Global Visa Application Centre Network

Since 2000, Visa Application Centres (VACs) have helped Visa Offices (VOs) provide administrative support to visa and immigration applications across the globe. Currently, Citizenship and Immigration Canada (CIC) has 60 VACs located in 41 countries in which all of the agreements in place—with a few exceptions—are locally managed through Service Agreements (SA) with corresponding VOs.

Until the Global VAC Network, expansion of VACs was limited to where there was access to service providers and where volumes in applications would justify opening a VAC. Through a Global VAC Network however, CIC will be able to open VACs in areas that were previously out of reach and offer standardized services in both high- and low- volume areas. This will ensure consistency in service across international regions, in particular as CIC moves towards implementing biometrics in 2013.

In 2011, the former Service Innovation Office (SIO) presented a Privacy Impact Assessment (PIA) to the Office of the Privacy Commissioner (OPC) on three Mexico VACs. The report’s objectives were to address the privacy risks associated with the establishment of a centrally managed service arrangement. A PIA was also conducted in 2003 for the New Delhi VAC, which assessed the impacts of the use of a Service Provider that would perform a number of functions on behalf of applicants as well as facilitate the distribution of information to a Mission.

The India and Mexico PIAs served as foundational documents which set the groundwork for the Global VAC Network Request for Proposal (Global VAC RFP), which is the subject of this PIA. A privacy risk cross-reference analysis has been conducted to assess whether the risks identified in the preceding PIAs have been mitigated or addressed through the Global VAC Network RFP.

This Report is the first of three PIAs to be conducted on the Global VAC Network within CIC. While the complete assessment of the Global VAC Network will be done in three Phases, the objectives of this Report are to evaluate the privacy measures included in the RFP for the Global VAC Network—published on January 31, 2012—as well as to provide recommendations to address the privacy risks associated with the Global VAC RFP. In an effort to build privacy considerations into the RFP, extensive consultations were conducted to establish overall privacy protection measures to identify key provisions to enable privacy protection practices from bidders. Phase 2 of the Global VAC PIA will assess the Privacy Management Plans (PMPs) provided by the winning bidders post contract-award to specifically evaluate the contractor’s privacy protection strategies. Phase 3 will assess the country-specific annexes to the PMPs provided for each country in the contractor’s awarded region and will assess any additional privacy considerations as a result of the biometric solution implementation. All three Reports will assess the privacy impact of using VACs for the Temporary Resident (TR) line of business.

In this report, a number of privacy risks associated to CIC’s Global VAC Network were identified as well as their respective mitigation mechanisms. Only one high-level risk was identified relating to the privacy and security of personal information collected in foreign jurisdictions. As a result of this risk, privacy requirements/clauses were built into the RFP as per Treasury Board Secretariat (TBS) guidelines and following recommendations of the Office of the Privacy Commissioner (OPC). In addition, Performance Management Plans will be required from all vendors which will be evaluated by CIC prior to deployment. This Report also identifies privacy risks associated with the principles of Safeguard, Accuracy, and Retention as well as provides various mitigation mechanisms that are/will be employed to address each risk, such as developing a Privacy Risk Assessment tool, designing privacy-friendly-procedures, and implementing appropriate audit measures. The status of these risks and the mitigation strategies discussed within this report will be updated in phases 2 and 3 of the Global VAC.

Features