Assessment, Benefit and Service Branch
Business Returns Directorate

On this page

• Overview & Privacy Impact Assessment Initiation (PIA)
• Summary of the project, initiative or change
• Risk identification and categorization

Overview & Privacy Impact Assessment (PIA) Initiation

Government institution

Canada Revenue Agency

Government official responsible for the PIA

Gillian Pranke
Assistant Commissioner
Assessment, Benefit and Service Branch

Head of the government institution or Delegate for section 10 of the Privacy Act

Anne Marie Laurin
Director General
Access to Information and Privacy Directorate
Public Affairs Branch

Name of program or activity of the government institution

Tax Services and Processing

We give taxpayers access to accurate and timely information they need to comply with Canada's tax laws by modernizing our services, including expanding our digital services and enhancing our telephone platform, making it easier for taxpayers to meet their tax obligations. In addition to the individual returns program, we register businesses for a business number and administer T2, T3, GST/HST, excise, and other levies programs. We help businesses and individuals to voluntarily comply with Canada's tax laws by processing their information and payments as quickly and accurately as possible and telling them the results of their assessment or reassessment.

Standard or institution specific class of record:

Administration of GST/HST Returns and Rebates
CRA ABSB 246

Standard or institution specific personal information bank:

GST/HST Returns and Rebates Program
CRA PPU 241
TBS Registration Number: 000013

Legal authority for program or activity

• Part IX of the Excise Tax Act
• Bill C-78, An Act respecting temporary cost of living relief (affordability)
• Title I of the Act Respecting the Québec Sales Tax, Chapter t-0.1
• Tax Administration Act (Quebec)
• Subsection 63(1) of the Canada Revenue Agency Act
• Section 7 of the Federal-Provincial Fiscal Arrangements Act
• Financial Administration Act
• Section 87 of the Indian Act
• Foreign Missions and International Organizations Act
• Vienna Convention
• Comprehensive integrated tax coordination agreements
• Reciprocal tax agreements
• Memoranda of understanding with Revenu Québec
• Visiting Forces Act

Summary of the project, initiative or change

Overview of the Program or Activity

The goods and services tax (GST) is a commodity tax that applies to the supply of most property and services in Canada. The provinces of Nova Scotia, New Brunswick, Newfoundland and Labrador, Ontario, and Prince Edward Island, referred to as the participating provinces, harmonized their provincial sales tax with the GST to create the harmonized sales tax (HST). Generally, the HST applies to the same base of property and services as the GST. The province of Quebec continues to administer a separate GST and provincial sales tax. According to a memorandum of understanding signed in December 2012, the Canada Revenu Agency is responsible for administering any GST/HST and Quebec Sales Tax (QST) requirements for all selected listed financial institutions (SLFIs) from January 1, 2013.

Consumers and businesses have to pay the GST/HST on purchases of taxable supplies of property and services (other than zero-rated supplies). A limited number of sales or supplies are exempt or zero‑rated from GST/HST.

Although the consumer is the last in the supply chain that pays the tax, businesses are responsible for collecting and remitting the GST/HST on behalf of the government. Organizations that collect and must remit the GST/HST have a unique business number and are called registrants.

Registrants must collect and remit the GST/HST that applies on sales or purchases they make to operate their business. They can claim input tax credits to recover the GST/HST paid or payable on the purchases they use in their taxable commercial activities.

GST/HST registrants must meet certain responsibilities. Generally, registrants must file returns on a regular basis, collect the tax on taxable supplies they make in Canada, and remit any resulting net tax owing.

There are various situations that entitle resident and non-resident individuals or organizations to a GST/HST rebate. In some cases, it is not necessary to be registered for the GST/HST. For example, one may have paid the GST/HST in error on an exempt or zero-rated supply. GST/HST rebate claimants who are not registrants are also given a unique business number.

The CRA supports the division that administers the GST/HST returns and rebates (also referred to as the GST/HST program) by performing the following activities:

• Ensures businesses that are required or elect to be registered for GST/HST are registered and that registration information is kept current
• Ensures selected listed financial institutions (SLFIs) that are required or elect to be registered for GST/HST and/or QST are registered, as well as keeping registration information current
• Protects revenue and processes GST/HST and QST returns, rebates, elections, and remittances
• Processes payments, collects accounts receivable of overdue taxes, interest, and penalties
• Assesses entitlement to refund and rebate claims, and
• Accounting for all business programs including GST/HST

The GST/HST program is responsible for the following activities related to the GST/HST and QST SLFI programs:

• Ensuring all organizations and individuals are registered accurately and efficiently, minimizing the burden of voluntary compliance
• Assessing and validating information filed for GST/HST returns, rebates, and elections
• Ensuring all GST/HST client data has been accurately captured, and
• Developing electronic processes to ease the tax burden on organizations and individuals

The GST/HST program provides the central management framework for planning, processing, monitoring, and reporting on the annual program activities in two tax centres (TCs). This functional support role includes providing policy development, program enhancements, system specifications, operational procedures, field communications, financial and budget oversight, quality assurance, and program monitoring. The GST/HST program is also involved in the analysis, design, development, delivery of projects, and technological innovations including new and improved electronic services.

The GST/HST program works regularly with Revenu Québec and other areas of the CRA to ensure consistent GST/HST program delivery for businesses, organizations, and individuals who claim rebates or file GST/HST returns or both, including applicable GST/HST elections.

The GST/HST program is responsible for ensuring that GST/HST returns are accurately processed, recorded, and assessed. Every year, our TCs receive over 7.5 million GST/HST returns filed by registrants to report the GST/HST. GST/HST registrants have five methods to file a GST34 return: GST/HST NETFILE, GST/HST TELEFILE, GST/HST Electronic Data Interchange (EDI), GST/HST Internet File Transfer (GIFT), and on paper.

The GST/HST program is responsible for ensuring accurate processing and assessing of returns and rebates under the Excise Tax Act, for the following:

• certain businesses
• organizations
• individuals
• foreign convention organizers
• sponsors and exhibitors
• diplomats and embassies, and
• public service bodies (PSBs)

The GST/HST program is responsible for ensuring accurate processing and assessing of rebate applications for government entities as covered by comprehensive integrated tax coordination agreements and reciprocal tax agreements with the provinces and territories.

The major rebate categories are new housing, new residential rental property, PSBs, government, general rebates, foreign conventions, and tour operators. All GST/HST rebates are currently processed at the Sudbury and Atlantic TCs with the exception of rebates that fall under Revenu Québec (RQ) administration, which RQ processes.

The GST/HST program is also responsible for the processing of returns and rebates of QST in specific circumstances. Under the Act Respecting the Québec Sales Tax, SLFIs and businesses that would be SLFIs if Quebec was a harmonized province, are eligible to submit a return or claim a rebate for the recovery of the QST paid on certain goods and services that have been purchased or leased. A memorandum of understanding (MOU) is in place between the Government of Canada and the Government of Québec regarding the CRA’s administration of these returns and rebates.

Given that RQ administers the GST/HST in Quebec on behalf of the Canada Revenue Agency (CRA), RQ-administered GST accounts are not eligible to use My Business Account and Represent a Client for GST‑related services. In collaboration with the CRA, RQ has expanded their public-facing application Mon Dossier to offer the same view and update services for the GST accounts they administer. Also, RQ has expanded their internal portals so that RQ employees can view accurate and up-to-date GST/HST information. Existing data transfers between the CRA and RQ were insufficient therefore a web interface was developed. The project was implemented in the following stages:

• For businesses (Phase 1 – October 2018)
  • Allow businesses to view the following GST/HST information online through RQ portals: business profile, returns filed, elections, account statements, rebates, payments and their breakdowns, information regarding objections and appeals
  • Create an internal portal for RQ officers, which displays the data viewed by the client, to provide better client service
• For businesses and individuals (Phase 2 – October 2020)
  • Allow businesses and individuals to generate their (initial) GST/HST rebate applications online through the RQ portals
  • Allow businesses and individuals to monitor the status of their rebate applications
  • Update the internal RQ portal. Allow businesses and individuals to file their GST74 election using the RQ web service during the registration process
• For businesses and individuals (Phase 3 – October 2021)
• Allow businesses and individuals to submit additional initial GST/HST rebate applications online through the RQ secure portals

What’s New

To address the Fall 2020 Economic Statement for the digital tax measures, the CRA launched a web form on the external CRA website to allow non-residents to register for the GST/HST as digital suppliers. These registrants are identified by operations (for example, digital supplies, short‑term accommodation, fulfillment warehouses) and by registration method (regular or simplified) for reporting purposes. The registration process is available to non‑residents on Canada.ca since June 21, 2021.

Scope of the Privacy Impact Assessment

For businesses

With the passing of legislative amendments to Part XI of the Excise Tax Act through Bill C-78, An Act respecting temporary cost of living relief (affordability), businesses are temporarily exempt from paying goods and services / harmonized sales tax (GST/HST) on certain goods purchased between December 14, 2024, and February 15, 2025. Businesses who are charged incorrectly are able to submit a rebate claim to be reimbursed for the amount they paid in error. These organizations have to complete and file a Form GST189, General Application for GST/HST Rebates, to claim a Reason Code 1C rebate for amounts paid in error. This claim will also be known as the GST/HST break. Businesses can file using the following methods:

• My Business Account (MyBA)
• Represent a Client (RAC)
• Paper-filed Form GST189

In the second phase, we have developed additional functionalities that support the assessment of returns received from the new simplified GST/HST registrant. One of the major elements of this phase includes a solution to allow the Agency to convert returns received in certain foreign currencies into Canadian funds. Phase two system changes were tested and implemented in October 2021.

A GST189 webform was developed to allow non-resident simplified GST/HST registrants to file general rebate Reason Codes 1C or 4 rebates. Implementation date for this was May 2022.

Non-resident registrants file their GST/HST returns electronically using the existing GST/HST NETFILE or RAC services. The CRA captures the IP address for electronically-filed GST/HST rebates, as it is captured for GST34 returns.

For individuals

With the passing of legislative amendments to Part XI of the Excise Tax Act through Bill C‑78, An Act respecting temporary cost of living relief, individuals are temporarily exempt from paying goods and services or harmonized sales tax (GST/HST) on certain goods purchased between December 14, 2024, and February 15, 2025. Individuals who are charged incorrectly are able to submit a rebate claim to be reimbursed for the amount they paid in error. Individuals have to complete and file a Form GST189, General Application for GST/HST Rebates, and submit receipts to claim a Reason Code 1C rebate for amounts paid in error. This claim will also be known as the GST/HST break. Individuals can file a request for a GST/HST rebate using the following methods:

• My Account (MyA)
• RAC
• Paper-filed Form GST189

As part of promoting the CRA’s web services the existing electronic rebate filing options for individuals were expanded by adding to MyA services. The option to file Form GST190, GST/HST New Housing Rebate Application for Houses Purchased from a Builder, is now available. This rebate application, for certain rebate application types, can now be submitted by individuals through MyA and RAC. Similar to MyBA, MyA and RAC were enhanced to accept certain electronically‑filed reason codes on Form GST189, for individuals, as well as options to file Form GST524, GST/HST New Residential Rental Property Rebate Application, and Form GST495, Rebate Application for Provincial Part of Harmonized Sales Tax (HST). Once the data is entered in a secure portal, it is transmitted to the GST/HST program for processing.

Scope of the privacy impact assessment

This privacy impact assessment (PIA) identifies and assesses privacy risks to personal information relating to the GST/HST program activities. The following activities are administered by the Business Returns Directorate of the Assessment, Benefit, and Service Branch (ABSB):

• GST/HST account registration
• Processing of GST/HST returns, rebate applications and various elections that are filed by businesses, organizations, third parties, and individuals in regards to GST/HST collected and submitted by businesses and third parties and GST/HST paid by individuals and businesses where a rebate is applicable. QST amounts can also be paid to individuals and businesses in specific situations according to MOU 819
• The administration of the GST and the QST for selected listed financial institutions (SLFIs) that have a permanent establishment in Quebec as well as those that have a permanent establishment outside Quebec, but do business in Quebec, and
• Support the web interface to process Revenu Québec web service requests to the GST/HST suite of systems and other systems supporting the GST/HST program according to the various phases of the project.
• This PIA does not cover activities about the GST/HST credit that is available to individuals based on income thresholds and is issued every three months. Those activities are administered by the Benefit Programs Directorate and are reflected in a separate PIA entitled GST/HST Credit and Related Benefits and Credits.
• This PIA also does not cover compliance activities, those activities are administered by the Collections and Verification Branch and are reflected in the PIA entitled Corporations and GST/HST Compliance Programs.

Risk identification and categorization

A) Type of program or activity

Administration of Programs / Activity and Services

Level of risk to privacy: 2

Details:

The personal information collected is used mainly for the administration of the GST/HST program (for example, identification purposes, processing returns, rebates, elections, collecting revenue, issuing payments, and providing support to clients) to determine the correct amount of GST/HST owing on the account and to prevent the disbursement of unwarranted refunds and rebates.

During our select processes we link information from other revenue lines or programs to the information on a registrant’s GST/HST return. For example, when looking at a sole proprietor’s account, we gather the SIN and names to match from the T1 data, to compare them to the individual’s GST/HST account. As well, the GST/HST program conducts limited reviews, verifications or validations, and reassesses files (such as returns and rebate claims).

B) Type of personal information involved and context

Social insurance number (SIN), medical, financial or other sensitive personal information and/or the context surrounding the personal information is sensitive. Personal information of minors or incompetent individuals or involving a representative acting on behalf of the individual.

Level of risk to privacy: 3

Details:

The GST/HST program relies on information collected to assess files (returns, rebate claims, and elections). Personal information collected from taxpayers includes details such as name, contact information, financial information and signature, to validate a person’s identity. Information is also collected verbally with questions to ensure the confidentiality and security test is passed, before discussing individual tax matters over the phone.

The SIN is used for identification purposes. For example, to properly identify a claimant to ensure eligibility for rebates.

The GST/HST program also collects financial information to complete requests for direct deposit of approved refund or rebate amounts. Direct deposit of credits is a service offered to clients.

C) Program or activity partners and private sector involvement

Private sector organizations or international organizations or foreign governments

Level of risk to privacy: 4

Details:

Information may be collected from and shared with participating provincial partners and other federal institutions. For example, Global Affairs Canada (GAC) provides monthly arrival and departure reports which lists the name, diplomat number, dates of eligibility, and country represented. We need this information to determine eligibility of GST/HST rebate applications for foreign representatives, diplomatic missions, consular posts, international organizations, or visiting forces units. For example, we need the dates of entry and exit if the applicant submits a claim outside their eligibility period. We also require the claimant’s country of origin as the reciprocal agreements vary, depending on the country represented. GAC also validates and verifies addresses of eligible properties as well as eligible spouses and dependants. If a claimant has a problem with their assessment, they often contact GAC as an intermediary between themselves and the CRA.

Information and procedures are also shared with Revenu Québec as they are responsible for administering the GST within the province of Quebec.

Private sector involvement includes external third parties that may be used to identify or clarify missing information on GST/HST rebate applications. For example, a builder who credits a rebate amount to the home purchaser (claimant) at the time of purchase may be contacted to clarify details if the purchaser subsequently submitted a second, related application.

D) Duration of the program or activity

Long-term program

Level of risk to privacy: 3

Details:

The GST was established in 1991. The GST/HST program is an existing long-term program with no anticipated sunset date. Although certain return, rebate, or election types processed by the CRA may be transitional in nature with an established sunset date, the program as a whole is long‑term.

E) Program population

The program affects certain individuals for external administrative purposes.

Level of risk to privacy: 3

Details:

The GST/HST program affects organizations and individuals, both registrants and non-registrants, who have filed or not filed (but may be required to) a return, rebate, or election related to the GST/HST program.

F) Technology & privacy

1. Does the new or modified program or activity involve the implementation of a new electronic system, software or application program including collaborative software (or groupware) that is implemented to support the program or activity in terms of the creation, collection or handling of personal information?

Risk to privacy: No

2. Does the new or modified program or activity require any modifications to IT legacy systems and/or services?

Risk to privacy: Yes

3. Does the new or modified program or activity involve the implementation of one or more of the following technologies?

Enhanced identification methods - this includes biometric technology (i.e. facial recognition, gait analysis, iris scan, fingerprint analysis, voice print, radio frequency identification (RFID), etc.) as well as easy pass technology, new identification cards including magnetic stripe cards, "smart cards" (i.e. identification cards that are embedded with either an antenna or a contact pad that is connected to a microprocessor and a memory chip or only a memory chip with non-programmable logic).

Risk to privacy: No

Use of Surveillance - this includes surveillance technologies such as audio/video recording devices, thermal imaging, recognition devices, RFID, surreptitious surveillance/interception, computer aided monitoring including audit trails, satellite surveillance etc.

Risk to privacy: Yes

Use of automated personal information analysis, personal information matching and knowledge discovery techniques - for the purposes of the Directive on PIA, government institutions are to identify those activities that involve the use of automated technology to analyze, create, compare, identify or extract personal information elements. Such activities would include personal information matching, record linkage, personal information mining, personal information comparison, knowledge discovery, information filtering or analysis. Such activities involve some form of artificial intelligence and/or machine learning to uncover knowledge (intelligence), trends/patterns or to predict behavior.

Risk to privacy: Yes

G) Personal information transmission

The personal information is transmitted using wireless technologies.

Level of risk to privacy: 4

Details:

Information received from registrants and taxpayers through paper copies or webforms that are deposited into an electronic repository, are keyed directly into our mainframe system. Electronically-filed returns, rebates, and elections involve an Internet connection and information is transferred to our mainframe through a secure connection. Within the mainframe, there is an exchange of information between systems. Headquarters and operational staff have access to the mainframe on laptops encrypted with Secure Remote Access if they are working remotely or using a wireless network. When employees are at desks located in CRA buildings, they have access to direct, wired connections to the Agency network.

Specific to the Revenu Québec (RQ) web service, infrastructure enhancements were completed to integrate the CRA and RQ systems to include a new method of secure data transfer. This allows for accurate and up‑to‑date GST/HST information to be available to the RQ internal and external users and to allow updates from RQ external users).

H) Potential risk that in the event of a privacy breach, there will be an impact on the individual or employee

Details:

There could be a significant risk of financial harm to the organization or individual if there is a breach of organizational or personal information.