Privacy impact reports 2026 to 2027 - ESDC
On this page
May
External Credentials Management Service (ECM)
Description
The External Credential Management (ECM) services (known as GCKey and Interac Sign in) was a Shared Services Canada program that offered an anonymous Branded Credential Service that has been in use since 2012. It is a service provided by the Government of Canada to allow individuals to securely conduct online business with various federal government programs and services through sign in services: Interac sign-in services (which uses bank-issued credentials) or GCKey (which is vendor-managed but government-issued credentials). It transitioned to the Canadian Digital Service (CDS) within Employment and Social Development Canada (ESDC) and will be phased out over the next few years and departments will transition to a new product called CanadaLogin. This PIA was undertaken to examine the privacy impacts of the ECM services transition to ESDC/CDS.
Why a privacy impact assessment was completed
This PIA was required to examine the privacy implications of transferring the service from Shared Services Canada to Employment and Social Development Canada.
Additional information
The PIA identified two (2) low risks.
Risk 1: Notice
Action: Update the privacy notice statement to include the legal authority for collection of personal information and to indicate that ESDC/CDS is the responsible government institution, along with an update link to the PIB.
Planned Completion: July 2026
Risk 2: Retention and Disposition
Action: Develop a formal records disposition authority
Planned completion: September 2026
Related personal information banks
- A personal information bank has been registered by Treasury Board of Canada Secretariat (ESDC PCU 607)
For more information about this privacy impact assessment
ESDC Access to Information and Privacy (ATIP) Coordinator
Telephone: 819-654-6981
Email: NC-COMM-ATIP-AIPRP-GD@hrsdc-rhdcc.gc.ca
Online request: ATIP Online Request Portal
HRSB Modernization Programme (HMP) Workforce Management Project (WFM)
Description
The CSFA Program, in partnership with its Service Provider (Nelnet), is implementing a multi‑phase modernization of the Repayment Assistance Plan (RAP) to enhance digital service delivery and borrower experience. Phase 1B focuses on improving the electronic RAP (e‑RAP) application within the Student Hub (SH) by enabling real‑time adjudication and providing borrowers with immediate eligibility information, application status, and repayment requirements.
The system will dynamically validate eligibility as borrowers navigate the e‑RAP landing page, allowing those who qualify to receive automated approval or refusal within seconds. Saved applications can be resumed if still valid, while ineligible borrowers will receive instant notifications explaining RAP requirements. Applications requiring additional verification-such as income or medical documentation-will be flagged for manual review, appear as pending in the Student Hub, and prompt follow‑up from the National Student Loans Service Centre.
Why a privacy impact assessment was completed
In accordance with section C.2.2.9.2 of the Directive on Privacy Practices by Treasury Board Secretariat (TBS), ESDC is conducting a Privacy Impact Assessment (PIA) on the e-RAP modernization phased approach as it contains elements that will lead to an administrative decision on borrowers. The modernization phased approach will contain substantial modifications to the RAP SH website.
Additional information
The PIA identified one (1) privacy risk.
Risk 1: Accountability and Safeguarding
Action: A finalized agreement between ESDC and the Service Provider be implemented that governs how personal information is retained and disposed. Clear retention schedules and procedures on destroying personal information should be in place and responsibilities outlined.
Planned Completion: December 2027
Related personal information banks
- Student Financial Assistance (ESDC PPU 030)
- Canada Apprentice Loans (ESDC PPU 709)
For more information about this privacy impact assessment
ESDC Access to Information and Privacy (ATIP) Coordinator
Telephone: 819-654-6981
Email: NC-COMM-ATIP-AIPRP-GD@hrsdc-rhdcc.gc.ca
Online request: ATIP Online Request Portal
Employment Insurance Board of Appeal (EI BOA) and Employment Insurance Enhancement-Recourse Process (EIE-RP)
Description
The Employment Insurance Board of Appeal (EI BOA) initiative will replace the Social Security Tribunal, General Division, EI Section, with the EI BOA for first-level EI appeals. The EI BOA will provide a fair and impartial quasi-judicial process for appeals of EI reconsideration decisions taken by Service Canada on behalf of the Canada Employment Insurance Commission (CEIC). The EI BOA will develop its procedures to provide its services under new changes to the Department of Employment and Social Development Act.
The EI BOA has a technical component which is the Employment Insurance Enhancement - Recourse Process (EIE-RP). Among the many technological components, the EIE-RP will include a secure, electronic, two-way communication to allow EI BOA parties to an appeal, and EI BOA staff to send and/or receive documentation electronically. The objective is to deliver a client-centric, faster, and simpler recourse process for EI benefits.
Release 1 focuses on the implementation of the EI BOA, the delivery of first-level EI appeals, and the foundational technical infrastructure. Subsequent releases (i.e., Releases 2 and 3) involving additional modifications to the IT infrastructure will be covered in corresponding privacy impact assessments (PIAs). ESDA).
Why a privacy impact assessment was completed
The initiative aims to create the EI BOA while transforming EI first-level appeals processes, tools, and systems. This transformation is a substantial modification to how personal information is transmitted and managed, particularly with respect to external access. As a result, a PIA is required according to the Treasury Board Secretariat’s (TBS) Directive on Privacy Practices.
Additional information
The PIA identified three (3) medium privacy risks and two (2) compliance issues:
Risk 1: Accountability
Actions: The EI BOA will define and document roles and responsibilities to clarify who is accountable for the overall handling of personal information.
Planned completion: September 2026
Risk 2: Retention and Disposition
Action: The EI BOA and EI Recourse Process Program to collaborate with Library and Archives Canada (LAC) and ESDC’s Enterprise Information Management (EIM) group to create a Retention and Disposition Authority (RDA) schedule.
Planned completion: A progress update will be provided with the next PIA iteration, coinciding with future project Releases.
Risk 3: Safeguarding
Action: The EI BOA Program will adapt and provide privacy training material to ensure that individuals involved in the Program are sufficiently informed of their privacy obligations in the protection of personal information entrusted to them.
Planned completion: September 2026
Issue 1: Personal information bank
Action: All related personal information banks (PIBs) will describe the personal information collected and used for EI BOA.
Planned completion: June 2026
Issue 2: Privacy notices
Action: The EI BOA and EI Recourse Process Program will ensure all forms include a compliant privacy notice.
Planned completion: April 2026
Related personal information banks
- Employment Insurance Claim Files (PIB) (ESDC PPU 151)
- Interstate Employment Insurance Claims (PIB) (ESDC PPU 170)
- Registration for the Employment Insurance Measure for Self-Employed People (PIB) (ESDC PPU 323)
For more information about this privacy impact assessment
ESDC Access to Information and Privacy (ATIP) Coordinator
Telephone: 819-654-6981
Email: NC-COMM-ATIP-AIPRP-GD@hrsdc-rhdcc.gc.ca
Online request: ATIP Online Request Portal
June
Addendum to Job Bank 3.0
Description
Job Bank is a free bilingual job website that allows job seekers to search for available job opportunities and for employers to find qualified candidates. Job Bank also provides labour market information to help job seekers make informed education, career and labour market related decisions. Job Bank is delivered by ESDC on behalf of the Canada Employment Insurance Commission (CEIC) as part of the National Employment Service pursuant to the Employment Insurance Act.
The purpose of this activity is to include Records of Employment (ROE) data to the list of personal information collected from the existing Job Bank program. Records of employment will be used for Employment Insurance validation services by ESDC. The validation of ROE data will reduce the time required to validate employers.
Why a privacy impact assessment was completed
In accordance with section C.2.2.9.2 of the Directive on Privacy Practices by Treasury Board Secretariat (TBS), ESDC is conducting an addendum to the May 2019 Privacy Impact Assessment (PIA) on Job Bank 3.0. This addendum covers the verification of records of employment (ROE) data provided by the individual. It constitutes an administrative decision as defined under Annex A of the Directive on Privacy Protection.
Additional information
The PIA Addendum did not identify any privacy nor compliance issues as the program’s inclusion of ROE data does not serve a new purpose, and its collection is consistent with the Job Bank program’s mandate.
Related personal information banks
The following personal information bank has been modified to include the use of ROE data and a correction on the naming of the Social Insurance Register.
- Job Bank - (ESDC PPU 711)
For more information about this privacy impact assessment
ESDC Access to Information and Privacy (ATIP) Coordinator
Telephone: 819-654-6981
Email: NC-COMM-ATIP-AIPRP-GD@hrsdc-rhdcc.gc.ca
Online request: ATIP Online Request Portal
Employment and Social Development Canada (ESDC) Privacy Impact Assessment (PIA) Report for Onboarding to the TBS ATIP Online Portal
Description
Employment and Social Development Canada (ESDC) provides access to eligible clients to their personal information or to general government information held by the department through Access to Information and Privacy (ATIP) requests, which have, up until now, been submitted to the department through an online portal held by Immigration, Refugee and Citizenship Canada (IRCC). ESDC discontinued the use of the IRCC Portal on November 19th, 2025.
The Treasury Board Secretariat (TBS) has developed its own client-facing portal for ATIP requests, to which most federal departments and agencies have onboarded. The TBS Online Portal, ("ATIP Online") is a mandated Government of Canada digital platform for ATIP requests. The department has, up until this point, delayed onboarding to ATIP Online due to the non-connectivity of the portal with ESDC's new ATIP processing software, ATIPXpress.
Planned direct connectivity between ATIP Online and ATIPXpress will bring many improvements for ATIP practitioners. ESDC has onboarded ATIP Online knowing that direct connectivity will eventually be available.
Why a privacy impact assessment was completed
The onboarding of ESDC to ATIP Online for ATIP requests and the discontinuation of the department's use of the IRCC portal for the same purpose, transfers initial collection of personal information for ATIP requests on behalf of ESDC from IRCC to the TBS, and represents a substantial modification to the handling of personal information for department. As a result, a PIA is required as per subsection C.2.2.9.2 of the Directive on Privacy Practices.
Additional information
The PIA identified one (1) medium privacy risk.
Risk 1: There is potential for human error in manual transfer of information to and from ATIP Online to ESDC’s ATIPXpress.
Action: Work is in progress to link ATIP Online to ESDC's ATIPXpress
Planned completion: March 2027
Related personal information banks
- Access to Information Act and Privacy Act Requests (PSU 901)
- Access to Information and Privacy Online Requests (PCE 805)
For more information about this privacy impact assessment
ESDC Access to Information and Privacy (ATIP) Coordinator
Telephone: 819-654-6981
Email: NC-COMM-ATIP-AIPRP-GD@hrsdc-rhdcc.gc.ca
Online request: ATIP Online Request Portal
July
S-Docs Repository
Description
S-Docs is a temporary solution that leverages ESDC's existing Protected B Microsoft 365 SharePoint Online environment but adds additional security controls to support drafting and collaboration of pre-Secret or sensitive work. Documents may only be retained in S-Docs for a maximum of 30 days and then moved for proper storage and retention to their assigned ESDC SPO or to the Shared Services Canada Government of Canada Secret Infrastructure (GCSI) for retention of information that exceeds Protected B (i.e., Cabinet Confidence documents).
Why a privacy impact assessment was completed
The assessment was completed on S-Docs to assess potential privacy impacts and to ensure that stricter privacy and security controls were implemented for the temporary use and storage of sensitive work including personal information prior to moving the work to the appropriate repository as a function of its classification.
Additional information
The PIA identified one low privacy risk:
Risk: Retention of documents in S-Docs for longer than is needed
Action: Information Innovation and Technology Branch (IITB) to work with ESDC's Information Management (AIM) to complete the following actions:
- Establish oversight and responsibility of information management for retention and transfer of documents to proper repository for longer retention and archival.
- Enhance reporting capabilities including monthly reporting of length of retention of documents to trigger action to transfer documents out of S-Docs.
Planned completion: December 2026
Related personal information banks
Not applicable
The privacy assessment was completed on a program-agnostic basis. Programs using S-Docs are required to have established PIBs.
For more information about this privacy impact assessment
ESDC Access to Information and Privacy (ATIP) Coordinator
Telephone: 819-654-6981
Email: NC-COMM-ATIP-AIPRP-GD@hrsdc-rhdcc.gc.ca
Online request: ATIP Online Request Portal
August
Identity Governance and Administration (IGA) Project
Description
The Identity Governance and Administration (IGA) project led by the Innovation, Information, and Technology Branch (IITB) involves the implementation of a centralized Identity Access Management (IAM) solution that will replace four legacy systems currently in use at Employment and Social Development Canada (ESDC). The IAM solution will modernize and automate the provisioning and management of digital identities and their associated access and authorization across ESDC.
Why a privacy impact assessment (PIA) was completed
The PIA was completed as required under the Treasury Board Secretariat's Directive on Privacy Practices given that the IGA project represents a substantial modification to the creation, collection, use, disclosure, retention and disposal of personal information for IAM purposes.
This PIA aims to identify, assess, and propose mitigation measures to potential privacy risks associated with the development and adoption of new IAM processes and information technology solutions.
Additional information
The PIA identified one medium-low privacy risk and one compliance issue.
Risk: Incomplete IT security assessment
Action: The IITB will work with internal IT security to complete an IT security assessment prior to implementation of the IAM solution.
Completed in August 2026
Issue: Privacy notice
Action: The privacy notice will be revised to clearly explain how personal information will be used in the IAM solution
Completed in August 2026
Related personal information banks
- Employee Personnel Record - PSE 901
- Professional Services Contracts - PSU 912
- Electronic Network Monitoring Logs - PSU 905
For more information about this privacy impact assessment
ESDC Access to Information and Privacy (ATIP) Coordinator
Telephone: 819-654-6981
Email: NC-COMM-ATIP-AIPRP-GD@hrsdc-rhdcc.gc.ca
Online request: ATIP Online Request Portal
Worker Retention Grant for Work-Sharing Employers
Description
The Worker Retention Grant for Work-Sharing Employers is a new funding opportunity designed to support skills development during Work-Sharing agreements. The Work-Sharing program is part of Employment Insurance (EI) and helps employers and workers avoid layoffs when there is a temporary decrease in the normal level of business activity that is beyond the employer's control.
The new Worker Retention Grant will allow employers with approved and implemented Work-Sharing agreements to top-up the income of their EI Work-Sharing eligible employees who are working reduced hours and opt to participate in the Grant by taking training during non-working days.
Why a privacy impact assessment was completed
The Worker Retention Grant is a new ESDC program that will involve the collection, use, and disclosure of personal information for the purpose of determining an individual's program eligibility, which is an administrative purpose. Accordingly, ESDC conducted a PIA pursuant to requirement C.2.2.9.1 of the TBS Directive on Privacy Practices.
Additional information
The PIA identified one privacy risk and one compliance issue.
Risk 1: Safeguards
Action: Confirm Information Technology quality assurance requirements in the context of the Worker Retention Grant.
Planned completion: September 2026
Issue 1: Personal Information Bank (PIB) and Info Source requirements
Action: Determine any required PIB modifications to reflect Worker Retention Grant activities and update ESDC's Info Source publication accordingly.
Planned completion: September 2026
Related personal information banks
- Employment Insurance Claim Files - ESDC PPU 151
- Additional Labour Market Initiatives - ESDC PPU 295
For more information about this privacy impact assessment
ESDC Access to Information and Privacy (ATIP) Coordinator
Telephone: 819-654-6981
Email: NC-COMM-ATIP-AIPRP-GD@hrsdc-rhdcc.gc.ca
Online request: ATIP Online Request Portal