Clause 47 of Bill C-15, the Budget Implementation Act, 2016, No. 1

Submission to the Standing Senate Committee on National Finance

June 3, 2016

The Honourable Larry Smith, Senator
Chair, Standing Senate Committee on National Finance
The Senate of Canada
Ottawa, Ontario K1A 0A4

Dear Senator,

Thank you for the opportunity to present the views of the Office of the Privacy Commissioner of Canada in connection with Clause 47 of Bill C-15, the Budget Implementation Act, 2016, No. 1, and its compliance with Canada's federal privacy legislation. We hope that our written comments will assist the Standing Senate Committee on National Finance in its pre-study of the Bill and address the questions raised by Committee members during your meeting of May 17, 2016.

This submission addresses Clause 47, which amends the Income Tax Act, while also taking into account those provisions in the bill that make analogous changes to other Acts of Parliament. These specific provisions are subject to the Privacy Act, which covers the personal information-handling practices of federal government departments and agencies, including notably the Canada Revenue Agency (CRA) and the Office of the Superintendent of Financial Institutions (OFSI).

Amendments to facilitate information-sharing for the collection of non-tax debts [sub-Clause 47(1)]

This sub-clause seeks to amend provisions in the Income Tax Act to permit the disclosure of "taxpayer information" to an official of the CRA for the collection of amounts owing under certain federal and provincial government programs. Clauses 67(3) and 75(4) of Bill C-15 would make equivalent amendments to the Excise Tax Act and the Excise Act, 2001, respectively.

We understand that these changes are meant to allow the sharing of information amongst CRA officials dealing with tax collection and those dealing with non-tax debts, in an effort to avoid duplicate efforts and simplify individuals' interactions with the CRA. To the extent that the information shared is limited to that which is necessary to fulfill the stated purpose — the Agency's collection of amounts owing — and the use given to the information is consistent with that purpose, and should the proposed changes become law, they would be consistent with the Privacy Act.^{Footnote 1}

Also, should the amendment come into law, it would fall on the CRA to operationalize the information-sharing in compliance with Treasury Board Secretariat privacy policies and guidance.

Amendments to allow information-sharing with the Chief Actuary [sub-Clause 47(2)]

This sub-clause proposes to amend the Income Tax Act to allow "taxpayer information" to be shared solely for the purpose of enabling the OFSI Chief Actuary to conduct actuarial reviews of pension plans established under the Old Age Security Act as required by the Public Pensions Reporting Act.

We note that these changes, as drafted, are meant to facilitate the work of the Chief Actuary and the fulfillment of his legislative duties. That said, how this information is shared with the Chief Actuary is of importance. Since the stated purpose of this provision relates to actuarial review — that is, the compilation and analysis of statistics in order to calculate risks and premiums in the specified pension plans and not specific individuals — it follows that the information to be shared need not be personally identifiable information. Our Courts have ruled that "information will be about an identifiable individual where there is a serious possibility that an individual could be identified through the use of that information, alone or in combination with other information."^{Footnote 2} Where the information shared with the Chief Actuary is personal information, the provisions of the Privacy Act on the collection, use and disclosure of personal information would apply.

The Bill as currently drafted would seem to allow for the sharing of personal information in circumstances where anonymized information would suffice. That is problematic from a privacy perspective since the sharing of personal information should be limited to only what is necessary for the Chief Actuary's purposes.

During their appearance before your Committee on May 17, 2016, Department of Finance officials testified that the information to be shared under this provision is "masked data, in order to protect the privacy of taxpayers." This leads us to understand that the government's intention is to "mask" or de-identify the information, which should be done in a manner that ensures that the information cannot be re-identified.

While ideally this intention should be made explicitly in the bill, at a minimum, it is our position that it should be confirmed in an agreement between the department disclosing the information and the Chief Actuary. Our understanding from the Office of the Chief Actuary is that it plans to establish formal information-sharing arrangements covering the purposes under sub-Clause 47(2) of Bill C-15. It is also our understanding that these arrangements will include privacy protection measures limiting collection, establishing retention times and providing for the destruction of the information. Further, we understand that the information to be shared does not encompass all taxpayer information, but specific data limited to what is necessary to fulfill their legislated mandate. If such an agreement were reached, then our privacy concerns about the bill would indeed be attenuated.

Thank you again for considering our views related to Clause 47 of Bill C-15, the Budget Implementation Act, 2016, No. 1. We hope that this information will assist in your study of the Bill and my Office would be pleased to follow up with whatever information you may require.

Sincerely,

c.c. Gaëtane Lemay
Clerk of the Committee