Introduction
This is an update of the Privacy Impact Assessment prepared in 2009 when Statistics Canada was installing a new automated access control system that replaced the system in place since 2002. The access control system and closed circuit television monitoring are specific to Statistics Canada Headquarters and in the Data Operations Centre.
Description
The automated access control system allows Statistics Canada to maintain the security posture required by the Policy on Government Security for the protection of both its employees and assets. This new system introduced enhanced security features, such as physical barriers, to prevent forceful entry and requires employees to "swipe out" when leaving the building. A system log is automatically generated, logging the entry and exit of employees. This feature supports a greater level of safety and security for Statistics Canada employees, in particular when they are in the buildings after normal hours working hours such as evenings and weekends.
Objectives
The privacy impact assessment for the Automated Access Control System and Closed Circuit Television Monitoring Program was updated to report a new use of the information collected from the automated access control system. Specifically, the entry and exit logs of the employee swipes would now be permitted to be used for investigating safety, security and personnel management.
The privacy impact assessment was also conducted to determine if there were any new privacy, confidentiality and security issues associated with the program, and if so, to make recommendations for their resolution or mitigation.
Risk Area Identification and Categorization
The PIA also identifies the risk areas and categorizes the level of potential risk (level 1 representing the lowest level of potential risk and level 4, the highest) associated with the collection and use of personal information of employees.
- Type of program or activity – Level 3: Compliance or regulatory investigations and enforcement.
- Type of personal information involved and context – Level 1: Only personal information, with no contextual sensitivities, collected directly from the individual or provided with the consent of the individual for disclosure under an authorized program.
- Program or activity partners and private sector involvement – Level 2: With other government institutions.
- Duration of the program or activity – Level 3: Long-term program or activity.
- Program population – Level 2: The program's use of personal information for internal administrative purposes affects all employees.
- Personal information transmission – Level 1: The personal information is used within a closed system (i.e., no connections to the Internet, Intranet or any other system and the circulation of hardcopy documents is controlled).
- Technology and privacy: The Program does not involve the implementation of a new electronic system or the use of a new application or software, does not require any modifications to information technology (IT) legacy systems or the implementation of new technologies.
- Privacy breach: There is a very low risk of a breach of some of the personal information being disclosed without proper authorization. The impact on the individual would be minimal as it would only divulge the entry and exit time as well as a digital recording of the individual taken in public spaces on Statistics Canada premises.
Conclusion
This privacy impact assessment did not identify any privacy risks that cannot be managed using existing safeguards. Statistics Canada has ensured that there are measures in place that meet central agency and Statistics Canada security standards for the protection of personal information captured by the system and the program.