16 ms·

Canada's tax revenue agency tries to ToS itself out of hacking liability

359 points by rinze 4y ago

phyzome 4y ago
If you're forced to sign a contract and don't get to negotiate the terms, and it tries to do unusual things like that, it can be... pretty hard to enforce.
tpmx 4y ago
Do government agencies generally have that kind of liability in the first place?
- kenned3 4y ago
  No, normally the government in Canada can be sued for this sort of thing. not exactly the same thing, but this is a $500,000 class action lawsuit for losing a USB Key containing patient data: https://www.thestar.com/news/gta/2012/05/28/durham_region_health_class_action_lawsuit_puts_price_on_personal_information.html https://www.thestar.com/news/gta/2012/05/28/durham_region_he... The expectation is that the government protect your privacy or pay if they fail to do so.. as with any private data.
  - chkaloon 4y ago
    But the government is financed by taxpayers, so the taxpayers will end up being the payers of any fines the government is liable for. It's circular.
    - liketochill 4y ago
      Only if all taxpayers get an equal settlement. And even then perhaps that money would have been spent on another group: “sorry no fighter jets this year money went privacy lawsuits”. So some taxpayers could come out ahead in the event of privacy lawsuits.
      - chkaloon 4y ago
        I didn't say that all taxpayers would come out equivalently. I said taxpayers would pay.
- emacsen 4y ago
  I am not a lawyer, but if it's provable that your data was stolen, why wouldn't a citizen be able to take an entity to court for what would be reason precautions and protections around their data? If you can show that they didn't have audits, protections against their DB, etc. then I can imagine they'd be as liable as a private entity. But as is mentioned, this is all but demanded of Canadians to use this service, and yet the government is absolving itself of liability.
  - Kranar 4y ago
    Due to the principle of sovereign immunity. A government can only be sued if it explicitly has granted permission, otherwise the government is immune from civil action.
    - deleted 4y ago
      [deleted]
kenned3 4y ago
This is so typical of the Canadian government. The effectivly FORCE you to use this site as they try to cut costs and reduce "call in" support. Then, they create a ToS which absolves them of all responsibility if they are hacked? I would be willing to bet that if any Canadian business tried this the government would crack down and state it not permitted. The government has a tendency of "do as i say not as i do". Any Canadian can tell you that for the most part government IT is utter garbage. <cough>arrive-can</cough><cough>Phoenix</cough> ....
- mulmen 4y ago
  > The government has a tendency of "do as i say not as i do". Well that’s the value proposition of government, right? A monopoly on violence in exchange for a set of rules leading to a stable society.
  - int_19h 4y ago
    A set of rules that also applies equally to the government itself is one thing. But "do as I say, not as I do" is not that.
    - mulmen 4y ago
      That’s the “monopoly on violence“. The government isn’t equal. They hold the monopoly on violence, until they get so far out of line that the people take it back. The only open question is how to prevent that from happening.
- xattt 4y ago
  CRA is almost a separate entity from other federal departments, so it behaves like a private business than a government department. They aren’t even at the behest of the treasury board.
  - Kranar 4y ago
    The CRA is its own department, like any other department. It is structured and operates just like any other government department as opposed to a private business. They are not at the behest of the Treasury Board because the Treasury Board is a committee, not an administration or agency. The board has no executive authority whatsoever and exists to give advice to Cabinet rather than to perform or execute a duty. However, the individual members of the Treasury Board do have the ability to order the CRA, principally the Minister of National Revenue, who sits on the Treasury Board, is the executive of the CRA. Perhaps you're thinking of the Bank of Canada, which is an actual corporation and operates in a semi-independent manner from Parliament, although technically Parliament has full oversight and authority over it.
stewx 4y ago
> 10. The Canada Revenue Agency has taken all reasonable steps to ensure the security of this Web site. We have used sophisticated encryption technology and incorporated other procedures to protect your personal information at all times. However, the Internet is a public network and there is the remote possibility of data security violations. In the event of such occurrences, the Canada Revenue Agency is not responsible for any damages you may experience as a result I am not a lawyer, but I would be surprised if this holds water, legally speaking. Imagine going to an amusement park and signing a waiver that the park takes no responsibility for your injuries. If you climb aboard a rollercoaster that hasn't seen any maintenance in 20 years and you get decapitated, I'm pretty sure the park is still legally responsible. Getting someone to sign something that says "we did our due diligence" doesn't make it true.
- bee_rider 4y ago
  On top of this, I don’t see how a contract that you are compelled to agree to in order to do your taxes could be seen as one that you’ve willingly entered.
  - stewx 4y ago
    Using the My Account web site is not required to do your taxes. You can file by mail AND electronically with Netfile without using it at all. Src: https://www.canada.ca/en/revenue-agency/services/e-services/e-services-individuals/netfile-overview/eligibility.html https://www.canada.ca/en/revenue-agency/services/e-services/... That being said, My Account is a useful, albeit very flawed online tool.
- theloco 4y ago
  [flagged]
  - dang 4y ago
    Can you please not post like this to HN? It's not what this site is for, and destroys what it is for. If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.
nayuki 4y ago
Also noteworthy is that compared to leading commercial websites (Amazon, Facebook, etc.), the Canada Revenue Agency website: Responds an order of magnitude slower (like 3000 ms vs. 300 ms), and has maintenance downtime hours (instead of being up 24/7). > However, the Internet is a public network and there is the remote possibility of data security violations. They conveniently ignore the fact that HTTPS is pervasive and that you can reasonably carry private conversations on a public network. And why don't they have a disclaimer for the fact that the telephone network is public and the mail network is public?
- bawolff 4y ago
  Personally i would rather my tax money be spent elsewhere than latency optimizing a website that i have to use once a year. The maintenance hours thing is unconsiable though. Sometimes i want to know how much tfsa room i have on sunday evening.
  - version_five 4y ago
    Rest assured, it will have cost way more than a comparable commercial website. Poor performance is not a cost savings measure.
  - tenpies 4y ago
    > Sometimes i want to know how much tfsa room i have on sunday evening Which you wouldn't want to check with the CRA either, because the information is often incomplete and updated annually at best. The CRA even advises that whatever numbers they give you are essentially fugazi, and you should keep your own records because if you make a mistake they will obliterate you with fines. One of the mottos of the Canadian government is: if you make a mistake because we gave you the wrong information, it is still your fault and you will give us money.
    - earleybird 4y ago
      Personal experience, once received a notification from CRA to the effect: "6 months ago we refunded you incorrectly, you owe us, oh by the way we're also charging you a penalty for our mistake.". The amount was not inconsequential but not a problem to remedy. The insult was "we made a mistake and we are punishing you for it".
scohesc 4y ago
This government is so shoddily ran (leaving individual party politics aside) - Canadians aren't holding their government accountable. They're too busy trying to survive inflation and the knock-on effects it continues to cause, while distracting themselves with media that tells them "it's okay" and "it's not that bad" Other boondoggled IT projects brought to you by the Canadian government include the Phoenix federal government paysystem - which coming up on a decade now, some federal employees _still_ aren't getting paid correctly, and the ArriveCan app - which is their hastily created, bug-filled app for pre-entry customs processing checklists that had accessibility problems for the disabled which have likely still been ignored, among other issues. Between this and the very dodgy reactions from government officials (or lack thereof) to the recent news of foreign influence in our politics and elections processes from China, I would say this country has had its core emptied out and replaced with a nougat center of tasty corporate corruption and money laundering goodness. The attitude seems to be "Not enough money to create and maintain a system that respects the privacy of our citizens, but we'll just legalese our responsibility away because we can and we're the government so _there_! We're like a silicon valley company, just try to sue us!" At least we know that tax companies in the states are lobbying to make it harder to file taxes with the US government - the Canadian government just makes it more difficult by themselves! I for one would like our government to be as responsible as possible when it comes to handling our data - ideally having as little of it as possible, only the required amounts to interact with me as minimally as possible - instead of having it all available in a portal that can be easily compromised and hacked judging from previous leaks/breaches in the linked article.
- snapplebobapple 4y ago
  you should consider donating to the Canadian constitution foundation (https://www.youtube.com/@theCCF https://www.youtube.com/@theCCF) then or something like them because our constitution actually does have a decent protections for separation of power between provinces and the federal government and getting that back to what is actually in the constitutional documents (as opposed to what has been twisted by decades of bad decisions to favor the federal government) would go a long way in creating the kind of competitive multi-polar environment that keeps America strong vs the uni-polar corrupted junk that Canada has increasingly become.
ilrwbwrkhv 4y ago
[flagged]
- barbazoo 4y ago
  What are you talking about?
  - switchbak 4y ago
    Here's someone who has clearly never been to Canada. Canada has lots of problems, yes, but this just smacks of a strongly held yet uninformed opinion. Actually, looking at their comment history they seem to be the champion of edgy one-liner comments. Nothing to see here.
deleted 4y ago
[deleted]
isaacremuant 4y ago
They do the same thing in tenancy documents in some countries. Basically an excuse to have the worst security and not be liable. I don't know if it would hold if actual negligence was shown.
rkagerer 4y ago
If you pay attention to ToS's, you'll find companies are increasingly trying to pull stunts like this. The CRA's terms are objectionable, yet sadly benign compared to other reprehensible terms I've seen gating the web. Lawyers are copying each other's tactics and propogating dark patterns that I doubt will stand the test of litigation (but will cost some poor sap a lot of money and time to get there). Indemnity clauses are another one (no, I'm not going to reimburse you for damage if my account gets hacked through no fault of my own). When I encounter clearly dodgy terms like this I often contact the organization and tell them I do not accept the given clause. Sometimes they say 'stop using our service' (rarely enforced) but most often they simply don't respond. Someone at CRA with authority to fix this might perk up if thousands of Canadians start emailing them about it, report it to MP's, the Privacy Commissioner and other ombudsmen, etc.
- slickrick216 4y ago
  Yeah like you say this isn’t a new phenomenon. In some cases they even try to shield themselves with legislation. For example let’s look at Ireland. [0] Ireland tries to exclude itself from GDPR https://www.thejournal.ie/data-protection-bill-2018-3853647-Feb2018/ https://www.thejournal.ie/data-protection-bill-2018-3853647-... [1] Entire health system compromised and possibly majority of PHI data exfiltrated https://www.hse.ie/eng/services/publications/conti-cyber-attack-on-the-hse-full-report.pdf https://www.hse.ie/eng/services/publications/conti-cyber-att... [2] Irish health service only begins notifications to confirmed affected individuals a year later https://www.hse.ie/eng/services/news/media/pressrel/hse-begins-national-data-breach-notification-programme.html https://www.hse.ie/eng/services/news/media/pressrel/hse-begi... [3] selective punishment of companies whose data is breached eg google https://techcrunch.com/2022/03/14/dpc-sued-google-rtb-complaint https://techcrunch.com/2022/03/14/dpc-sued-google-rtb-compla... vs meta https://www.dataprotection.ie/en/news-media/data-protection-commission-announces-conclusion-two-inquiries-meta-ireland https://www.dataprotection.ie/en/news-media/data-protection-... Laws unevenly applied make a mockery of justice.
  - nickff 4y ago
    Re: [0] My understanding is that member states (and perhaps all sovereigns) are not required to comply with GDPR unless they explicitly choose to.
afrcnc 4y ago
This seems to be a recent change. It wasn't there last year: http://web.archive.org/web/20220418211009/https://www.canada.ca/en/revenue-agency/services/e-services/e-services-individuals/account-individuals/preview-account-terms-conditions-use.html http://web.archive.org/web/20220418211009/https://www.canada...
CKMo 4y ago
Wonder if the IRS will try this soon or if the zero trust architecture they're implementing will come fast enough
matbilodeau 4y ago
1.Sue CRA. 2.Win. 3.??? 4.CRA pays, taxes go up for everyone to make up for it.
matbilodeau 4y ago
Fortunately, contracts in Quebec are dependent of the Civil Code. Terms of service match the definition of a contract. I am eager to see if such practices by any level of government will pass the test of tribunals and current jurisprudence. Excerpts : 1458 Every person has a duty to honour his contractual undertakings. Where he fails in this duty, he is liable for any bodily, moral or material injury he causes to the other contracting party and is bound to make reparation for the injury; neither he nor the other party may in such a case avoid the rules governing contractual liability by opting for rules that would be more favourable to them. https://www.legisquebec.gouv.qc.ca/en/document/cs/CCQ-1991?langCont=fr#se:1458 https://www.legisquebec.gouv.qc.ca/en/document/cs/CCQ-1991?l... 1474 A person may not exclude or limit his liability for material injury caused to another through an intentional or gross fault; a gross fault is a fault which shows gross recklessness, gross carelessness or gross negligence. He may not in any way exclude or limit his liability for bodily or moral injury caused to another. 1475 A notice, whether posted or not, stipulating the exclusion or limitation of the obligation to make reparation for injury resulting from the nonperformance of a contractual obligation has effect, with respect to the creditor, only if the party who invokes the notice proves that the other party was aware of its existence at the time the contract was formed. 1476 A person may not by way of a notice exclude or limit his obligation to make reparation with respect to third persons; such a notice may, however, constitute disclosure of a danger 1477 The assumption of risk by the victim, although it may be considered imprudent having regard to the circumstances, does not entail renunciation of his remedy against the author of the injury. https://www.legisquebec.gouv.qc.ca/en/document/cs/CCQ-1991?langCont=fr#se:1474 https://www.legisquebec.gouv.qc.ca/en/document/cs/CCQ-1991?l...
- nickff 4y ago
  IANAL... but... I don't think that the CRA is subject to Quebec law, and believe that the CRA may exercise sovereign immunity, though I'm not sure that it has done so in the past.
  - matbilodeau 4y ago
    That's where 3149 would come in. Maybe even 3150 if you have "ID theft" insurance. 3149. Québec authorities also have jurisdiction to hear an action based on a consumer contract or a contract of employment if the consumer or worker has his domicile or residence in Québec; the waiver of such jurisdiction by the consumer or worker may not be set up against him. 3150. Québec authorities also have jurisdiction to hear an action based on a contract of insurance where the holder, the insured or the beneficiary of the contract is domiciled or resident in Québec, the contract covers an insurable interest situated in Québec or the loss took place in Québec. https://www.legisquebec.gouv.qc.ca/en/document/cs/CCQ-1991?langCont=en https://www.legisquebec.gouv.qc.ca/en/document/cs/CCQ-1991?l...
dcow 4y ago
Certainly having a government agency able to force you to accept ToS like you'd see in the private sector is absurd since it lets the government skirt its own laws. Feels like a "could the government do that" standard would be a good one to apply to any ToS when figuring out whether it's enforceable. Or maybe this is just more evidence that ToS should be generally and universally ruled unenforceable.
emptybits 4y ago
Canadian here. Thank you for sharing your Terms of Service. I don't agree to them. Thus, I wish to opt out of your Tax Revenue Collection Service. M'kay?
- matbilodeau 4y ago
  You don't need a computer to file your taxes. Paper kits are provided by CRA and declarations can be submitted on paper by mail. Potential use cases being technology illiteracy, access to reliable internet connections just to name a few . https://www.canada.ca/fr/agence-revenu/services/formulaires-publications/trousses-impot-toutes-annees-imposition/trousse-generale-impot-prestations.html https://www.canada.ca/fr/agence-revenu/services/formulaires-...
  - emptybits 4y ago
    I'll go out on a limb here ... tell me if you disagree ... that if you file your taxes on paper, all that personal information will be quickly scanned and available in a database. The database of the site in question. I say this because the My Account service allows a Canadian to check their balance, payments, credits, filing status, etc. It's there for anyone, ready to go, with whatever information the CRA has stocked it with. Your information, even if it started out on paper. It's pretty inconceivable that the CRA could function if the paper filings didn't soon end up in the same database as the e-filings. Anyways, then at that point, your paper personal data is sitting right there behind the login of that same CRA site we're talking about. For your future convenience. Or leaking. Or hacking. And then we're back to ... "in the event of such occurrences, the Canada Revenue Agency is not responsible for any damages you may experience as a result."
    - matbilodeau 4y ago
      I follow you train of thought and I'm wondering where the loophole would be. I mean if you file on paper you don't use the My Account service. How would the agreement acceptance occur ? Maybe the TOS could be interpreted as "being the holder of a canadian SIN, CRA gives you access to My Account". In return for the Canada Revenue Agency (CRA) giving you access to My Account, you agree to abide by the following terms and conditions of use for this and all future uses of My Account: https://www.canada.ca/en/revenue-agency/services/e-services/e-services-individuals/account-individuals/preview-account-terms-conditions-use.html https://www.canada.ca/en/revenue-agency/services/e-services/...
langsoul-com 4y ago
Can't every site do this then? Seems like a good move considering just how big of a target large sites are.
alkonaut 4y ago
I doubt anyone gets fired or fined for making ToS that would never hold up in a court. The opposite seems true though: any legal department will write N things even if half of them aren't enforceable because it doesn't hurt (more than being ridiculed on HN, or by a court). Not sure what would be the best way of getting rid of "legal fluff" though. I imagine it costs quite a lot to society to have to sift through pages of meaningless legal text in order to find important (actually valid) legal statements.
- cjfd 4y ago
  This is the reason I think that for any of those ToS if it turns out that any provision in them is unenforceable it should be that the whole ToS automatically becomes unenforceable.
  - alkonaut 4y ago
    That would be brilliant. Lawyers would have to scour employment contracts, various risk waivers and so on, to try to find the problems. In the end, they'd all fit on post-its because only the most obvious things would be on them.
franciscop 4y ago
I asked my father - a lawyer in Spain - about these kind of terms, and he explained to me that the vast majority of noticeboards that claim no liability are total BS (at least in Spain, and talking about the kind that are on a wall, not signed/agreed ones). I still think it's highly relevant for this case; a contract implies agreement AND benefits for both parties, so if you cannot legally avoid agreeing to this contract it must be invalid. The specific example was a paid garage that claimed no liability for any break-ins, any issue with the cars, etc etc. but he explained that if you are paying for a private parking, there are some expectations to the law and you cannot notice-board out of those. They are mainly a deterrent for people who are unaware of the law or these things, or made by a hapless manager.
- nordsieck 4y ago
  Exactly. In the US, there are a lot of gravel trucks that say something like "Stay back 200 feet. Not responsible for broken windshields" But the truth is: every vehicle on the road is responsible for not dropping stuff on the road. Especially dangerous stuff. Is it difficult in the case of gravel trucks - sure. But that doesn't matter.
2253539242 4y ago
om.07
2253539242 4y ago
I guess Solar powered Game Boy would make for less attractive title.https://www.instagram.com/reel/CnXDxp9pmUk/?igshid=YmMyMTA2M2Y= https://www.instagram.com/reel/CnXDxp9pmUk/?igshid=YmMyMTA2M...
giancarlostoro 4y ago
This will end badly when they do get hacked and people will suffer for it. I get that you don't want to be on the ball for it, but you're better of spending on annual security audits and ensuring any raised concerns are addressed in a reasonable time frame vs getting a few lawyers together to write something that says even if we "somehow" got hacked, we will not be liable we tried not to! Nobody expects to be hacked until it happens.
- BeefWellington 4y ago
  Oftentimes it's not even a hack. Many years ago the national student loan lender in Canada lost a hard drive containing seven years' loan details, leading to a class action suit.[1] [1]: https://www.canada.ca/en/employment-social-development/programs/canada-student-loans-grants/privacy-breach-notice.html https://www.canada.ca/en/employment-social-development/progr...
deleted 4y ago
[deleted]
newsclues 4y ago
This wouldn't be such an issue, but the Canadian government wants to shut down any offices or public interactions with people and force everyone to online services to interact with basic government functions like paying your taxes.

359 points by rinze 4y ago

If you're forced to sign a contract and don't get to negotiate the terms, and it tries to do unusual things like that, it can be... pretty hard to enforce.

tpmx 4y ago

Do government agencies generally have that kind of liability in the first place?

kenned3 4y ago
No, normally the government in Canada can be sued for this sort of thing. not exactly the same thing, but this is a $500,000 class action lawsuit for losing a USB Key containing patient data: https://www.thestar.com/news/gta/2012/05/28/durham_region_health_class_action_lawsuit_puts_price_on_personal_information.html https://www.thestar.com/news/gta/2012/05/28/durham_region_he... The expectation is that the government protect your privacy or pay if they fail to do so.. as with any private data.
- chkaloon 4y ago
  But the government is financed by taxpayers, so the taxpayers will end up being the payers of any fines the government is liable for. It's circular.
  - liketochill 4y ago
    Only if all taxpayers get an equal settlement. And even then perhaps that money would have been spent on another group: “sorry no fighter jets this year money went privacy lawsuits”. So some taxpayers could come out ahead in the event of privacy lawsuits.
    - chkaloon 4y ago
      I didn't say that all taxpayers would come out equivalently. I said taxpayers would pay.
emacsen 4y ago
I am not a lawyer, but if it's provable that your data was stolen, why wouldn't a citizen be able to take an entity to court for what would be reason precautions and protections around their data? If you can show that they didn't have audits, protections against their DB, etc. then I can imagine they'd be as liable as a private entity. But as is mentioned, this is all but demanded of Canadians to use this service, and yet the government is absolving itself of liability.
- Kranar 4y ago
  Due to the principle of sovereign immunity. A government can only be sued if it explicitly has granted permission, otherwise the government is immune from civil action.
  - deleted 4y ago
    [deleted]

kenned3 4y ago

This is so typical of the Canadian government. The effectivly FORCE you to use this site as they try to cut costs and reduce "call in" support. Then, they create a ToS which absolves them of all responsibility if they are hacked? I would be willing to bet that if any Canadian business tried this the government would crack down and state it not permitted. The government has a tendency of "do as i say not as i do". Any Canadian can tell you that for the most part government IT is utter garbage. <cough>arrive-can</cough><cough>Phoenix</cough> ....

mulmen 4y ago
> The government has a tendency of "do as i say not as i do". Well that’s the value proposition of government, right? A monopoly on violence in exchange for a set of rules leading to a stable society.
- int_19h 4y ago
  A set of rules that also applies equally to the government itself is one thing. But "do as I say, not as I do" is not that.
  - mulmen 4y ago
    That’s the “monopoly on violence“. The government isn’t equal. They hold the monopoly on violence, until they get so far out of line that the people take it back. The only open question is how to prevent that from happening.
xattt 4y ago
CRA is almost a separate entity from other federal departments, so it behaves like a private business than a government department. They aren’t even at the behest of the treasury board.
- Kranar 4y ago
  The CRA is its own department, like any other department. It is structured and operates just like any other government department as opposed to a private business. They are not at the behest of the Treasury Board because the Treasury Board is a committee, not an administration or agency. The board has no executive authority whatsoever and exists to give advice to Cabinet rather than to perform or execute a duty. However, the individual members of the Treasury Board do have the ability to order the CRA, principally the Minister of National Revenue, who sits on the Treasury Board, is the executive of the CRA. Perhaps you're thinking of the Bank of Canada, which is an actual corporation and operates in a semi-independent manner from Parliament, although technically Parliament has full oversight and authority over it.

stewx 4y ago

> 10. The Canada Revenue Agency has taken all reasonable steps to ensure the security of this Web site. We have used sophisticated encryption technology and incorporated other procedures to protect your personal information at all times. However, the Internet is a public network and there is the remote possibility of data security violations. In the event of such occurrences, the Canada Revenue Agency is not responsible for any damages you may experience as a result I am not a lawyer, but I would be surprised if this holds water, legally speaking. Imagine going to an amusement park and signing a waiver that the park takes no responsibility for your injuries. If you climb aboard a rollercoaster that hasn't seen any maintenance in 20 years and you get decapitated, I'm pretty sure the park is still legally responsible. Getting someone to sign something that says "we did our due diligence" doesn't make it true.

bee_rider 4y ago
On top of this, I don’t see how a contract that you are compelled to agree to in order to do your taxes could be seen as one that you’ve willingly entered.
- stewx 4y ago
  Using the My Account web site is not required to do your taxes. You can file by mail AND electronically with Netfile without using it at all. Src: https://www.canada.ca/en/revenue-agency/services/e-services/e-services-individuals/netfile-overview/eligibility.html https://www.canada.ca/en/revenue-agency/services/e-services/... That being said, My Account is a useful, albeit very flawed online tool.
theloco 4y ago
[flagged]
- dang 4y ago
  Can you please not post like this to HN? It's not what this site is for, and destroys what it is for. If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.

nayuki 4y ago

Also noteworthy is that compared to leading commercial websites (Amazon, Facebook, etc.), the Canada Revenue Agency website: Responds an order of magnitude slower (like 3000 ms vs. 300 ms), and has maintenance downtime hours (instead of being up 24/7). > However, the Internet is a public network and there is the remote possibility of data security violations. They conveniently ignore the fact that HTTPS is pervasive and that you can reasonably carry private conversations on a public network. And why don't they have a disclaimer for the fact that the telephone network is public and the mail network is public?

bawolff 4y ago
Personally i would rather my tax money be spent elsewhere than latency optimizing a website that i have to use once a year. The maintenance hours thing is unconsiable though. Sometimes i want to know how much tfsa room i have on sunday evening.
- version_five 4y ago
  Rest assured, it will have cost way more than a comparable commercial website. Poor performance is not a cost savings measure.
- tenpies 4y ago
  > Sometimes i want to know how much tfsa room i have on sunday evening Which you wouldn't want to check with the CRA either, because the information is often incomplete and updated annually at best. The CRA even advises that whatever numbers they give you are essentially fugazi, and you should keep your own records because if you make a mistake they will obliterate you with fines. One of the mottos of the Canadian government is: if you make a mistake because we gave you the wrong information, it is still your fault and you will give us money.
  - earleybird 4y ago
    Personal experience, once received a notification from CRA to the effect: "6 months ago we refunded you incorrectly, you owe us, oh by the way we're also charging you a penalty for our mistake.". The amount was not inconsequential but not a problem to remedy. The insult was "we made a mistake and we are punishing you for it".

scohesc 4y ago

This government is so shoddily ran (leaving individual party politics aside) - Canadians aren't holding their government accountable. They're too busy trying to survive inflation and the knock-on effects it continues to cause, while distracting themselves with media that tells them "it's okay" and "it's not that bad" Other boondoggled IT projects brought to you by the Canadian government include the Phoenix federal government paysystem - which coming up on a decade now, some federal employees _still_ aren't getting paid correctly, and the ArriveCan app - which is their hastily created, bug-filled app for pre-entry customs processing checklists that had accessibility problems for the disabled which have likely still been ignored, among other issues. Between this and the very dodgy reactions from government officials (or lack thereof) to the recent news of foreign influence in our politics and elections processes from China, I would say this country has had its core emptied out and replaced with a nougat center of tasty corporate corruption and money laundering goodness. The attitude seems to be "Not enough money to create and maintain a system that respects the privacy of our citizens, but we'll just legalese our responsibility away because we can and we're the government so _there_! We're like a silicon valley company, just try to sue us!" At least we know that tax companies in the states are lobbying to make it harder to file taxes with the US government - the Canadian government just makes it more difficult by themselves! I for one would like our government to be as responsible as possible when it comes to handling our data - ideally having as little of it as possible, only the required amounts to interact with me as minimally as possible - instead of having it all available in a portal that can be easily compromised and hacked judging from previous leaks/breaches in the linked article.

snapplebobapple 4y ago
you should consider donating to the Canadian constitution foundation (https://www.youtube.com/@theCCF https://www.youtube.com/@theCCF) then or something like them because our constitution actually does have a decent protections for separation of power between provinces and the federal government and getting that back to what is actually in the constitutional documents (as opposed to what has been twisted by decades of bad decisions to favor the federal government) would go a long way in creating the kind of competitive multi-polar environment that keeps America strong vs the uni-polar corrupted junk that Canada has increasingly become.

ilrwbwrkhv 4y ago

[flagged]

barbazoo 4y ago
What are you talking about?
- switchbak 4y ago
  Here's someone who has clearly never been to Canada. Canada has lots of problems, yes, but this just smacks of a strongly held yet uninformed opinion. Actually, looking at their comment history they seem to be the champion of edgy one-liner comments. Nothing to see here.

deleted 4y ago

[deleted]

isaacremuant 4y ago

They do the same thing in tenancy documents in some countries. Basically an excuse to have the worst security and not be liable. I don't know if it would hold if actual negligence was shown.

rkagerer 4y ago

If you pay attention to ToS's, you'll find companies are increasingly trying to pull stunts like this. The CRA's terms are objectionable, yet sadly benign compared to other reprehensible terms I've seen gating the web. Lawyers are copying each other's tactics and propogating dark patterns that I doubt will stand the test of litigation (but will cost some poor sap a lot of money and time to get there). Indemnity clauses are another one (no, I'm not going to reimburse you for damage if my account gets hacked through no fault of my own). When I encounter clearly dodgy terms like this I often contact the organization and tell them I do not accept the given clause. Sometimes they say 'stop using our service' (rarely enforced) but most often they simply don't respond. Someone at CRA with authority to fix this might perk up if thousands of Canadians start emailing them about it, report it to MP's, the Privacy Commissioner and other ombudsmen, etc.

slickrick216 4y ago
Yeah like you say this isn’t a new phenomenon. In some cases they even try to shield themselves with legislation. For example let’s look at Ireland. [0] Ireland tries to exclude itself from GDPR https://www.thejournal.ie/data-protection-bill-2018-3853647-Feb2018/ https://www.thejournal.ie/data-protection-bill-2018-3853647-... [1] Entire health system compromised and possibly majority of PHI data exfiltrated https://www.hse.ie/eng/services/publications/conti-cyber-attack-on-the-hse-full-report.pdf https://www.hse.ie/eng/services/publications/conti-cyber-att... [2] Irish health service only begins notifications to confirmed affected individuals a year later https://www.hse.ie/eng/services/news/media/pressrel/hse-begins-national-data-breach-notification-programme.html https://www.hse.ie/eng/services/news/media/pressrel/hse-begi... [3] selective punishment of companies whose data is breached eg google https://techcrunch.com/2022/03/14/dpc-sued-google-rtb-complaint https://techcrunch.com/2022/03/14/dpc-sued-google-rtb-compla... vs meta https://www.dataprotection.ie/en/news-media/data-protection-commission-announces-conclusion-two-inquiries-meta-ireland https://www.dataprotection.ie/en/news-media/data-protection-... Laws unevenly applied make a mockery of justice.
- nickff 4y ago
  Re: [0] My understanding is that member states (and perhaps all sovereigns) are not required to comply with GDPR unless they explicitly choose to.

afrcnc 4y ago

This seems to be a recent change. It wasn't there last year: http://web.archive.org/web/20220418211009/https://www.canada.ca/en/revenue-agency/services/e-services/e-services-individuals/account-individuals/preview-account-terms-conditions-use.html http://web.archive.org/web/20220418211009/https://www.canada...

CKMo 4y ago

Wonder if the IRS will try this soon or if the zero trust architecture they're implementing will come fast enough

matbilodeau 4y ago

1.Sue CRA. 2.Win. 3.??? 4.CRA pays, taxes go up for everyone to make up for it.

matbilodeau 4y ago

Fortunately, contracts in Quebec are dependent of the Civil Code. Terms of service match the definition of a contract. I am eager to see if such practices by any level of government will pass the test of tribunals and current jurisprudence. Excerpts : 1458 Every person has a duty to honour his contractual undertakings. Where he fails in this duty, he is liable for any bodily, moral or material injury he causes to the other contracting party and is bound to make reparation for the injury; neither he nor the other party may in such a case avoid the rules governing contractual liability by opting for rules that would be more favourable to them. https://www.legisquebec.gouv.qc.ca/en/document/cs/CCQ-1991?langCont=fr#se:1458 https://www.legisquebec.gouv.qc.ca/en/document/cs/CCQ-1991?l... 1474 A person may not exclude or limit his liability for material injury caused to another through an intentional or gross fault; a gross fault is a fault which shows gross recklessness, gross carelessness or gross negligence. He may not in any way exclude or limit his liability for bodily or moral injury caused to another. 1475 A notice, whether posted or not, stipulating the exclusion or limitation of the obligation to make reparation for injury resulting from the nonperformance of a contractual obligation has effect, with respect to the creditor, only if the party who invokes the notice proves that the other party was aware of its existence at the time the contract was formed. 1476 A person may not by way of a notice exclude or limit his obligation to make reparation with respect to third persons; such a notice may, however, constitute disclosure of a danger 1477 The assumption of risk by the victim, although it may be considered imprudent having regard to the circumstances, does not entail renunciation of his remedy against the author of the injury. https://www.legisquebec.gouv.qc.ca/en/document/cs/CCQ-1991?langCont=fr#se:1474 https://www.legisquebec.gouv.qc.ca/en/document/cs/CCQ-1991?l...

nickff 4y ago
IANAL... but... I don't think that the CRA is subject to Quebec law, and believe that the CRA may exercise sovereign immunity, though I'm not sure that it has done so in the past.
- matbilodeau 4y ago
  That's where 3149 would come in. Maybe even 3150 if you have "ID theft" insurance. 3149. Québec authorities also have jurisdiction to hear an action based on a consumer contract or a contract of employment if the consumer or worker has his domicile or residence in Québec; the waiver of such jurisdiction by the consumer or worker may not be set up against him. 3150. Québec authorities also have jurisdiction to hear an action based on a contract of insurance where the holder, the insured or the beneficiary of the contract is domiciled or resident in Québec, the contract covers an insurable interest situated in Québec or the loss took place in Québec. https://www.legisquebec.gouv.qc.ca/en/document/cs/CCQ-1991?langCont=en https://www.legisquebec.gouv.qc.ca/en/document/cs/CCQ-1991?l...

dcow 4y ago

Certainly having a government agency able to force you to accept ToS like you'd see in the private sector is absurd since it lets the government skirt its own laws. Feels like a "could the government do that" standard would be a good one to apply to any ToS when figuring out whether it's enforceable. Or maybe this is just more evidence that ToS should be generally and universally ruled unenforceable.

emptybits 4y ago

Canadian here. Thank you for sharing your Terms of Service. I don't agree to them. Thus, I wish to opt out of your Tax Revenue Collection Service. M'kay?

matbilodeau 4y ago
You don't need a computer to file your taxes. Paper kits are provided by CRA and declarations can be submitted on paper by mail. Potential use cases being technology illiteracy, access to reliable internet connections just to name a few . https://www.canada.ca/fr/agence-revenu/services/formulaires-publications/trousses-impot-toutes-annees-imposition/trousse-generale-impot-prestations.html https://www.canada.ca/fr/agence-revenu/services/formulaires-...
- emptybits 4y ago
  I'll go out on a limb here ... tell me if you disagree ... that if you file your taxes on paper, all that personal information will be quickly scanned and available in a database. The database of the site in question. I say this because the My Account service allows a Canadian to check their balance, payments, credits, filing status, etc. It's there for anyone, ready to go, with whatever information the CRA has stocked it with. Your information, even if it started out on paper. It's pretty inconceivable that the CRA could function if the paper filings didn't soon end up in the same database as the e-filings. Anyways, then at that point, your paper personal data is sitting right there behind the login of that same CRA site we're talking about. For your future convenience. Or leaking. Or hacking. And then we're back to ... "in the event of such occurrences, the Canada Revenue Agency is not responsible for any damages you may experience as a result."
  - matbilodeau 4y ago
    I follow you train of thought and I'm wondering where the loophole would be. I mean if you file on paper you don't use the My Account service. How would the agreement acceptance occur ? Maybe the TOS could be interpreted as "being the holder of a canadian SIN, CRA gives you access to My Account". In return for the Canada Revenue Agency (CRA) giving you access to My Account, you agree to abide by the following terms and conditions of use for this and all future uses of My Account: https://www.canada.ca/en/revenue-agency/services/e-services/e-services-individuals/account-individuals/preview-account-terms-conditions-use.html https://www.canada.ca/en/revenue-agency/services/e-services/...

langsoul-com 4y ago

Can't every site do this then? Seems like a good move considering just how big of a target large sites are.

alkonaut 4y ago

I doubt anyone gets fired or fined for making ToS that would never hold up in a court. The opposite seems true though: any legal department will write N things even if half of them aren't enforceable because it doesn't hurt (more than being ridiculed on HN, or by a court). Not sure what would be the best way of getting rid of "legal fluff" though. I imagine it costs quite a lot to society to have to sift through pages of meaningless legal text in order to find important (actually valid) legal statements.

cjfd 4y ago
This is the reason I think that for any of those ToS if it turns out that any provision in them is unenforceable it should be that the whole ToS automatically becomes unenforceable.
- alkonaut 4y ago
  That would be brilliant. Lawyers would have to scour employment contracts, various risk waivers and so on, to try to find the problems. In the end, they'd all fit on post-its because only the most obvious things would be on them.

franciscop 4y ago

I asked my father - a lawyer in Spain - about these kind of terms, and he explained to me that the vast majority of noticeboards that claim no liability are total BS (at least in Spain, and talking about the kind that are on a wall, not signed/agreed ones). I still think it's highly relevant for this case; a contract implies agreement AND benefits for both parties, so if you cannot legally avoid agreeing to this contract it must be invalid. The specific example was a paid garage that claimed no liability for any break-ins, any issue with the cars, etc etc. but he explained that if you are paying for a private parking, there are some expectations to the law and you cannot notice-board out of those. They are mainly a deterrent for people who are unaware of the law or these things, or made by a hapless manager.

nordsieck 4y ago
Exactly. In the US, there are a lot of gravel trucks that say something like "Stay back 200 feet. Not responsible for broken windshields" But the truth is: every vehicle on the road is responsible for not dropping stuff on the road. Especially dangerous stuff. Is it difficult in the case of gravel trucks - sure. But that doesn't matter.

2253539242 4y ago

om.07

2253539242 4y ago

I guess Solar powered Game Boy would make for less attractive title.https://www.instagram.com/reel/CnXDxp9pmUk/?igshid=YmMyMTA2M2Y= https://www.instagram.com/reel/CnXDxp9pmUk/?igshid=YmMyMTA2M...

giancarlostoro 4y ago

This will end badly when they do get hacked and people will suffer for it. I get that you don't want to be on the ball for it, but you're better of spending on annual security audits and ensuring any raised concerns are addressed in a reasonable time frame vs getting a few lawyers together to write something that says even if we "somehow" got hacked, we will not be liable we tried not to! Nobody expects to be hacked until it happens.

BeefWellington 4y ago
Oftentimes it's not even a hack. Many years ago the national student loan lender in Canada lost a hard drive containing seven years' loan details, leading to a class action suit.[1] [1]: https://www.canada.ca/en/employment-social-development/programs/canada-student-loans-grants/privacy-breach-notice.html https://www.canada.ca/en/employment-social-development/progr...

deleted 4y ago

[deleted]

newsclues 4y ago

This wouldn't be such an issue, but the Canadian government wants to shut down any offices or public interactions with people and force everyone to online services to interact with basic government functions like paying your taxes.