Privacy impact reports 2026 to 2027 - ESDC
On this page
May
External Credentials Management Service (ECM)
Description
The External Credential Management (ECM) services (known as GCKey and Interac Sign in) was a Shared Services Canada program that offered an anonymous Branded Credential Service that has been in use since 2012. It is a service provided by the Government of Canada to allow individuals to securely conduct online business with various federal government programs and services through sign in services: Interac sign-in services (which uses bank-issued credentials) or GCKey (which is vendor-managed but government-issued credentials). It transitioned to the Canadian Digital Service (CDS) within Employment and Social Development Canada (ESDC) and will be phased out over the next few years and departments will transition to a new product called CanadaLogin. This PIA was undertaken to examine the privacy impacts of the ECM services transition to ESDC/CDS.
Why a privacy impact assessment was completed
This PIA was required to examine the privacy implications of transferring the service from Shared Services Canada to Employment and Social Development Canada.
Additional information
The PIA identified two (2) low risks.
Risk 1: Notice
Action: Update the privacy notice statement to include the legal authority for collection of personal information and to indicate that ESDC/CDS is the responsible government institution, along with an update link to the PIB.
Planned Completion: July 2026
Risk 2: Retention and Disposition
Action: Develop a formal records disposition authority
Planned completion: September 2026
Related personal information banks
- A personal information bank has been registered by Treasury Board of Canada Secretariat (ESDC PCU 607)
For more information about this privacy impact assessment
ESDC Access to Information and Privacy (ATIP) Coordinator
Telephone: 819-654-6981
Email: NC-COMM-ATIP-AIPRP-GD@hrsdc-rhdcc.gc.ca
Online request: ATIP Online Request Portal
HRSB Modernization Programme (HMP) Workforce Management Project (WFM)
Description
The CSFA Program, in partnership with its Service Provider (Nelnet), is implementing a multi‑phase modernization of the Repayment Assistance Plan (RAP) to enhance digital service delivery and borrower experience. Phase 1B focuses on improving the electronic RAP (e‑RAP) application within the Student Hub (SH) by enabling real‑time adjudication and providing borrowers with immediate eligibility information, application status, and repayment requirements.
The system will dynamically validate eligibility as borrowers navigate the e‑RAP landing page, allowing those who qualify to receive automated approval or refusal within seconds. Saved applications can be resumed if still valid, while ineligible borrowers will receive instant notifications explaining RAP requirements. Applications requiring additional verification-such as income or medical documentation-will be flagged for manual review, appear as pending in the Student Hub, and prompt follow‑up from the National Student Loans Service Centre.
Why a privacy impact assessment was completed
In accordance with section C.2.2.9.2 of the Directive on Privacy Practices by Treasury Board Secretariat (TBS), ESDC is conducting a Privacy Impact Assessment (PIA) on the e-RAP modernization phased approach as it contains elements that will lead to an administrative decision on borrowers. The modernization phased approach will contain substantial modifications to the RAP SH website.
Additional information
The PIA identified one (1) privacy risk.
Risk 1: Accountability and Safeguarding
Action: A finalized agreement between ESDC and the Service Provider be implemented that governs how personal information is retained and disposed. Clear retention schedules and procedures on destroying personal information should be in place and responsibilities outlined.
Planned Completion: December 2027
Related personal information banks
- Student Financial Assistance (ESDC PPU 030)
- Canada Apprentice Loans (ESDC PPU 709)
For more information about this privacy impact assessment
ESDC Access to Information and Privacy (ATIP) Coordinator
Telephone: 819-654-6981
Email: NC-COMM-ATIP-AIPRP-GD@hrsdc-rhdcc.gc.ca
Online request: ATIP Online Request Portal