Language selection

OPC Logo Office of the Privacy Commissioner of Canada

Search

Investigation into the disclosure of an adopted child’s name to their biological mother by the Canada Revenue Agency

Complaint under the Privacy Act (the Act)

February 27, 2025

Update

The day after the issuance of the final report, the CRA agreed to implement two of the OPC’s three recommendations. Specifically, the CRA committed to reviewing and revising its existing procedures and providing comprehensive training to its employees. However, it declined to implement oversight measures to monitor compliance with the new procedures for one year following the implementation of our recommendations.

Description

The complainant adopted a child through a closed adoption process and changed their name shortly after the adoption for safety reasons. She alleged that the CRA inappropriately disclosed her personal information and that of her adoptive child to the child’s biological mother. We found that on the balance of probability, the CRA likely disclosed the child’s adoptive name to the biological mother and thereby contravened section 8 of the Act. In addition, we found deficiencies in its internal procedures that put adopted children’s personal information at risk of unauthorized disclosure.

Report of findings

Overview

The complainant (the adoptive mother) alleges that the Canada Revenue Agency (CRA) inappropriately disclosed her personal information and that of her adoptive child to the child’s biological mother (the biological mother). She also alleges that the CRA made changes to their accounts without their knowledge or consent and used inaccurate information to do so.

Regarding the accuracy of the information, we note that the CRA made changes to the child’s name in its system following the receipt of the biological mother’s application. The CRA corrected the issue when the complainant reported the error. Since this allegation was resolved before the launch of this investigation, it will not be examined in this report.

At issue, therefore, is whether the CRA contravened section 8 of the Privacy Act (the Act). This section states that personal information can only be disclosed with an individual’s consent – per subsection 8(1) – or in accordance with one of the exceptions outlined in subsection 8(2).

During the investigation, the CRA did not submit any representations as to whether there had been a contravention to section 8 of the Act, as it was unable to confirm whether the disclosure of the complainant’s and the child’s personal information did in fact occur. However, it acknowledged that it did not adequately protect the child’s personal information.

After consideration of the facts and the submissions of the parties, we determined that on the balance of probabilities, the CRA inappropriately disclosed the complainant’s and the child’s personal information to the biological mother.

Consequently, the Office of the Privacy Commissioner (OPC) issued a preliminary report of findings and recommended that the CRA (i) review and revise the current procedures set out in the CRA Benefits Operation Manual to highlight the importance of and enhance the safeguarding of the personal information of children,Footnote 1 (ii) ensure that CRA employees receive comprehensive training on the updated procedures, and (iii) implement oversight measures to monitor compliance with the new procedures.

The CRA did not provide a response to the preliminary report within the specified deadline, and did not inform the OPC whether it agreed to implement the above-mentioned recommendations. In light of the foregoing, we find that the complaint is well-founded and not resolved.

Background

Timeline

  1. In 2010, the complainant adopted the child from a non-governmental child protection organization through a closed adoption process. This type of adoption means that the child and their adoptive family are not in contact with the biological family.Footnote 2 Our investigation confirmed that the child was not in contact with their biological parents since they were removed from their care. In addition, we note from the complainant’s submissions that she decided to change the child’s name shortly after the adoption, for safety reasons.
  2. On June 11, 2010, the CRA received the complainant’s Canada Child Tax BenefitFootnote 3 (CCTB) application for the child under their adoptive name.
  3. On August 5, 2010, the CRA received a second CCTB application, this time submitted by the biological mother under the child’s birth name. Upon receiving this second application, the CRA changed the child’s adoptive to their birth name in CRA’s system.
  4. In 2015, the complainant contacted the CRA because she was receiving correspondence under the child’s birth name. The CRA confirmed that the child’s name was inaccurate in its system and corrected it back to the adoptive name.
  5. During the course of the investigation, the OPC contacted the biological mother who confirmed that, in the summer of 2018, a CRA employee verballyFootnote 4 disclosed the child’s full adoptive name to her when she contacted the call centre for an unrelated matter. She also confirmed that prior to this conversation, she did not know the child’s new name nor the identity of their adoptive parents. She further explained that, with that information, she was able to subsequently locate the complainant and the child and initiate contact with them.
  6. The complainant represented that the biological mother’s first contact with the child took place in December 2018, shortly after the alleged disclosure.

The Dependent Identification Number account

  1. The Dependent Identification Number (DIN) is used by the CRA to refer to a child’s account in its Child Credit Management system (DIN accountFootnote 5) for the processing of applications such as the Canada Child Benefit and the Children Special Allowances. The DIN account is linked to the account of the taxpayer who requested benefits for the child (or the public organization’s account in cases where a child is under the legal care of such organization), even if they are deemed ineligible by the CRA to receive them. Any updates made to a DIN account will be displayed in linked taxpayers’ accounts.
  2. The CRA indicated that when it receives multiple applications for the same child from different applicants, in most cases it creates distinct DIN accounts for the child and undertakes a review to “determine with whom the qualified dependant resides, and who is primarily responsible for their care and upbringing.” In this specific case, the CRA did not create a distinct DIN nor did it deem it necessary to complete a review.Footnote 6
  3. It is important to note that when the complainant submitted their CCTB application, a DIN account for the child already existed in CRA’s system: the non-governmental child protection organization, who initially had the custody of the child, applied for and was receiving the benefits from the CRA and was depositing the funds in a Registered Education Savings Plan accountFootnote 7 in the child’s name. According to the CRA’s procedures, there is an exception to the requirement to create a new DIN account when the child has always been in the custody of an agency. Therefore, when the complainant filed her CCTB application, the CRA did not create a new DIN account. It only updated the existing account to reflect the information contained in her application and linked it to her taxpayer account.
  4. In its representations, the CRA explained that an error occurred as a result of an employee not following internal proceduresFootnote 8 to process the biological mother’s application. It further explained that the employee made changes to the child’s existing DIN account instead of creating a new one. As a result, the child’s DIN account was subsequently also linked to both the complainant’s account and the biological mother’s account.Footnote 9 This means that from this point forward, any changes made to the child’s DIN account, such as the change of the name entered in the CRA’s system in 2015, would show on the biological mother’s account in the “CCB Child(ren) information” section.Footnote 10

Analysis

Issue: Did the CRA disclose the child’s adoptive name to the biological mother in contravention of section 8 of the Act?

The procedures set out in the CRA Benefits Operation Manual
  1. Given that the CRA noted that its internal procedures were not followed by the employee who processed the biological parent’s application, the OPC reviewed the relevant excerptsFootnote 11 of the CRA Benefits Operation Manual. The “adoption” subsectionFootnote 12 states that:

    Adoption

    An adoption occurs when a third party adopts a child and will not know whom the child’s biological parents or previous primary caregivers are. In most cases, the child already exists on our system; therefore, the child will have a DIN.

    For these types of adoptions, a new DIN must be created for the child, in order to protect the identity of previous and current primary caregivers. A [Custody Dispute Indicator (CDI)]Footnote 13 must be set on the old DIN.

  2. We noted that the procedure does not refer to any other scenarios and only describes the most common and likely situation: The CRA receives the first application from a biological parent and the initial DIN account is linked to their account. This was also confirmed by the CRA’s representations: “when CRA Benefits Operation Manual procedures are followed, the child’s information post-adoption would only be accessible via the adoptive caregiver’s account. Once the new DIN is created, the old DIN (with the child’s information prior to the adoption) is frozen from future changes.”
  3. In this case, the order was reversed since the adoptive mother’s application was received before the biological mother’s application, a scenario which is not included in the manual. Therefore, the DIN account (initially created and associated with the organization and subsequently associated with the adoptive mother) already existed in the CRA’s system when the biological mother’s application was received by the CRA. Given that the manual does not include this reverse scenario, it may have created confusion for the CRA employee who processed the biological parent’s application.
  4. In addition, the OPC noted that the use of CDIs was limited to “old” DIN accounts, and that the procedures did not otherwise include a mechanism to flag a safety risk for adopted children.
  5. While the CRA explained that the purpose of creating a new DIN account for adopted children (which didn’t happen in this case) is to protect their identity, the procedures only emphasize that the new DIN should be created “to protect the identity of previous and current primary caregivers” – there is no mention of protecting the children’s identity nor mention that a new DIN should also aim to protect adopted children’s personal information and privacy.
  6. While we have no indication that this is a systemic issue, this incident demonstrates the CRA’s important role in safeguarding children’s personal information that is under its control.
  7. In summary, the CRA should have clear and robust procedures in place to properly safeguard adopted children’s personal information. The OPC therefore finds that CRA’s current procedures should be reviewed and updated to address the aforementioned deficiencies. In addition, CRA employees who create, and update adopted children’s accounts should have an extensive knowledge of the applicable procedures and be aware of potential harms if children’s personal information is breached.
The disclosure to the biological mother
  1. The complainant also alleged that, contrary to what is intended by the closed adoption, the disclosure of her own and the child’s personal information to the biological parent had severe negative impacts on them. The complainant provided evidence of the consequences that the disclosure had on their family, and more importantly on the child, including considerable psychological and legal repercussions.
  2. It is important to note that the child’s adoptive last name is the same as that of the complainant, which allowed the biological mother to identify both the complainant and the child. Considering that the complainant provided the child’s adoptive name to the CRA in a confidential correspondence, the OPC considers the child’s adoptive name to be also the complainant’s personal information under section 3 of the Act.Footnote 14
  3. Section 8 of the Act specifies that a disclosure of personal information without an individual’s consent can only be made under certain limited circumstances described under subsection 8(2) of the Act.
  4. As explained in a previous section of this report, the CRA represented that the employee who processed the biological parent’s application in August 2010 did not follow internal procedures. This resulted in the child’s personal information, including their full adoptive name, to be linked to both the biological and adoptive mothers’ accounts.
  5. The CRA represented that “unfortunately [the child]’s information was not afforded the appropriate level of security […].” However, since it had no records to substantiate whether or not the child’s and the complainant’s information was disclosed to the biological parent, it did not submit any representations regarding compliance with section 8 of the Act.
  6. Because the CRA did not make representations as to whether the alleged disclosure took place and given the passage of time since the events occurred, we considered the following elements to make our determination:
    • The CRA confirmed that the child’s DIN account was linked to both the biological and adoptive mothers’ accounts. It further explained that if the biological mother asked about the child at the time, it is possible that the CRA shared with her the information that is in the child’s file, including their adoptive name;
    • The biological mother confirmed that when she contacted the CRA call centre in 2018, an employee disclosed to her the child’s full adoptive name, which helped her to locate the child and their adoptive family, and initiate contact with them; and
    • Based on CRA’s existing procedures, the call centre employee would have had no reason to suspect that the DIN contained information that the biological mother was not entitled to know. According to the CRA, the DIN that was linked to the biological mother’s account should have been created strictly based on the information contained in her own CCTB application.
  7. In light of the foregoing, the OPC finds that, on the balance of probabilities, the CRA likely disclosed the child’s full adoptive name to the biological mother and thereby, contravened section 8 of the Act. In fact, the CRA had no evidence to the contrary and admitted that the procedures were not followed. Therefore, the complaint is well-founded.
  8. During the course of the investigation, the CRA confirmed that it manually deleted and unlinked the first DIN account from the biological mother’s account,Footnote 15 and created a new one for “added security”. The new DIN account, linked to the biological mother’s account, contains only information that she provided in her own application and therefore, information in the first DIN account will no longer be visible from her account. The CRA also advised that it set a CDI on both the initial and new DIN accounts.
  9. While the information has already been shared and generated negative impacts for the adoptive family, a fact which cannot be changed, the OPC is satisfied that the CRA has taken adequate measures to mitigate the risks associated with this specific case. However, we find that the procedures in the CRA Benefits Operation Manual to protect adopted children’s personal information remain insufficient for future similar cases. The CRA should therefore implement corrective measures to prevent recurrence of similar incidents for other families.

Recommendations

  1. Given that the OPC found that 1) the CRA failed to comply with its obligations to prevent the unauthorized disclosure of the child’s and the complainant’s personal information, and 2) there are deficiencies in the existing procedures, putting adopted children’s personal information at risk, we issued a preliminary report of findings to the CRA on January 17, 2025 and recommended that, within a year of the issuance of this report, the CRA:
    1. Review and revise the procedures in the CRA Benefits Operation Manual, as well as any other related policy or procedure related to the processing of children’s personal information.
    2. Ensure that employees who process applications related to children, such as CCB applications, receive comprehensive training on the updated procedures and on the importance of safeguarding children’s personal information.
  2. Additionally, we recommended that during the year that follows the implementation of the above measures, the CRA implement oversight measures to monitor compliance with the new procedures to ensure that they are implemented consistently and being followed by the employees.
  3. The CRA did not provide a response to the preliminary report within the specified deadline, and did not inform the OPC whether it agreed to implement the above-mentioned recommendations. Therefore, we find that the complaint is well-founded and not resolved.
Date modified: