Canadian privacy & access decisions

A complainant raised concerns that the Canada Revenue Agency (CRA) outsourced the storage of Canadian taxpayer information to Mobilshred Inc., which the complainant believed was a division of a US-based company, Recall. The complainant was concerned that this could make the personal information vulnerable to disclosure under the USA PATRIOT Act. The OPC investigated whether the CRA had properly safeguarded personal information from unauthorized disclosure. The CRA clarified that Mobilshred Inc. is a Canadian company, and the contract explicitly requires all physical records to remain in Canada. The OPC found that the CRA took appropriate steps to mitigate risks by ensuring all information remained in Canada and that Mobilshred Inc. is a Canadian entity. The complaint was found to be not well-founded.

• Whether the CRA properly safeguarded personal information entrusted to Mobilshred Inc. from unauthorized disclosure under the Privacy Act
• Whether Canadian taxpayer information was vulnerable to disclosure to US authorities under the USA PATRIOT Act due to the contract with Mobilshred Inc.
• Whether Mobilshred Inc. is a Canadian entity or affiliated with a US-based company