The Policy on Privacy Impact Assessments (PIAs)

http://www.tbs-sct.gc.ca/pubs_pol/ciopubs/pia-pefr/paip-pefr-eng.asp

The Privacy Commissioner has publicly endorsed PIAs as a means of ensuring the protection of Canadians' personal information.

Canadian institutions have conducted privacy assessments for a number of years and have taken steps to ensure the protection of Canadian citizens' privacy in their transactions with government. The Policy, however, is new and was developed in consultation with a number of groups, including the Office of the Privacy Commissioner. It is based on the following policies of the government of Canada:

• Ensuring that privacy protection is a core consideration in the initial framing of program or service objectives and in all subsequent activities.
• Ensuring that accountability for privacy issues is clearly incorporated into the duties of program managers and any other participants, including those from other institutions, jurisdictions and sectors.
• Providing decision-makers with the information necessary to make fully informed policy, program, system design and procurement decisions based on an understanding of the privacy implications, risks and the options available for mitigating risks.
• Reducing the risk of having to terminate or substantially modify a program or service after its implementation to comply with privacy requirements.
  
  

  The PIA Policy applies to about 150 federal institutions that include Government of Canada (GoC) departments, agencies and a number of Crown Corporations.

  

• Providing documentation on the business processes and flow of personal information for use and review by departmental and agency staff and to serve as the basis for consultations with clients, the Privacy Commissioner and other stakeholders.
• Promoting an awareness of sound privacy practices associated with program and service delivery by informing the Privacy Commissioner and the public of all proposals for new or modified programs and services that raise privacy issues.

The Policy gives institutions a consistent framework to use when identifying and resolving privacy issues during the design or re-design of programs and services. This framework helps to document, publish and maintain PIAs for all programs and services where privacy issues may be inherent. As a result, it helps assure Canadians that their privacy is protected when they deal with the Government of Canada, whether they transmit their personal information in person, by telephone, by mail or on-line.

The Policy is based on the privacy principles outlined in the Privacy Act and it represents the first time a national government has made conducting PIAs a matter of official policy.

PIPEDA

TBS PIA guidelines