Assessment, Benefit and Service Branch
Individual Returns Directorate

On this page

• Overview & Privacy Impact Assessment Initiation (PIA)
• Summary of the project, initiative or change
• Risk identification and categorization

Overview & Privacy Impact Assessment (PIA) Initiation

Government institution

Canada Revenue Agency

Government official responsible for the PIA

Gillian Pranke
Assistant Commissioner
Assessment, Benefit and Service Branch

Head of the government institution or Delegate for section 10 of the Privacy Act

Anne Marie Laurin
Director General
Access to Information and Privacy Directorate
Public Affairs Branch

Name of program or activity of the government institution

Tax Services and Processing

Standard or institution specific class of record:

T3 Initial Assessment and Reassessment program
CRA ABSB 139

Standard or institution specific personal information bank:

T3 Assessment program
Personal Information Bank number: CRA PPU 015
TBS Registration Number: 003536

Legal authority for program or activity

The legal authority for collecting personal information under the Income Tax Act is found in sections 150 and 220. Also, the social insurance number is collected under paragraph (c) of the "graduated rate estate” definition in subsection 248(1) of the Income Tax Act and is used for identification purposes.

Subsection 204.2(1) of the Income Tax Regulations requires the reporting of a “TIN” as defined in subsection 270(1) of the Income Tax Act. Subsection 270(1) defines a “TIN" to mean (a) the number used by the Minister to identify an individual or entity, including (i) a social insurance number, (ii) a business number, and (iii) an account number issued to a trust; and (b) in respect of a jurisdiction other than Canada, a taxpayer identification number used in that jurisdiction to identify an individual or entity (or a functional equivalent in the absence of a taxpayer identification number).

Regulation 204.2 of the Income Tax Regulations requires individuals who have control of, or receive income, gains, profits, or can influence trustee decisions, to provide information about a trust, appointment of income or capital from a trust.

Disclosure to Department of Justice

Subparagraph 241(4)(e)(vii) of the Income Tax Act authorizes the Canada Revenue Agency (CRA) to provide taxpayer information to the Department of Justice solely for the purposes of the administration of the Family Orders and Agreements Enforcement Assistance Act.

Sections 18 and 19 of the Family Orders and Agreements Enforcement Assistance Act authorize the CRA to disclose personal information to the Department of Justice Canada to administer and enforce the calculation of child support payments. Section 5(1) d of the Release of Information for Family Orders and Agreements Enforcement Assistance Regulations specifically identifies the corporation income tax.

Summary of the project, initiative or change

Overview of the Program or Activity

What is a trust?

A trust is a binding obligation, voluntarily undertaken, but enforceable by law when undertaken, created orally, by written instrument, or by a court order or statute whereby the responsibility for the property real and/or personal is taken on by the trustee for the benefit of a person or persons on the instructions of the settlor, court, or statute. The trustee who has management and control of the trust, although not having physical possession of the trust assets, will be the person who has most or all of the following powers or responsibilities:

• control over changes in the trust's investment portfolio
• responsibility for the management of any business or property owned by the trust
• responsibility for any banking, financing, and arrangements for the trust
• control over any other trust assets
• ultimate responsibility for preparation of the trust accounts and reporting to the
• beneficiaries of the trust, and
• power to contract with and deal with trust advisors (for example, auditors and lawyers)

A trust is either a testamentary trust or an inter vivos trust. Each trust has different tax rules. A testamentary trust is a trust or estate that is generally created on and or as a result of the death of a person. The terms of the trust are established by the will or by the court order in relation to the deceased individual’s estate under provincial or territorial law. An inter vivos trust is a trust that is not a testamentary trust.

Types of trusts:

• Alter ego
• Amateur athlete
• Bare
• Blind revocable
• Blind irrevocable
• Canadian Wheat Board
• Commercial
• Communal organization trust
• Deemed resident
• Deferred Profit Sharing Plan (DPSP)
• Designated Stock Exchange
• Employee
• Employee benefit plan
• Employee life and health (ELHT)
• Employee Ownership
• Employee Pension Plan
• Environment Quality Act
• First home savings account (FHSA)
• First Nations Child and Family Services
• Graduated rate estate
• Health and welfare
• Hepatitis C
• Indian residential school
• Indian residential school agreement
• Insurance segregated fund
• Inter vivos
• Investment Fund (127.55 (f)(ii))
• Joint spousal or common-law partner
• Land settlement
• Lifetime benefit
• Master
• Mutual fund
• Non-profit organization
• Nuclear Fuel Waste Act
• Other
• Personal
• Pooled registered pension plan (PRPP)
• Qualified disability trust (QDT)
• Qualified environmental (QET)
• Real estate investment (REIT)
• Registered Investment
• Retirement compensation arrangement (RCA) Part X1.3
• RRSP, RRIF, RDSP, or RESP trust
• Salary deferral arrangement (SDA)
• Safe drinking water
• Specified investment flow-through (SIFT)
• Spousal/common-law partner trust
• Subsection 127.55 (f)(iii)
• Supplementary Unemployment Benefit Plan
• Tax-free savings account (TFSA)
• Testamentary
• Unit

In 2023, the rules changed about the situations that require a trust to file a return, and any related schedules and statements for tax years ending on or after December 31, 2023. A return must be filed if either bullet applies:

• Express trust which is resident in Canada and is not a listed trust
• Income from the trust property is subject to tax, and:
  • The trust is an express trust resident in Canada and is a listed trust, or
  • The trust is not an express trust resident in Canada

and in the year the trust:

• has tax payable
• is requested to file
• is resident in Canada and has either disposed of, is deemed to have disposed of, a capital property, or has a taxable capital gain
• is a non-resident throughout the year, and has a taxable capital gain or has disposed of taxable Canadian property
• is a deemed resident trust
• holds property that is subject to subsection 75(2) of the Income Tax Act, and
• has provided a benefit of more than $100 to a beneficiary for upkeep, maintenance, or taxes for property maintained for the beneficiary’s use;
• or receives from the trust property any income, gain, or profit that is allocated to one or more beneficiaries, and the trust has: total income from all sources of more than $500; income of more than $100 allocated to any single beneficiary; made a distribution of capital to one or more beneficiaries; or allocated any portion of the income to a non-resident beneficiary.

The trust return is filed as both an income tax return, which calculates tax liability, and an information return, which reports amounts allocated and designated to beneficiaries. A trust can also apply for a trust account number.

The T3 Trust Returns Assessing Program includes assessing and reassessing the following income tax trust returns: T3-RET, T3 ATH-IND, T3D, T3F, T3GR, T3M, T3P, T3PRP, T1061, T3IND, T3RCA, T3RI, and T3S. This review checks whether the required documents support all amounts on the return, and verifies the accuracy of the calculations of the amounts reported on the documents.

The program is also responsible for:

• Analyzing proposed and announced federal, provincial, and territorial legislative changes that affect the processing of trust returns;
• Developing policies and procedures for trust returns relating to identification, assessing, and reassessing;
• Monitoring and reporting on T3 activities such as service standards and program results both internally to the CRA and externally to other government departments;
• The assessment or reassessment of various T3 trust income tax and information returns.

The CRA shares the data file for T3 information slips, T3 summaries, and trust income tax and information returns (T3RET), for trusts and beneficiaries residing in Quebec, with the Ministère des Finances du Québec and Revenu Québec because they are responsible for the administration of Quebec provincial tax.

More information about trust income tax is available on the CRA’s web page at canada.ca/en/services/taxes/income-tax/trust-income-tax.

What’s New

Starting January 1, 2024, an individual must file electronically when they have more than five information returns of the same type for a calendar year. Failure to file electronically may result in a penalty.

The clean technology investment tax credit (ITC) is refundable and available to qualifying taxpayers that make eligible investment in clean technology property after March 28, 2023.

The 2018 Federal Budget proposed that certain trusts provide additional information on an annual basis to improve the collection of beneficial ownership information for these trusts. Royal assent was granted December 15, 2022, (Government Bill (House of Commons) C-32 (44-1)) and the legislation will apply to tax years that end after December 30, 2023.

Beneficial owners could be a trustee, known beneficiaries, and/or the settlors of the trust having direct or indirect control of, or receiving income, gains or profits from a trust. If the trust is a widely held trust or a publicly traded trust, the beneficial owners are also the trustees and all persons who own or control, directly or indirectly, 25% or more of the units of the trust.

Beneficial ownership information is the identity information of all trustees, beneficiaries, and settlors of the trust, as well as the identity of each person who has the ability to exert control over the trustee decisions about the allocation, distribution, or capital of the trust.

A bare trust is a trust arrangement under which the trustee can reasonably be considered to act as agent for all the beneficiaries under the trust for all dealings with all of the trust's property.

As a result of these new tax obligations and reporting requirements, all trusts unless specific conditions are met, will be required to file an annual trust income tax return and Schedule 15, “Beneficial ownership information of a trust” for tax years ending after December 30, 2023. A penalty may apply for failure to comply with these requirements.

Beneficial ownership of the trust information must be reported as part of the T3-RET, T3 ATH-IND, T3M, and T3RCA trust returns, for those tax years that end after December 30, 2023.

For the purposes of this filing requirement, beneficial ownership information is considered to be the name, address, tax identification number (such as social insurance number, temporary taxation number, internation tax number, or business number), date of birth, and residency of all the settlors, trustees, and beneficiaries of the trust. As well, any person who has the ability (through the trust terms or related agreement) to control or override trustee decisions over the appointment of income or capital of the trust.

The former trust systems were heavily reliant on manual processes and were not designed to assess high volumes of returns, or capture beneficial ownership information.

All trust account information that was administered under the previous systems will continue to be accessible under the new platform. Beneficial ownership is the only new personal information that will be collected through the redesigned T3 systems for the 2024 tax year.

For the Canada Revenue Agency (CRA) to effectively administer the new legislation, multiple internal systems and processes have been updated or developed to collect and process beneficial ownership information and manage the increase in trust returns.

In February 2021, the online T3 Trust Account Registration process became available in the CRA’s existing secure portals; My Account (MyA), My Business Account (MyBA), and Represent a Client (RAC), allowing individuals to electronically apply and receive a resident trust account number and electronically submit legal documents.

While any taxpayer may create the trust account and register the trust account, only the legal representative of a trust (trustee, executor, administrator, or liquidator) or an representative authorized by the legal representative will have access to trust information through My Trust Account (MyTA) found in the Represent a Client Portal once the application is finalized.

Individuals can continue to send in applications for a trust account and trust registration number by mail using Form T3APP, Application for Trust Account Number. After the CRA assigns the trust account number, the trustee must use it when filing T3 returns or a penalty will be charged.

My Trust Account was implemented in February 2023. My Trust Account is accessible through Represent a Client, a secure portal that allows trustees and authorized representatives to view representatives, trustee contacts, returns and balances, and beneficial ownership.

New disclosure to Department of Justice

Effective November 2024, the CRA will support the Department of Justice’s administration and enforcement of the Family Orders and Agreements Enforcement Assistance Act.

The CRA will begin sharing information, including personal information, from the trust tax returns and T3 Statement of Trust Income Allocations and Designations slips with the Department of Justice. It will be used for the calculation and enforcement of child and spousal support payments when a provincial or territorial court has submitted an application for tax information and the CRA is bound by law to respond.

The Department of Justice will electronically identify individuals to the CRA using the trust account number. The CRA will use the trust account number to locate and securely share the T3 return and associated slips containing the personal information with the Department of Justice. The Department of Justice will share the information from the return and slips with the requesting provincial or territorial court official for the calculation of child and/or spousal support. The Court(s) will use this information to calculate support payments and may then choose to share the T3 return and slips, including personal information with each individual involved in the court proceedings.Scope of the Privacy Impact Assessment.

Scope of the Privacy Impact Assessment

The scope of this privacy impact assessment includes those sections of the T3 (re)assessing program for resident and non-resident returns that fall within the above description, including the application of the 162(7) penalty which is applied in those cases where the T3 return acts only as an information return.

Certain compliance activities such as identifying non-filers, audits, and criminal investigations are separate programs and therefore are not included. The authentication and access of the CRA’s online portals is out of scope of the PIA.

Risk identification and categorization

A) Type of program or activity

Administration of Programs / Activity and Services

Level of risk to privacy: 2

Details:

The CRA uses personal information to determine a trust’s tax payable, penalties, interest, or refund, and puts this information on a notice of assessment or reassessment. Penalties include the application of the 162(7) penalty which is applied at the assessing stage in those cases where the trust return acts only as an information return. The 162(1) penalty is determined and applied at the accounting stage of the assessment. All other penalties related to trusts are determined by other compliance programs.

The information is also used for statistical analysis to enhance and improve services administered by the CRA.

B) Type of personal information involved and context

Social insurance number, Tax identification number, medical, financial or other sensitive personal information and/or the context surrounding the personal information is sensitive. Personal information of minors or incompetent individuals or involving a representative acting on behalf of the individual.

Level of risk to privacy: 3

Details:

The personal information collected is used in the context of income tax assessments and reassessments including limited validations of these assessments. Most of this information fits into category 3 since it relates to an individual’s information from the return such as SIN, TIN, or trust account number, name, date of birth, date of death, address, residency, and financial information.

C) Program or activity partners and private sector involvement

Private sector organizations or international organizations or foreign governments

Level of risk to privacy: 4

Details:

The exchange of taxpayer information mainly occurs between the T3 Trust Returns Assessing Program and other CRA departments. The CRA also provides aggregate information for the purpose of validating tax collection under tax collection agreements with the provinces and territories. Aggregate information is also shared with provincial governments for the purpose of formulating or evaluating fiscal policy.

Also, the CRA contracts a private sector organization for record storage. The T3 Trust Returns Assessing Program contracts other federal government departments for the printing and mailing of certain types of T3 (re)assessment notices.

The CRA shares personal information with the Ministère des Finances du Québec and Revenu Québec to assist in the administration of Quebec provincial tax.

Personal information is shared electronically with the Department of Justice for the administration and enforcement of child and spousal support payments.

D) Duration of the program or activity

Long-term program

Level of risk to privacy: 3

Details:

This is a long-term core program for the CRA with no clear sunset time frame.

E) Program population

The program affects certain individuals for external administrative purposes.

Level of risk to privacy: 3

Details:

The program affects individuals involved in a trust that files a return. This could include the settlor (the person setting up the trust), beneficiaries of a trust, and trustees which can include an executor, administrator, assignee, receiver, custodian or liquidator who owns or controls property for some other person, and their representatives.

F) Technology & privacy

1. Does the new or modified program or activity involve the implementation of a new electronic system, software or application program including collaborative software (or groupware) that is implemented to support the program or activity in terms of the creation, collection or handling of personal information?
   
   Risk to privacy: Yes
2. Does the new or modified program or activity require any modifications to IT legacy systems and/or services?
   
   Risk to privacy: Yes
3. Does the new or modified program or activity involve the implementation of one or more of the following technologies?

Enhanced identification methods - this includes biometric technology (i.e. facial recognition, gait analysis, iris scan, fingerprint analysis, voice print, radio frequency identification (RFID), etc.) as well as easy pass technology, new identification cards including magnetic stripe cards, "smart cards" (i.e. identification cards that are embedded with either an antenna or a contact pad that is connected to a microprocessor and a memory chip or only a memory chip with non-programmable logic).

Risk to privacy: No

Use of Surveillance - this includes surveillance technologies such as audio/video recording devices, thermal imaging, recognition devices, RFID, surreptitious surveillance/interception, computer aided monitoring including audit trails, satellite surveillance etc.

Risk to privacy: No

Use of automated personal information analysis, personal information matching and knowledge discovery techniques - for the purposes of the Directive on PIA, government institutions are to identify those activities that involve the use of automated technology to analyze, create, compare, identify or extract personal information elements. Such activities would include personal information matching, record linkage, personal information mining, personal information comparison, knowledge discovery, information filtering or analysis. Such activities involve some form of artificial intelligence and/or machine learning to uncover knowledge (intelligence), trends/patterns or to predict behavior.

Risk to privacy: Yes

G) Personal information transmission

The personal information is transmitted using wireless technologies.

Level of risk to privacy: 4

Details:

When the return is filed electronically (EFILE or Submit Docs), the personal information can be transmitted by the EFILER to the CRA using wireless or non-wireless technology. That information is then stored in various CRA systems and databases.

The personal information from paper-filed returns (mailed) is keyed into various CRA systems and databases.

The personal information is pulled from the CRA’s mainframe system and sent to other Agency areas using file transfer protocol, often by means of Entrust encryption software. Limited amounts of personal information are also shared internally within CRA by means of wireless devices.

Online T3 Trust Account Registration web application: External online users (trustees and authorized representatives) are first validated using an existing CRA portal (My Account, MyBA, or RAC) and then they will have access to the web application to apply for a new trust account number and receive a trust account number in real time; or submit documents such as trust documents, wills, and other legal documents. The information is transmitted then stored in various CRA systems and databases.

My Trust Account (MyTA) web application: External online users (trustees and authorized representatives) are first validated using an existing CRA portal (MyAccount, MyBA, RaC) and then they will have access to the My Trust Account services. The information is transmitted then stored in various CRA systems and databases.

CRA employees use laptop computers and cell phones with access controls. Access to the Agency network from remote locations must be done with full disk encryption and standard Secure Remote Access. The Information Technology Branch has developed an enterprise-wide telecommuting platform that offers users secure access to the network.

H) Potential risk that in the event of a privacy breach, there will be an impact on the individual or employee

Details:

Compromised personal data has the potential to cause financial harm such as identify theft or fraud and embarrassment to the individual.