Privacy and Information in Ontario
Reviewed by the Commoner Law Editorial Team. Sourced from Canadian federal statutes and official sources. Provincial information reflects each province's own legislation and court rulings. Written in plain language for general understanding — this is educational content, not legal advice. Our editorial standards
What is this right?
The CRA is legally required to protect your personal tax information. Section 241 of the Income Tax Act makes unauthorized disclosure of taxpayer information a criminal offence.
The Privacy Act and the Taxpayer Bill of Rights (Right #3) give you the right to have your information treated as confidential. No CRA employee can share your information without your written consent unless specifically authorized by law.
You have the right to access your own information. You can view much of it through My Account, or submit a formal request under the Access to Information and Privacy (ATIP) process. The CRA must respond within 30 days.
If your information contains errors, you can request corrections. If the CRA shares your data improperly, you can file a complaint with the Privacy Commissioner of Canada.
When does it apply?
This applies to every person and business that files taxes or interacts with the CRA in any way.
- Your privacy rights apply whether you are filing a return, being audited, or receiving benefits.
- These protections cover all CRA interactions — phone, mail, online, and in person.
What to Do If the CRA Improperly Discloses Your Tax Information in Canada
- Access your information through My Account — it shows your returns, assessments, benefit payments, and correspondence.
- Submit an ATIP request if you need detailed records the CRA holds about you.
- File a complaint with the Privacy Commissioner if you believe your information was shared improperly.
- Authorize a representative using Form T1013 if you want someone to access your information on your behalf.
- Request corrections if your CRA records contain errors.
What should you NOT do?
- Don't share your My Account login credentials with anyone — use Form T1013 to authorize a representative instead.
- Don't give your SIN to anyone who doesn't legally need it — the CRA will never ask for your SIN by email or text message.
- Don't assume the CRA can share your information freely — they need legal authority or your written consent.
- Don't overlook ATIP requests in tax disputes — getting the CRA's internal records can be valuable for your objection or appeal.
How Ontario differs from federal law
Your tax information is protected by strict confidentiality rules under both federal and Ontario law. The CRA cannot share your tax information without your consent, except in limited circumstances defined by statute.
- Section 241 of the federal Income Tax Act prohibits CRA officials from disclosing taxpayer information except as authorized by law (e.g., to law enforcement with a court order, or to provincial tax authorities for tax administration).
- The Privacy Act (federal) gives you the right to access your personal information held by the CRA and to request corrections.
- Ontario's Freedom of Information and Protection of Privacy Act (FIPPA) protects personal information held by Ontario government institutions. If you have dealings with the Ontario Ministry of Finance (e.g., employer health tax, land transfer tax), your information is protected under FIPPA.
- You can control who accesses your CRA information by authorizing (or revoking) representatives using Form T1013 or through My Account.
- The CRA must keep your information for prescribed retention periods and then securely destroy it.
Additional Steps in Ontario
Access your tax information through CRA My Account. To file a privacy complaint, contact the Office of the Privacy Commissioner of Canada at 1-800-282-1376. For Ontario provincial records, file an access request under FIPPA with the relevant Ontario ministry. You can authorize or revoke representatives at any time through My Account or by filing Form T1013.
Relevant Law: Income Tax Act, R.S.C. 1985, c. 1 (5th Supp.), s. 241 (Taxpayer Confidentiality); Privacy Act, R.S.C. 1985, c. P-21; Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c. F.31
Common Questions
When does privacy and information apply?
This applies to every person and business that files taxes or interacts with the CRA in any way.Your privacy rights apply whether you are filing a return, being audited, or receiving benefits.These protections cover all CRA interactions — phone, mail, online, and in person.
What should I do if I think the CRA in Canada shared my personal tax information without my consent?
Access your information through My Account — it shows your returns, assessments, benefit payments, and correspondence.Submit an ATIP request if you need detailed records the CRA holds about you.File a complaint with the Privacy Commissioner if you believe your information was shared improperly.Authorize a representative using Form T1013 if you want someone to access your information on your behalf.Request corrections if your CRA records contain errors.
What mistakes should I avoid with privacy and information?
Don't share your My Account login credentials with anyone — use Form T1013 to authorize a representative instead.Don't give your SIN to anyone who doesn't legally need it — the CRA will never ask for your SIN by email or text message.Don't assume the CRA can share your information freely — they need legal authority or your written consent.Don't overlook ATIP requests in tax disputes — getting the CRA's internal records can be valuable for your objection or appeal.
Legal Resources
We may earn a commission if you use these services — at no extra cost to you. This supports our mission to make legal information free for everyone.