Canada Revenue Agency privacy breach leaks prominent Canadians' tax details

Detailed tax information about the private lives of hundreds of Canadians — many of them rich and famous — was sent to CBC News by Canada's tax agency in a major privacy breach.

The highly confidential details, including home addresses of taxpayers and the value of tax credits they were granted, are contained in a copy of a Canada Revenue Agency spreadsheet covering the years 2008 to 2013.

The 18 pages include information on donations made by such Canadian luminaries as author Margaret Atwood, former prime minister Jean Chrétien, grocery magnate Frank Sobey, cartoonist Lynn Johnston, pollster Allan Gregg, financier Stephen Bronfman, former CBC executive Richard Stursberg, Olympics chief Richard Pound and many others.

"Letting confidential figures slip that way, is very sloppy … I'm sure they didn't do it on purpose," Atwood told CBC on Tuesday.

The list outlines what donations of manuscripts, photographs and fine art these Canadians have made to Canadian galleries and museums, and includes their home addresses and the value the taxman attached to the donations for the purpose of claiming a charitable tax break.

The values for the donations range widely, from less than $5,000 for some personal papers to a Rubens painting deemed to be worth $200 million and given to the Art Gallery of Ontario.

The artifacts being donated to art galleries and museums across the country include manuscript collections from well-known writers, photographs, sculptures and oil paintings, many from the artists themselves  — and even cels from animated films.

CBC News is withholding most details from the list, apart from the names of some of the people cited, out of respect for privacy.

Revenue Minister Kerry-Lynne Findlay later confirmed to the House of Commons there had been a privacy breach, saying the department reported it to the privacy commissioner and was attempting to reach the individuals affected.

"This privacy breach is extremely serious and completely unacceptable," Findlay said, after grilling by the opposition. "Measures are being taken to notify, support and protect individuals affected by this breach."

A spokesperson for the federal privacy commissioner confirmed the office was notified of the incident by Canada Revenue Agency commissioner Andrew Treusch on Tuesday afternoon by telephone, and that the agency would be providing a preliminary report "very quickly."

"From what we have seen in media reports, the incident clearly raises significant privacy concerns," said Valerie Lawton.

The unredacted list, delivered to CBC in digital format, was an erroneous response to a request for unrelated records under the Access to Information Act.

A handful of the entries on the list refer to "gifting tax shelters," a form of donation that in the past has provided a bigger tax break for investors than the actual value of the item donated. The list carefully identifies these schemes to ensure they are given proper scrutiny by officials.

Some 50,000 of these gifting tax shelters existed in 2006, but tougher rules and scrutiny by the revenue agency since have reduced them to about 10,000 registered each year, altogether worth about $85 million in tax breaks annually.

Not the 1st privacy breach

Previous privacy breaches under the Conservative government have involved the confidential information of ordinary citizens, but this breach is unique in that it includes so many well-known and well-heeled Canadians in the fields of politics, sports and culture.

The spreadsheet shows not only what the donors claimed their donations are worth, but what the government later determined was the true worth, sometimes well below the initial claimed value.

Cultural donations in Canada are vetted by an arm's-length, blue-ribbon panel, the Canadian Cultural Property Export Review Board, which normally receives applications from cultural institutions that have come to some arrangement with a donor. The board then must certify the donation as an "object of significance and national importance," and ensure the value attached is appropriate for the purposes of a tax break.

In 2012-13, the last year for which figures are available, the board reviewed 581 potential donations worth some $72 million — or $5 million less than the total amount first claimed by the prospective donors. The board says about 13 per cent of donations are determined to be less than the claimed value.

Privacy breaches at federal government agencies have become almost routine. Lawton said a total of 168 federal privacy breaches have been reported since April 1, including 22 from the Canada Revenue Agency, making it among the top offenders.

Canada's privacy law forbids disclosure of sensitive personal information that "could reasonably be expected to cause serious injury or harm to the individual and/or involves a large number of affected individuals."

'Here we go again'

But the Canada Revenue Agency is held to an even higher standard, with a special duty to preserve confidential tax information of individuals and businesses - protecting it from disclosure even to other federal departments and police forces.

The agency was roundly criticized by Canada's privacy commissioner in her annual report issued October 2013, which detailed "numerous reports of privacy breaches involving employees inappropriately accessing taxpayer information in recent years."

In a special audit, the commissioner found "weaknesses in key privacy and security practices that led to taxpayer information not being protected as it should, with thousands of files being accessed inappropriately for years without detection."

The NDP tax critic, Murray Rankin, said the agency has apparently learned nothing. "They were warned.… Here we go again."

Rankin, a former privacy lawyer, said the breach, along with agency staff cuts that appear to weaken its ability to chase down offshore tax evaders, suggest mismanagement is rampant.

"They're putting their money in going after people who are environmental charities and birdwatchers, and they've got lots of money for that," he said. "But … the management of the CRA is missing in action on this."

An Ottawa lawyer specializing in privacy law called the latest breach "very, very serious," among the worst he has seen in 30 years.

"I don't remember a case when CRA lost control over such information," Michel Drapeau said in an interview.

Former Ontario privacy commissioner Ann Cavoukian said she was "outraged" to learn of the breach. "It's completely unfathomable," she said. "Perhaps you have to discharge certain employees.… You need a complete overhaul, top to bottom."

The tax receipts provided to donors can be claimed for charitable-donation tax credits, which are a smaller percentage of the fair market value of the donated item, based on a formula. The credits can then be used to reduce taxes payable.

The names on the list obtained by CBC News include:

• Historian John English.
• Financier Eric Sprott.
• Author Tim Wynne-Jones.
• Author Spider Robinson.
• Photographer Edward Burtynsky.
• Broadcaster Dini Petty.
• Artist Christopher Pratt.
• Filmmaker Robert Lantos.
• Artist Charles Pachter.
• Sculptor Sorel Etrog.
• Former judge Louise Arbour.
• Artist David Blackwood.
• Artist, the late Alex Colville.
• Former diplomat Allan Gotlieb.
• Television czar and publisher Moses Znaimer.