Privacy breach is tax department’s largest ever

• In what is reportedly the largest privacy breach in the Canada Revenue Agency’s history, an employee at a Prairie region tax office improperly accessed more than 1,200 records.

The CRA fired the employee involved, but will not disclose at which office the breach occurred due to “confidentiality considerations,” spokeswoman Marie Tichborne said via an emailed statement.

The Prairie region encompasses offices in Saskatoon, Regina, Winnipeg and locations in Alberta.

An internal affairs investigation into the incident was launched in March, 2016, according to documents obtained by The Star-Phoenix through an Access to Information request. The documents did not reveal who the employee was or the date the incident occurred.

The investigation found that a CRA employee looked at the accounts of 38 people in detail, as well as his or her own account. The employee also glanced at 1,264 accounts after using the search function, entering various surnames and postal codes.

The employee did not make changes to any of the accounts, but was able to see the names, contact information, social insurance numbers, income and deductions and employment information for the taxpayers.

The investigation found that the “risk of injury” to the 1,264 accounts was low because the information was on- screen for an estimated two seconds per account and the employee did not access any of the accounts directly.

Tichborne said only the 38 taxpayers whose information was directly accessed were notified of the breach.

In a statement, the CRA said it takes the protection of Canadians’ tax information “very seriously.”

This past March, t he agency implemented a new technology that monitors employees’ access to taxpayer information and “will flag accesses that appear inconsistent with the employees’ assigned workloads or duties,” it said. The project cost $10.2 million.

The agency employs more than 40,000 people nationwide.