Introduction

All departing Statistics Canada employees are required to complete an Employee Clearance Notification form to ensure that all documents, reference materials and equipment assigned to employees are returned prior to their leaving the Agency. An electronic version of this form was developed to facilitate this process for the employees to better meet this requirement and to address related issues.

Objectives

A privacy impact assessment of the electronic Employee Clearance Notification form was conducted to determine if there were any privacy, confidentiality and security issues, and if so, to make recommendations for their resolution or mitigation.

Description

The electronic version of the Employee Clearance Notification form was developed and added to the Data Access Request System which is available on Statistics Canada’s Administrative Systems Portal. The completion of the electronic version of this form will be less onerous on employees. When completing the paper version, there were eleven different signatures that employees needed to obtain by going from one section to another throughout the Agency. In reality, there were many drawbacks: because the process was very time-consuming and many employees did not obtain all signatures which meant, in certain instances, there were outstanding issues that had to be dealt with after the employees’ departure.

As well departing employees were also asked to do an exit survey that was often not completed because employees did not have the time. Requesting that employees do this exit survey on-line will be part of the new process.

Using the electronic Employee Clearance Notification form, employees will be able to initiate the process earlier in anticipation of their departure which should assist in ensuring the full completion of the form by all responsible areas. Hence this improvement will allow the better management of the return or re–assignment of any documents, material and equipment previously assigned to these employees. It is also anticipated that the new process will also result in an increase in the number of completed exit departure surveys.

Conclusion

This privacy impact assessment did not identify any privacy risks that cannot be managed using either current safeguards or others that have been specifically developed for the implementation of the electronic version of the Employee Clearance Notification form.

Introduction

The Staffing Activity Management System (SAMS) was developed to facilitate the tracking and monitoring of staffing activities within Statistics Canada.

Objective

A privacy impact assessment of the Staffing Activity Management System was conducted to determine if there were any privacy, confidentiality and security issues, and if so, to make recommendations for their resolution or mitigation.

Description

The Staffing Activity Management System was developed as a secure system. This tool is used as a method for Statistics Canada’s staffing officers to manage the staffing activities related to a position. It has been added to Statistics Canada’s Administrative Portal which resides on the internal closed network (Network A). Access to SAMS is restricted to Statistics Canada staffing advisors and assistants.

Conclusion

This privacy impact assessment did not identify any privacy risks that cannot be managed using either current safeguards or others that have been specifically developed for the implementation of the Staffing Activity Management System.

Introduction

In Canada, the census of population is conducted every five years. It provides a snapshot of the population: its size and geographic distribution as well as its demographic, socio-cultural and socio-economic characteristics. The data produced are used widely by all levels of government for policy planning and program administration. Population estimates based on census counts are used to determine fiscal transfers between levels of government. Aggregated census data are also used by the private sector, educators and the general public.

Statistics Canada will be conducting the 2006 Census of Population on May 16^th, 2006.

Objectives

A privacy impact assessment for the 2006 Census of Population was conducted to determine if there were any privacy, confidentiality and security issues associated with the census, and if so, to make recommendations for their resolution or mitigation.

Description

The 2006 Census of Population will collect detailed socio-demographic information on individuals and households through a long-form questionnaire which is completed by approximately one household in five. The remaining Canadian households will receive a short-form questionnaire asking basic demographic questions. Response to both questionnaires is mandatory under the Statistics Act.

Significant changes are being introduced into the collection and capture of data for the 2006 Census. The census will be more centralized and automated than in the past and respondents will be given the option of completing their questionnaire on-line as an alternative to mailing back a paper questionnaire. Questionnaires that are returned by mail will be imaged and data captured in a single Data Processing Centre using automated Optical Character Recognition technology before being edited and coded. Therefore local enumerators will no longer see the completed form and, overall, fewer people will handle respondents' information. These changes will improve the privacy, confidentiality and security of respondents' personal information.

Statistics Canada has reviewed the overall Census process and conducted a threat and risk assessment of the various collection and processing methods to be used in the 2006 Census. Some of the changes being introduced in 2006, however, warranted a more in-depth review: the use of the Internet for collection of Census data, the option of permitting use of tax records, the procurement of hardware, software and printing of questionnaires from the private sector for the 2006 Census, the capture, use and retention of names and addresses; and the implications of legislation allowing the archiving and eventual public release of Census records.

With respect to the introduction of an Internet option for completing the census questionnaire, Statistics Canada, in conjunction with the government's Secure Channel, has developed an approach that provides a much higher level of data security than that typically in place for commercial — including financial — transactions. While there are inherent risks in using the Internet, the use of Secure Channel and safeguards built into the Census application significantly reduce these risks, providing a secure and efficient on-line option to respond to the Census.

Also introduced in the 2006 Census is the option for respondents to give Statistics Canada explicit consent to obtain their income information from tax files rather than providing this information on the Census questionnaire. The questionnaire is designed to encourage the person completing it to consult each individual tax filer as to whether they grant permission or not. This option not only reduces respondent burden, but it also involves less privacy risk since sensitive income data will not appear on the census questionnaire.

The new methodology introduced for the 2006 Census required investment in hardware and systems development. Through a transparent and competitive procurement process, systems development for the Internet application, for the call centres, and for the Data Processing Centre was contracted out. To address concerns about private-sector contractors having access to Canadians' personal information, stringent security measures have been put in place to ensure that no confidential information is ever in the possession of contractors. All collection and processing of Census data is conducted exclusively by Statistics Canada employees in Statistics Canada facilities with no external connections. Regardless, all contractors must have the required security clearance and are sworn-in under the Statistics Act (thereby they are subject to sanctions for any breach of confidentiality). Contractors are under the direct supervision of Statistics Canada employees at all times. Finally, Statistics Canada is undertaking three independent Information Technology security assessments to further validate the security of contractor developed systems. With these measures, the privacy risk associated with the contracting out of work is mitigated.

The use of automated data capture from images makes it possible to capture names and addresses from Census questionnaires in a cost-effective manner. The availability of names and addresses in electronic format in turn improves the efficiency of collection, processing and evaluation activities. Other than in records retained for archival purposes, names will be retained on Census files for only a limited period of time. Strict controls have been put into place to limit access to identifiable information, such as names and addresses, which minimize the potential for misuse or disclosure of identifiable Census data.

In June 2005, Parliament passed an amendment to the Statistics Act allowing for the release of Census information by Library and Archives Canada after 92 years. For the 2006 Census and subsequent censuses, only information for persons who have given explicit consent will be released 92 years following a census. The wording of the question in the 2006 Census is designed to ensure that the responses reflect each individual's choice regarding the eventual release of their personal information.

Conclusion

This assessment concluded that the privacy risks related to the 2006 Census of Population were either negligible, were mitigated through existing safeguards or were addressed through the implementation of additional safeguards.

Introduction

The Human Resources Self Serve Portal was developed to provide desktop access to Statistics Canada employees to a wide range of personal and work-related information.

Objectives

A privacy impact assessment of the Human Resources Self Serve Portal was conducted to determine if there were any privacy, confidentiality and security issues, and if so, to make recommendations for their resolution or mitigation.

Description

To make the management of a variety of employee information more efficient, the Human Resources Self Serve Portal was developed and added to Statistics Canada’s Administrative Portal. It resides on a secure internal network and access to the portal is restricted to Statistics Canada employees with a valid Statistics Canada computer account.

Prior to the Human Resources Self Serve Portal, key employee information was kept in numerous data bases and files. Employees did not have direct access to these, so, as a result they had to contact Human Resources Branch. For example if an employee needed to change his/her home or mailing address, or emergency contact, a request had to be made to Human Resources Branch and an officer would then make the requested change on the file of the employee.

With the Human Resources Self Serve Portal, employees can now make changes themselves as well as having access to other personal and work-related information.

Conclusion

This privacy impact assessment did not identify any privacy risks that cannot be managed using either current safeguards or others that have been specifically developed for the implementation of the Human Resources Self Serve Portal.

Introduction

Statistics Canada is installing a new automated access control system that replaces the system that has been in place since autumn 2002. At the same time, Statistics Canada is expanding its closed circuit television monitoring program by increasing the number of cameras and adding the capability to record.

Objective

A privacy impact assessment of the new automated access control system and the closed circuit television monitoring program was conducted to determine if there were any privacy, confidentiality and security issues, and if so, to make recommendations for their resolution or mitigation.

Description

The automated access control system allows Statistics Canada to maintain the security posture required by the Government Security Policy for the protection of both its employees and assets.

This new system introduces enhanced security features, such as physical barriers, to prevent forceful entry and will require employees to “swipe out” when leaving the building. A system log is automatically generated, logging the entry and exit of employees. This feature supports a greater level of safety and security for Statistics Canada employees, in particular when they are in the buildings after normal hours working hours such as evenings and weekends.

Statistics Canada currently uses a limited number of closed circuit television cameras. Based on recommendations following an evaluation of its physical security posture conducted in 2007, it will be increasing the number of cameras, each of which will have the capacity to make a recording. These cameras will be placed in public areas, not in any area where persons would have an expectation of privacy.

The use of any information collected by the access control system and from the recordings made by the CCTVs will be strictly restricted to specific purposes, that is to say, security- and safety-related investigations. In all cases, any authorized use will require the approval of the Departmental Security Officer.

The personal information is part of the Personal Information Bank, Security Video Surveillance and Temporary Visitor Access Control Logs and Building Passes (PSU 907). Upon request, Statistics Canada will provide employees and others with access to their personal information related to this PIB.

Conclusion

This privacy impact assessment did not identify any privacy risks that cannot be managed using either current safeguards or others that have been specifically developed for the installation of a new automated access control system and the increased use of closed circuit television monitoring.

Introduction

In order to conduct the 2006 Census of Population and the 2006 Census of Agriculture, Statistics Canada needs to hire additional temporary staff. To facilitate this process, the Agency provides potential employees with the option of making a job application on-line via its Web site.

Objectives

A Preliminary Privacy Impact Assessment (PPIA) was conducted for the 2006 Census On-line Recruitment Application project. The purpose was to determine if there were any confidentiality, privacy or security issues associated with the project and, if so, to make recommendations for their resolution.

Description

The Preliminary Privacy Impact Assessment came to the following conclusions:

• The project does not involve new or increased collection of personal information - a similar on-line service was offered during the 2001 Census.
• The application requires the collection of less personal information from candidates than was the case in 2001.
• Persons are advised of alternate means of submitting a job application if they choose not to submit one via the Internet.
• A Threat and Risk Assessment was undertaken. It did not identify any risks to confidentiality, privacy or security of the personal information collected or used.

Conclusion

A full Privacy Impact Assessment is not required for the 2006 Census On-line Recruitment Application project.

Introduction

The National Routing System project is a pilot initiative being undertaken to demonstrate the feasibility of setting up a federal-provincial-territorial network that will allow vital event data to be delivered from the "producing" organizations to the authorized "subscribing" organizations. The pilot project must also demonstrate that the information can be delivered in a manner which follows established security protocols designed to protect the privacy of individuals.

Objectives

The rationale for completing a Preliminary Privacy Impact Assessment (PPIA) on the National Routing System Project was to determine if any privacy risks may be associated with the NRS pilot initiative and, if so, to determine possible options for resolving those risks.

Description

The NRS is envisioned as a secure communications network that will ultimately link together provinces and territories (P/Ts), federal departments and agencies for the purpose of providing both real-time and batch exchange of vital event information. This information flow is essential to authenticate identity, to determine program eligibility and entitlement for benefits, and to update vital records databases. It will also enable improvements in data quality, timeliness and cost effectiveness for statistical programs based on vital events.

Conclusion

This Preliminary PIA Report did not identify any privacy risks that would warrant a PIA for the NRS pilot initiative. However, a review should be undertaken of the recommendations made in the Acceptance Pilot Evaluation (March 2006). If NRS design changes are contemplated, an analysis should be undertaken to determine whether or not a PIA is required.