Executive Summary
CBSA Assessment and Revenue Management (CARM) Privacy Impact Assessment
The CBSA launched the CBSA Assessment and Revenue Management (CARM) solution to enable the CBSA to track duties and taxes payable on the importation of commercial goods, monitor payments and facilitate reimbursements in the event of an overpayment by importers. The solution encompasses connections to multiple existing CBSA applications and databases and integrates with the Revenue Ledger (RL). The CARM solution requires connections with the Canada Revenue Agency (CRA) and with Public Services and Procurement Canada (PSPC).
The information held within the CARM solution is mostly commercial in nature: corporate contact information, corporate business numbers, and carrier codes. CARM holds information about importers, carriers, duty free shop owners, warehouse owners and customs brokerages. In some cases, the importers or carriers may be small-scale, sole proprietors and, in those cases, the identity, CRA-issued business numbers (BN) and even carrier numbers could be considered to be personal information.
The first phase of CARM, the Accounts Receivable Ledger (ARL) solution, was implemented in . In the Fall of 2020, the CARM project will launch the first release of Phase 2, wherein the ARL solution will undergo a technology upgrade and will move onto the SAP S/4HANA platform. No new personal information or functionality will be introduced, and current connections with multiple CBSA applications and databases and other government departments will remain in place. The Privacy Impact Assessment (PIA) created for ARL has been updated for CARM.
General legal authority is derived from the Canada Border Services Agency Act, the Customs Act, the Customs Tariff, the Excise Act, the Excise Tax Act and the Special Import Measures Act. Specific legal authority derives from section 17(1) of the Customs Act.
Information will be stored in the CARM software solution. In addition, information may be stored in the Customs Commercial System (CCS), Traveller Entry Processing System (TEPS), Batch Accounting Reporting K32 System (BARKS) and Automated Monetary Penalty System (AMPS).
Basic contact information will be leveraged by the CBSA to communicate with clients for newsflashes, outage bulletins and to communicate any urgent information.
Conclusions
Limited administrative risks were noted during the PIA process:
- While the Record Disposition Authority (RDA) and associated retention disposition standards have been identified, the CARM solution is not currently designed to identify records that are eligible for disposal. It is the intention of the CARM project team to build this function prior to the (six full year) retention date being met.
- Opportunities exist to strengthen the Memorandum of Understanding between the CRA and CBSA, specifying retention and disposition requirements, documenting access points internal to the CBSA as well as documenting which organization should be responsible for handling any requests for access to information under the Privacy Act.
- As the BN and Program Account information is collected indirectly by CRA, and provided to CBSA, there is no obligation for the CBSA to provide notice to the individuals at the time of collection. It was noted, however, that neither the related CRA PIB (CRA PPU 223), nor the BN application form reference disclosure of the information to the CBSA. While this is not a risk for the CBSA, CRA has been contacted and informed of this omission.
Right of Access
For any information received via the online Feedback Form, such as compliment, comment or complaint, the user is informed of the program purpose, as well as the related collection, use, disclosure and retention practices.
The personal information related to CARM will be held for six complete fiscal years before being destroyed. Because the information originates with the CRA, CBSA encourages individuals to file requests for access and records corrections with the CRA citing CRA PIB (CRA PPU 223) BN Registration and/or CRA PIB (CRA PPU 092) Excise and GST/HST Rulings and Interpretations. Further information about this activity is described within the CBSA Info Source Chapter under the Personal Information Bank CBSA PPU 1501.
You may formally request access to your personal information, or access to corporate records related to or created by CARM by contacting the Access to Information and Privacy Division.
Accountability
If you have concerns about the collection, use, disclosure or retention of your personal information, you may issue a complaint to CBSA Access to Information and Privacy Division. Complaints should be made in writing, and include your name, contact information, and a brief description of your concerns. Contact information for the Access to Information and Privacy Division at the CBSA can be found on the CBSA website.
- Date modified: