Meltwater: Social Trends Monitoring Tool - Privacy impact assessment summary

Introduction

Statistics Canada will use Meltwater, a social trends monitoring tool, to search, monitor and analyze social media and traditional media trends and conversations on issues and topics relevant to the Agency’s mandate, in an effort to maintain and improve its public relations, communications, outreach and engagement activities with Canadians.

Objective

A privacy impact assessment for Meltwater was conducted to determine if there were any privacy, confidentiality or security issues with this tool and, if so, to make recommendations for their resolution or mitigation.

Description

Statistics Canada will use Meltwater, a social monitoring tool, to search, monitor and analyze social media and traditional media trends and conversations on issues and topics relevant to Statistics Canada. Using Application Programming Interfaces (APIs), Meltwater performs searches of social and traditional media content based on specific search query keywords relevant to the agency's mandate, indexes the related information found and then presents the results to licensees accessing this tool. The results are then aggregated in summary reports and can be shared internally within the Agency, on a need-to-know basis. The use of Meltwater will allow the Agency to better understand current opinion, sentiment and overall conversation on specific Statistics Canada issues to create communications products that resonate with target audiences.

Risk Area Identification and Categorization

The PIA identifies the level of potential risk (level 1 is the lowest level of potential risk and level 4 is the highest) associated with the following risk areas:

a) Type of program or activity

Program or activity that does not involve a decision about an identifiable individual.

Risk scale: 1

b) Type of personal information involved and context

Sensitive personal information, including detailed profiles, allegations or suspicions and bodily samples, or the context surrounding the personal information is particularly sensitive.

Risk scale: 4

c) Program or activity partners and private sector involvement

Within the institution (among one or more programs within the same institution)

Risk scale: 1

d) Duration of the program or activity

Long-term program or activity.

Risk scale: 3

e) Program population

The program's use of personal information is not for administrative purposes. Information is collected under the Statistics Act.

Risk scale: N/A

f) Personal information transmission

The personal information is used in a system that has connections to at least one other system.

Risk scale: 2

g) Technology and privacy

While the Meltwater web based tool is new to Statistics Canada, its functionalities and objectives are not new. Monitoring of social media and traditional media environments has been a common practice at Statistics Canada for years. The use of Meltwater will make this practice more efficient and will directly support the Agency's desire to further engage with Canadians and translate data stories via social media, media relations, outreach and engagement activities. It will also be a critical support system for the 2021 Census collection strategy. Daily reports on public sentiment will allow for immediate adjustments to our communication strategy in aid of collection. There will also be an update to the agency's social media terms of use to include a section detailing the use of social monitoring tools such as Meltwater.

h) Potential risk that in the event of a privacy breach, there will be an impact on the individual or employee.

Statistics Canada has robust risk mitigation procedures in place to guard against accidental and purposeful privacy breaches. The use of the Meltwater software provides a low risk to the individual because Meltwater will only access individuals' publicly-available personal information which is made available by the user through the social media accounts' privacy settings. Meltwater uses open Application Programming Interfaces (APIs) to access public social media and traditional media databases. APIs are a software intermediary that allow two applications to talk to each other. Meltwater performs searches of social and traditional media content based on specific search query keywords relevant to the agency's mandate, indexes the related information found, and then presents the results to licensees accessing this tool. The results are then aggregated in summary reports and can be shared internally within the agency, on a need-to-know basis.

The Agency's risk mitigation practices/measures will be fully utilized to guard against purposeful breaches. This includes the employee security screening process, leveraging Statistics Canada's culture (of privacy and confidentiality protection), and leveraging practices and training material used with the Agency's interviewers designed to physically control access to confidential data. Training material will outline the policies and directives governing employees' day-to-day activities.

There is a low risk of a breach of some of the personal information being disclosed without proper authorization, noting the impact on the individual would below. This is because the information available through Meltwater is limited to the specific search criteria, and because any personal information collected by the application is already publicly available and consistent with the parameters outlined by the social media platforms.

i) Potential risk that in the event of a privacy breach, there will be an impact on the institution.

There is a very low risk of a breach of some of the personal information being disclosed without proper authorization. The impact on the institution would be low.

j) Potential risk of Meltwater users being able to identify an individual by the information obtained such as their IP address, a picture or a chain of unique characters.

It is not intended for Meltwater users to access IP addresses, pictures or videos. None of that information is necessary and has no value to the Agency. However, certain identifiable information may be visible to our select Meltwater users due to the nature and settings of an individual's account or social media platform. For example, information about location is accessible in Meltwater if the individual has agreed and consented to a) publishing location information in social media posts, b) publishing location in their profile, or c) enabling social media platforms to access their devices internal GPS (location services are enabled). It is important to mention that access to Meltwater will be controlled through licenses administered to only a select group of individuals on the social monitoring and social media teams. Personal information accessed through the tool will be controlled through licenses administered to only a select group of individuals on the social monitor and social media teams. Personal information accessed through the tool will only be disclosed on a need-to-know basis.

There is a very low risk of an individual being identified by their IP address, pictures, videos or via a chain of unique characters in their messages. The impact on the institution would be low.