Shared Services Canada’s technology assessment for privacy implications

Contact Centre as a Service (CCaaS) – Bell/Genesys Cloud CX Platform

Description

Shared Services Canada (SSC) completed a Technology Assessment for Privacy Implications (TAPI) for the Government of Canada’s Contact Centre as a Service (CCaaS) solution delivered by Bell and powered by Genesys Cloud CX, hosted in AWS Canadian regions. The assessment evaluates privacy implications of the technology itself; client departments remain responsible for program-level privacy assessments.

Why a Technology Assessment for Privacy Implications (TAPI) was completed

Following TBS updates in 2024, SSC developed a TAPI instrument to ensure enterprise technologies receive privacy assessments even though the new Standard on Privacy Impact Assessments (PIAs) applies to programs. CCaaS, delivered by the Bell-Genesys partnership, is a new solution being offered by SSC to client departments. This TAPI outlines solution-level privacy considerations for departments.

Summary of privacy risks and mitigation measures

Key risks include indirect caller location data, assumptions that SSC’s assessment replaces departmental PIAs, extensive reporting capabilities, variable retention and dormancy practices, with additional evidence required to address two security controls. Mitigations include departmental confirmation of the necessity of metadata, communication of program responsibilities, report governance, standards for dormant accounts and disposition, and security authorization requirements.

Related personal information banks (PIBs)

The solution itself does not require a PIB. Personal information processed must be captured in each client department’s program-level PIB.

Additional information

The CCaaS platform processes caller and agent data, stored in AWS Canada with limited exceptions for certain sub-processors. The system supports retrieval of personal information for requests under the Privacy Act and includes safeguards such as role-based access, encryption, and logging and validation controls.