Introduction
In 2006, the My Account feature was launched to provide visitors to the Statistics Canada website with the option to receive email notifications when products of interest are released. In 2014, My Account was updated and improved to ensure that it continues to meet the needs of its users, and was renamed My StatCan.
Objectives
A privacy impact assessment for My StatCan was conducted to determine if there were any privacy, confidentiality and security issues associated with the web application, and if so, to make recommendations for their resolution or mitigation.
Description
My StatCan includes the following key features: increased access to Statistics Canada information, a more efficient email notification system, and a one-stop registration for all online interactions with Statistics Canada, such as the Chat with an Expert, Question of the Month and StatCan Blog.
Participants are asked to provide a user name (alias) and their email address, which may be used to correspond with them if required, and indicate by checking a box whether they wish to participate in Statistics Canada's future consultations.
A username is a necessary component of the registration process because it allows registrants to log in to My StatCan and customize their home page. It also enables them to participate in Statistics Canada’s online discussion platforms such as Chat with an Expert. Participants are told explicitly that their username will be displayed in their My StatCan account, and alongside their questions or comments in the online discussion platforms.
All questions and comments posted will be subject to moderation to ensure that the rules of engagement are followed and that no personal information is disclosed.
Risk Area Identification and Categorization
The privacy impact assessment also identifies the risk areas and categorizes the level of potential risk (level 1 representing the lowest level of potential risk and level 4, the highest) associated with the collection and use of personal information through My StatCan.
Personal information of respondents:
- Type of program or activity – Level 1: Program or activity that does not involve a decision about an identifiable individual.
- Type of personal information involved and context – Level 1: Only personal information, with no contextual sensitivities, collected directly from the individual or provided with the consent of the individual for disclosure under an authorized program.
- Program or activity partners and private sector involvement – Level 1: Within the institution (among one or more programs within the same institution).
- Duration of the program or activity – Level 3: Long-term program or activity (ongoing).
- Program population – Level 3: The program's use of personal information for external administrative purposes affects certain individuals.
- Personal information transmission – Level 2: The personal information is used in a system that has connections to at least one other system.
- Technology and privacy: The platform will use the Drupal software, which has already been implemented for other Statistics Canada online products, including StatCan Blog and Question of the Month.
- Privacy breach: There is a very low risk of personal information being disclosed.
Conclusion
This assessment of My StatCan did not identify any privacy risks that cannot be managed using existing safeguards.