Privacy Impact Reports 2019 to 2020

Canada’s Volunteer Awards Program (April 2019)

Description of program

Employment and Social Development Canada’s (ESDC) Canada’s Volunteer Awards (CVA) annually recognizes the significant contributions of individual volunteers, groups of volunteers, not-for-profit organizations, and socially responsible businesses across Canada in helping communities. The program highlights best practices in community leadership, and encourages partnerships across sectors.

The CVA annual Call for Nominations requires that personal information be collected from a number of stakeholders (nominators, nominees, authors of letters of support, Regional Reviewers and National Advisory Committee members) in order to be used as part of a decision-making process nominating award recipients.

Why a Privacy Impact Assessment (PIA) was completed

This PIA was completed because ESDC will be collecting and using personal information from various stakeholders as part of a decision-making process directly affecting individuals.

The assessment examines the privacy-related risks due to the use of recipients’ personal information, and proposes methods to lower these risks.

More Information

This PIA focused on ESDC’s collection and use of various stakeholders’ personal information as part of a decision-making process directly affecting individuals.

The PIA identified 1 low, 2 medium and no high risks. The mitigation strategies for these risks were scheduled for completion by the end of the 2018 to 2019 fiscal years.

If you would like more information about this PIA, please contact:

Employment and Social Development Canada
Corporate Secretariat / Privacy Management Division
Phase IV 12 Floor mailstop 1203
140 Promenade du Portage
Gatineau QC  K1A 0J9
Email: EDSC.SM.ViePrivee-Privacy.CS.ESDC@hrsdc-rhdcc.gc.ca
Tel.: 1-800-O-Canada
Teletypewriter: 1-800-926-9105

MyAlberta Digital Identity Pilot (April 2019)

Description of program

The MyAlberta Digital Identity (MADI) Pilot will give Alberta residents the opportunity to streamline their access to their My Service Canada Account (MSCA) by using their provincially approved identity-bound credential (in other words, MADI) referred to as a Trusted Digital Identity (TDI).

Why a Privacy Impact Assessment (PIA) was completed

A PIA was completed because of the following changes:

1. MADI introduces a new technology to Employment and Social Development Canada (ESDC) in the sense that it is the first TDI option used to access MSCA
2. the use of MADI involves the indirect collection of personal information by ESDC from Service Alberta

More information

This PIA focused on the identification of the privacy risks related to the handling of personal information during the Registration and Authentication process a user has to go through prior to accessing MSCA using MADI.

The PIA identified 3 low and 4 medium risks. The mitigation strategy to address these risks is documented in the PIA.

If you would like more information about this PIA, please contact:

Employment and Social Development Canada
Corporate Secretariat / Privacy Management Division
Phase IV 12 Floor mailstop 1203
140 Promenade du Portage
Gatineau QC  K1A 0J9
Email: EDSC.SM.ViePrivee-Privacy.CS.ESDC@hrsdc-rhdcc.gc.ca
Tel.: 1-800-O-Canada
Teletypewriter: 1-800-926-9105

Disclosure of information collected under the Old Age Security Act to the province of Newfoundland and Labrador for the administration of the 65 Plus Plan (May 2019)

Description of program

The 65 Plus Plan provides seniors living in Newfoundland and Labrador who receive the Old Age Security (OAS) and Guaranteed Income Supplement (GIS) seamless access to eligible prescription medications at a reduced cost. It is 1 of the 4 plans under the Newfoundland and Labrador Prescription Drug program created under the provincial Pharmaceutical Services Act.

Why a Privacy Impact Assessment (PIA) was completed

This PIA was completed as personal information of OAS/GIS recipients is disclosed for an administrative purpose.

The assessment examines the privacy-related risks due to the disclosure of recipients’ personal information and proposes methods to lower these risks.

More information

This PIA focused on ESDC’s disclosure of OAS/GIS recipients’ personal information to the Newfoundland and Labrador Department of Health and Community Services for the administration of the 65 Plus Plan.

The PIA identified 6 medium risks and no high risks. The mitigation strategies to address these risks are scheduled for completion by December 2020.

If you would like more information about this PIA, please contact:

Employment and Social Development Canada
Corporate Secretariat / Privacy Management Division
Phase IV 12 Floor mailstop 1203
140 Promenade du Portage
Gatineau QC  K1A 0J9
Email: EDSC.SM.ViePrivee-Privacy.CS.ESDC@hrsdc-rhdcc.gc.ca
Tel.: 1-800-O-Canada
Teletypewriter: 1-800-926-9105

Exchange of personal information between Employment and Social Development Canada, Nova Scotia Department of Community Services and Service Nova Scotia (May 2019)

Description of program

Employment and Social Development Canada (ESDC) and the Nova Scotia Department of Community Services (DCS) consolidated several Information Sharing Agreements (ISA) into an umbrella ISA in order for the Nova Scotia DCS to administer their Income Assistance (IA) and Disability Support Program (DSP).

In addition, an ISA was negotiated between ESDC and Service Nova Scotia (SNS) to allow for the administration of their Property Tax Rebate for Seniors (PTRS) and Heating Assistance Rebate Program (HARP).

Why a Privacy Impact Assessment (PIA) was completed

A PIA was completed as Nova Scotia will be using personal information as part of a decision-making process that directly affects individuals living in Nova Scotia who are eligible for programs administered by the DCS and SNS, and to ensure that personal information is appropriately managed.

The PIA examined the privacy risks associated with the exchange of information between ESDC and the province of Nova Scotia, and proposed methods to lower these risks.

More information

The PIA assessed the ISAs and the mode of transmission used for the exchange, collection and use of Canada Pension Plan (CPP) and Old Age Security (OAS)/Guaranteed Income Supplement (GIS) information for the administration of the Nova Scotia programs, as well as the processes relevant to these exchanges. The assessment did not take into consideration the initial collection of personal information by ESDC for the administration of the Canada Pension Plan (CPP) and Old Age Security (OAS) program.

The PIA identified 2 low and 5 medium risks, and a mitigation action plan has been developed and is in progress.

If you would like more information about this PIA, please contact:

Employment and Social Development Canada
Corporate Secretariat / Privacy Management Division
Phase IV 12 Floor mailstop 1203
140 Promenade du Portage
Gatineau QC  K1A 0J9
Email: EDSC.SM.ViePrivee-Privacy.CS.ESDC@hrsdc-rhdcc.gc.ca
Tel.: 1-800-O-Canada
Teletypewriter: 1-800-926-9105

Job Bank (May 2019)

Description of program

Job Bank is delivered by Employment and Social Development Canada (ESDC) on behalf of the Canada Employment Insurance Commission (CEIC) as part of the National Employment Service pursuant to the Employment Insurance Act. It is a free and bilingual job website which allows job seekers to search for available job opportunities and for employers to find qualified candidates. Job Bank also provides labour market information to help users make informed education, career and labour market related decisions.

Job Bank collects information from job seekers such as their email address and details about their education and work experience in order to match them to suitable job postings and to help them with their job search. Job Bank also collects business information from employers and their employees in order to confirm that they are authorized representatives of genuine business entities and to enable them to post their job opportunities.

Why a Privacy Impact Assessment (PIA) was completed

This PIA was completed because ESDC is collecting and using personal information from various users as part of a decision-making process directly affecting individuals and because substantial modifications have been made to Job Bank since 2015.

The assessment examines the privacy-related risks due to the handling of personal information and proposes methods to lower these risks.

More information

This PIA focused on ESDC’s collection and use of various users’ personal information as part of a decision-making process directly affecting individuals.

The PIA identified 4 low, 1 medium and no high risks. The mitigation strategies for these risks were scheduled for completion by the end of the 2018 to 2019 fiscal years.

If you would like more information about this PIA, please contact:

Employment and Social Development Canada
Corporate Secretariat / Privacy Management Division
Phase IV 12 Floor mailstop 1203
140 Promenade du Portage
Gatineau QC  K1A 0J9
Email: EDSC.SM.ViePrivee-Privacy.CS.ESDC@hrsdc-rhdcc.gc.ca
Tel.: 1-800-O-Canada
Teletypewriter: 1-800-926-9105

Canada Student Loans and Grants Program (CSLP) – June 2019 Release (June 2019)

Description of program

The Department of Employment and Social Development Canada (ESDC), in partnership with the provinces and territories, plays a central role in providing student financial assistance (SFA) to students in financial need to ensure equal access to post-secondary education across Canada. CSLP is part of the services and programs that compose the SFA.

Why a Privacy Analysis was completed

This Privacy Analysis was completed to identify the privacy risks related to the substantial modification of the program’s loan management system and the changes to the contractual relationship between CSLP and its service provider.

The assessment examines the privacy risks and associated mitigations related to the management and protection of personal information because of the program’s new electronic service delivery model. Specifically, it assessed the privacy implications of the new delivery model’s June 2019 release.

More information

This Privacy Analysis assessed the collection, use and disclosure of personal information for the purposes of the June 2019 release, which encompasses front-end improvements for new clients and allows existing clients to access an improved online platform.

The PIA identified 2 medium level risks. The mitigation strategies to address these risks were scheduled for completion by the end of the 2020 to 2021 fiscal year.

If you would like more information about this PIA, please contact:

Employment and Social Development Canada
Corporate Secretariat / Privacy Management Division
Phase IV 12 Floor mailstop 1203
140 Promenade du Portage
Gatineau QC  K1A 0J9
Email: EDSC.SM.ViePrivee-Privacy.CS.ESDC@hrsdc-rhdcc.gc.ca
Tel.: 1-800-O-Canada
Teletypewriter: 1-800-926-9105

DARS Replacement Project (July 2019)

Description of program

Employment and Social Development Canada (ESDC) collaborates closely with the Canada Revenue Agency (CRA) on the collection of debts owing to the Crown across a number of ESDC statutory programs. This relationship is codified in the form of a 2005 Order in Council which formally transfers debt collection activities for specific programs (Canada Pension Plan, Old Age Security, Canada Student Loans Program, Canada Education Savings Program and Canada Student Financial Assistance Program) to CRA. For a number of other ESDC Programs CRA collects debts on behalf of ESDC via agreement.

In either case, CRA officials access an ESDC IT solution to manage the work. The current departmental accounting system, the Departmental Accounts Receivable System (DARS) is being replaced by an SAP based solution called the Public Sector Collections and Disbursements (PSCD) module.

This PIA examines the impacts on the management of personal information related to the implementation of the PSCD solution, focusing on how ESDC manages personal information for the purposes of ESDC debt management.

Why a Privacy Impact Assessment (PIA) was completed

This PIA was initiated consistent with criteria listed in TB Directive on Privacy Impact Assessment Section 6.3.1:

• substantial modifications to the system ESDC and CRA use to manage the collection of outstanding ESDC debts to the Crown

More Information

The assessment examines the privacy risks and associated mitigations related to the management and protection of personal information related to new business processes associated with the PSCD module of SAP developed for the financial management and collections activities of specific ESDC debts due to the Crown. Both CRA and ESDC will use PSCD as it relates to their respective roles and responsibilities set out in legislation, policies, and agreements.

The PIA identified 6 medium risks, 2 low risks, as well as 3 compliance issues. The mitigation strategies to address these risks are scheduled for completion by early in the 2020 to 2021 fiscal year.

If you would like more information about this PIA, please contact:

Employment and Social Development Canada
Corporate Secretariat / Privacy Management Division
Phase IV 12 Floor mailstop 1203
140 Promenade du Portage
Gatineau QC  K1A 0J9
Email: EDSC.SM.ViePrivee-Privacy.CS.ESDC@hrsdc-rhdcc.gc.ca
Tel.: 1-800-O-Canada
Teletypewriter: 1-800-926-9105

Canada Pension Plan Disability Medical Adjudication Quality Assurance Program (Phase 1) (September 2019)

Description of program

The Canada Pension Plan Disability (CPPD) program provides partial income replacement for eligible individuals. Medical Adjudicators (MA) assess CPPD applications to determine eligibility to the program. The CPPD Medical Adjudication Quality Assurance (MA QA) program was developed to ensure that a robust quality assurance framework for medical adjudication decisions is being followed. The quality of decision-making will be assessed in terms of consistency in following procedures and the accuracy of the decisions made. The MA QA program will be implemented in 2 phases.

Why a Privacy Impact Assessment (PIA) was completed

This PIA was completed to assess the privacy implications of the activities of the CPPD MA QA program which involves the creation of a new database containing personal information. The new database will allow national headquarters to assess the quality and consistency of the medical adjudication process and decisions taken.

The PIA examines the privacy risks associated with the implementation of the Phase 1 of the CPPD MA QA program regarding the use and handling of personal information, the system that will be used, and proposes methods to mitigate these risks.

More information

This PIA focused on ESDC’s collection, use, disclosure and disposal of personal information in keeping with the requirements of the Privacy Act and the Department of Employment and Social Development Act.

The PIA identified 2 medium, 2 low and no high risks. The mitigation strategies for those risks are scheduled for completion by the end of 2019 to 2020 fiscal year.

If you would like more information about this PIA, please contact:

Employment and Social Development Canada
Corporate Secretariat / Privacy Management Division
Phase IV 12 Floor mailstop 1203
140 Promenade du Portage
Gatineau QC  K1A 0J9
Email: EDSC.SM.ViePrivee-Privacy.CS.ESDC@hrsdc-rhdcc.gc.ca
Tel.: 1-800-O-Canada
Teletypewriter: 1-800-926-9105

Rogers Virtual Contact Centre Privacy Analysis for IT Solutions (November 2019)

Description of Program/Activity

Employment and Social Development Canada’s (ESDC) Canada Education Savings Program and the Canada Student Loan Program Contact Centres will be switching technologies to Rogers Virtual Contact Centre because the existing system is no longer able to provide the flexibility and scalability to meet current and future business needs.

Why a Privacy Analysis for IT Solutions was completed

A Privacy Analysis for IT Solutions provides a high-level privacy analysis for enterprise solutions/systems/applications at the design, procurement or acquisition phases. This Privacy Analysis for IT Solutions was completed to document the fact that the protection of personal information was considered in the design of the solution or application in this initiative.

More Information

This Privacy Analysis for IT Solutions focused on the initial migration of the Canada Education Savings Program and the Canada Student Loan Program Contact Centres to Rogers Virtual Contact Centre. Functionalities will include call routing, interactive voice response, real-time and historical reporting of call volumes.

Privacy Management Division has not identified any risks or issues associated with the handling or protection of personal information for the use of Rogers Virtual Contact Centre for the Canada Education Savings Program or the Canada Student Loan Program.

If you would like more information about this PIA, please contact:

Employment and Social Development Canada
Corporate Secretariat / Privacy Management Division
140 Promenade du Portage
Phase IV, 12th Floor, mailstop 1203
Gatineau, Quebec K1A 0J9
Email: EDSC.SM.ViePrivee-Privacy.CS.ESDC@hrsdc-rhdcc.gc.ca
Tel.: 1-800-O-Canada
Teletypewriter: 1-800-926-9105

Biometrics Expansion Project: Service Canada In-Canada Biometrics Collection Services for the Department of Immigration, Refugees and Citizenship Canada (IRCC)

Description of Program/Activity

The department of Immigration, Refugees and Citizenship Canada (IRCC) began collecting biometric information (digital photograph and fingerprints) from select nationals in 2013, under the Temporary Resident Biometrics Project (TRBP). Following the success of the TRBP, the Biometrics Expansion Project was initiated to expand the biometric requirement to all temporary resident visa, work or study permit, and temporary resident permit applicants (excluding US nationals) and to all permanent resident (PR) applicants. By expanding biometrics collection, IRCC and its partners aim to increase the safety and security of Canadians, maintain the integrity of Canada’s immigration system, facilitate travel for bona fide visitors, and increase confidence in Canada’s immigration program.

IRCC is the lead department in managing the Biometrics Expansion Project in collaboration with its primary delivery partners: Canada Border Services Agency (CBSA), Royal Canadian Mounted Police (RCMP) and Shared Services Canada (SSC). One of the core mandates of the Biometrics Expansion Project is the delivery of an In-Canada Biometrics Collection service, a support service that will be delivered to IRCC’s by Service Canada (SC). SC will provide the service through its existing network of SC Centres and Passport (PPT) offices. The In-Canada Biometric Collection Service will include approximately 109 primary collections kits in 58 locations across Canada (exact numbers may change after launch).

This PIA covers the activities carried out by SC for the delivery of the In-Canada Biometrics Collection support service. This includes the collection and transmission of IRCC client’s biometric and biographic data, via IRCC’s Biometric Collection Solution (BCS). To enable a timely launch, currently scheduled for December 3rd, 2019, an Interim solution for the collection of biographic/biometrics information was adopted to mitigate network integration risks that would have delayed the project. The Interim solution will utilize a new independent ESDC computer for Biometric collection workstations. This computer will be connected directly to IRCC on a parallel network in order to transmit the data.

Why was a Privacy Impact Assessment (PIA) completed?

This PIA was completed to identify the privacy risks associated mitigations related to the Biometrics Expansion Project: Service Canada In-Canada Biometrics Support Collection Services for the Department of Immigration, Refugees and Citizenship Canada (IRCC).

Consistent with section 6.3.1 of the Treasury Board Directive on Privacy Impact Assessment (PIA), a PIA needs to be completed by ESDC for its part in the In-Canada Biometrics Support Collection Service. This is necessary because sensitive personal information (including both biographic and Biometric information such as fingerprints and a digital photograph) will be collected, handled by SC, and disclosed by SC to IRCC, as part of an administrative decision-making process by IRCC.

More Information

This PIA is only pertinent to the Interim Solution and focused on the collection of IRCC’s client biometric information: fingerprints, digital photograph and associated biographical data; the transmission of that information to IRCC; and the purging process of biometric and associated biographic data in ESDC’s control.

This PIA is about ESDC/SC’s service delivery activity in relation to the In-Canada Biometrics Collection Service only. The use, disclosure, and storage of the personal information, once transmitted to IRCC and/or other partners is IRCC’s responsibility; any related privacy assessments are being undertaken and coordinated by IRCC as part of the Biometrics Expansion Project.

The PIA identified 3 risks; one 1 low risk, two (2) medium risks, as well as one Compliance Issue. The mitigation strategies to address these risks were scheduled for completion by the end of the 2019 to 2020 fiscal year.

If you would like more information about this PIA, please contact:

Employment and Social Development Canada
Corporate Secretariat / Privacy Management Division
140 Promenade du Portage
Phase IV, 12th Floor, mailstop 1203
Gatineau, Quebec K1A 0J9
Email: EDSC.SM.ViePrivee-Privacy.CS.ESDC@hrsdc-rhdcc.gc.ca
Tel.: 1-800-O-Canada
Teletypewriter: 1-800-926-9105

Receipt of Entry-Exit Data from the Canada Border Services Agency by the Employment Insurance Program (December 2019)

Description of Program

The Employment Insurance (EI) Program provides support to partially replace lost employment income for eligible unemployed contributors to the program. Service Canada’s Integrity Services Branch (ISB Integrity Operations) is responsible for investigating fraud and abuse of the EI Program. In part, those responsibilities require information from the Canada Border Services Agency (CBSA) to validate that EI claimants have properly self-reported any absences from Canada.

The manner in which the CBSA collects and discloses exit and entry information to or from Canada is changing. Historically, Customs Declaration Cards (Form E311) have been used by the CBSA and data from those cards provided to ESDC to identify EI claimants who may have been absent from Canada while receiving EI benefits. The CBSA has now introduced an electronic Entry-Exit system, which will collect exit information from airlines and the U.S. Customs and Border Protection, while also collecting entry information when a traveller returns to Canada.

Why was a Privacy Impact Assessment (PIA) completed?

This PIA was completed to identify the privacy risks associated with the collection of Entry-Exit data from the CBSA in accordance with s. 107(5)(i) of the Customs Act, which authorizes the disclosure of traveller information for the administration and enforcement of the Employment Insurance Program and the Old Age Security Program. The change was assessed by ESDC and determined to be a substantial modification to the EI Program and, pursuant to s. 6.3.9 of the Directive on Privacy Impact Assessment, a PIA was therefore required.

The assessment examines the privacy risks and associated mitigations related to the management and protection of personal information in the receipt, data matching, and investigation assignment of Entry-Exit data.

More Information

This PIA focuses on the receipt and use of the Entry-Exit data file and the manner in which the personal information is used to identify investigation observations to load into ISB Integrity Operations’ case management system; the National Integrity Investigation System (NIIS).

The PIA identified 3 risks; 1 low, and 2 medium-level risks. The mitigation strategies to address these risks were scheduled for completion by the end of the 2020 to 2021 fiscal year.

If you would like more information about this PIA please contact:

Employment and Social Development Canada
Corporate Secretariat / Privacy Management Division
140 Promenade du Portage, Phase IV, 12th Floor
Gatineau, Quebec K1A 0J9
Email: EDSC.SM.ViePrivee-Privacy.CS.ESDC@hrsdc-rhdcc.gc.ca
Tel.: 1-800-O-Canada
Teletypewriter: 1-800-926-9105

Non-ESDC Saba Cloud Integrated Learning Management System for Government of Northwest Territories Employees (February 2020)

Description of Program

Employment and Social Development Canada’s (ESDC) Service Canada Centres provide an access point to many Government of Canada programs. Through a service delivery partnership, the Government of the Northwest Territories (GNWT) provides services on behalf of Service Canada to remote locations. In order for GNWT employees to provide this service delivery, they must first complete the required training on programs and services, privacy and security.

Why a Privacy Analysis was completed

This Privacy Analysis was completed to identify the privacy risks related to the tracking and administration of training specific to these GNWT employees and recommends strategies to mitigate those risks.

More Information

This Privacy Analysis identifies the privacy risks associated with using a web-based Cloud Learning Management System (LMS) operated by Saba Software. Service Canada administers and tracks the GNWT employee’s training plan via the Saba Cloud LMS.

This Privacy Analysis identified 1 medium and 4 low level risks. The mitigation strategies to address these risks were scheduled for completion by April 2020.

If you would like more information about this PIA, please contact:

Employment and Social Development Canada
Corporate Secretariat / Privacy Management Division
140 Promenade du Portage
Phase IV, 12th Floor, mailstop 1203
Gatineau, Quebec K1A 0J9
Email: EDSC.SM.ViePrivee-Privacy.CS.ESDC@hrsdc-rhdcc.gc.ca
Tel.: 1-800-O-Canada
Teletypewriter: 1-800-926-9105