Access to Statistics Canada's Microdata in Authorized Workspaces - Privacy impact assessment summary

Introduction

Statistics Canada is expanding its data access model to facilitate secure access to protected data, in accordance with the Statistics Act. This is an extension of the pilot project that was conducted with Canada Mortgage and Housing Corporation from July 2019 to March 2020.

Objective

A privacy impact assessment for Access to Statistics Canada's Microdata in Authorized Workspaces was conducted to determine if there were any privacy, confidentiality or security issues with this activity and, if so, to make recommendations for their resolution or mitigation.

Description

Statistics Canada's expanded model will provide approved researchers (Deemed Employees) with secure access to anonymized data in an "Authorized Workspace", as defined below:

Authorized Workspace: workspace approved by Statistics Canada and specified in a data access agreement. It may include a closed office, closed conference room or meeting room, open workspace within the premises of an organization, or a private space within a Deemed Employee's personal residence.Footnote 1

Only anonymized data (i.e., direct personal identifiers removed) with lower level of sensitivity and lower risk of re-identification will be accessible via an Authorized Workspace. At all times, the data reside on Government of Canada approved IT infrastructure.

Statistics Canada will continue to evaluate this access modality for its security, privacy, and user-centric improvements to data access. If any incidents related to violations of security protocols arise, Statistics Canada will analyze the contributing factors and implement additional mitigation factors, where deemed necessary.

Risk Area Identification and Categorization

The PIA identifies the level of potential risk (level 1 is the lowest level of potential risk and level 4 is the highest) associated with the following risk areas:

level of potential risk (level 1 is the lowest level of potential risk and level 4 is the highest) associated with the following risk areas
  Risk scale
a) Type of program or activity
Program or activity that does not involve a decision about an identifiable individual.
1
b) Type of personal information involved and context
Only Statistics Canada Anonymized Data are accessed and used by Deemed Employees. All personal identifiers have been removed from the datasets and there is low risk of re-identification.
N/A
c) Program or activity partners and private sector involvement
Private sector organizations, international organizations or foreign governments
4
d) Duration of the program or activity
Long-term program or activity.
3
e) Program population
The program's use of personal information is not for administrative purposes. Information is collected for statistical purposes, under the authority of the Statistics Act.
N/A
f) Personal information transmission
Only Statistics Canada Anonymized Data are accessed and used by Deemed Employees. All personal identifiers have been removed from the datasets and there is low risk of re-identification.
N/A
g) Technology and privacy
The initiative does not involve the implementation of a new electronic system, the use of a new application or software, or any modifications to information technology (IT) legacy systems.
N/A
h) Potential risk that in the event of a privacy breach, there will be an impact on the individual or employee.
There is a very low risk of a breach of personal information since all data are anonymized and de-identified. The impact on the individual would be minimal as the information is not linked to an individual's name, address or any other personal identifiers.
N/A

Conclusion

This assessment of the Access to Statistics Canada’s Microdata in Authorized Workspaces did not identify any privacy risks that cannot be managed using existing safeguards.

Date modified: