Assessment, Benefit and Service Branch
Individual Returns Directorate

On this page

• Overview & Privacy Impact Assessment Initiation (PIA)
• Summary of the project, initiative or change
• Risk identification and categorization

Overview & Privacy Impact Assessment (PIA) Initiation

Government institution

Canada Revenue Agency

Government official responsible for the PIA

Melanie Serjak
Assistant Commissioner
Assessment, Benefit, and Service Branch

Head of the government institution or Delegate for section 10 of the Privacy Act

Anne Marie Laurin
Director General
Access to Information and Privacy Directorate

Name of program or activity of the government institution

Tax Services and Processing

Standard or institution specific class of record:

Underused Housing Tax
CRA ABSB 215

Standard or institution specific personal information bank:

Underused Housing Tax
CRA PPU 214
TBS Registration Number: pending registration

Legal authority for program or activity

The Underused Housing Tax Act, S.C. 2022, c.5, s. 10 (the UHTA) received Royal Assent on June 9, 2022, but came into force on January 1, 2022.

• Section 19 of the UHTA allows the CRA to administer and enforce the underused housing tax (UHT).
  • Section 19: “The Minister must administer and enforce this Act, and the Commissioner may exercise the powers and perform the duties of the Minister under this Act.”
• Subsections 7(1) and 8(a) and section 10 of the UHTA allow the CRA to collect personal information to manage the Underused Housing Tax.
  • Subsection 7(1): “A person that, on December 31 of a calendar year, is an owner of a residential property (other than an excluded owner of the residential property) is required to file a return for the residential property for the calendar year.”
  • Subsection 8(a): “A person that is required under section 7 to file a return for residential property for a calendar year must make the return in prescribed form containing prescribed information and file it with the Minister in prescribed manner on or before April 30 of the following calendar year.”
  • Section 10: “The Minister may, on demand sent by the Minister, require a person to file, within any reasonable time stipulated in the demand, a return under this Act for any calendar year designated in the demand.”
• Section 3 of the Underused Housing Tax Regulations, 2022, c. 19, s. 116 allows the CRA to collect social insurance numbers to administer the UHT.
  • Section 3: “The Minister may require an individual to provide their social insurance number in a return filed under the Act.”
    • Subsection 84(1)(c) of the UHTA allows the creation of regulations that require individuals to provide their social insurance number.
• Subsection 32(6) of the UHTA allows the CRA to share the personal information it collected when administering the UHT.
  • Subsection 32(6): “Subsections 211(6) and 211(6.1) of the Excise Act, 2001 apply in this Act.”

Summary of the project, initiative or change

Overview of the Program or Activity

The Underused Housing Tax took effect on January 1, 2022, and is a tax on the ownership of vacant or underused residential properties in Canada. Residential property owners who are affected by the Underused Housing Tax had until April 30, 2024, to file their returns and pay the tax for the 2022 calendar year without the CRA charging them penalties or interest.

People who, on December 31 of a calendar year, are affected owners of residential properties that are situated in Canada have to pay Underused Housing Tax on each residential property in Canada that they own. These people do not have to pay Underused Housing Tax if their ownership of a particular residential property is exempt for the calendar year. Parts 4, 5, and 6 of Form UHT-2900, Underused Housing Tax Return and Election Form, outline the exemptions.

As of 2023, individuals, trusts, and corporations must file Form UHT-2900 for each residential property they own that is in Canada unless they are excluded owners.

An excluded owner of a residential property is any of the following:

• an owner of the residential property in their capacity as a trustee of any of the following trusts:
  • a specified Canadian trust (new excluded owner, starting in the 2023 calendar year)
  • a mutual fund trust for Canadian income tax purposes
  • a real estate investment trust (REIT) for Canadian income tax purposes
  • a specified investment flow-through (SIFT) trust for Canadian income tax purposes
  • an owner of a residential property in their capacity as a partner of a specified Canadian partnership (new excluded owner, starting in the 2023 calendar year)
• an owner of a residential property in a capacity other than as a trustee of a trust or partner of a partnership if the owner is:
  • an individual who is a Canadian citizen or a permanent resident of Canada
  • a specified Canadian corporation (new excluded owner, starting in the 2023 calendar year)
  • a Canadian corporation that has listed its shares on a designated, Canadian stock exchange for Canadian income tax purposes
  • a registered charity for Canadian income tax purposes
  • a cooperative housing corporation, hospital authority, municipality, public college, school authority, or university according to subsection 123(1) of the Excise Tax Act
  • a para-municipal organization according to section 1 of Part VI of Schedule V to the Excise Tax Act
  • an Indigenous governing body according to section 2 of the Department of Indigenous Services Act or a corporation that such a body wholly owns
  • the government of Canada, a province, or an agent of the government of Canada or a province
  • a Canadian corporation whose shares are substantially owned or controlled by a mutual fund trust, a real estate investment trust, a specified investment flow-through trust, or by a Canadian corporation whose shares are listed on a designated, Canadian stock exchange for Canadian income tax purposes (new excluded owner, starting in the 2023 calendar year)
• an individual who is a Canadian citizen or permanent resident of Canada and is an owner of the residential property as a personal representative of a deceased individual.

Owners who do not meet the criteria in the excluded list are affected owners. Affected owners can file their return on paper, electronically through the CRA account portal, or through the external online webform using a digital access code. Underused Housing Tax online digital access codes let affected owners get a system-generated digital access code so they can file their return online using the webform. Digital access codes are valid from the day the user gets them until December 31 of the same calendar year.

Returns collect owners’ personal information such as their social insurance number, individual tax number , temporary tax number , business number , citizenship, contact information, and financial details. The CRA then uses that information to calculate and collect the amount of underused housing tax that the owner must pay.

The CRA verifies and validates owners’ identification information against existing identification information that it originally collected for the individual returns and assessment program or business number registration program.

The Payment Processing Program administers, develops, implements, monitors, and maintains the systems that support and facilitate the remitting, processing, and tracking of payments that the CRA receives.

Once the CRA processes a return, it will issue a notice of assessment to the owner. The CRA shares the information it collected with its internal programs for collection and enforcement procedures.

A third-party organization that is in the private sector and is under contract with the CRA stores paper documents containing personal information for a specified period of time. The CRA has specific requirements for how long personal information must be kept. The retention rule for Underused Housing Tax operations is 10 years after the retention trigger.

Scope of the Privacy Impact Assessment

This privacy impact assessment (PIA) identifies and assesses privacy risks to personal information relating to the CRA’s Underused Housing Tax assessment program, including processing Form UHT-2900 returns and payments.

Certain compliance activities, such as audits and investigations, are separate programs and therefore are out of the scope of this PIA.

This PIA identifies and assesses privacy risks to personal information relating to the Underused Housing Tax Program’s activities including:

• capturing and processing special returns and election forms
• validating return and form data
• storing data
• sending letters and notices
• post accounting transactions
• reporting

Risk identification and categorization

A) Type of program or activity

Administration of Programs / Activity and Services

Level of risk to privacy: 2

Details:

The CRA uses the personal information it collects to administer the Underused Housing Tax Program (for example, validating identification information, processing the return, collecting property value information, processing payments, and providing support to taxpayers). The Underused Housing Tax Program needs this information to calculate the correct amount of taxes owing or credits on the account and to prevent unwarranted refunds.

The Underused Housing Tax Program shares the personal information that it collects with compliance programs to determine the correct amount of taxes payable. The vast majority of these cases will involve only administrative consequences, such as audits resulting in additional taxes owing and possible civil penalties. The CRA can select any Underused Housing Tax return for audit depending on the return’s risk assessment. A referral from another compliance program could also trigger an audit. The audit could produce leads for other taxpayers or other compliance programs, which in turn could result in the CRA auditing those taxpayers. The program does not undertake criminal prosecutions but may refer some cases for criminal prosecution. Compliance activities are separate programs and therefore are not included in this PIA.

B) Type of personal information involved and context

Social insurance number, medical, financial or other sensitive personal information and/or the context surrounding the personal information is sensitive. Personal information of minors or incompetent individuals or involving a representative acting on behalf of the individual.

Level of risk to privacy: 3

Details:

Personal information includes the following:

• full name
• identification numbers (including social insurance number, individual tax number, temporary tax number, business number)
• mailing or home address information
• citizenship or residency status
• information about an authorized representative (including their name, the business or employer’s name, and contact information)
• language preference
• financial information (including the property’s fair market value)
• residential property information (including property address, ID, tax or assessment roll number, value and type, and ownership type)

Personal information about associated individuals (spouse or common-law partner of the affected filer) may also be involved. This information includes:

• the associated individual’s full name
• their social insurance number, individual tax number, or temporary tax number
• whether they consent to the joint election

C) Program or activity partners and private sector involvement

With other federal institutions

Level of risk to privacy: 2

Details:

The Underused Housing Tax program shares personal information with various CRA programs. Other programs analyze the shared information to determine if they need more filing detail. Programs cross reference data on a need-to-know basis for program administration and enforcement purposes. The aim is to encourage businesses and individuals to:

• fully disclose financial activity
• meet reporting and remitting requirements
• lessen aggressive tax planning or tax deferral

The CRA also shares information with Public Services and Procurement Canada to help issue assessment and reassessment notices and refunds.

A third-party organization that is in the private sector and is under contract with the CRA stores paper documents containing personal information for a specified period of time.

D) Duration of the program or activity

Long-term program

Level of risk to privacy: 3

Details:

The Underused Housing Tax Program does not have a sunset date.

E) Program population

The program affects certain individuals for external administrative purposes.

Level of risk to privacy: 3

Details:

The Underused Housing Tax Program applies mostly to non-resident, non-Canadian owned residential real estate that the CRA considers to be vacant or underused.

F) Technology & privacy

1. Does the new or modified program or activity involve the implementation of a new electronic system, software or application program including collaborative software (or groupware) that is implemented to support the program or activity in terms of the creation, collection or handling of personal information?
   
   Risk to privacy: No
2. Does the new or modified program or activity require any modifications to IT legacy systems and/or services?
   
   Risk to privacy: Yes
3. Does the new or modified program or activity involve the implementation of one or more of the following technologies?

Enhanced identification methods - this includes biometric technology (i.e. facial recognition, gait analysis, iris scan, fingerprint analysis, voice print, radio frequency identification (RFID), etc.) as well as easy pass technology, new identification cards including magnetic stripe cards, "smart cards" (i.e. identification cards that are embedded with either an antenna or a contact pad that is connected to a microprocessor and a memory chip or only a memory chip with non-programmable logic).

Risk to privacy: No

Use of Surveillance - this includes surveillance technologies such as audio/video recording devices, thermal imaging, recognition devices, RFID, surreptitious surveillance/interception, computer aided monitoring including audit trails, satellite surveillance etc.

Risk to privacy: No

Use of automated personal information analysis, personal information matching and knowledge discovery techniques - for the purposes of the Directive on PIA, government institutions are to identify those activities that involve the use of automated technology to analyze, create, compare, identify or extract personal information elements. Such activities would include personal information matching, record linkage, personal information mining, personal information comparison, knowledge discovery, information filtering or analysis. Such activities involve some form of artificial intelligence and/or machine learning to uncover knowledge (intelligence), trends/patterns or to predict behavior.

Risk to privacy: Yes

G) Personal information transmission

The personal information is transmitted using wireless technologies.

Level of risk to privacy: 4

Details:

The system the CRA uses to process returns connects with other systems located on secured CRA servers. Access is available to CRA employees on a need-to-know basis only. There is controlled access to the physical location where the computers are kept. There is an audit trail for all views and changes through these systems. The CRA assigns each user a level of access based on organizational requirements (roles and profiles).

Data files are encrypted and transferred electronically via file transfer protocol or, in exceptional situations, by bonded courier using removable media encrypted by CRA-approved encryption software.

In general, the use of wireless technology is increasing, as is the need for greater accessibility to the CRA environment from any geographic location. To allow access to the CRA environment while users are away from the office, the CRA implemented secure remote access for laptops and approved smart phone or device platforms.

H) Potential risk that in the event of a privacy breach, there will be an impact on the individual or employee

Details:

If the personal information becomes compromised, it could cause financial harm, damage to property, and embarrassment to the individual.