Privacy Impact Assessment Summary: Use of Computer Analytics in IRCC Programs

Every year, more and more people are seeking to come to Canada on a temporary basis, whether for business, tourism, or to visit family and friends. As a result, IRCC is looking at new ways to manage our increasing volume of Temporary Resident Visa applications.

In 2018, IRCC launched a pilot project using computer analytics to help officers triage online Temporary Resident Visa applications from China. The pilot project’s goal is to improve client service and make processing more efficient, while continuing to protect the safety and security of Canadians. The computer analytics helps officers to identify applications that are routine and straightforward for streamlined processing and to triage files that are more complex for a more thorough review. In all cases, officers must still screen for security and criminality for all applications.

A Privacy Impact Assessment (PIA) was undertaken to assess, mitigate and resolve potential privacy risks associated with the implementation of computer analytics in the processing of online Temporary Resident Visa applications from China.

The PIA identified nine privacy risks related to providing appropriate notice to clients, implementing new retention and disposition rules, managing the triage criteria, and ensuring safeguards around the data used to build the analytics system. These risks have been resolved or have a resolution plan in progress. These risks were considered to present a medium to low residual risk from privacy point of view.

Of note, Part 4.1 of the Immigration Refugee Protection Act provides explicit authority to use electronic means to support decision-making.

Additionally, the computer analytics system only uses personal information from the application form and IRCC’s other existing systems. There is no new collection or disclosure of personal information.

Privacy risks will remain a central consideration as IRCC expands its use of analytics in the future.

For more information on the disclosure, collection, use retention, disposition of personal information in the use of computer analytics in relation to this the PIA, please refer to Personal Information Bank: Migration Control and Security Management (PPU 068).