Ontario Sex Offender Registry

Privacy impact assessment (PIA) summary

Overview

The Ontario Sex Offender Registry (OSOR) is a database that provides 24-hour support for police services throughout the province. It is located at the Ontario Provincial Police (OPP) General Headquarters in Orillia. This service supports the objective of the Christopher's Law (Sex Offender Registry) of Ontario, 2000 which is to:

The OPP has been mandated by the Government of Ontario to establish, operate and maintain the OSOR on behalf of the Ministry of Community Safety and Correctional Services. Correctional Service Canada (CSC) is responsible for the disclosure of the offender's personal information through a process whereby CSC, on a daily basis, extracts the information to be provided from its Offender Management System and transfers it electronically to OSOR via a virtual private network (VPN) using an internet connection.

Summary of risks and recommendations

General use

Risk

Recipients of the information may use it for purposes for which it was not intended.

There is potential of embarrassment for CSC should a police force misuse the personal information of an offender.

Recommendations for mitigation

CSC has established contractual and technical measures to minimize the risks that the recipients of the information will use it for unauthorized purposes.

The legislative and contractual framework provides reasonable assurance that OSOR and the police forces that will receive the information provided by CSC will be rigorous in the way in which they use and handle it.

The PIA Team believes that the best way to respond to an occurrence resulting in potential embarrassment for CSC would be to make sure that the public understands the limitations of CSC's action and responsibility in that regards.

Retention and disposal

Risk

The possibility that the staff of OSOR or police forces reproduce and/or print some of the information to which they will have access and that they retain those copies beyond the scheduled period for their disposition.

The possibility that the staff of OSOR or police forces improperly remove information from the system before the expiry of its retention schedule.

Recommendations for mitigation

These risks have always existed in relation to the offenders' information that CSC provides to Ontario, and the OSOR information sharing agreement will not, in all probability, increase those risks.

The legislated and contractual framework established by the agreement as well as by the applicable Ontario privacy and archival legislation for the retention and the disposal of the personal information that will be involved in the proposed sharing program meets the requirements of the Privacy Act.

Safeguarding

Risk

A threat and risk assessment (TRA) was completed.

Recommendations for mitigation

The security risks that were identified during the TRA were addressed by CSC at the time of the PIA.