Reader Heather Osborne in Ottawa asks: “If I use tax software, is my data protected? Or am I giving away my personal financial information?” Report on Business reporter Ian McGugan says, “No – at least not without your consent. You should check the details in the privacy agreement that accompanies whichever software package you use, but generally you must approve any use of your personal information.” He explains:
Intuit, maker of the popular TurboTax software, declares it “will not rent, sell, or otherwise distribute your personal information without your permission.” The main exceptions are if courts demand the information be handed over or if the information is “reasonably required” to fulfill your service or product requirements, but even then the third parties are bound to privacy requirements.
But here’s where things get tricky: Read your privacy statement and you’ll find that every tax software company will acknowledge making use of your personal information in various ways that does not involve actually selling it. You may or may not find these to be objectionable.
H&R Block, for instance, says it will use your personal information to alert you to products and tailor marketing material to your needs. You can choose not to receive these materials by calling them at a number provided or sending them an e-mail.
For its part, Intuit says it may aggregate many individuals’ information to provide a composite picture of, say, how many people bought a product. However, Julie Smithers, a spokesperson for the company, says it does not sell aggregate information to third parties. If Intuit shares aggregate data with other parties for whatever purpose, it attempts to purge the data of anything that could be used to identify an individual.
“If or when aggregate data sharing occurs… those data sets are de-identified using proprietary algorithms,” Ms. Smithers says. “We also require vendors and partners via contract to not re-identify the data.”
The key lesson here? Read the privacy statement and make sure you understand how your information is being used. Each company has a chief privacy officer you should contact if you have concerns. You can also take advantage of various provisions for controlling the future use of your personal information. Intuit, for instance, will usually alert you about product revisions or updates, but you can choose not to receive them.
While consumers should always remain suspicious, there is no indication that tax software companies are abusing the current system. The Office of the Privacy Commissioner of Canada says it has never investigated a complaint involving tax software.
Companies’ apparent good behavior on this point probably reflects a bit of enlightened self-interest. It would, after all, be a singularly stupid tax preparer that would jeopardize its business by blatantly disclosing personal information. But companies are also responding to Canada’s privacy laws.
The Personal Information Protection and Electronic Documents Act sets rules for how companies may collect and use information. It says companies can use personal information only for the purposes for which it was collected. “If an organization is going to use it for another purpose, consent must be obtained again,” says a guide to the act.
“Canadian privacy laws are generally rooted in reasonableness, notice and consent” writes David Fraser, a partner in the Halifax law firm McInnes Cooper and a leading authority on privacy law. A company that wants to use your personal information must give you notice and tell you about what it intends to do. It must get your consent and the purpose must be reasonable.
In an interview, Mr. Fraser said he’s not aware of any litigation in Canada that has ever arisen from privacy concerns regarding tax software.
He added that Canada’s Office of the Privacy Commissioner takes a dim view of companies that try to push the limits. It recently rebuked Bell Canada for its attempt to track people’s browsing habits, phone call patterns and app usage, then sell that information to marketers so they could deliver targeted advertising. The commissioner insisted that Bell get customers’ explicit consent to opt into the program, rather than simply allowing people to opt out of it.
Mr. Fraser said the requirement that users provide explicit, opt-in consent for use of their information takes on particular force when information is deemed to be particularly sensitive – as personal financial data undoubtedly would be.
“I’d expect that most of the info on a tax return is at the sensitive end of the spectrum, so any creator of tax preparation software would have to get opt-in consent to any secondary use of that sensitive personal information,” he writes.
“Secondary use encompasses a pretty broad range of activities and may use a range of information. It may be expected and reasonable for Intuit to use some of your less sensitive information to market other Intuit products – ‘you used the small business deduction, maybe you’d like our small business accounting product’ – but less okay for them to take sensitive information (the fact that you’re married, have two kids, make $250K, have loads of RRSPs and live in a particular neighbourhood) and sell that info to a condo developer or a financial planner.
“In any event, under Canadian privacy laws, they’d have to disclose that in their privacy statements.”