ARCHIVED - Performance Measurement for the Government On-Line Initiative

Privacy

Indicator(s)

Adequate steps to protect personal information/individual privacy on-line

Citizens/clients perceive that on-line services offer good privacy protection

Measurement Level and Technique

Measurement at the "whole of government" level using citizen/client feedback, at the departmental level using self-assessments, and at the service level using self- and third-party assessments

Specific tool(s)/data source(s)

1)   Omnibus surveys – includes, e.g., EKOS' Information Highway studies, Ipsos-Reid research

2)   Privacy Impact Assessments (PIAs) – federal institutions conduct PIAs for new or redesigned programs/services that raise privacy issues; they provide the results of these assessments to the Privacy Commissioner before implementation, and publish summaries of the results on their Web sites

3)   Departmental reporting on implementation of the Common Look and Feel Standards for the Internet (CLF) – federal institutions self-assessed their compliance with the seven CLF components (33 standards in total) using either all or a representative sample of their Web sites; the score for each component is an average of what all departments and agencies subject to CLF have reported; the focus, here, is reporting on consistent placement and use of important notices (especially privacy notices) (CLF component descriptions, related standards, and a self-assessment guide are available at: http://www.tbs-sct.gc.ca/clf-nsi/index-eng.asp)

Summary of results achieved in 2003

Very positive – A high percentage of Canadians think that the federal government has the appropriate safeguards in place to protect personal information submitted on-line; they have as much confidence in the federal government as the banks, and more confidence in the federal government than the private sector to protect this information. While many Canadians still have concerns about on-line transactions that require the exchange of personal information, the current take-up of federal services (from 21% in 2002 to 24% in 2003) provides evidence that these concerns are being addressed. Departments and agencies are ensuring that protection of privacy is a key consideration from the initial design of on-line services and onwards; to accomplish this, they are conducting an increasing number of privacy impact assessments. While few Canadians understand the overall privacy stance of the federal government, including the extent to which personal information is being shared among departments and agencies, a majority believe that the privacy law is being followed.

Raw data

General perceptions

• 34% of Canadians believe that federal departments and agencies have easy access to personal information, 25% that access requires a special request, 19% that access depends on personal consent, 18% that sharing with all other departments and agencies is prohibited (Ipsos-Reid, 2003)
• 66% of Canadians have a moderate (58%) to high (eight percent) level of confidence that federal departments and agencies will follow privacy laws regarding the use of personal information, a decrease from 73% in 2001 (EKOS, 2003)

•  70% of Canadians do not mind governments using personal information as long as they know about it and can stop it, up from 66% in 2001 (EKOS, 2003)

• 49% of Canadians are comfortable with some sharing of personal information among federal departments and agencies if it means better and faster service, down from 54% in 2001 (EKOS, 2003)

Perceptions of on-line service delivery

• 54% of Canadians think they have enough information to know how the Internet may affect their privacy, up from 48% in 2001 (EKOS, 2003)
• 70% of Canadians are somewhat (30%), quite (17%), or extremely (23%) concerned about conducting transactions that require the exchange of confidential or personal information on-line (Ipsos-Reid, 2003)

• However, 52% of Internet users have submitted personal information on-line, about the same as in 2001 (51%) (EKOS, 2003)

Perceptions of the federal government

• Canadians have higher levels of trust in CCRA than any other major organisation to safeguard their personal information and not share it without permission (EKOS, 2003)
• Internet users have as much confidence in the federal government as the banks, and more confidence in the federal government than the private sector, in terms of being able to fully protect any personal information they submit on-line (EKOS, 2003)

Privacy Impact Assessment (PIA) process

• The PIA Policy came into effect on May 2, 2002; it outlines a process fordetermining the effects of program or service delivery on individual privacy, and ensures that the appropriate steps are taken to avoid, address, or mitigate any risks; this process also helps provide Canadians with the assurance that their personal information is protected whether it is transmitted through the Internet, in person, by telephone, or by mail
• Departments and agencies are required to conduct a PIA for any new or redesigned program/service that raises privacy issues; specifically, they are required to conduct a PIA if there will be: an increased use of personal information, a broader target population, a shift from direct to indirect collection of personal information, use of personal information for purposes other than those for which it was collected, greater sharing of personal information, contracting out, the creation of a common personal identifier, or an anticipated negative public response
• To date, departments and agencies have submitted 41 PIAs and 16 preliminary PIAs to the Office of the Privacy Commissioner; the expectation is that these numbers will double in 2004-05

• Impacts of conducting PIAs include: a reduction in the risk of non-compliance with privacy legislation and policies, assurance that privacy protection is built into programs and services at the outset, assistance to senior officials in making fully informed decisions, and promotion of an awareness and an understanding of privacy issues by the program and service delivery communities

Common Look and Feel Standards for the Internet (CLF) – Important Notices

• For all departments and agencies subject to CLF, the average level of implementation of the four CLF standards supporting important notices (e.g., placement and content of privacy notices) is 93%, where each standard accounts for one-quarter of the total implementation level

Plans for improvement

•  Independent assessments to ensure appropriate content in the privacy notices posted on federal Web sites, e.g., that they inform Internet users what type of information is being collected (automatically) and the purpose for which it will be used