Canada's Taxpayers' Ombudsperson has launched an investigation into 'undue delays' at the Canada Revenue Agency (CRA) following a report from the privacy watchdog that revealed over 42,000 tax account breaches since 2020. The Office of the Privacy Commissioner of Canada cited significant gaps in the CRA's prevention and detection measures, as well as delayed implementation of multi-factor authentication.
Privacy Report Highlights Systemic Failures
The privacy commissioner's report, released earlier this week, detailed how the CRA failed to adequately protect taxpayer information, leading to thousands of unauthorized access incidents. The report noted that the agency did not promptly implement multi-factor authentication, leaving accounts vulnerable to cyberattacks. 'The CRA's slow response to known vulnerabilities has put millions of Canadians at risk,' said Privacy Commissioner Philippe Dufresne.
Ombudsperson's Mandate
The Taxpayers' Ombudsperson, François Boileau, stated that his office will examine whether the CRA's handling of the breaches constitutes 'undue delays' under the Taxpayer Bill of Rights. 'Canadians deserve timely and effective responses when their personal information is compromised,' Boileau said in a statement. The investigation will focus on the period from 2020 to 2025, during which the breaches occurred.
CRA Response
The CRA has acknowledged the report and stated that it is committed to improving its cybersecurity measures. 'We have already begun implementing multi-factor authentication for all accounts and are working to enhance our detection systems,' a CRA spokesperson said. However, critics argue that the agency has been too slow to act, leaving taxpayers exposed for years.
Impact on Taxpayers
The breaches have caused significant concern among Canadians, many of whom have reported identity theft and fraudulent tax returns. 'I had someone file a tax return in my name and claim a refund,' said Toronto resident Sarah Mitchell. 'It took me months to resolve, and I still don't feel my information is safe.' The ombudsperson's investigation aims to hold the CRA accountable and ensure that similar incidents are prevented in the future.
The investigation is expected to take several months, with a report to be published by the end of 2026. In the meantime, the privacy commissioner has recommended that the CRA implement stronger security protocols and provide timely notifications to affected taxpayers.
