Special report to Parliament: Investigation of unauthorized disclosures and modifications of taxpayer personal information at the Canada Revenue Agency

1. 1Whether the CRA adequately protected personal information against unauthorized disclosure and modification
2. 2Whether the CRA contravened subsection 6(2) of the Privacy Act regarding accuracy of personal information
3. 3Whether the CRA contravened subsection 8(2) of the Privacy Act regarding disclosure of personal information
4. 4Whether the CRA's prevention measures were adequate
5. 5Whether the CRA implemented mandatory multi-factor authentication (MFA) in a timely manner and with sufficient strength
6. 6Whether the CRA's authentication processes by phone were strong enough
7. 7Whether the CRA considered and integrated a zero-trust approach into its security measures
8. 8Whether the CRA had sufficient visibility over its attack surface and managed it effectively
9. 9Whether the CRA's vetting, training, and awareness tools were effective for employees and third parties
10. 10Whether the CRA's monitoring and detection approach was tailored to the threats and risks leading to Unauthorized Use of Taxpayer Information by a Third Party (UUTP)
11. 11Whether the CRA's remediation efforts for individual UUTPs were adequate, including root cause analysis
12. 12Whether the CRA's governance processes for addressing UUTPs were coordinated, comprehensive, and efficient

• Safeguards for personal information: CRA contravened Privacy Act subsections 6(2) and 8(2)
• Multi-factor authentication: Delayed implementation identified as weakness
• Breach tracking: Insufficient tracking identified as weakness
• Recommendations issued: Nine recommendations issued to CRA
• Recommendations accepted: CRA accepted eight recommendations in full and one in part
• Outcome of investigation: Investigation found well-founded and conditionally resolved

The Commissioner made nine recommendations to the CRA, which the Agency accepted eight in full and one in part, focusing on strengthening MFA, enhancing phone authentication, integrating zero-trust principles, improving attack surface management, assessing training and awareness, tailoring monitoring and detection, developing comprehensive breach tracking, and reviewing governance processes.

• s.6(2) Privacy Act
• s.8(2) Privacy Act
• s.39(1) Privacy Act
• s.40(1) Privacy Act
• TBS Policy on Privacy Protection
• TBS Policy on Government Security
• TBS Directive on Security Management