Canada Revenue Agency mails private records to wrong person

The federal privacy commissioner is investigating the Canada Revenue Agency, after it mailed confidential records on other taxpayers to a B.C. woman, and failed to get the package back when she tried to return it.

"My first reaction to it was, well OK, somebody screwed up, but it could happen to anybody — and I’m sure they want to get it fixed as soon as possible," said Danielle Baxter, of Langley, B.C.

"And here I still have it … and it’s my problem to take care of the contents of the envelope that I never should have received."

The package arrived at Baxter’s home in mid-May after she requested tax information on her deceased daughter, which she needed to prepare a final tax return.

"It’s bad enough having to do your child’s tax return after they’ve died," she said.

When she opened the CRA envelope, she found her daughter's information, plus cover letters addressed to five other Canadians, stapled to financial records about them or their family members.

Baxter said she didn’t look at the contents, but instead called the main CRA number, to report the obvious mistake. When she couldn’t get through, she decided to deliver the records in person to the tax centre in Surrey.

She didn’t get the kind of response she expected.

Turned away

"In the doorway is a security guard standing smack in the doorway," said Baxter, who felt he was there strictly to keep people out.

He told her the public information office closed a few months ago, she said. "And I said, ‘Here’s my situation. What should I do?’"

He indicated he couldn’t advise her or even speak to her, Baxter said, because he was being monitored. "He kind of looked around and didn’t say anything … and then he said ‘I’m on camera’," she said.

"I couldn’t believe it. He’s on camera, afraid to talk to a taxpayer at the door of the tax building."

The security guard suggested she put the unlabelled, open package — with several people’s tax information in it — in the drop box outside.

Baxter said she felt that was inadequate, so she went back to her car and tried phoning the main CRA number again. She managed to get through to an employee somewhere in Canada, who put her on hold for several minutes.

When he came back, she said, he gave her two choices. She could go home and get a fresh envelope, address it with the exact wording he gave her, and then drive back to Surrey to put it in the drop box.

Otherwise, Baxter said, he told her she would have to wait ten days for the CRA to send her a specially-labelled envelope, which she could then use to mail the material back to the agency.

Handover refused

She asked for someone to come out to meet her — so she could hand over the sensitive records, personally — but said she was told that wasn’t possible.

"I was sitting in front of the building," she said. "I don’t see why someone couldn't have come out and received it. As far as I’m concerned if I’d put it in their hand, it’s secure."

"To store it for ten days — until I get their envelope — and then put it in the mail ... is considered more secure?" Baxter asked. "At no time did he ask who I was, so that he would have some connection to the material."

Baxter then took the paperwork home and decided to contact Go Public, because of how this was handled. She felt the other taxpayers had a right to know where their information went.

"If they are waiting for their materials in order to file their taxes and I just send this stuff back and nobody makes note of the fact that it had got lost…detained and everything else, are they going to be paying penalties through no fault of their own on their taxes, when they finally file them?" said Baxter.

"It was really bothering me that I was being left responsible for the whole thing."

Taxpayers affected

Go Public got the names of the other people affected, without looking at any of their information, and attempted to inform all of them.

One, who decided to speak out, was Alexandra Fontaine — another mother who was waiting for records to do her deceased son’s taxes. She’s upset over how his identity could have been exploited.

"It could've gotten in the hands of someone who wasn't honest, who could have used that information…thank goodness it was an honest person," said Fontaine.

"It's aggravating because it's just not right, you know, [the CRA] wants us to do things one way, but it's not the same for them."

Another person affected works with a large law firm. The firm emailed to say, "[The firm] Fasken Martineau appreciates the CBC’s efforts in contacting us."

Privacy Commissioner Jennifer Stoddart said her office is now investigating to see what went wrong at the CRA.

"We’re going to see exactly what they did. We’re going to see what the consequences are," said Stoddart.

"We’re also going to look at whether this is a systemic issue, because either somebody or some machine that was mis-calibrated or not checked stuffed several tax letters into the same envelope."

'Happens far too often'

She said the CRA was already on her radar for too many privacy breaches.

"It happens far too often," she said. "We have had quite a few data breaches with the CRA. And we have had enough data incidents, I’d say, enough incidents of mishandling of Canadian’s personal information, that I asked the CRA be audited…we’ll be reporting on that in my next annual report."

When asked what repercussions the CRA might face for this breach, Stoddart said, "There has to be some accountability around it and there has to be some remedies going forward. So, I think it would go to training. I would think there has to be some kind of acknowledgement of this Good Samaritan coming forward."

The agency said it is sorry and promised to contact all the taxpayers whose privacy was violated.

"The CRA takes the protection of Canadians’ tax information very seriously. The confidence and trust that individuals and businesses have in the CRA is a cornerstone of Canada’s voluntary tax system," said spokesperson David Morgan in an email.  

"If there is an incident, corrective action is taken immediately to ensure it doesn’t reoccur. We are aware there has been a report of an incident that involves mail containing taxpayer information. The CRA apologizes for this unfortunate error."

The agency has said it will contact all the taxpayers affected. Fontaine has since received her son's tax records by courier.

Go Public then asked Morgan how an incident like this should have been handled. He said the agency has adopted Treasury Board guidelines on privacy breaches. They outline a detailed rundown of procedures, which are not mandatory.

Under ‘how to respond to a privacy breach’, they suggest, "Take immediate action to stop the breach…and attempt to retrieve any documents or copies of documents that were wrongfully disclosed."

After Go Public contacted the CRA, Baxter said she immediately received several calls from government officials. A woman from the B.C. tax office then came to her home and picked up the documents.

Baxter wonders how often this type of thing is handled badly and never gets reported.

"I can’t imagine that this is a completely isolated incident," she said. "The horses are out of the barn and they are long gone…nobody showed any interest…in even meeting me even halfway on getting this material back."

Submit your story ideas to Kathy Tomlinson at Go Public

Follow @CBCGoPublic on Twitter 

Document

As a result of Go Public's calls on this story, Alexandra Fontaine received this letter from the CRA. She also received her son's tax information that same day.