I have a very slight difference of reading of the above but it still boils down to the same thing: it would be very stupid to make any misrepresentation (including an omission of relevant information) about the contents of your tax returns.
The very slight minor difference is that I think the part I bolded is important, that the relevant act of parliament or regulation must authorize the disclosure - and probably explicitly.
But: I strongly suspect that even if the disclosure could be confirmed without 'disclosure' (i.e. sharing the full contents) by a simple mechanism - IRCC clients sign various documents permitting confirmation of the data included, and I believe the relevant regs and acts of parliament would permit at any rate confirmation of information attested to by the client.
Anyone who had a very specific interest and was prepared to pay a lawyer to give them more detail could look more into this, of course; and it probably has come up in case law/immigration decisions.
But it would be very naive indeed to believe that if one has interactions with IRCC in which one provides information where CRA information (such as tax returns or key information from them) is relevant, that government is not able to confirm them, and that any substantive misrepresentation would not lead to potentially serious consequences.
I'm a bit too lazy to look up more details and legal framework of privacy protections because I don't think relevant in the vast majority of cases; like I said, I think it would be just plain obtuse to operate under any other assumption. (And whether IRCC staff have direct access to full returns or the procedures by which they do so or whether they just have ability to confirm key information is a distinction that really won't matter to most)