Information & Ethics committee  In fact, all of our print-to-mail operations are essentially automated now. When you get something in a wrong envelope, it's usually a machine error. It usually means that a machine has picked up two pages instead of one, or somehow the flow between the envelope and the documen

Information & Ethics committee  In this instance we do follow Treasury Board of Canada policy. We spoke earlier about the risk assessment that is undertaken to determine the degree of the breach and its impact on an individual, and that includes whether there is potential for identity fraud. It covers three s

Information & Ethics committee  I can't speak about specific instances, but the informing of an individual would be dependent on the outcome of the risk assessment that we did based on the criteria in that fact case.

Information & Ethics committee  Keep in mind that many of those pieces of correspondence were, in fact, ultimately recovered by the agency.

Information & Ethics committee  Well, that's...yes, we can—

Information & Ethics committee  Obviously all of the information on a person's income tax and benefit return...so that would be the SIN, their income, and the credits they're applying for. To apply for some credits, you need to provide additional information. It could be medical information, if you're applying

Information & Ethics committee  Possibly, yes. It's probably important to mention also that we do collect information on behalf of some provinces and territories as well, as a more streamlined approach, so we do have provincial information that we collect on their behalf too.

Information & Ethics committee  Regrettably, the answer may be available, but the CRA would not track it.

Information & Ethics committee  Again, it's outside our expertise, but we're not aware of any instance where we would have run across that. I mentioned in response to a previous question that all of the commercial software that is made available on the CRA website has gone through an extremely rigorous authent

Information & Ethics committee  Again, this area is a little outside of our area of expertise. What I can tell you is that we have a very big recertification process for all of the software that is available through our site, commercial software, to file income tax and benefit returns. These cannot be certified

Information & Ethics committee  I'm sure Ms. Brown will want to add detail to my answer, but that is correct. At the time, the CRA was certainly monitoring privacy breaches, but we were doing it by monitoring and tracking centrally the number of investigations. At the time that question was asked, we had not

Information & Ethics committee  Well, you're right, certainly the CRA views privacy—

Information & Ethics committee  We certainly view it as a shared responsibility. With regard to what we ask Canadian taxpayers to do to protect the information that they send to us, we always ask them to make sure that they have verified that they are dealing with us, that whenever they're in doubt, they take

Information & Ethics committee  No. There's a protocol from Treasury Board that gives departments guidance on which cases should be reported to the Privacy Commissioner. It covers a fairly detailed risk assessment. Departments are asked to look at the sensitivity of the information that was disclosed. Is it, fo

Information & Ethics committee  We are guided by the outcome of our risk assessment. If the risk assessment indicates that there is a reasonable chance of harm to the individual, then we will report to the OPC. In that timeframe, we reported 479 cases.