Community volunteer income tax program v2.0

Assessment, Benefit, and Service Branch
Disability, Indigenous, and Benefits Outreach Services Directorate

On this page

• Overview & Privacy Impact Assessment Initiation (PIA)
• Summary of the project, initiative or change
• Risk identification and categorization

Overview & Privacy Impact Assessment (PIA) Initiation 

Government institution

Canada Revenue Agency

Government official responsible for the PIA

Sujata Verma
Director General
Disability, Indigenous, and Benefits Outreach Services Directorate
Assessment, Benefit, and Service Branch

Head of the government institution or Delegate for section 10 of the Privacy Act

Lia Jackson
Director
Access to Information and Privacy Directorate

Name of program or activity of the government institution

Tax Services and Processing

Standard or institution specific class of record:

Community Volunteer Income Tax Program
CRA ABSB 110

Standard or institution specific personal information bank:

Community Volunteer Income Tax Program
CRA PPU 100

Legal authority for program or activity

The minister of national revenue is responsible for administering and enforcing the Income Tax Act, under section 220 of the Act.

The Canada Revenue Agency has been granted responsibility for general administrative policy at the Agency, under paragraph 30 (1) (a) of the Canada Revenue Agency Act.

Summary of the project, initiative or change

Overview of the Program or Activity

The Community Volunteer Income Tax Program (CVITP) is a collaboration between community organizations and the Canada Revenue Agency (CRA). The program has been operating since 1971. Its mandate is to help individuals and families in need by preparing income tax and benefit returns for individuals. To qualify to receive help, an individual must have a modest income and a simple tax situation.

Community organizations throughout Canada operate on a volunteer basis to host free tax clinics to prepare income tax and benefit returns for eligible individuals within their community.

The role of the CVITP is to:

• monitor the registration of volunteers and community organizations
• provide support, training and promotional material, and tax preparation software
• establish policies, procedures and best practices
• make sure all participants are aware of, and adhere to, federal privacy requirements and minimum standards for the protection of personal information

The program is offered in the province of Quebec under the Income Tax Assistance – Volunteer Program (ITAVP). A memorandum of understanding between Revenu Québec and the CRA outlines the joint obligations and duties of both parties. Revenu Québec and CRA employees work together as coordinators for the ITAVP. Revenu Québec’s employees have access to the program’s information for their region via the CRA’s computers and network. All personal information collected for participating volunteers and organization contact persons is kept and monitored by the CRA.

To participate, volunteers and organizations must register with the program each year. The preferred method of registration is to fill out an online form available on the CRA website. An account is created every time a new volunteer or organization registers. Subsequent registrations are stored under the account belonging to the volunteer or organization. Account and registration details are stored in a standalone database called the CVITP Management Tool (CMT).

Organizations that cannot register online can register over the phone by talking to a CVITP coordinator. After a community organization registers, a CVITP coordinator will review the information to make sure that the registration is complete and that the organization is in good standing. Afterwards the organization is approved to participate until the end of the registration year.

Volunteers who cannot register online can register by mailing a completed and signed Form T242, Community Volunteer Income Tax Program Volunteer Registration and Agreement, or Form COM-307, Information Sheet and Tax Software Agreement (for Québec), to a CVITP/Outreach officer. In both instances, a CVITP/Outreach officer will capture the information in the CVITP Management Tool.

After a volunteer registers, depending on their roles, they must meet the screening criteria by either of the following:

• obtaining their EFILE certification via the online registration
• submitting a police record check to the community organization with which they will be affiliated

The EFILE program is responsible for letting the volunteer know of the result of the certification process. The community organization is responsible for reviewing the police record check and informing the CVITP coordinator by email or by phone of whether the organization will accept the volunteer.

Once the screening criteria is met, the volunteer’s registration is approved, and they can start filing returns for taxpayers. An exception is made to the screening criteria for volunteers who have participated in the program for more than five years. This exception was grandfathered in 2016. Also, in remote areas where no community organizations exist, a volunteer may be allowed to participate independently, even though they are not affiliated with an organization. Independent volunteers must meet the security screening via the EFILE certification, unless they fall under the grandfathered exception.

In addition to the information collected for registration purposes, anonymized views and opinions are collected because of some projects operating in partnership with the CVITP to monitor the effectiveness of the program. Reports may be written to summarize views and opinions. But the reports will not include personal information that would make it possible to identify participants.

What’s New

In keeping with the CRA’s commitment to offer improved support to taxpayers who are not receiving the credits and benefits they are eligible to receive, the CVITP made the Autofill my return service available to volunteers. Auto-fill my return provides a fast and efficient way to access taxpayer information; increases the accuracy of returns filed by automatically filling in parts of returns with information the CRA has on hand; and ultimately, helps to make sure that more returns are completed for low-income and fixed-income individuals.

Auto-fill my return was made available to a select group of volunteers in 2018 (for the 2017 tax year) and to all volunteers in 2019 (for the 2018 tax year).

To use Autofill my return, volunteers must:

• register and be approved as a CVITP volunteer
• register in Represent a Client and receive a RepID
• provide their RepID during registration (can be provided to a CRA coordinator after registration)
• register and be approved as an EFILE user
• provide their organization with a valid police record check
• use UFile-CVITP software
• be authorized by the taxpayer to act as their representative for income tax matters, by having the taxpayer complete Form TIS60, Community Volunteer Income Tax Program Taxpayer Authorization

Using Autofill my return is a two-part process involving the electronic filing of Form TIS60 and the accessing of Autofill my return.

Managing increased risk related to using Autofill my return:

• All CVITP volunteers, including those wanting to use Autofill my return, must register through the CVITP online registration portal and acknowledge that they have read, and agree with, the declaration included there. The declaration states that they have never been convicted of any offence under the Criminal Code or any act of Parliament:

“I declare that I have never been convicted of any offence under the Criminal Code or any Act of Parliament including any offence involving evasion in the payment or remittance of tax, fraudulent transactions in which the public or any person is defrauded property, money or valuable security or service, possession of property obtained by crime or the proceeds of crime.”

• To use Autofill my return, volunteers must have first registered as an individual, electronic filer. When a person registers for EFILE certification, the CRA ensures that the person meets the suitability screening necessary to prepare returns for taxpayers. This certification process improves the integrity of the CVITP.
• To use Autofill my return, volunteers must provide the related organization with a valid police record check.
• All training material emphasizes the importance of safeguarding taxpayer information. Community organizations and volunteers must keep all taxpayer information secure and confidential as per the guidelines described in Publication TIS5, Volunteer Handbook.
• A volunteer’s RepID is tied to their social insurance number, which allows the CRA to easily monitor and trace their access.
• Represent a Client has transaction codes to allow for random or specific auditing of volunteers.

There are two levels of authorization that can be given to a representative. CVITP volunteers are granted Level 1, view-only access, which allows only the disclosure of tax information to an authorized representative for indicated tax year(s). This level does not authorize the representative to request financial or other changes to a taxpayer’s account.

• Volunteers are instructed to read a script to taxpayers which explains, in plain language, why they are being asked to sign a completed Form TIS60 authorization (that is, full disclosure).
• A completed Form TIS60 is only valid until 11:59 pm, Eastern time, on the day it is submitted).

Also new to the CVITP Management Tool is the introduction of the CVITP organization identification number (COIN). A COIN is a unique and permanent eight-digit number that is assigned by the program to approved organizations and communicated in their approval letter (sent by email). COINs will be used to improve statistical reporting for the CVITP by confirming the number of federal income tax and benefit returns electronically filed by volunteers under a given organization. CVITP organizations will be responsible for sharing their COIN with their volunteers who will be encouraged to enter the COIN into the appropriate field of the UFILE-CVITP software. A COIN will stay the same year over year, even if there is a break in participation. Volunteers who are affiliated with more than one organization will receive a different COIN specific to each organization that they volunteer for. COINs will not be linked to any identifiable T1 data. Each COIN is scrubbed of all taxpayer information, so that it can not be traced back to specific taxpayers. A COIN is simply a mechanism for counting the total number of returns filed by an organization.

Scope of the Privacy Impact Assessment

The scope of this privacy impact assessment (PIA) covers the Community Volunteer Income Tax Program’s role as coordinator and overseer of the participation of organizations and volunteers in the program. This PIA does not cover any of the following:

• preparation of income tax and benefit returns
• interaction between volunteers and taxpayers
• EFILE certification process

Risk identification and categorization

A) Type of program or activity

Administration of Programs / Activity and Services 

Level of risk to privacy: 2

Details:

Personal information is used to assess suitability of volunteers, to register them for the Community Volunteer Income Tax Program (CVITP), and to identify an organization’s contact person. Information is also collected to monitor the effectiveness of the program.

B) Type of personal information involved and context

A social insurance number, as well as medical, financial, and other sensitive personal information and the context surrounding that information is sensitive. What may be involved is the personal information of minors, incompetent individuals, and representatives for an individual.

Level of risk to privacy: 3

Details:

The information used to administer the CVITP includes name, contact information, police record checks, and biographical information. EFILE certification may be used as a security measure instead of a police record check. When this occurs, only the result of the certification is communicated by the EFILE helpdesks to the CVITP. The personal information collected by the EFILE program is not shared with the CVITP.

Views and opinions may also be collected to enhance the program.

C) Program or activity partners and private sector involvement

Private-sector organizations or international organizations or foreign governments

Level of risk to privacy: 4

Details:

The CVITP is a community-based outreach program that is administered by the CRA in partnership with community organizations, as well as with Revenu Québec. Community organizations confirm with the CRA when they review and accept a police record check as a security measure for a volunteer. The CRA informs organizations when their volunteers have been approved so that they can start to participate in the program.

D) Duration of the program or activity

Long-term program 

Level of risk to privacy: 3

Details:

The CVITP is a long-term program. It has been in place since 1971, and there is no plan to end the program.

E) Program population

The program affects certain individuals for external administrative purposes.

Level of risk to privacy: 3

Details:

The CVITP affects individuals applying to be volunteers in it. The CVITP also involves contacting individuals who represent participating community organizations.

The views and opinions of CVITP and study participants are collected for non-administrative purposes to monitor the effectiveness of the program.

Since the CVITP operates at arm’s length with its volunteers and organizations, there is no information shared between the CVITP and any taxpayers.

F) Technology & privacy

1. Does the new or modified program or activity involve the implementation of a new electronic system, software or application program including collaborative software (or groupware) that is implemented to support the program or activity in terms of the creation, collection or handling of personal information?

   Risk to privacy: No

2. Does the new or modified program or activity require any modifications to IT legacy systems and/or services?

   Risk to privacy: No

3. Does the new or modified program or activity involve the implementation of one or more of the following technologies?

Enhanced identification methods - this includes biometric technology (i.e. facial recognition, gait analysis, iris scan, fingerprint analysis, voice print, radio frequency identification (RFID), etc.) as well as easy pass technology, new identification cards including magnetic stripe cards, "smart cards" (i.e. identification cards that are embedded with either an antenna or a contact pad that is connected to a microprocessor and a memory chip or only a memory chip with non-programmable logic).

Risk to privacy: No

Use of Surveillance - this includes surveillance technologies such as audio/video recording devices, thermal imaging, recognition devices, RFID, surreptitious surveillance/interception, computer aided monitoring including audit trails, satellite surveillance etc.

Risk to privacy: No

Use of automated personal information analysis, personal information matching and knowledge discovery techniques - for the purposes of the Directive on PIA, government institutions are to identify those activities that involve the use of automated technology to analyze, create, compare, identify or extract personal information elements. Such activities would include personal information matching, record linkage, personal information mining, personal information comparison, knowledge discovery, information filtering or analysis. Such activities involve some form of artificial intelligence and/or machine learning to uncover knowledge (intelligence), trends/patterns or to predict behavior.

Risk to privacy: Yes

G) Personal information transmission

The personal information is transmitted using wireless technologies.  

Level of risk to privacy: 4

Details:

Volunteers and organizations can register online by filling out an electronic registration form available on the CRA’s website. The information is then transmitted to the CVITP Management Tool. Alternatively, volunteers can fill out a paper form and organizations can register over the phone. For paper forms, the information is entered manually in the CVITP Management Tool by a CRA coordinator.

Due to being a repository for the data displayed in the CVITP Management Tool, the Agency Data Warehouse has access to the information of individuals applying to be volunteers in the CVITP and individuals who represent community organizations.

Although there is no information shared between the program and the taxpayer, it is important to note that the CVITP is responsible for establishing procedures to ensure all participants are aware of, and adhere to, federal privacy requirements and minimum standards for the protection of personal information. As such, specific instructions are provided to volunteers on how to handle and protect taxpayers’ information. For example, volunteers must encrypt returns using the tax software and save the electronic files on a USB flash drive only. If the tax software does not encrypt returns, they must use an encrypted USB flash drive.

H) Potential risk that in the event of a privacy breach, there will be an impact on the individual or employee

Details:

Given the limited personal information collected on the volunteers and the contacts of community organizations, a privacy breach would not cause serious injury or harm to the individual involved. However, if a person were not accepted as a volunteer, they could feel a measure of embarrassment if that became known.