Collections and Verification Business Intelligence

Privacy Impact Assessment (PIA) summary – Technology and Business Intelligence Directorate, Collection and Verification Branch

Overview & PIA Initiation

Government institution

Canada Revenue Agency

Government official responsible for the PIA

Michael Snaauw
Assistant Commissioner, Collections and Verification Branch

Head of the government institution or Delegate for section 10 of the Privacy Act

Marie-Claude Juneau
ATIP Coordinator

Name of program or activity of the government institution

Collections, Compliance and Verification

Description of the class of record and personal information bank

Standard or institution specific class of record:

• Non-Filer – Compliance (CRA CVB 181)
• Employer, GST/HST and Business Compliance (CRA CVB 188)
• Collection Actions (CRA CVB 190)

Standard or institution specific personal information bank:

• Collection Action (CRA PPU 050)
• Non-Filer Compliance (CRA PPU 025)
• Trust Accounts Compliance (CRA PPU 120)

Legal authority for program or activity

Income Tax Act under subsection 220(2) and correspondingly subsection 275(2) of the Excise Tax Act outlines CRA’s responsibilities with respect to the administration and enforcement of these Acts.

Legal authority for a CRA official to provide taxpayer information to another CRA official for the purpose of administering or enforcing the Income Tax Act is clearly provided in subparagraph 241(4)(d)(ii) of that Act and 295 (5)(d)(ii) of the Excise Tax Act.

Summary of the project / initiative / change

The collections, compliance and verification programs identify, address, and prevent non-compliance to help resolve tax debt quickly.

The CRA maximizes the use of business intelligence tools to predict cases where CRA intervention might influence payment and filing compliance.

By using technology and business intelligence, the CRA is able to make strategic and operational decisions so that taxpayer files can be directed to the most appropriate collection or compliance strategy, such as the Debt Management Call Centre, the Accounts Receivable National Inventory, or directly to a tax service office for intervention. Data mining models allow the call centre to receive taxpayer files that might be settled through an automated phone call or a call from a call centre agent, whereas the more complex and higher-risk files are directed to a tax service office for more aggressive action. New technologies and faster processing are helping CRA to access, integrate, and analyze this data more effectively, resulting in better business intelligence about taxpayer behaviour.

Using this knowledge, CVB is in a stronger position to positively influence taxpayer behaviour. This, in turn, supports our compliance and collections efforts, from placing a well-timed phone call or receiving an automated reminder of their filing obligations and due dates, to selecting files for examination when non-compliance is suspected.

This privacy impact assessment (PIA) focuses on the business intelligence activities carried out by the Technology and Business Intelligence Directorate (TABI) on behalf of the Collections and Verification Branch (CVB) in order to enhance program delivery and achieve effective compliance results.

The Business Intelligence information enables the collections, compliance and verification programs to administer and measure the programs and services and to discover new insights about how those programs and services could be delivered in ways that are more efficient and effective.

The scope of this PIA covers the Business Intelligence outcomes and activities such as operational and performance reports, predictive modeling, and the research and analytics services, but not the operational decisions to use the information for Collections, Compliance and Verification programs and activities. The CVB programs, activities and the results of BI activities used for operational purposes will be included in the individual program level PIAs.

Risk identification and categorization

A) Type of program or activity

Compliance / Regulatory investigations and enforcement

Personal information is used for purposes of detecting fraud or investigating possible abuses within programs where the consequences are administrative rather than criminal in nature (e.g., a discontinuation of benefits or an audit of personal income tax file).

Level of risk to privacy: 3

Details: The results of Business Intelligence (BI) activities such as research papers, operational and performance reports or predictive data mining are used to establish the demographics, explore potential workloads, monitor inventory and develop an algorithm for a risk score. Personal information such as social insurance number, postal code, age, language and gross income are summarized to produce these results. The information from these types of reports is at the aggregate level and does not involve a decision about an identifiable individual.

Personal information is used to identify and assess risks of non-compliance. For predictive data mining models, personal data is used to develop and enhance the model. The outcome is a risk score that may be applied within business operations; however the decision to use this risk score to support Collection Verification Branch (CVB) programs and activities are determined by collections and compliance programs.

The results of the BI activities enables the CVB programs to administer and measure their programs and services and to discover new insights about how those programs and services could be delivered in ways that are more efficient and more effective. The use of BI information ensures program areas are more agile in addressing emerging risks and challenges and, at the same time, in providing better service to taxpayers by implementing new compliance strategies and initiatives based on taxpayer’s behaviours. BI provides data for workload development and workload management activities and these results are used to support CVB programs. The decisions to use the results of BI are not made in BI areas, but in the program delivery areas of CVB. The cases handled by CVB’s programs areas may result in administrative consequences.

B) Type of personal information involved and context

Social Insurance Number, medical, financial or other sensitive personal information— and/or the context surrounding the personal information— is sensitive. Personal information of minors or incompetent individuals, or involving a representative acting on behalf of the individual.

Level of risk to privacy: 3

Details: Personal information may include social insurance number, financial information, the address of the taxpayer and other sensitive personal information. . The data will be used in performance and operational reports and for research and analysis purposes. In the majority of circumstances, the data will be compiled at an aggregate level to establish non-compliance demographic, trend analysis and workload management.

C) Program or activity partners and private sector involvement

Within the institution (amongst one or more programs within the same institution)

Level of risk to privacy: 1

Details: The data used for Business Intelligence (BI) activities comes from existing internal CRA sources. The data is gathered through collections and compliance activities, as well as other CRA programs.

However, the original source may have been from a third party such as data related to Underground Economy initiatives. For example, the Compliance Programs Branch can request information through a court order warrant related to Requirement for Information for Unnamed Persons (RFIUP) and this information may be shared with CVB.

D) Duration of the program or activity

Long-term program

Level of risk to privacy: 3

Details: The Business Intelligence activities play an important role in achieving the Agency`s mandate. It is not foreseen that they will be discontinued in the near future.

E) Program population

The program affects certain individuals for external administrative purposes.

Level of risk to privacy: 3

Details: The Business Intelligence activities include most taxpayers. However, any decisions that may result in administrative actions are made on the non-compliant population by the CVB collections and compliance programs and these activities will be addressed in those corresponding PIAs.

F) Technology & privacy

Does the new or modified program or activity involve the implementation of a new electronic system, software or application program including collaborative software (or groupware) that is implemented to support the program or activity in terms of the creation, collection or handling of personal information?

Risk to privacy: No

Does the new or modified program or activity require any modifications to IT legacy systems and / or services?

Risk to privacy: No

The new or modified program or activity involves the implementation of one or more of the following technologies:

Enhanced identification methods - this includes biometric technology (i.e. facial recognition, gait analysis, iris scan, fingerprint analysis, voice print, radio frequency identification (RFID), etc...) as well as easy pass technology, new identification cards including magnetic stripe cards, "smart cards" (i.e. identification cards that are embedded with either an antenna or a contact pad that is connected to a microprocessor and a memory chip or only a memory chip with non-programmable logic).

Risk to privacy: No

Use of Surveillance - this includes surveillance technologies such as audio/video recording devices, thermal imaging, recognition devices , RFID, surreptitious surveillance / interception, computer aided monitoring including audit trails, satellite surveillance etc.

Risk to privacy: No

Use of automated personal information analysis, personal information matching and knowledge discovery techniques - for the purposes of the Directive on PIA, government institutions are to identify those activities that involve the use of automated technology to analyze, create, compare, identify or extract personal information elements. Such activities would include personal information matching, record linkage, personal information mining, personal information comparison, knowledge discovery, information filtering or analysis. Such activities involve some form of artificial intelligence and/or machine learning to uncover knowledge (intelligence), trends/patterns or to predict behavior.

Risk to privacy: Yes

Details: Similar to other tax administrations, the CRA collects, produces, and stores vast amounts of data. New technologies and faster processing are helping us to more effectively access, integrate, and analyze this data, resulting in better business intelligence about taxpayer behaviour.

Equipped with this knowledge, we are in a stronger position to positively influence taxpayer behaviour. This, in turn, supports our compliance and collections efforts, from placing a well-timed phone call or offering a reminder, to selecting files for examination when non-compliance is suspected. Examples of our initiatives include:

• Using data analysis to predict which instalment remitters were likely to make payments enabled us to better target follow-up phone calls, resulting in additional negotiated payment arrangements.
• Using data analysis to identify accounts that would "self-resolve" allowed us to focus our collections efforts on higher-risk accounts.
• Using data analysis to predict the assessed value of unfiled T1 returns, enabling us to better select T1 non-filer workload for follow-up action, and resulting in additional positive assessments.
• Having successfully used a "nudge" approach with our automated dialler strategy, we began to establish pilots using a "nudge" approach for collections.
• Capturing and consistently reporting information over time to support trends analysis

With the evolution of the Agency’s understanding of the compliance continuum, it has been recognized that it is not the type of non-compliance that needs to be dealt with in isolation, but rather the taxpayer as a whole. This taxpayer-centric thinking represents a significant shift from the business concepts on which the current silo source systems were developed. In order to gain a better understanding about the taxpayer, it is necessary for the Agency to develop new tools and methods to gather, align, and filter data that relates to a taxpayer to better support the program delivery and address the needs of the taxpayer.

G) Personal information transmission

The personal information is transmitted using wireless technologies.

Level of risk to privacy: 4

Details: The data used for Business Intelligence (BI) activities comes from data gathered from collections and compliance activities, as well as other CRA program activities. This data is stored in the mainframe source systems. BI makes a copy of this information and it is saved in another database. The information in the database uses statistical analysis software to extract the data into a report which then aggregates the data into performance, operational, research and analysis reports. This information is used to support collections and compliance program activities such as workload management, inventory monitoring, and establishing trends related to taxpayer behaviour and non-compliance actions.

The majority of the end results from performance reports, research papers, and program results analysis will be at the aggregate level and are transmitted to the collections and compliance programs through internal systems, including by email. There will be no identifiable personal information in these types of BI results since the data will be summarized at the office, region, provincial level and other types of segmentation.

The use of wireless technology is increasing as well as the need for greater accessibility to the CRA environment from anywhere. The Secure Remote Access (SRA) for laptops and the Blackberry platforms are the ITB’s answers for accessing the CRA environment while away from the office. Sending Protected A and B information using wireless technology, has low risk. Protected C or Classified information must not be discussed, stored, or processed on a BlackBerry device.

Many of the BI tools and applications are accessible by the user through a secure site, which enables them to create and run performance and operational reports on their own.

H) Risk impact to the individual or employee

Details: In the event of a privacy breach, an individual may become a victim of identity theft, and this information may be used without this person’s knowledge or consent in ways that could result in a financial or reputational loss to that person.

However, it is very difficult to access personal information about a taxpayer since the social insurance number (SIN) and business number (BN) are masked using a Meaningless But Unique Number (MBUN) such as Client Identification number. This MBUN allows for safe querying of data without exposing the identity of an individual. The Client Identifier would have to be data matched against information from another database to find the SIN or BN number. In order to gather more information on the taxpayer it will be necessary to sign into a mainframe source system using a CRA User ID to access the taxpayer account information (address, telephone and financial information). Access to mainframe source system is tracked by the National Audit Trail System.

I) Risk impact to the institution

Details: If personal tax information is misused, it could result in embarrassment to the CRA and decrease compliance in the future. The Minister of National Revenue and the Commissioner of the CRA would be subject to criticism if the information was misused in any way.