Executive Summary: CBSA Assessment and Revenue Management (CARM) Release 2 Privacy Impact Assessment

From: Canada Border Services Agency

The Canada Border Services Agency (CBSA) launched the CBSA Assessment and Revenue Management (CARM) solution to enable the CBSA to track duties and taxes payable on the importation of commercial goods, monitor payments and facilitate reimbursements in the event of an overpayment by importers. The solution encompasses connections to multiple existing CBSA applications and databases and integrates with the Revenue Ledger (RL). The CARM solution requires connections with the Canada Revenue Agency (CRA) and with Public Services and Procurement Canada (PSPC).

The CARM solution collects and uses personal information pertaining to certain individuals. The information held within the CARM solution is mostly commercial in nature: corporate contact information and corporate business numbers. CARM holds information about importers (domestic and foreign), trade service advisors, carriers, couriers, duty free shop owners, warehouse owners and customs brokerages, during the application phase and once confirmed as business partners. In some cases, the importers or carriers may be small-scale, sole proprietors and, in those cases, the client identifier (CRA-issued Business Numbers, Carrier Codes or Business Partner ID) could be considered to be personal information. Personal information about business owners is collected during the application phase in order to establish that the business meets specific requirements.

This information is collected in accordance with sections 17(1), 60(1)-(3) and 67.1 of the Customs Act.

This information is shared with multiple existing CBSA applications and databases. The CARM solution requires connections with the Canada Revenue Agency (CRA) and with Public Services and Procurement Canada (PSPC); information is also shared with the Canadian Food Inspection Agency and Statistics Canada. Non-governmental partners include surety companies and the Canadian Banks and Clearing House.

Information is shared with these partners in accordance with sections 17(1), 60(1)-(3) and 67.1 of the Customs Act for the purposes of enabling the CBSA to track duties and taxes payable on the importation of commercial goods, monitor payments and facilitate reimbursements in the event of an overpayment by importers. Subsequent use and disclosure of this information is restricted by the Privacy Act.

The CARM solution involves the modification of an existing solution and is intended by CBSA for long-term operation. The final Phase 2 release of CARM, Release 2, expands the functionalities of the CARM Client Portal by adding registration and enrolment capabilities, additional accounting functionality and electronic management of appeals and compliance actions. Release 2 will include the transition of functionality from CBSA legacy systems to the CARM solution.

Conclusions

Limited administrative risks were noted during the CARM PIA process:

• The CARM system is replacing legacy systems that support a variety of CBSA activities. Especially in the case where CARM and legacy systems operate together, the handling of personal information as it flows from one system to another within a single information bank must be clearly documented.
• Retention schedules for all CARM data have been documented, but the associated PIBs have not been updated to reflect these changes.
• The CARM system’s Privacy Notice requires modification in order to follow the standard CBSA Privacy Notice template.
• Opportunities exist to strengthen the Memorandum of Understanding between the Canada Revenue Agency and the Canada Border Services Agency.

Right of Access

For any information received via the online Feedback Form, such as compliment, comment or complaint, the submitter is informed of the program purpose, as well as the related collection, use, disclosure and retention practices.

The personal information related to CARM will be held according to the timeframes outlined in the Retention Disposition Strategy before being destroyed. Because the information originates with the CRA, CBSA encourages individuals to file requests for access and records corrections with the CRA citing CRA Personal Information Bank (PIB) BN Registration (CRA PPU 223) and / or CRA PIB Excise and GST/HST Rulings and Interpretations (CRA PPU 092). Further information about this activity is described by PIB CBSA PPU 1501, available in the Information about Programs and Information Holdings (formerly Info Source).

Individuals may formally request access to their personal information or access to corporate records related to or created by the CBSA Assessment and Revenue Management (CARM) solution by contacting the CBSA Information Sharing, Access to information and Chief Privacy office (ISATICPO).

Accountability

If the applicant has concerns about the collection, use, disclosure or retention of their personal information, the applicant may issue a complaint to the CBSA Information Sharing, Access to information and Chief Privacy office (ISATICPO). Complaints should be made in writing, and include the applicant’s name, contact information, and a brief description of their concerns.