Assessment, Benefit and Service Branch
Disability, Indigenous, and Benefits Outreach Services Directorate

On this page

• Overview & Privacy Impact Assessment Initiation (PIA)
• Summary of the project, initiative or change
• Risk identification and categorization

Overview & Privacy Impact Assessment (PIA) Initiation

Government institution

Canada Revenue Agency

Government official responsible for the PIA

Chris Bowen
Director General
Benefit Programs Directorate and
Disability, Indigenous, and Benefits Outreach Services Directorate
Assessment, Benefit, and Services Branch

Head of the government institution or Delegate for section 10 of the Privacy Act

Lia Jackson
Director
Access to Information and Privacy Directorate

Name of program or activity of the government institution

Benefits

Standard or institution specific class of record:

Community Volunteer Income Tax Program CRA ABSB 110
Communications PRN 939

Standard or institution specific personal information bank:

Community Volunteer Income Tax Program
CRA PPU 100
Outreach Activities
PSU 938
Public Communications
PSU 914

Legal authority for program or activity

The Minister of National Revenue is responsible for administering and enforcing the Income Tax Act under section 220 of the Act.

The Canada Revenue Agency (CRA) has been granted responsibility for general administrative policy at the CRA under paragraph 30 (1) (a) of the Canada Revenue Agency Act.

Summary of the project, initiative or change

Overview of the Program or Activity

The Community Volunteer Income Tax Program (CVITP) is a collaboration between community organizations and the CRA. The program has been operating since 1971. Its mandate is to help individuals and families in need by preparing income tax and benefit returns for individuals. To qualify to receive help, an individual must have a modest income and a simple tax situation.

Community organizations throughout Canada operate on a volunteer basis to host free tax clinics to prepare income tax and benefit returns for eligible individuals within their community.

The role of the CVITP is to:

• monitor the registration of volunteers and community organizations
• provide support, training, promotional material, and tax preparation software
• establish policies, procedures and best practices, and
• make sure all participants are aware of, and adhere to, federal privacy requirements and minimum standards for the protection of personal information

The program is offered in the province of Quebec under the Income Tax Assistance – Volunteer Program (ITAVP). A memorandum of understanding between Revenu Québec and the CRA outlines the joint obligations and duties of both parties. Revenu Québec and CRA employees work together as ITAVP officers. Revenu Québec’s employees have access to the program’s information for their region through the CRA’s computers and network. All personal information collected for participating volunteers and organization contact persons is kept and monitored by the CRA.

To participate, volunteers and organizations must register with the program each year. The preferred method of registration is to fill out an online form available on the CRA web page. An account is created every time a new volunteer or organization registers. Subsequent registrations are stored under the account belonging to the volunteer or organization.

Organizations that cannot register online can register over the phone by talking to a CVITP officer. After a community organization registers, a CVITP officer will review the information to make sure the registration is complete and that the organization is in good standing. Afterwards the organization is approved to participate until the end of the registration year.

Volunteers who cannot register online can register by mailing a completed and signed Form T242, Community Volunteer Income Tax Program Volunteer Registration and Agreement, or Form COM-307, Information Sheet and Tax Software Agreement (for Québec), to a CVITP/Outreach officer. In both cases, a CVITP/Outreach officer will capture the information in their management tool.

After a volunteer registers, depending on their roles, they must meet either of the following screening criteria:

• obtaining their EFILE certification via the online registration, or
• submitting a police record check to the community organization with which they will be affiliated

The EFILE program is responsible for letting the volunteer know of the result of the certification process. The community organization is responsible for reviewing the police record check and informing the CVITP officer by email or by phone of whether the organization will accept the volunteer.

Once the screening criteria is met, the volunteer’s registration is approved and they can start filing returns for taxpayers.

In addition to the information collected for registration purposes, anonymized views and opinions are collected as a result of some projects operating in partnership with the CVITP to monitor the effectiveness of the program. Reports may be written to summarize views and opinions. However, the reports will not include personal information that would make it possible to identify participants.

In keeping with the CRA’s commitment to offer improved support to taxpayers who are not receiving the credits and benefits they are eligible to receive, the CVITP made the Autofill my return service available to volunteers. Autofill my return provides a fast and efficient way to access taxpayer information; increases the accuracy of returns filed by automatically filling in parts of returns with information the CRA has; and ultimately, helps to make sure that more returns are completed for low-income and fixed-income individuals.

Autofill my return was made available to a select group of volunteers in 2018 (for the 2017 tax year) and to all volunteers in 2019 (for the 2018 tax year).

To use Autofill my return, volunteers must:

• register and be approved as a CVITP volunteer
• register in Represent a Client and receive a RepID
• provide their RepID during registration (or provide it to a CVITP officer after registration)
• register and be approved as an EFILE user
• provide their organization with a valid police record check
• use UFile CVITP software
• be authorized by the taxpayer to act as their representative for income tax matters, by having the taxpayer complete Form TIS60, Community Volunteer Income Tax Program Taxpayer Authorization

Using Autofill my return is a two-part process involving the electronic filing of Form TIS60 and accessing Autofill my return.

Managing increased risk related to using Autofill my return:

All CVITP volunteers, including those wanting to use Autofill my return, have to register through the CVITP online registration portal and acknowledge that they have read, and agree with, the declaration included there. The declaration states that they have never been convicted of any offence under the Criminal Code or any act of Parliament:

“I declare that I have never been convicted of any offence under the Criminal Code or any Act of Parliament including any offence involving evasion in the payment or remittance of tax, fraudulent transactions in which the public or any person is defrauded property, money or valuable security or service, possession of property obtained by crime or the proceeds of crime.”

To use Autofill my return, volunteers must have first registered as an individual, electronic filer. When a person registers for EFILE certification, the CRA ensures that the person meets the suitability screening necessary to prepare returns for taxpayers. This certification process improves the integrity of the CVITP.

To use Autofill my return, volunteers must provide the related organization with a valid police record check.

All training material emphasizes the importance of safeguarding taxpayer information. Community organizations and volunteers must keep all taxpayer information secure and confidential as per the guidelines described in Publication TIS5, Volunteer Handbook.

A volunteer’s RepID is tied to their social insurance number, which allows the CRA to easily monitor and trace their access.

There are two levels of authorization that can be given to a representative. CVITP volunteers are granted Level 1, view-only access, which allows only the disclosure of tax information to an authorized representative for indicated tax year(s). This level does not authorize the representative to request financial or other changes to a taxpayer’s account.

Volunteers are instructed to read a script to taxpayers which explains, in plain language, why they are being asked to sign a completed Form TIS60 authorization (that is, full disclosure).

A completed Form TIS60 is only valid until 11:59 pm, Eastern time, on the day it is submitted).

Also new to their management tool is the introduction of the CVITP organization identification number (COIN). A COIN is a unique and permanent eight-digit number that is assigned by the program to approved organizations and communicated in their approval letter (sent by email). COINs will be used to improve statistical reporting for the CVITP by confirming the number of federal income tax and benefit returns electronically filed by volunteers under a given organization. CVITP organizations will be responsible for sharing their COIN with their volunteers who will be encouraged to enter the COIN into the appropriate field of the UFile CVITP software. A COIN will stay the same year over year, even if there is a break in participation. Volunteers who are affiliated with more than one organization will receive a different COIN specific to each organization that they volunteer for. COINs will not be linked to any identifiable T1 data. Each COIN is scrubbed of all taxpayer information, so that it can not be traced back to specific taxpayers. A COIN is simply a mechanism for counting the total number of returns filed by an organization.

What’s New

CARES

The Client Assistance Referral and Enquiry Service (CARES) offers assistance to modest-income taxpayers that will improve their access to benefits and credits. CARES is an unadvertised, enquiry-based, internal phone service. It is used by CRA outreach officers, Service Canada client service specialists, and the Service Canada Outreach Service Centre to refer their clients to an agent who can assist them with account-specific needs or help them file tax returns. CRA outreach officers may validate an individual’s identity in person to help the individual pass confidentiality checks to speak with a CARES phone agent. Outreach officers may assist clients with account-specific needs in some situations when the CARES phone agents are unavailable.

Northern Service Centres and Virtual Outreach Pilot

Employees operating from the Northern Service Centres (NSCs) will support individuals and community organizations through outreach visits, in the centres, and through the virtual outreach pilot by:

• directing clients to free tax clinics
• answering general and account-specific questions, and distributing information related to benefits and credits individuals should receive
• assisting clients with CRA communications (e.g., letters from the CRA)
• promoting and supporting the Community Volunteer Income Tax Program (CVITP)
• helping clients access the CRA’s digital services, including:
  • registering for My Account
  • submitting documents online

Employees operating from the NSCs will also be available to assist small businesses and self-employed individuals in scheduling either virtual or in-person visits with a liaison officer to help them meet their tax obligations.

During an in-person visit, liaison officers will support businesses by:

• answering small business tax-related questions and addressing concerns
• providing information on the various tools and services offered by the CRA
• having a detailed and personalized discussion about their books and records and providing recommendations on how small businesses can strengthen their bookkeeping systems

The Virtual Outreach pilot will allow outreach officers to virtually deliver services normally offered in-person in the three NSCs by using an MS Teams videoconference or a phone call to interact with individuals identified through existing partners. These individuals will visit a trusted community partner, such as a band council, territorial or municipal government partner and connect with a CRA outreach officer with the assistance of the partner or trusted referee. The partner will contact the outreach officer by phone or email to either immediately connect through Teams or phone, or to schedule a session at a later time. This pilot will initially run for a period of three months after implementation, to allow outreach officers sufficient time to connect with partners, arrange and host activities, and record post-activity information. Services will continue to be offered in-person to those residing in or visiting the territorial capitals where the NSCs are located.

After the pilot period, the results will be analysed and, if determined to be successful, virtual outreach will be expanded across Canada.

Scope of the Privacy Impact Assessment

The scope of this privacy impact assessment (PIA) covers the CVITP’s role as coordinator and overseer of the participation of organizations and volunteers in the program as well as the collection of personal information by CRA outreach officers. This PIA does not cover any of the following:

• preparation of income tax and benefit returns
• interaction between volunteers and taxpayers
• EFILE certification process

The CRA outreach officers and CARES contact call centre agents may collect and use personal information and may require access and make updates to taxpayer accounts and program-specific systems. These activities are undertaken in service to various CRA programs (e.g., Individual Returns Assessment Program, Canada Child Benefits Program, GST/HST Returns and Rebates Program, Collections Government Programs). The personal information related to these activities is assessed in the applicable program PIAs. The level of risk to the personal information that is collected in contact call centres, as well as the safeguards that are in place to protect the information, are captured in the ABSB Contact Centre PIA.

Risk identification and categorization

A) Type of program or activity

Administration of Programs / Activity and Services

Level of risk to privacy: 2

Details:

Personal information is used to assess suitability of volunteers, to register them for the Community Volunteer Income Tax Program (CVITP), and to identify an organization’s contact person. Information is also collected to monitor the effectiveness of the program.

For the CARES program, personal information is used to administer call contact centre operations, which includes validating the identity of the caller. The outreach officers in the NSCs use personal information to administer center operations. This includes validating identity and assisting taxpayers with their personal tax, business, or benefits account enquiries.

B) Type of personal information involved and context

Social insurance number, medical, financial or other sensitive personal information and/or the context surrounding the personal information is sensitive. Personal information of minors or incompetent individuals or involving a representative acting on behalf of the individual.

Level of risk to privacy: 3

Details:

The information used to administer the CVITP includes name, contact information, police records checks, and biographical information. EFILE certification may be used as a security measure instead of the police records check. When this occurs, only the result of the certification is communicated by the EFILE helpdesks to the CVITP program. The personal information collected by the EFILE program is not shared with CVITP.

Views and opinions may also be collected to enhance the program.

For the Benefits Outreach program, personal information may involve validating government-issued identification. The outreach officer will look at the characteristics of the original physical document and its security features (or markers, as applicable) in the presence of the person being identified. The outreach officer will not copy, record, or duplicate the government-issued identification, as this would then lead to an over-collection of information.

NSC agents may ask for specific personal information (SIN, address, contact information, date of birth, and other identification numbers) to validate the taxpayer’s identity. The CRA collects and uses personal information to support the administration of specific tax and benefits programs. The collection of personal information for these programs is also assessed in those programs’ individual PIAs.

C) Program or activity partners and private sector involvement

Private sector organizations or international organizations or foreign governments

Level of risk to privacy: 4

Details:

The CVITP is a community-based outreach program that is administered by the CRA in partnership with community organizations and with Revenu Québec. Community organizations confirm with the CRA when they review and accept a police record check as a security measure for a volunteer. The CRA informs organizations when their volunteers have been approved so that they can start to participate in the program.

D) Duration of the program or activity

Long-term program

Level of risk to privacy: 3

Details:

The CVITP is a long-term program. It has been in place since 1971, and there is no plan to end the program.

CARES was launched in February 2024, and there is no planned end date for this service.

The NSC is a long-term support program with no sunset date. The Virtual Outreach pilot is scheduled for three months but may be extended depending upon its success.

E) Program population

The program affects certain individuals for external administrative purposes.

Level of risk to privacy: 3

Details:

This program affects individuals applying to be volunteers in the CVITP. It also involves contacting individuals representing community organizations who participate in the CVITP.

Views and opinions of CVITP and study participants are collected for non-administrative purposes to monitor the effectiveness of the program. As the CVITP operates at arm’s length with the volunteers and organizations, there is no information shared between the CVITP program and the taxpayer.

The CARES program assists individuals who are Canadians, including priority segments of the population such as Indigenous Peoples, newcomers, adults 65 and older, students, persons with disabilities, housing-insecure individuals, and individuals with a modest income who would like to have access to the necessary tools and information to navigate the tax system, and access benefits and credits.

The NSC and virtual outreach program assists individuals and businesses in the Yukon, Northwest Territories and Nunavut.

F) Technology & privacy

1. Does the new or modified program or activity involve the implementation of a new electronic system, software or application program including collaborative software (or groupware) that is implemented to support the program or activity in terms of the creation, collection or handling of personal information?
   
   Risk to privacy: No
2. Does the new or modified program or activity require any modifications to IT legacy systems and/or services?
   
   Risk to privacy: No
3. Does the new or modified program or activity involve the implementation of one or more of the following technologies?

Enhanced identification methods - this includes biometric technology (i.e. facial recognition, gait analysis, iris scan, fingerprint analysis, voice print, radio frequency identification (RFID), etc.) as well as easy pass technology, new identification cards including magnetic stripe cards, "smart cards" (i.e. identification cards that are embedded with either an antenna or a contact pad that is connected to a microprocessor and a memory chip or only a memory chip with non-programmable logic).

Risk to privacy: No

Use of Surveillance - this includes surveillance technologies such as audio/video recording devices, thermal imaging, recognition devices, RFID, surreptitious surveillance/interception, computer aided monitoring including audit trails, satellite surveillance etc.

Risk to privacy: No

Use of automated personal information analysis, personal information matching and knowledge discovery techniques - for the purposes of the Directive on PIA, government institutions are to identify those activities that involve the use of automated technology to analyze, create, compare, identify or extract personal information elements. Such activities would include personal information matching, record linkage, personal information mining, personal information comparison, knowledge discovery, information filtering or analysis. Such activities involve some form of artificial intelligence and/or machine learning to uncover knowledge (intelligence), trends/patterns or to predict behavior.

Risk to privacy: Yes

G) Personal information transmission

The personal information is transmitted using wireless technologies.

Level of risk to privacy: 4

Details:

Volunteers and organizations can register online by filling out an electronic registration form available on the CRA’s web page. The information is then transmitted to their management tool. Alternatively, volunteers can fill out a paper form and organizations can register over the phone. For paper forms, the information is entered manually in their management tool by a CVITP officer.

Due to being a repository for the data displayed in the management tool, the Agency Data Warehouse has access to the information of individuals applying to be volunteers in the CVITP and individuals who represent community organizations.

Although there is no information shared between the program and the taxpayer, it is important to note that the CVITP is responsible for establishing procedures to ensure all participants are aware of, and adhere to, federal privacy requirements and minimum standards for the protection of personal information. As such, specific instructions are provided to volunteers on how to handle and protect taxpayers’ information. For example, volunteers must encrypt returns using the tax software and save the electronic files on a USB flash drive only. If the tax software does not encrypt returns, volunteers must use an encrypted USB flash drive.

CRA security controls:

CRA has implemented Secure Remote Access (SRA) for its employees. Any telework done is through SRA. The Information Technology Branch has developed an enterprise-wide telecommuting platform that offers users secure access to the network.

Public Key Infrastructure (PKI) was implemented to support several initiatives throughout the CRA such as SRA. A PKI certificate is required to access an SRA account. PKI is a combination of policy and technology that establishes a secure electronic working environment, allowing CRA users to conduct secure electronic transactions. PKI uses digital certificates, which are critical tools for enabling secure and trusted use of our electronic networks.

Internal Multi-Factor Authentication (IMFA) was started at the Agency in 2025. All employees have or will receive a security key and will be required to create an associated Personal Identification Number (PIN) to use at Windows sign-in and when accessing cloud resources, such as Microsoft Teams, SharePoint, or OneDrive. The security key is a device, similar in form to a USB key, which authenticates users when accessing Cloud services, and is optional at Windows sign-in. Using the key reduces the risk of unauthorized access to CRA devices, helps eliminate cyber security threats that arise from using only a username and password, and decreases the possibility of user credentials being compromised through phishing attacks. By using this universally accepted technology, the CRA is in compliance with Treasury Board Secretariat and Canadian Centre for Cyber Security policies and guidance on multi-factor authentication.

Laptops comply with the Security for the Computing Environment Policy with Encryption and access control. Any USB keys used must be agency issued and formatted with encryption technology specific to the user.

H) Potential risk that in the event of a privacy breach, there will be an impact on the individual or employee

Details:

Given the limited personal information collected on the volunteers and the contacts of community organizations, a privacy breach would not cause serious injury or harm to the individual involved. However, if a person was not accepted as a volunteer, they could feel a measure of embarrassment if that became known.

For the Outreach and CARES programs, due to the nature of the personal information collected, a privacy breach could result in reputation harm, embarrassment, financial loss and identity theft, and, in limited cases, a breach could result in physical or psychological harm.