Privacy Impact Assessment Summary: Social Media Monitoring

Summary Issues and Mitigation Strategies

The purpose of the Executive Summary is to provide a brief overview of the IRCC program and/or activity the PIA report will be addressing including the scope (what the assessment will specifically cover), and a list of all the privacy risks identified via the PIA process along with the planned mitigation measures to address these risks. 

About the Program

This PIA was developed to assess IRCC’s social media monitoring activities. Social media monitoring includes the collection, analysis and reporting of online public communications, including forum discussions and social media activity. Such communications are collected through the use of keyword searches run within a third-party social media monitoring software; searches are designed to collect data on communications relevant to IRCC’s mandate and issues of interest under that mandate, rather than data on individuals/clients.

Scope of the PIA

The PIA covers social media monitoring activities, such as what information is put into the tool (keyword searches), how data is collected and transmitted, and how IRCC uses the data (how data is reported and stored). Consideration is also given to the privacy policy of the third-party software, and of social media platforms. Outside the scope of the PIA are traditional media monitoring activities, data collected without the use of the tool, instances where individuals directly engage IRCC, and stakeholder social media activity.

Summary of Privacy Issues and Mitigation Strategies

Privacy concerns are centered on the improper or unnecessary collection and/or use of public communications data. For example, the tool could be used to search for, collect, and/or report personal information that is not required to meet the objectives of the activity. The data generated from the report could also be distributed beyond what is necessary. Privacy issues identified also include the potential for information to be retained for longer than is necessary, or that the information retained/shared may have changed prior to collection. Finally, IRCC’s social media monitoring activities are conducted without direct notification to individuals, with the risk that individuals are unaware of data collection/use.

Mitigations include: the publication of a privacy notice; the publication of the PIB and PIA summaries posted to the website; restriction of access to the tool; the implementation of a usage protocol for all tool users, providing guidance on how the tool is to be used; reporting protocols which require tool users to not include identifiable details from public communications data, and which outline how information should be retained and destroyed; technical mitigations to restrict access to reports generated with data from the tool; and auditing capacity for the access, alteration or other use of reports. IRCC’s ATIP division will be consulted as required to confirm appropriate protocols where existing mitigations are unclear or where an exceptional circumstance may arise