6. 6Whether the CRA fulfilled its mandatory privacy breach reporting obligations to the OPC

• Accuracy of personal information: CRA failed to ensure accuracy
• Safeguards against unauthorized access: CRA safeguards were inadequate
• Corrective measures: CRA implemented enhanced security
• Complaint outcome: Complaint well-founded and conditionally resolved

The CRA implemented corrections to its authentication request processes and enhanced security measures for high-impact modifications to personal information. The OPC also encouraged the CRA to implement measures to address situations where taxpayer information accessible in another department's system has been compromised, and to act more promptly in notifying affected individuals of material breaches.

• s.6(2) Privacy Act