Privacy impact assessment – Canada Day Challenge
The Canada Day Challenge is an annual art, photography and creative writing contest for youth in Canada. Launched in 1987, over 350,000 participants from across Canada have taken up the Challenge and shown their pride in Canada while discovering and learning about Canada’s heritage and diversity.
The Canada Day Challenge invites young Canadians aged 8 to 18 to express their creativity and show their pride in being Canadian by presenting an entry in one or more than one category, as follows:
- Draw it! – present a poster, a drawing or a painting
- Snap it! – present an original digital photograph
- Write it! – present a short story, a poem or an essay
The personal information collected by Canadian Heritage from all participants/entrants consists of: name of contestant, subject, photograph, address, telephone number, email, language, school contact information, parent or legal guardian name and consent. Regions collect the names and phone numbers of jurors.
Winners win a trip to Ottawa. For those winning a trip, a void cheque (which contains personal financial information such as bank account number) will be requested from a parent or legal guardian in order to electronically transfer the travel advance for the trip.
The legal authority for the Canada Day Challenge is paragraph 4(10) of the Department of Canadian Heritage Act.
Modifications to the delivery and administration of the Canada Day Challenge prompted a Privacy Impact Assessment.
Privacy risk mitigation
The Privacy Impact Assessment has been prepared and the analysis of the risks was made against the ten universal privacy and fair information practice principles of the Canadian Standards Association Model Code for the Protection of Personal Information.
Canadian Heritage takes the protection of Canadians’ information very seriously and is committed to taking further action to mitigate the privacy risks that were identified in the process.
The following are the privacy risks identified through the PIA process that pertain to the installation of four specific modules of the Site-Secure software and the mechanisms to mitigate these risks:
- Nature of risk: No Personal Information Bank (PIB) has been established for the Canada Day Challenge
Mitigation mechanism: A PIB has been created by PCH and will be sent to the Treasury Board Secretariat (TBS) for review and registration. Upon receiving confirmation by TBS of the PIB registration, the PIB will be included in PCH’s chapter in Info Source.
- Nature of risk: The personal information (PI) from the Challenge was destroyed when the contest was over.
Mitigation mechanism: A personal information and entry storage policy has been developed to determine what is kept and for which duration to ensure compliance with the Privacy Act.
- Nature of risk: There is no mention of a PIB in the consent form.
Mitigation mechanism: The PIB number has been included in the Privacy Statement on the consent form for the new program year.
- Nature of risk: The void cheques collected from the winners’ parent/guardian present a higher risk than the rest of the personal information.
Mitigation mechanism: The Challenge team deletes the electronic copies of the void cheques and banking information of the winners’ parents once the information is provided to the departmental financial area.
- Date modified: