Introduction

This document is a generic privacy impact assessment developed to assess the privacy, confidentiality and security risks associated with the collection, use and disclosure of personal information by Statistics Canada in the application of its mandate under the Statistics Act. This approach makes use of the opportunity provided by the Treasury Board PIA Policy which enables departments and agencies to develop generic impact assessments.

Through the Privacy Act and the Personal Information Protection and Electronic Documents Act, the Government of Canada is committed to privacy and the protection of personal information used in the course of providing programs and services to the public. The challenge is to assist Canadians in understanding how the government handles their personal information and to trust it to do so responsibly.  To meet this challenge, the Treasury Board of Canada Secretariat approved the Privacy Impact Assessment Policy and the Privacy Impact Assessment Guidelines: A Framework to Manage Privacy Risks in May 2002 (Treasury Board Secretariat, 2002a, 2002b).

A privacy impact assessment (PIA) is an evaluation process that allows those responsible for the collection, use and disclosure of personal information to evaluate the privacy, confidentiality and security risks that may be involved and to develop mitigation measures aimed at avoiding or reducing the identified risks.  The Privacy Impact Assessment Guidelines developed by Treasury Board include questions that encompass ten fundamental privacy principles and are designed to guide federal institutions in conducting their privacy impact assessments. These ten privacy principles are related to accountability, collection, consent, use, disclosure and disposition, accuracy, safeguarding confidential information, openness, access, and challenging compliance.  The Guidelines also require that a threat and risk assessment be undertaken to determine the nature of risk involved in the collection, use and disclosure of personal information and to assist in the development of measures intended to mitigate, if not remove, such identified risks.

Top of Page

Statistics Canada: Role and responsibility

The Statistics Act is Statistics Canada’s governing legislation; it provides Statistics Canada with the mandate to collect, compile, analyse, abstract and publish statistical information relating to the commercial, industrial, financial, social, economic and general activities and condition of the people.

Statistics Canada produces statistics that help Canadians better understand their country - its population, resources, economy, society and culture. In Canada, providing statistics is a federal responsibility and, as Canada’s central statistical agency, Statistics Canada is to serve this function for the whole of Canada and for each of the provinces and territories.  Objective statistical information is vital to an open and democratic society. It provides a solid foundation for informed decision-making by elected representatives, businesses, unions and non-profit organizations, as well as individual Canadians.

At the same time, Statistics Canada’s activities are, by their very nature, privacy-intrusive.  Respecting respondents’ personal privacy, safeguarding their information and ensuring that appropriate security measures are in place to do so are critical to the Agency’s mandate and its relations with respondents.  Statistics Canada’s commitment to keep in trust the information it obtains from the Canadian public is enshrined in both the Statistics Act and the Agency’s various policies and practices that frame its data collection, analysis and dissemination activities.

Top of Page

Application of the Privacy Impact Assessment Policy at
Statistics Canada

Given Statistics Canada’s unique position in the Federal Government in collecting personal information solely for statistical and research purposes, and following discussions with the Office of the Privacy Commissioner, Statistics Canada determined that the privacy issues associated with its survey activities could be addressed by means of:

• a generic privacy impact assessment that would address the majority of survey collections undertaken by the Agency under the authority of the Statistics Act, and when required,
• a specific privacy impact assessment for specific statistical activities that pose a privacy risk not addressed by the approved generic PIA.

Generic privacy impact assessment for Statistics Canada surveys

The generic approach is made possible because, while the subject-matter may vary, Statistics Canada’s surveys generally entail similar processes and procedures and, ultimately, similar privacy risks.

Thus, this document applies generally to all Statistics Canada surveys and is intended to accompany, when required, a specific PIA covering privacy-related issues specific to an individual survey, as outlined in Statistics Canada’s Privacy Impact Assessment Policy.  This generic document covers the ten privacy principles and their associated questions as set forth in the Treasury Board Secretariat’s policy and guidelines for privacy impact assessments. Generic data flow analyses have also been prepared for Statistics Canada’s major data collection and dissemination methodologies, such as paper and pencil interviewing, computer-assisted interviewing and electronic data reporting and transfer.  As well, section 3 of this document describes the legal and policy requirements for the disclosure of confidential Statistics Act information outside of Statistics Canada.

In this document, the term survey is used generically to cover any activity of Statistics Canada that collects or acquires statistical data.  Included are:

• a census, which attempts to collect data from all members of a population;
• a sample survey, in which data are collected from a (usually random) sample of population members;
• use of data from administrative records, in which data are derived from files originally collected by another organization and subsequently communicated to Statistics Canada for statistical purposes;
• a derived statistical activity, in which data are estimated, modeled, or otherwise derived from existing statistical data sources.