Privacy Impact Assessment (PIA) Summary: International Student Program – Letter of Acceptance (LOA) Verification Tool

Lead Government Institution

Immigration, Refugees and Citizenship Canada (IRCC)

Name of the Program/Activity

International Student Program – Letter of Acceptance (LOA) Verification Tool

Legal Authority

The legal authority for the International Student Program (ISP) is identified in section 30 of the Immigration and Refugee Protection Act (IRPA), which states:

• 30(1) A foreign national may not work or study in Canada unless authorized to do so under this Act.
• An officer may, on application, authorize a foreign national to work or study in Canada if the foreign national meets the conditions set out in the regulations.

Examination activities in support of the ISP are established in sections 15-16, 32(d), and 32(d.1)-(d.3) of IRPA.

• 15-16 authorize IRCC to collect personal information from a foreign national who makes a study permit application.
• 30, 32(d), 32(d.1)-(d.3) provide the authorities for the international student program, conditions that may be imposed for the purpose of study, and the verification of documents.

Various sections of the Immigration and Refugee Protection Regulations (IRPR) support the activities of IRCC in the processing of study permit applications and the decision-making process; see sections 210-216, 219 and 220.1, 220.1(4).

• 210-216 outline the requirements for the issuance of study permits, which includes that the foreign national be accepted at a designated learning institution (216(1)(e)), for which the documentary evidence is a valid Letter of Acceptance.
• 219 and 220.1 set out the specific requirements around studying at a designated learning institution, including that “a study permit shall not be issued to a foreign national unless they have written documentation from the designated learning institution where they intend to study that states that they have been accepted to study there” (219(1)).
• 220.1(4) also provides authority for officers to request evidence that the study permit holder will enroll at a designated learning institution if the officer has reason to believe that the permit holder is not complying or has not complied with one or more of the conditions of their study permit, or as part of a random assessment of the overall level of compliance with conditions by study permit holder.

Disclosure of personal information contained on letters of acceptance to designated learning institutions for the purpose of verification is authorized pursuant to sub-sections 8(1) and 8(2)(a) of the Privacy Act.

• 8(1) and 8(2)(a) provide respectively for disclosure of personal information under the control of a government institution on consent of the individual as well as for the purpose for which the information was obtained or for a use consistent with that purpose.

Description of the program or activity

This Privacy Impact Assessment (PIA) serves as a follow-up to the 2014 PIA on the International Student Program (ISP), and will focus on the shift from case-by-case to systematic sharing of personal information with all post-secondary designated learning institutions (DLIs), including sharing through the portal, and for applications submitted via online and paper channels.

As Canada becomes a more popular choice for international students, the frequency of sophisticated scams involving fraudulent documents is apparent. The ISP has become a target of these fraud cases, having IRCC, the media and other organization discovering trends of fraudulent letters of acceptance (LOAs).

LOA fraud is a significant issue that increases application complexity, adds to the resources that must be invested in decision making, and may lead to non-genuine students obtaining study permits on the basis of fraudulent documents. It has also led to genuine students, targets of unscrupulous actors abroad, coming to Canada with fraudulent LOAs unbeknownst to them and facing hardships, vulnerability and uncertain immigration status as a result.

In an effort to avoid disingenuous applications, mandatory upfront LOA verification will help strengthen Canada’s ISP and better protect genuine students from fraud. LOA verification is only one example of the verification that the Department regularly does in the processing of all immigration applications regardless of business line. To help ensure the integrity of Canada’s immigration system, officials routinely validate a variety of documentation that has been provided by applicants with third parties, for example bank documents, language test results, and proof of employment.

As of December 1, 2023, all post-secondary DLIs will be required to verify LOAs submitted with study permit applications from outside Canada. IRCC has sent emails directly to “primary users” in each DLI, which have been identified using an existing list of DLI primary users for IRCC compliance reporting purposes, as well as new users. The primary user of the validation tool is the “super user” for that DLI. This primary user list is updated by IRCC based on information from Provinces and Territories on an ad-hoc basis. There is also a new process in place for applications submitted via online and paper channels. This initiative triggers the need for a new or modified PIA because the program is shifting from case-by case to systematic information sharing with DLIs to verify the LOAs of international student applicants. It involves changes to existing technology to support DLIs verifying the LOA through an existing portal. The information exchange is used in support of the administrative decision about accepting or rejecting international student applicants.

Personal Information Banks

• International Students (PPU 051)

Summary of Risk Identification and Categorization

Below is the risk identification and categorization table corresponding to this initiative.

Summary of Risks and Mitigation Strategies

This PIA identified several risks concerning: an outdated personal information bank (PIB), unclear language and missing Government of Canada requirements in the consent statement, IRCC and DLIs adhering to the retention and disposition standards, improper disclosure to the wrong DLI, unauthorized access of client personal information, lack of information sharing agreements (ISAs) between DLIs and IRCC, and unauthorized access to the IRCC portal. Mitigation strategies include: updating the PIB to include UCI and DLI user information, reviewing forms and updating them to meet requirements, conducting usability testing and client surveys to make sure the product meets client needs, implementing detailed guidance on retention and disposal standards based on information type, ensuring DLIs have secure storage of personal information through safeguards, sharing personal information with DLIs securely through the IRCC portal, regularly reviewing employees’ access to determine what is necessary, identifying the Terms of Use with DLIs covering agreements normally seen in ISAs, and monitoring user-lists to clean up, and audit information maintaining DLIs accountability for access control.

Conclusion

A majority of the mitigation strategies identified in the PIA are ongoing and are being monitored in response to the risks associated with the program. The remaining mitigation strategies are scheduled to be implemented in Q2 2024-2025.