Executive Summary
CBSA Assessment and Revenue Management (CARM) Privacy Impact Assessment

The Canada Border Services Agency (CBSA) launched the CBSA Assessment and Revenue Management (CARM) solution to enable the CBSA to track duties and taxes payable on the importation of commercial goods, monitor payments and facilitate reimbursements in the event of an overpayment by importers. The solution encompasses connections to multiple existing CBSA applications and databases and integrates with the Revenue Ledger (RL). The CARM solution requires connections with the Canada Revenue Agency (CRA) and with Public Services and Procurement Canada (PSPC).

The information held within the CARM solution is mostly commercial in nature: corporate contact information and corporate business numbers. CARM holds information about importers (domestic and foreign), trade service advisors, carriers, couriers, duty free shop owners, warehouse owners and customs brokerages. In some cases, the importers or carriers may be small-scale, sole proprietors and, in those cases, the identity, CRA-issued business numbers (BN) could be considered to be personal information.

The first phase of CARM, the Accounts Receivable Ledger (ARL) solution, was implemented in January 2016. In January 2021, the CARM project launched the first release of Phase 2, wherein the CARM Phase 1 solution underwent a technology upgrade and was moved onto the SAP S/4HANA platform. No new personal information or functionality was introduced, and existing connections with multiple CBSA applications and databases and other government departments remained in place. In May 2021, the CARM project deployed additional Phase 2 components. The new components include an online portal for Trade Chain Partners (TCPs), an automated chatbot, and a modern and efficient case management functionality for CBSA employees. This version of the PIA reflects the current release of CARM Phase 2.

General legal authority is derived from the Canada Border Services Agency Act, the Customs Act, the Customs Tariff, the Excise Act, the Excise Tax Act and the Special Import Measures Act. Specific legal authority derives from sections 17(1), 60(1)-(3) and 67.1 of the Customs Act.

Personal information will be stored in the CARM software solution. In addition, personal information may be stored in the Customs Commercial System (CCS), Traveller Entry Processing System (TEPS), Batch Accounting Reporting K32 System (BARKS) and Automated Monetary Penalty System (AMPS).

Basic contact information will be leveraged by the CBSA to communicate with clients for newsflashes, outage bulletins and to communicate any urgent information.

Conclusions

Limited administrative risks were noted during the PIA process:

• While the Record Disposition Authority (RDA) and associated retention disposition standards have been identified, the CARM solution is not currently designed to identify records that are eligible for disposal. It is the intention of the CARM project team to build this function, as part of Release 2, prior to the (six full year) retention date being met.
• Opportunities exist to strengthen the Memorandum of Understanding between the CRA and CBSA, specifying retention and disposition requirements, documenting access points internal to the CBSA as well as documenting which organization should be responsible for handling any requests for access to information under the Privacy Act.
• As the BN and Program Account information is collected indirectly by CRA, and provided to CBSA, there is no obligation for the CBSA to provide notice to the individuals at the time of collection. It was noted, however, that neither the related CRA PIB (CRA PPU 223), nor the BN application form reference disclosure of the information to the CBSA. While this is not a risk for the CBSA, CRA has been contacted and informed of this omission.

Right of Access

For any information received via the online Feedback Form, such as compliment, comment or complaint, the submitter is informed of the program purpose, as well as the related collection, use, disclosure and retention practices.

The personal information related to CARM will be held according to the timeframes outlined in the Retention Disposition Strategy before being destroyed. Because the information originates with the CRA, CBSA encourages individuals to file requests for access and records corrections with the CRA citing CRA PIB (CRA PPU 223) BN Registration and/or CRA PIB (CRA PPU 092) Excise and GST/HST Rulings and Interpretations. Further information about this activity is described within the CBSA Info Source Chapter under the Personal Information Bank CBSA PPU 1501.

Applicants may formally request access to their personal information, or access to corporate records related to or created by CARM by contacting the CBSA Information Sharing, Access to Information and Chief Privacy Office (ISATICPO).

Accountability

If the applicant has concerns about the collection, use, disclosure or retention of their personal information, the applicant may issue a complaint to the CBSA Information Sharing, Access to Information and Chief Privacy Office (ISATICPO). Complaints should be made in writing, and include the applicant’s name, contact information, and a brief description of their concerns. Contact information for the Information Sharing, Access to Information and Chief Privacy Office (ISATICPO) at the CBSA.

Date modified:

2021-05-15