Privacy impact reports 2017-2018

Proactive Enrolment Initiative – Phase 3 – Automatic Enrolment for the Guaranteed Income Supplement (October 2017)

Description of Program

In 2012, Employment and Social Development Canada (ESDC) developed the Old Age Security (OAS)/Guaranteed Income Supplement (GIS) Service Improvement Strategy (OAS/GIS SIS) in order to address demographic and program pressures. It was determined that having individuals complete and submit paper applications in order to receive their OAS pension and GIS is a burden on individuals. The OAS/GIS SIS is an approach that seeks to alleviate the requirement for paper applications by implementing the Proactive Enrolment Initiative. This initiative will automatically enrol individuals who are eligible for the OAS pension and the GIS.

Information on Phase 2 of the Proactive Enrolment Initiative.

Why was a Privacy Impact Assessment (PIA) completed?

This PIA was completed as ESDC will be using personal information from other sources as part of a decision-making process that will directly affect individuals.

The PIA examines the privacy risks associated with the management of personal information throughout the process of automatically enrolling individuals for the GIS and proposes methods to lower these risks.

More Information

This PIA focused on ESDC’s collection, use, retention and disposal of personal information throughout the administration of the Proactive Enrolment Initiative. It is limited to the third phase of the automatic enrolment for the GIS and is not intended as an overarching program PIA under the entire OAS program.

The PIA identified four low, three medium and no high level risks, and a mitigation action plan has been developed and is in progress.

Direct Deposit and Address Information Sharing Initiative Iteration I, Canada Pension Plan Direct Deposit (October 2017)

Description of the Initiative

The Tell-Us-Once – Direct Deposit and Address Information Sharing Initiative (DAISI) is a joint effort between Employment and Social Development Canada (ESDC) and the Canada Revenue Agency (CRA) that allows Canadians to update their personal information once and consent to have it automatically shared between both organizations. The first phase of this initiative, also referred to as Iteration I, gives Canadians the option to share their direct deposit banking information for the administration of both the ESDC Canada Pension Plan (CPP) and CRA related programs.

Why was a Privacy Impact Assessment (PIA) completed?

This PIA was conducted because the CRA will be using personal information disclosed by ESDC as part of an administrative process that will directly affect the individual.

The PIA examines the privacy-related risks associated with the consent based personal information exchange between ESDC and the CRA, and proposes methods to lower these risks.

More Information

This PIA focused on ESDC’s collection, use, retention and disclosure of information. The PIA is not intended as an overarching program PIA and does not assess privacy risks and impacts associated to the CPP program as a whole.

The PIA identified five low, two medium and no high level risks, and a mitigation action plan has been developed and is in progress.

First Nations Job Fund (October 2017)

Description of Program

The First Nations Job Fund (FNJF) provided personalized job training to Income Assistance clients in participating on-reserve communities who were referred from Indigenous and Northern Affairs Canada’s Enhanced Service Delivery Program. The FNJF was delivered through the Aboriginal Skills and Employment Training Strategy (ASETS) network of Agreement Holders (AHs) and sunset on March 31, 2017, as part of the on-reserve Income Assistance Reform horizontal initiative.

Why was a Privacy Impact Assessment (PIA) completed?

This PIA was completed as personal information was used as part of an administrative process that directly affects individuals.

The PIA examined the privacy-related risks and associated mitigation strategies of the FNJF, and the lessons learned were taken into consideration in the implementation design for the renewed ASETS programming.

More Information

This PIA focused on ESDC’s collection, use, retention and disposal of personal information for the administration of the FNJF. It did not include an examination of information sharing between ESDC and Indian and Northern Affairs Canada as only aggregated information was exchanged between the two Departments.

The PIA identified one medium and three low level risks. A mitigation action plan was developed and implemented.

Call Recording and Screen Capture Functionality for the 1 800 O-Canada and Customized Information Services Quality Assurance Program (September 2017)

Description of Initiative

The 1 800 O-Canada toll-free telephone service provides the public with general information on all Government of Canada programs, services and initiatives, and acts as a first point of contact to access quick, up-to-date government information. A new feature, call recording and screen capture, was introduced to enhance the quality assurance monitoring process and program.

Why was a Privacy Impact Assessment (PIA) completed?

This PIA was completed because the new functionality represents a substantial modification to an existing program. Even though the capturing of personal information will be used for non-administrative purposes (quality assurance) that will not result in decision-making that will directly affect individuals, the activity was deemed sensitive enough to warrant a PIA.

The PIA examines the privacy risks and impacts of the initiative and proposes methods to mitigate these risks.

More Information

This PIA focussed on the privacy risks related to the collection of personal information via screen capture/call recording, and the handling, storage, access to, and disposal of this information throughout its lifecycle. It summarizes the privacy impacts and risks associated with a new screen capture and call recording functionality for the 1 800 O-Canada and Customized Information Services call centre operations as a result of the migration to a new Virtual Contact Centre solution. The assessment does not include other supporting functions for the Program.

The PIA identified five low, one medium and no high level risks. The mitigation strategy to address it was scheduled for completion in September 2017.

Exchange of Information between Employment and Social Development Canada and the Northwest Territories Department of Education, Culture and Employment (August 2017)

Description of Program

Employment and Social Development Canada (ESDC) provides personal information to the Northwest Territories for the purpose of administering the Senior Citizen Supplementary Benefit (SCSB), which is a monthly monetary benefit to help low-income seniors pay for living expenses. The SCSB is automatically provided to eligible seniors residing in the Northwest Territories who are receiving the Old Age Security (OAS) Guaranteed Income Supplement, Allowances and Allowances for the Survivor paid for under the OAS program. In addition, ESDC will provide Canada Pension Plan and OAS personal information to the Northwest Territories for the administration of the Northwest Territories Income Assistance Program.

Why was a Privacy Impact Assessment (PIA) completed?

This PIA was completed because ESDC will be disclosing personal information to the Northwest Territories as part of a decision-making process that will directly affect individuals.

The PIA examines the privacy compliance requirements, the risks associated with the current disclosure of personal information, and proposes methods to lower these risks.

More Information

This PIA focused on the identification and categorization of the risks presented by ESDC disclosing personal information to the government of the Northwest Territories’ Income Security programs.

The PIA identified four low, three medium and no high level risks, and a mitigation action plan has been developed and is in progress.

eNotification Project in My Service Canada Account (August 2017)

Description of the Project

ESDC has developed a new eNotification service within My Service Canada Account – Employment Insurance (MSCA-EI), which offers clients improved messaging and a notification service (Alert Me). Clients who consent to the Alert Me feature will receive timely emails alerting them when changes occur to their EI claim.

Why was a Privacy Impact Assessment (PIA) completed?

This PIA was completed as the Alert Me service includes the requirement to collect and store the personal email addresses of EI clients who voluntarily choose to register for the new service.

The PIA examines the privacy-related risks associated with the new Alert Me feature in MSCA as part of the EI Automation and Client Services Improvements project.

More Information

This PIA focused on Employment and Social Development Canada’s collection, use, disclosure, retention and disposition of personal email addresses of clients who participate voluntarily. It does not extend to existing EI Program processing systems or to the MSCA Canada Pension Plan, Old Age Security and Tax Slip services that do not reside within the EI eNotification space of MSCA.

The PIA identified two low risks, and the mitigation strategies for these were scheduled for completion by the end of the 2017-2018 fiscal year.

Canada Apprenticeship Loans Phase III: Repayment (June 2017)

Description of Program

The Canada Apprentice Loans (CAL)provides loans to registered apprentices for the cost of technical training. It is administered by the Canada Student Loan Program and delivered by its service provider.

Why was a Privacy Impact Assessment (PIA) completed?

This PIA was completed in order to assess the management of the loan repayment process.

The PIA examines the privacy risks associated with the final phase of CAL and proposes methods to lower these risks.

More Information

This PIA focused on Employment and Social Development Canada’s collection, use, disclosure, retention and disposition of personal information of loan recipients. It did not include an examination of privacy practices related to the entirety of CAL, nor does it examine the exchange of personal information to maintain interest-free status for registered apprentices.

The PIA identified six low, one medium and no high level risks. The mitigation strategies for these risks are in place.

Exchange of Personal Information between Employment and Social Development Canada and Yukon Department of Health and Social Services for the administration of the Yukon Senior Income Supplement (May 2017)

Description of Program

The Yukon Seniors Income Supplement (YSIS) provides financial assistance to low income seniors living in the Yukon who are in receipt of the Old Age Security (OAS) and Guaranteed Income Supplement (GIS) from the federal government. The Yukon supplement is also paid to spouses between the ages of 60 and 64 years who receive an Allowance for the Survivor. The purpose of this disclosure of information between Employment and Social Development Canada (ESDC) and Yukon Department of Health and Social Services is to provide Yukon seniors with seamless access to benefits while ensuring the information is disclosed and protected in line with the privacy and legislative framework.

Why was a Privacy Impact Assessment (PIA) completed?

This PIA was completed as Yukon will be using personal information disclosed by ESDC as part of a decision-making process that will directly affect individuals.

The PIA was developed to determine the privacy risks associated with the disclosure of information by ESDC to Yukon for the purposes of administering the YSIS and proposes methods to lower these risks.

More Information

This PIA focused on ESDC’s collection, use, disclosure and retention of personal information related to its disclosure to Yukon. It did not include an examination of privacy practices implicated in the collection of personal information by ESDC for the administration of the OAS Program.

The PIA identified five low, two medium and no high level risks, and a mitigation action plan has been developed and is in progress.

Youth Employment Strategy (April 2017)

Description of Program

The Youth Employment Strategy (YES) is the Government of Canada’s commitment to help young people aged 15 to 30 facing barriers to employment and to gain the skills, work experience and abilities they need to make a successful transition into the labour market. Employment Social Development Canada delivers the YES in collaboration with 10 other federal departments and agencies through three program streams.

Why was a Privacy Impact Assessment (PIA) completed?

This PIA was completed because personal information, including the Social Insurance Number is collected and used as part of a decision-making process that directly affects the individual.

The PIA examines the privacy-related risks associated with the collection, use, retention and disposal of personal information for the administration of the YES and proposes methods to lower these risks.

More Information

YES is a horizontal program – with a total of 11 participating departments and agencies, including ESDC. However, the scope of this PIA is limited to ESDC/Service Canada’s role and does not assess partners’ administration of the program. Concretely, the PIA examined personal information collected, manipulated/used, stored and disposed of by ESDC, as well as personal information provided to ESDC by contribution recipients in the various intake systems for administrative purposes, and the safeguarding of personal information provided to ESDC by partner departments and agencies via the interdepartmental data collection system.

The PIA identified five low, four medium and no high level risks. A mitigation action plan was developed to address the identified risks.

Workforce Development Agreement (April 2017)

Description of Program

The Workforce Development Agreements (WDAs) are new bilateral transfer agreements between the Government of Canada and the provinces and territories launched in 2017-2018. These agreements support provinces and territories to provide employment assistance and skills training with the flexibility to respond to the needs of their local labour markets.

The WDAs contain broad eligibility criteria, enabling provinces and territories to support a variety of clients including individuals who are unemployed or who may be further removed from the labour market. They can also be used to support those who are underemployed or seeking to upskill. The WDAs provide dedicated funding for programs for persons with disabilities. Provinces and territories may also target members of underrepresented groups such as Indigenous peoples, youth, older workers and newcomers to Canada to increase their labour market participation. The WDAs can also support employer-sponsored training.

These agreements support the Government of Canada’s priority of promoting a strong middle class by improving Canadians’ access to good quality job training.

Why was a Privacy Impact Assessment (PIA) completed?

This PIA was completed as the WDA is a new program that will collect the Social Insurance Number (SIN) for program administration, including evaluation.

The PIA examines the privacy-related risks associated with ESDC’s role in the implementation of the WDA and proposes methods to mitigate these risks.

More Information

This PIA focused on ESDC’s collection, use, retention and disposal of personal information for the administration of the WDA. It does not examine the provinces’ and territories’ privacy practices and the programs and services to be delivered under the WDAs since they will be designed and delivered by the provincial and territorial governments.

The PIA identified four low, five medium level, and one high level risks. The mitigation strategies to address those were scheduled for completion by winter 2020.

Memorandum of Understanding Concerning the Disclosure of Administrative Data Files from Employment and Social Development Canada to Statistics Canada (April 2017)

Description of Program

Employment and Social Development Canada (ESDC) had an information sharing agreement with Statistics Canada (StatCan) dated back to 1989 for the disclosure of personal information for research and statistical purposes. A new and updated Memorandum of Understanding (MOU) was developed in 2017 to incorporate additional program data and reflect departmental legislative changes and current information technology, privacy, and security standards. The 2017 MOU replaced the 1989 agreement.

Why was a Privacy Impact Assessment (PIA) completed?

Even though the information will not be part of a decision-making process that will directly affect individuals, a PIA was completed to assess the personal information that will be disclosed to StatCan as a result of this MOU.

This PIA examined privacy-related risks associated with the proposed sharing of personal information with StatCan for research and statistical purposes and suggested methods to lower these risks.

More Information

This PIA focused on ESDC’s handling and disclosure of personal information under the 2017 MOU, and to assess compliance with privacy and security laws and policies as well as Information Technology (IT) standards. It does not include an examination of systems used by programs to store personal information before it is transferred to StatCan.

The PIA identified three low, one medium and no high level risks. The mitigation strategy to address these risks has been underway since the completion of the assessment.

Additional information

If you would like more information about the above PIAs, please contact:

Employment and Social Development Canada
Corporate Secretariat / Privacy Management Division
140 Promenade du Portage
Phase IV, 12th Floor, mailstop 1203
Gatineau QC  K1A 0J9
Email: EDSC.SM.ViePrivee-Privacy.CS.ESDC@hrsdc-rhdcc.gc.ca
Telephone: 1-800-O-Canada
Teletypewriter: 1-800-926-9105

Report a problem or mistake on this page
Please select all that apply:

Thank you for your help!

You will not receive a reply. For enquiries, contact us.

Date modified: