Privacy impact reports 2026 to 2027 - ESDC
On this page
May
External Credentials Management Service (ECM)
Description
The External Credential Management (ECM) services (known as GCKey and Interac Sign in) was a Shared Services Canada program that offered an anonymous Branded Credential Service that has been in use since 2012. It is a service provided by the Government of Canada to allow individuals to securely conduct online business with various federal government programs and services through sign in services: Interac sign-in services (which uses bank-issued credentials) or GCKey (which is vendor-managed but government-issued credentials). It transitioned to the Canadian Digital Service (CDS) within Employment and Social Development Canada (ESDC) and will be phased out over the next few years and departments will transition to a new product called CanadaLogin. This PIA was undertaken to examine the privacy impacts of the ECM services transition to ESDC/CDS.
Why a privacy impact assessment was completed
This PIA was required to examine the privacy implications of transferring the service from Shared Services Canada to Employment and Social Development Canada.
Additional information
The PIA identified two (2) low risks.
Risk 1: Notice
Action: Update the privacy notice statement to include the legal authority for collection of personal information and to indicate that ESDC/CDS is the responsible government institution, along with an update link to the PIB.
Planned Completion: July 2026
Risk 2: Retention and Disposition
Action: Develop a formal records disposition authority
Planned completion: September 2026
Related personal information banks
- A personal information bank has been registered by Treasury Board of Canada Secretariat (ESDC PCU 607)
For more information about this privacy impact assessment
ESDC Access to Information and Privacy (ATIP) Coordinator
Telephone: 819-654-6981
Email: NC-COMM-ATIP-AIPRP-GD@hrsdc-rhdcc.gc.ca
Online request: ATIP Online Request Portal
HRSB Modernization Programme (HMP) Workforce Management Project (WFM)
Description
The CSFA Program, in partnership with its Service Provider (Nelnet), is implementing a multi‑phase modernization of the Repayment Assistance Plan (RAP) to enhance digital service delivery and borrower experience. Phase 1B focuses on improving the electronic RAP (e‑RAP) application within the Student Hub (SH) by enabling real‑time adjudication and providing borrowers with immediate eligibility information, application status, and repayment requirements.
The system will dynamically validate eligibility as borrowers navigate the e‑RAP landing page, allowing those who qualify to receive automated approval or refusal within seconds. Saved applications can be resumed if still valid, while ineligible borrowers will receive instant notifications explaining RAP requirements. Applications requiring additional verification-such as income or medical documentation-will be flagged for manual review, appear as pending in the Student Hub, and prompt follow‑up from the National Student Loans Service Centre.
Why a privacy impact assessment was completed
In accordance with section C.2.2.9.2 of the Directive on Privacy Practices by Treasury Board Secretariat (TBS), ESDC is conducting a Privacy Impact Assessment (PIA) on the e-RAP modernization phased approach as it contains elements that will lead to an administrative decision on borrowers. The modernization phased approach will contain substantial modifications to the RAP SH website.
Additional information
The PIA identified one (1) privacy risk.
Risk 1: Accountability and Safeguarding
Action: A finalized agreement between ESDC and the Service Provider be implemented that governs how personal information is retained and disposed. Clear retention schedules and procedures on destroying personal information should be in place and responsibilities outlined.
Planned Completion: December 2027
Related personal information banks
- Student Financial Assistance (ESDC PPU 030)
- Canada Apprentice Loans (ESDC PPU 709)
For more information about this privacy impact assessment
ESDC Access to Information and Privacy (ATIP) Coordinator
Telephone: 819-654-6981
Email: NC-COMM-ATIP-AIPRP-GD@hrsdc-rhdcc.gc.ca
Online request: ATIP Online Request Portal
Employment Insurance Board of Appeal (EI BOA) and Employment Insurance Enhancement-Recourse Process (EIE-RP)
Description
The Employment Insurance Board of Appeal (EI BOA) initiative will replace the Social Security Tribunal, General Division, EI Section, with the EI BOA for first-level EI appeals. The EI BOA will provide a fair and impartial quasi-judicial process for appeals of EI reconsideration decisions taken by Service Canada on behalf of the Canada Employment Insurance Commission (CEIC). The EI BOA will develop its procedures to provide its services under new changes to the Department of Employment and Social Development Act.
The EI BOA has a technical component which is the Employment Insurance Enhancement - Recourse Process (EIE-RP). Among the many technological components, the EIE-RP will include a secure, electronic, two-way communication to allow EI BOA parties to an appeal, and EI BOA staff to send and/or receive documentation electronically. The objective is to deliver a client-centric, faster, and simpler recourse process for EI benefits.
Release 1 focuses on the implementation of the EI BOA, the delivery of first-level EI appeals, and the foundational technical infrastructure. Subsequent releases (i.e., Releases 2 and 3) involving additional modifications to the IT infrastructure will be covered in corresponding privacy impact assessments (PIAs). ESDA).
Why a privacy impact assessment was completed
The initiative aims to create the EI BOA while transforming EI first-level appeals processes, tools, and systems. This transformation is a substantial modification to how personal information is transmitted and managed, particularly with respect to external access. As a result, a PIA is required according to the Treasury Board Secretariat’s (TBS) Directive on Privacy Practices.
Additional information
The PIA identified three (3) medium privacy risks and two (2) compliance issues:
Risk 1: Accountability
Actions: The EI BOA will define and document roles and responsibilities to clarify who is accountable for the overall handling of personal information.
Planned completion: September 2026
Risk 2: Retention and Disposition
Action: The EI BOA and EI Recourse Process Program to collaborate with Library and Archives Canada (LAC) and ESDC’s Enterprise Information Management (EIM) group to create a Retention and Disposition Authority (RDA) schedule.
Planned completion: A progress update will be provided with the next PIA iteration, coinciding with future project Releases.
Risk 3: Safeguarding
Action: The EI BOA Program will adapt and provide privacy training material to ensure that individuals involved in the Program are sufficiently informed of their privacy obligations in the protection of personal information entrusted to them.
Planned completion: September 2026
Issue 1: Personal information bank
Action: All related personal information banks (PIBs) will describe the personal information collected and used for EI BOA.
Planned completion: June 2026
Issue 2: Privacy notices
Action: The EI BOA and EI Recourse Process Program will ensure all forms include a compliant privacy notice.
Planned completion: April 2026
Related personal information banks
- Employment Insurance Claim Files (PIB) (ESDC PPU 151)
- Interstate Employment Insurance Claims (PIB) (ESDC PPU 170)
- Registration for the Employment Insurance Measure for Self-Employed People (PIB) (ESDC PPU 323)
For more information about this privacy impact assessment
ESDC Access to Information and Privacy (ATIP) Coordinator
Telephone: 819-654-6981
Email: NC-COMM-ATIP-AIPRP-GD@hrsdc-rhdcc.gc.ca
Online request: ATIP Online Request Portal
June
Addendum to Job Bank 3.0
Description
Job Bank is a free bilingual job website that allows job seekers to search for available job opportunities and for employers to find qualified candidates. Job Bank also provides labour market information to help job seekers make informed education, career and labour market related decisions. Job Bank is delivered by ESDC on behalf of the Canada Employment Insurance Commission (CEIC) as part of the National Employment Service pursuant to the Employment Insurance Act.
The purpose of this activity is to include Records of Employment (ROE) data to the list of personal information collected from the existing Job Bank program. Records of employment will be used for Employment Insurance validation services by ESDC. The validation of ROE data will reduce the time required to validate employers.
Why a privacy impact assessment was completed
In accordance with section C.2.2.9.2 of the Directive on Privacy Practices by Treasury Board Secretariat (TBS), ESDC is conducting an addendum to the May 2019 Privacy Impact Assessment (PIA) on Job Bank 3.0. This addendum covers the verification of records of employment (ROE) data provided by the individual. It constitutes an administrative decision as defined under Annex A of the Directive on Privacy Protection.
Additional information
The PIA Addendum did not identify any privacy nor compliance issues as the program’s inclusion of ROE data does not serve a new purpose, and its collection is consistent with the Job Bank program’s mandate.
Related personal information banks
The following personal information bank has been modified to include the use of ROE data and a correction on the naming of the Social Insurance Register.
- Job Bank - (ESDC PPU 711)
For more information about this privacy impact assessment
ESDC Access to Information and Privacy (ATIP) Coordinator
Telephone: 819-654-6981
Email: NC-COMM-ATIP-AIPRP-GD@hrsdc-rhdcc.gc.ca
Online request: ATIP Online Request Portal
Employment and Social Development Canada (ESDC) Privacy Impact Assessment (PIA) Report for Onboarding to the TBS ATIP Online Portal
Description
Employment and Social Development Canada (ESDC) provides access to eligible clients to their personal information or to general government information held by the department through Access to Information and Privacy (ATIP) requests, which have, up until now, been submitted to the department through an online portal held by Immigration, Refugee and Citizenship Canada (IRCC). ESDC discontinued the use of the IRCC Portal on November 19th, 2025.
The Treasury Board Secretariat (TBS) has developed its own client-facing portal for ATIP requests, to which most federal departments and agencies have onboarded. The TBS Online Portal, ("ATIP Online") is a mandated Government of Canada digital platform for ATIP requests. The department has, up until this point, delayed onboarding to ATIP Online due to the non-connectivity of the portal with ESDC's new ATIP processing software, ATIPXpress.
Planned direct connectivity between ATIP Online and ATIPXpress will bring many improvements for ATIP practitioners. ESDC has onboarded ATIP Online knowing that direct connectivity will eventually be available.
Why a privacy impact assessment was completed
The onboarding of ESDC to ATIP Online for ATIP requests and the discontinuation of the department's use of the IRCC portal for the same purpose, transfers initial collection of personal information for ATIP requests on behalf of ESDC from IRCC to the TBS, and represents a substantial modification to the handling of personal information for department. As a result, a PIA is required as per subsection C.2.2.9.2 of the Directive on Privacy Practices.
Additional information
The PIA identified one (1) medium privacy risk.
Risk 1: There is potential for human error in manual transfer of information to and from ATIP Online to ESDC’s ATIPXpress.
Action: Work is in progress to link ATIP Online to ESDC's ATIPXpress
Planned completion: March 2027
Related personal information banks
- Access to Information Act and Privacy Act Requests (PSU 901)
- Access to Information and Privacy Online Requests (PCE 805)
For more information about this privacy impact assessment
ESDC Access to Information and Privacy (ATIP) Coordinator
Telephone: 819-654-6981
Email: NC-COMM-ATIP-AIPRP-GD@hrsdc-rhdcc.gc.ca
Online request: ATIP Online Request Portal