Privacy Impact Assessment Summary on Canada's anti-spam legislation

Personal information of individuals may be obtained by the OPC from:

1. The SRC by means of data linked to online submissions or reports made to the SRC, through the IC consumer intake form or e-mail forwarding service, third-party data-feeds or honey pots;
2. Individuals providing the information directly by submitting an OPC PIPEDA online complaint form; or
3. Organizations providing direct disclosure of information to the OPC concerning alleged contraventions of CASL, or section 5 of PIPEDA, as it relates to a collection or use described in subsections 7.1(2) or 7.1(3) of PIPEDA, as set out under section 56 of CASL.

Such information is not intended to be used by the OPC for the purposes of making administrative decisions about the individuals who made submissions or reports to the SRC or OPC themselves.

Rather, personal information collected by the OPC as part of its enforcement activities under CASL - specifically that relating to potential targets or respondents - may be used for administrative purposes (i.e., to make decisions that directly affect an identifiable individual).

Typically, the OPC will use such personal information for compliance or regulatory investigations and enforcement (TBS Risk Level 3). However, due to the nature of the spam and electronic threats caught under the OPC's CASL enforcement mandate, e.g. the use of malware to collect or use individual's personal information without consent, it is envisaged that certain investigations may reveal potentially criminal behaviour by respondents.

Therefore, personal information may be used for investigating possible contraventions of CASL with administrative, civil or criminal consequences (TBS Risk Level 4). While actions against persons who make a submission are unlikely, an individual who makes a submission may be called upon to testify or act in support of enforcement actions or legal proceedings.

The use of personal information for investigative purposes and any subsequent disclosure of personal information to law enforcement authorities, foreign states or organizations, will be in accordance with the legislative provisions set out in CASL and the laws and policies of the Government of Canada.^{Footnote 2}

The OPC's CASL enforcement activities do not necessitate the collection, use or disclosure of sensitive personal information.

The personal information collected by the OPC from the SRC will be derived from submissions or reports and will generally be limited to an individual's name, basic contact information and information directly relevant to an alleged incident or wrongdoing. These personal information elements, when combined, are not considered to be sensitive. Indeed, steps have been taken to prevent the collection of such sensitive personal information through the IC intake form.

In some cases, persons who make submissions or reports may provide information that they believe to be relevant to their submission. This information, alone or when combined with other identifiable information, may be of a sensitive nature, e.g. IP address, e-mail address and an example of spam related to a medical condition, treatment or service.

Furthermore, while the OPC will seek to redirect individuals who wish to report concerns about spam and other electronic threats directly to the OPC back to the fightspam.gc.ca website and the IC consumer intake form, it is possible that certain individuals will submit OPC PIPEDA online complaints forms about CASL matters regardless. These forms will contain personal information and may, in some instances, contain sensitive personal information, even if the OPC has not requested such disclosure.

Where the OPC needs to collect additional personal information as part of its enforcement activities, such information will be collected directly from the individual to whom it belongs, or with the consent of the individual by a federal, international, private-sector partner for purposes of enforcing the law. The submission of non-relevant and potentially sensitive data will be strongly discouraged through OPC communications efforts, including the use of the OPC's public-facing website.

The OPC is not expected to use the personal information of individuals submitting concerns about spam or other electronic threats for secondary purposes.

The OPC's CASL enforcement activities will involve the sharing of personal information with the other Enforcement Agencies: the CRTC and CB.

Beyond any independent enforcement activities undertaken by the OPC to enforce PIPEDA, section 57 of CASL requires that all three Enforcement Agencies consult with each other to ensure the effective regulation of CASL.

Subsections 58(3) and 59(3) allows the Privacy Commissioner to disclose information to the CRTC and CB and use information disclosed to it by the CRTC and CB for enforcement purposes.

To facilitate the above, the OPC has entered into a Memorandum of Understanding for Cooperation, Coordination and Information Sharing^{Footnote 3} with the CRTC and CB.

Under section 60 of CASL, the OPC may share such information with the government of a foreign state (where information is relevant to an investigation or proceeding in respect of a contravention of the laws of a foreign state that is substantially similar to the conduct prohibited by Canadian law). Under the same section, information may be shared with a foreign state or organization where the disclosure is necessary in order to obtain from that foreign state or organization information that may be relevant to a Canadian investigation. The sharing of such information must be subject to a written arrangement or agreement.

The OPC may continue to share information with other provincial and international privacy enforcement agencies, by way of an information sharing arrangement or written agreement, as permitted under section 23 and subsection 23.1 of PIPEDA.

All information sharing is also to be conducted in compliance with the personal information handling requirements set out in the Privacy Act.

On July 1, 2014 sections 1 to 7, 9 to 46, 52 to 54, 56 to 67 and 69 to 82 of the CASL will come into force. On January 15, 2015, section 8 of CASL will come into force, and on July 1, 2017, sections 47 to 51 and 55 of CASL will come into force.

Enforcement activities are expected to continue indefinitely, without a set sunset date, in accordance with the Act and its supporting Regulations.

Notwithstanding the above, the indefinite operation of the OPC's CASL enforcement activities is not expected to present an elevated risk to the privacy of individuals.

Personal information collected by the OPC from individuals through the SRC or through its own enforcement activities will be - to the extent possible - limited to that required for stated purposes. The OPC will destroy or render anonymous this information in accordance with its own information retention and destruction policy.

CASL enforcement activities may affect certain individuals for external administrative purposes.

Following CASL's coming into force date of July 1, 2014, the OPC will be regularly extracting data from the SRC's SID. Due to the nature of its enforcement mandate investigating the unauthorized collection or use of personal information resulting from address harvesting, malware and other electronic threats, it is envisaged that some of the data pulled from the SID by the OPC will contain malicious content.

The OPC will establish a network infrastructure with appropriate security measures.

The SRC is intended to be the primary repository of personal information under CASL.

The SRC will provide the OPC with access to working copies of raw information held in the Spam Information Database, and provide analysis on spam trends and other reports of interest.

Direct access to the SRC's SID by the OPC will be restricted to designated individuals. An OPC-funded SRC Analyst will be designated to support the OPC's information needs.

The OPC will extract data of interest from the SRC's SID via secure means. The extent of the information pulled by the OPC from the SRC's SID will be based on pre-determined filters agreed between the SRC and OPC.

The OPC may also receive data direct from individuals wishing to submit information about spam and other electronic threats, through the OPC's PIPEDA complaint form. Such complaints are received as encrypted packages.

Personal information of individuals collected from the SRC by the OPC, for the purposes of analysis and the potential investigation of CASL contraventions is not likely to be sensitive in nature, as the ability to collect sensitive information has been reduced through a redesign of the IC intake form.

Although the volume of such data may be high, the privacy impact on individuals in the event of such a privacy breach by the OPC is considered to be low.

However, the privacy impacts on individuals may increase:

1. where an individual who made a submission or report to the SRC provided information of a sensitive nature in the submission or report, despite being warned not to do so;
2. A small number of individuals may enclose sensitive personal information to the OPC when submitting CASL-related concerns through PIPEDA online complaint forms; or
3. where the personal information gathered by the OPC is used in the context of an ongoing investigation or legal proceeding at the time of a breach.

In most cases, the risk to persons making submissions in the event of a data breach is likely to be limited to inconvenience or embarrassment.

However, it must be recognized that for a smaller group of individuals where sensitive information is involved, the impact may be a more serious invasion of privacy. The overall impact on these individuals and the attendant risk level must be considered Moderate, rather than Low.

Personal information most likely to be collected from persons who make a submission or report to the SRC under CASL is not considered to be sensitive in nature. The impact on any department or agency in the event of a data breach is therefore likely to be moderate.

These impacts are likely to be limited to organizational harms (i.e., a need to change organizational structures, decision-making, responsibilities and accountabilities and/or program activity architecture).

In some cases, depending on the nature of the breach and the personal information lost, stolen, accessed, or corrupted, reputational harms may also arise (e.g., embarrassment, loss of credibility, a decrease in public confidence, and an increase in attention on departmental and elected officials). This has some significance for the OPC due to its role as a privacy compliance regulator.