By Jacqueline M. Demczur

Charities Directorate Releases Privacy Impact Assessment

The Canadian Constitution grants provinces the authority to manage charities operating within their jurisdiction. However, the federal government, through the Income Tax Act, regulates tax benefits for registered charities and other qualified donees. The Canada Revenue Agency (CRA), particularly the Charities program, is responsible for registering and monitoring these entities for income tax purposes. This involves collecting, using, storing, disclosing, retaining, and disposing of personal information related to individuals connected to qualified donees.

On May 3, 2024, the Charities Directorate Released a privacy impact assessment (PIA) on data it collects from charities and other qualified donnees. The findings of this report are summarized below.

Registration and Compliance

To issue official donation receipts for income tax purposes, certain qualified donees must:

• Be listed by the CRA.
• Maintain books and records for CRA inspection.
• Issue donation receipts according to the Income Tax Act.

Qualified donees include registered Canadian amateur athletic associations, municipalities, universities outside Canada, foreign charities that received a gift from His Majesty, public bodies performing government functions in Canada, low-cost housing corporations for the aged, and registered journalism organizations.

Personal information collected includes general contact details for registration and audits, such as names, titles, and donation records.

Ineligible Individuals

Post-Budget 2011 amendments to the Income Tax Act allow the CRA to reject or revoke charity status if an ineligible individual is involved. This includes those with criminal histories or past misconduct. The CRA can also suspend receipting privileges if such individuals manage the charity.

Registered Journalism Organizations

Introduced in Budget 2019, registered journalism organizations can become tax-exempt qualified donees to support Canadian journalism. These organizations must produce original news content and meet specific requirements, including arm’s length board operations and limitations on gift sources.

Privacy Impact Assessment Scope

The Privacy Impact Assessment (PIA) aims to identify and mitigate privacy risks associated with the Charities program, focusing on the collection, use, disclosure, storage, and disposal of personal information. It does not cover the National Security Disclosure Program.

The following risk identification and categorization features a risk level from one (low) to four (high), depending on the perceived vulnerability of the type of program or the particular information collected by the CRA.

Risk Identification and Categorization

A) Type of Program or Activity

The Charities program involves decisions about client organizations rather than identifiable individuals, posing a low privacy risk (Level 1).

B) Type of Personal Information Involved

Personal information collected includes names, contact details, and official titles, with a high privacy risk (Level 4) due to additional sensitive information accessed from internal and external sources.

C) Program or Activity Partners and Private Sector Involvement

The program involves significant data sharing with other CRA programs, federal institutions, provincial governments, private sector organizations, international organizations or foreign governments, posing a high privacy risk (Level 4).

D) Duration of the Program or Activity

The Charities program is long-term with no planned end date, posing a moderate privacy risk (Level 3).

E) Program Population

The program affects certain individuals connected to qualified donees, including “the entity’s officials, representatives, employees and associates, and in some cases their beneficiaries and donors”, posing a moderate privacy risk (Level 3).

F) Technology & Privacy

The program uses new electronic systems for handling personal information and involves automated personal information analysis, posing a moderate privacy risk (no level assigned).

G) Personal Information Transmission

Personal information is transmitted using wireless technologies with access controls, posing a high privacy risk (Level 4).

H) Potential Risk in the Event of a Privacy Breach

A privacy breach could lead to identity theft and misuse of personal information, causing financial or reputational harm (no level assigned).

Conclusion

The CRA's Charities program involves extensive collection and handling of sensitive personal information. While it primarily affects organizations, the personal data of individuals associated with these organizations is at risk. The program has privacy measures but requires continuous assessment and improvement to mitigate potential privacy risks effectively. It is a positive development that the Charities Directorate undertakes such initiatives like the PIA, as any failure by it to protect the personal information in its possession could be very serious for affected individuals. 

CRA Reminds Charities that T3010 Filings are Due Soon

On June 25, 2024, the CRA provided a reminder to charities on its “What’s New” page regarding the upcoming June 30 deadline to file T3010 Registered Charity Information Return.

Charities whose fiscal periods end on or after December 31, 2023 must file their T3010 using version 24 or it will be rejected by the CRA.  This would mean that your charity will not have filed its T3010 on time and could be revoked for non-filing. 

If filing on paper always download the latest version of Form T3010 from the official website.

If you use My Business Account (MyBA) or Represent a Client, the correct version is automatically provided, making it a fast, convenient, and secure option. For charities with fiscal period endings other than December 31, check the designated webpage for specific filing deadlines.

For assistance, consult the T3010 charity return page, the comprehensive guide on Completing the Registered Charity Information Return, or the T3010 webinar for step-by-step guidance.

MyBA is the most efficient and secure way to file, offering quicker processing and enabling charity registration, return filing, CRA correspondence, and account updates. The MyBA reference guide and webinar can help with registration, account access, and authorizing new directors.

The CRA now offers a document verification service for immediate online account access, bypassing the wait for a security code by mail. For more information on accessing CRA digital services, visit their website. For further assistance, contact the CRA at 1-800-267-2384, available Monday through Friday, 9 am to 5 pm, local time.

​Read the June 2024 Charity & NFP Law Update