Introduction

PIAs are generally required when there is:

A new or increased collection, use or disclosure of personal information, with or without the consent of individuals.
A broadening of target population.
A shift from direct to indirect collection of personal information.
An expansion of personal information collection for purposes of program integration, program administration or program eligibility.
New data matching or increased sharing of personal information between programs or across institutions, jurisdictions or sectors.
Significant changes to business process or systems that affect the physical or logical separation of personal information or the security mechanisms used to manage and control access to personal information
Contracting out or devolution of a program or service to other levels of government or the private sector.
Creation of a new or extended use of a common personal identifier(s) (e.g. a SIN number.
An anticipated negative public response due to the privacy implications.