18 May 2022 External T.I. 2019-0801531E5 - Identity Theft Shield Premiums

Please note that the following document, although believed to be correct at the time of issue, may not represent the current position of the CRA.
Prenez note que ce document, bien qu'exact au moment émis, peut ne pas représenter la position actuelle de l'ARC.

Principal Issues: Do employer paid premiums for identity theft protection services represent a deductible expense and would they be considered a taxable benefit to employees?

Position: Question of fact.

Reasons: In the absence of additional information suggesting a heightened risk of identity theft for employees or a link between the personal information monitored and an employer’s business, this particular employer-paid plan would appear to provide an economic advantage that is primarily for the benefit of the employee.

XXXXXXXXXX						2019-080153
T. Witteveen

May 18, 2022

Dear XXXXXXXXXX:

Re: Taxable Benefit and Identity Protection Services

This is in reply to correspondence from your legal representative of March 19, 2019, wherein they asked whether certain identity theft shield premiums would be considered a deductible business expense and whether premiums paid on behalf of employees would be considered a taxable benefit to the employee. XXXXXXXXXX.

Identity theft refers to the preparatory stage of acquiring and collecting someone else’s personal information for criminal purposes. Identity theft protection services generally provide identity or credit monitoring services to determine if an individual’s personal information has been compromised.

Based on the plan details XXXXXXXXXX, the company will provide privacy and security monitoring, identity consultation services and identity restoration services. In particular, the XXXXXXXXXX details indicate the service will monitor for matches of an individual’s personally identifiable information: name, date of birth, social insurance number, up to ten bank account numbers, up to ten international bank account numbers, up to ten credit/debit card numbers, up to ten medical identification numbers, up to ten email addresses, up to ten phone numbers, driver’s license number, and up to five passport numbers. Only plans for individuals are listed on XXXXXXXXXX website; no business or corporate plans are listed. Therefore, it appears that identity theft protection premiums paid by a business would relate to individual employees or an individual who is the business’ owner.

Our Comments

This technical interpretation provides general comments about the provisions of the Income Tax Act (the “Act”) and related legislation (where referenced). It does not confirm the income tax treatment of a particular situation involving a specific taxpayer but is intended to assist you in making that determination. The income tax treatment of particular transactions proposed by a specific taxpayer will only be confirmed by this Directorate in the context of an advance income tax ruling request submitted in the manner set out in Information Circular IC 70-6R12, Advance Income Tax Rulings and Technical Interpretations.

Employment Benefit

Paragraphs 6(1)(a) and 6(1)(b) of the Act generally include in an individual’s employment income the value of all benefits and allowances received by an employee in respect of, in the course of, or by virtue of an office or employment unless excluded by another provision of the Act. The value of a benefit will be included in an employee’s income under paragraph 6(1)(a) where the employee, or an individual not dealing at arm’s length with the employee:

• receives an economic advantage measurable in monetary terms; and

• is the primary beneficiary of the benefit.

To determine who is the primary beneficiary of a particular benefit, all of the relevant facts must be reviewed on a case-by-case basis. It is the employer’s responsibility to determine whether the primary beneficiary is the employer or the employee. Although no single factor may be conclusive, a positive answer to one or more of the following questions may suggest that the employer is the primary beneficiary of the benefit:

• Does the employer have a business purpose for providing the benefit?

• Is the benefit required for the employee to perform the employment duties more effectively?

• Is the benefit required to fulfill a condition of employment?

• Does the employer have a moral or contractual obligation to provide the benefit to ensure that employees are not unduly subject to harm from performing the employment duties?

Given our understanding of the services offered under the identity theft protection plan, and in the absence of additional information suggesting a heightened risk of identity theft for employees or a link between the personal information monitored and an employer’s business, the employer-paid plan would appear to provide an economic advantage that is primarily for the benefit of the employee. In such a situation, the cost of the premium would be included in the employee’s income under paragraph 6(1)(a) of the Act.

In addition, where the premiums are paid for an individual who is both an employee and a shareholder, a determination will need to be made as to whether a benefit has been received in the individual’s capacity as an employee or as a shareholder. Where a benefit has been received by an individual in their capacity as a shareholder, it will be included in income pursuant to subsection 15(1) of the Act.

Business Expense

Subsection 9(1) of the Act provides that a taxpayer’s income from a business for a taxation year is, subject to any other specific rule in Part I, the taxpayer’s profit from that business for the year. Generally, in order to qualify as a deductible business expense, an expense must be made or incurred by the taxpayer for the purpose of gaining or producing income from the business (paragraph 18(1)(a) of the Act), must not be on account of capital (paragraph 18(1)(b)), must not be a personal expense (paragraph 18(1)(h)) and the amount of the expense must be reasonable in the circumstances (section 67).

It is a question of fact as to whether identity theft protection plan premiums paid by a business are deductible. Based on the details of the identity theft protection plan, the services appear to relate to the protection of an individual’s personal and financial information and are not related to an individual’s employment or business information.

However, to the extent that the employer-paid premiums are included in the employees’ income under paragraph 6(1)(a) of the Act, the premiums would generally be deductible for business purposes provided that they are also considered reasonable pursuant to section 67 of the Act. Where the employer-paid premiums are included in an individual’s income under subsection 15(1) of the Act, as discussed above, the corporation will not be able to deduct the premiums in computing income.

We trust that these comments will be of assistance.

Yours truly,

Sandro D’Angelo, CPA, CMA
Acting Manager
Business Income and Capital Transactions Section
Business and Employment Division
Income Tax Rulings Directorate
Legislative Policy and Regulatory Affairs Branch