Privacy Impact Assessment Summary: Use of Computer Analytics in IRCC Programs – India Temporary Resident Visa (Visitor) Annexes

A PIA was previously completed on the Use of Computer Analytics in IRCC Programs, specifically in processing Temporary Resident Visa (TRV) e-applications from China. After the implementation of computer analytics in China, a second implementation in India necessitated a review of privacy risks.

There are no significant differences between the processing of China TRV e-applications and India TRV e-applications. The legislative and regulatory authorities are identical, as are the manner in which an individual submits their e-application and how IRCC processes the application. Therefore, there were no updates required for the body of the PIA. The updates that were required pertained to some annexes so that India-specific information could be analyzed for privacy risks. Specifically, six annexes were updated, which included a review of the rules, information used to create the rules, variables used for triaging, results of the pilot, and the bin assignments.

Four risks to privacy were identified, all of which have either been mitigated or are in the process of being mitigated. The risks were around safeguards of certain information being stored in IRCC’s case management system, governance of how IRCC manages computer analytics projects, and the addition of data in the computer analytics pilot. The residual risk to privacy is considered low.

As is the case for the use of computer analytics in the TRV e-applications from China, Part 4.1 of the Immigration Refugee Protection Act provides explicit authority to use electronic means to support decision-making, and the computer analytics system only uses personal information from the application form and IRCC’s other existing systems. There is no new collection or disclosure of personal information.

Privacy risks remain a central consideration as IRCC expands its use of analytics in the future.

For more information on the disclosure, collection, use, retention and disposition of personal information in relation to these Annexes, please refer to Personal Information Bank: Migration Control and Security Management (PPU 068).