Privacy Impact Assessment Summary

Athlete Assistance Program (AAP)

1. About

Sport and physical activity play an important role in the health, social, linguistic, economic, and cultural diversity of Canadians. The Athlete Assistance Program (AAP) is a federal grant program that provides direct financial assistance to high-performance athletes in Canada. This includes living and training allowances, and tuition and supplementary support in specific situations. The AAP is one of three Sport Canada programs administered by the Department of Canadian Heritage’s (PCH) Sport Canada branch to support the development of Canadian athletes and the improvement of Canada’s competitiveness in international sporting competitions.

2. Collection of Personal Information

In order to process an application for funding under the AAP, PCH must collect, use and share personal information from eligible athletes. Personal information is also used for program management and administration purposes. Personal information may be collected from eligible athletes and from the parents or guardians and coaches of athletes. Whereas PCH collects and uses personal information for ‘administrative’ purposes (i.e., to make a decision about an identifiable individual), it elected to perform a Privacy Impact Assessment (PIA) in relation to the AAP.

3. Scope of the Privacy Impact Assessment (PIA)

PCH is named in the Schedule to the Privacy Act and is subject to the privacy policies and directives of the Government of Canada. Under the Treasury Board of Canada Secretariat’s (TBS) Policy on Privacy Protection, all federal institutions subject to the Privacy Act are required to undertake an assessment of the privacy impacts associated with the development or design of new programs or services involving personal information. PIAs are also required when making significant changes to an existing program or service.

Although the AAP was established prior to the effective date of the Government of Canada’s Policy on Privacy Protection, in 2020 PCH planned to introduce a new management information system to support the Program. As such, and whereas PCH intends to continue collecting, using and disclosing personal information in the administration of the AAP, the Department elected to undertake a core PIA in order to ensure that privacy risks, if any, associated with the Program and its new supporting system are properly mitigated. It was management’s view that the performance of a PIA in relation to the new system –and more importantly the underlying activities of the AAP – offered an opportune time to review and assess how best to handle the personal information of program applicants and participants.

The PIA was completed under the direction of the Department’s Chief Information Officer Branch (Strategic Business Transformation), and in consultation with AAP program officials. The Department’s Access to Information and Privacy (ATIP), information technology, and information management groups were engaged as and when needed.

In keeping with its scope as a core PIA, the assessment included a high-level review of the AAP, as operating at the time this report was drafted. It included a review of the AAP applicant registration process, and an assessment of approved uses of personal information collected from eligible athletes. The review also included a review of the new AAP Management Information System (AAPMIS) in its earliest stages of design (i.e., a proof of concept). This included a review of business requirements, planned workflows, and core system functionality.

The PIA did not include an assessment of IT and general privacy controls relating to the new system. IT security matters related to AAPMIS and other supporting applications and databases were examined primarily through PCH’s Security Assessment and Authorization (SA&A) process. A separate PIA has been prepared by PCH for the My PCH On-line Portal

4. Privacy Analysis

Based on the PIA, privacy risks arising from the AAP and the first iteration of the new AAPMIS are considered to be moderate to low. The Program involves the collection of only a limited set of personal data, most of which is non-sensitive in nature. That data is collected directly from the individual to whom it belongs and is used exclusively for Program management and administration (i.e., there are no secondary uses of athlete information).

5. Risk Area Identification and Categorization