Preliminary Privacy Impact Assessment Analysis

This page has been archived on the Web

Information identified as archived is provided for reference, research or recordkeeping purposes. It is not subject to the Government of Canada Web Standards and has not been altered or updated since it was archived. Please contact us to request a format other than those available.

Archived

This page has been archived on the Web.

Issue:

The Office of the Privacy Commissioner (OPC) is requesting submissions from stakeholders (industry, industry associations, academics, advocates) and the public as part of its consultations on consumer privacy issues.The OPC will be  also requesting further feedback from interested parties on its draft report on the consultations.

It is expected that some individuals, in their personal capacity, will forward submissions to the Office.  The personal information that they are likely to submit includes name, contact information^{Footnote 1} (optional), and opinions.

The OPC is also asking for people to volunteer their interest in being panelists or audience members. Individuals who seek to be panelists, or those who OPC approaches for this purpose, may provide limited biographical information, in addition to name and contact information. Confirmed panelists will also be asked for a cell phone number for the purpose of contacting them once they have arrived for the event, as well as their arrival and departure dates. In cases where OPC is covering travel costs, panelists will also be providing a travel claim to OPC.

Audience members will be asked to provide their name, organization (optional) and contact information for the purpose of ensuring that there is enough space at the event, to confirm attendance, and to prepare an attendance list.

Both panelists and audience members may volunteer any dietary preferences or mobility constraints.

Names of panelists and audience members will be disclosed to the event planner for the purpose of preparing name tag badges and distributing them at the event.

Does this require a Privacy Impact Assessment?

• a new or increased collection, use or disclosure of personal information, with or without the consent of individuals; YES
• a broadening of target populations; NO
• a shift from direct to indirect collection of personal information; NO
• an expansion of personal information collection for purposes of program integration, program administration or program eligibility; NO
• new data matching or increased sharing of personal information between programs or across institutions, jurisdictions or sectors; NO
• development of or a new or extended use of common personal identifiers; NO
• significant changes to the business processes or systems that affect the physical or logical separation of personal information or the security mechanisms used to manage and control access to personal information; NO  or
• the contracting out or devolution of a program or service to another level of government or the private sector; NO

Preliminary Privacy Impact Assessment

Information to be collected:

1. From authors of submissions: name, contact information (optional), opinions
2. From panelists: name, contact information, limited biographical information, cell phone number, arrival and departure dates, dietary preferences (if applicable), mobility constraints (if applicable); travel claim information (if applicable)
3. From audience members: name, organization (optional), contact information, dietary preferences (if applicable), mobility constraints (if applicable)

Legislative, Policy and Program Authority: Under the Personal Information Protection and Electronic Documents Act, the Privacy Commissioner has authority to conduct research and public education.  The OPC 2010 Consumer Privacy Consultation falls under the Office’s research and public education mandate.

Roles and Responsibilities of primary stakeholders: There are five stakeholders:

Office of the Privacy Commissioner staff is responsible for informing the authors of the submissions that the Office of the Privacy Commissioner of Canada is subject to the Access to Information Act and the Privacy Act. The Office of the Privacy Commissioner’s staff is responsible for reviewing the submissions and summarizing them.  They will produce a report that provides an overview of the consultations, including any written submissions.  This report will not name individuals. OPC staff is also responsible for collecting the names and contact information of audience members to ensure there is enough space at the event, to confirm attendance, and to prepare an attendance list.  OPC staff will also collect name, contact information and possibly limited biographical information about potential and confirmed panelists to determine whether an individual may be an appropriate fit to participate on a panel.  Confirmed panelists will also be asked for a cell phone number for the purpose of contacting them once they have arrived for the event, as well as their arrival and departure dates. In cases where OPC is covering travel costs, panelists will also provide a travel claim to OPC. Panelists and audience members may volunteer any dietary preferences or mobility constraints.

• Authors of submissions will have to provide their names in order for the submissions to be accepted.
• Potential and confirmed panelists will have to provide name and contact information, possibly limited biographical information, Confimred panelists will be asked to provide their cell phone number, arrival and departure dates, travel claims (if applicable), dietary preferences (optional), and mobility constraints (optional).
• Individuals who seek to be audience members will have to provide their name, organization (optional), contact information for registration purposes, Confirmed audience members can volunteer any dietary preferences and mobility constraints.
• The event planner is responsible for preparing name tag badges and distributing them at the events.

Privacy Risks: Persons making submissions to the consultation process will be required to make their name, contact information (optional) and opinions available to the Office.

Individuals are being informed via the OPC web site, the submission form and in the acknowledgement e-mail sent to the individuals that their submissions with respect to the draft report will be made public unless they indicate otherwise.

Data analysis

The Office of the Privacy Commissioner has prepared a Notice of Consultation and Call for Submissions for both the Online Tracking, Profiling and Targeting and the Cloud Computing consultations.

The OPC will be preparing a draft report on the consultations soliciting further comment from interested parties.

The great majority of the submissions will not involve the collection or analysis of personal information. If an individual decides to make a submission, they will provide their name, contact information (optional), and opinions.

This information can be sent in one of two ways:  by email or by postal mail.  If the individual chooses to use e-mail, his/her submission will be sent to a special e-mail address to which limited OPC employees have access.  Individuals will receive a response acknowledging receipt of their submission.  If they send it by postal mail, it will go to the Office’s mailing address.  Whether by e-mail or by postal mail, the submission will be reviewed by a limited number of OPC staff for the purpose of summarizing their submission and preparing the Office’s position on these issues.

The individual’s name and contact information, if provided, will be used to identify the source of the submission.

A secondary use of the individual’s name, contact information and submission may be to contact selected individuals to see if they wish to be panelists or audience members at the consultation events.

If the individual wishes to be a panelist or audience member at one of the consultation events, they can indicate so through the submission process.

Individuals who seek to be panelists, or those who OPC approaches for this purpose, may provide limited biographical information.  If this information is provided, it will be used to assess whether a panelist’s perspective will fit well with the chosen panel subjects and with the balance of perspectives that OPC will be trying to achieve with the panel selection.  Limited biographical information of panelists may also be used in consultation event materials.

Panelists will also be asked for a cell phone number for the purpose of contacting them once they have arrived for the event, as well as their arrival and departure dates. In cases where OPC is covering travel costs, panelists will also be providing a travel claim to OPC. Panelists can also volunteer any dietary preferences and mobility constraints.

Individuals who seek to be audience members will provide their name, organization (optional) and contact information. This information will be used to make sure there is adequate space at the event, to confirm attendance, and to prepare an attendance list. Audience members can also volunteer any dietary preferences and mobility constraints.

Individuals are being informed via the OPC web site, on the submission form and in the acknowledgement e-mail sent to the individuals that their submissions with respect to the draft report will be made public unless they indicate otherwise.

Residual risks

Individuals who provide the Office of the Privacy Commissioner with opinions on the consultation subjects may also provide opinions and information on subjects that fall outside of the consultation topics.

Communications

The call for submissions advises the public that the Office is subject to the Access to Information Act and the Privacy Act.  

Individuals are also advised that, as the OPC cannot guarantee the security of electronic systems or e-mail, we do not recommend sending sensitive personal information electronically at this time.  As an alternative to email, we provide a postal mail address.

Individuals who indicate their interest in participating as panelists will be advised that the Office is subject to the Access to Information Act and the Privacy Act. Individuals are being informed via the OPC web site, on the submission form and in the acknowledgement e-mail sent to the individuals that their submissions with respect to the draft report will be made public unless they indicate otherwise.

Disclosure

The OPC is subject to the Access to Information Act and the Privacy Act. Some of the information provided in this process may be accessible under the Access to Information Act. This does not include personal information as defined in the Privacy Act.

Names of audience members and panelists will be disclosed to the event planner for the purpose of preparing name badges and distributing them at the event.

Limited biographical information of panelists may also be disclosed to the public in consultation event materials.

Individuals are being informed via the OPC web site, on the submission form and in the acknowledgement e-mail sent to the individuals that their submissions with respect to the draft report will be made public unless they indicate otherwise.

Safeguards

Once the Office of the Privacy Commissioner has received a submission, the safeguards include review by a limited number of OPC staff with a need-to-know for the purpose of summarizing their submission.  The names and contact information of those who have provided the submissions will be safeguarded in this manner. The submissions will be stored on a networked drive with limited access rights. The Office of the Privacy Commissioner of Canada has a Privacy Breach Policy.

Where biographical information is provided by potential panelists, it will be reviewed by a limited number of OPC staff with a need-to-know for the purpose of assessing whether an individual may be an appropriate fit to participate on a panel.

Where an individual is participating on a panel, limited biographical information may be used in consultation event materials and therefore disclosed to the public.

Retention and Disposal

The names and contact information of individuals, as well as their submissions, will be retained for the duration of this consultation project, until December 2011.

Biographical information provided by those individuals who indicated their interest in participating in a panel, but who were not selected, will be retained until 2011.

Information retained following the conclusion of the project will be depersonalized for policy and research purposes.

Conclusion

Given the overall low impact on privacy, the Office has concluded that a full Privacy Impact Assessment is not required.