Privacy of your CRA My Account User Data

The Canada Revenue Agency’s My Account online platform is a useful and convenient tool for the preparation of your tax returns and the storage of your tax information. The Canada Revenue Agency has put security measures into place to prevent hackers and cybercriminals from being able to access your personal data.

The CRA uses specially configured computer Web servers for its online platform. It also uses firewalls to protect its Web servers from unauthorized access. Additionally, the CRA securely stores your personal information on separate computer systems that are not directly accessible from the Internet.

You can only access My Account from Web browsers that meet high security standards of encryption. This way, the CRA ensures that your personal and financial information is encrypted when it is transmitted between your computer and its Web servers. This ensures that computer hackers and other Internet users cannot access or alter the data being transmitted. Its standard for encryption is the Transport Layer Security protocol. This ensures that transferred data is encrypted so that it cannot be read by anyone except the recipient.

Before you use My Account, you must give the CRA two pieces of confidential information. These two pieces of identification information are used to create your digital signature or electronic identification. This is so the CRA can confirm the identity of the sender of a message, whether the message is encrypted or not. Keep this information and any passwords confidential so that others cannot use your digital signature.

Furthermore, the CRA’s My Account is configured so that you can log in using a secure connection from your financial institution. This way, you benefit from the CRA’s security measures and also from your bank’s.

The CRA has introduced a service that allows you to receive some of your correspondence from the CRA directly in My Account. However, for greater security, the CRA does not actually send any of this information to you by email.

Instead, the CRA sends an email notification to the email address you provided to let you know when new mail is available for you to view in My Account. The email notification does not contain any links. Only by logging into My Account can you view the actual content of the correspondence from the CRA. This way, even if someone had access to your emails, he could not view the CRA’s correspondence.

The CRA has also publicly committed to using a proactive approach to online security. Mainly, it does this by notifying taxpayers about potential threats involving fraudulent communications claiming to be from the CRA, a process known as phishing, as soon as the CRA becomes aware of its existence. The CRA never provides or asks for personal information in emails, so any communication purporting to do so is probably a phishing attempt.

Register for a CRA My Account.

Learn more about registering for a CRA My Account.