Author: OSB
Version: Public Summary - Privacy Impact Assessment
PIA Date: March 2017
Executive Summary
This is a summary of the Privacy Impact Assessment ( PIA ) completed by the Office of the Superintendent of Bankruptcy ( OSB ) for the OSB Licence Administration Application ( OLAA ).
OLAA provides an online self-service solution for Licensed Insolvency Trustees ( LIT ) and new LIT candidates to apply for new licences or make changes to existing licences, including annual licence renewal. The system allows OSB employees to review applications and track requests. Using OLAA LITs are able to determine what of their information will be available to the general public. Members of the general public will have improved access to a trustee directory including a map with a search function.
Scope of PIA
The scope of this PIA was to assess the potential privacy impacts associated with system improvements, and therefore did not result in any new or substantial modifications to the personal information holdings at Innovation, Science and Economic Development Canada.
Risk Mitigation
The PIA concluded that the OSB is addressing all risks with risk mitigation strategies that are in line with privacy best practices including ensuring:
- the objectives of the TBS Directive on Privacy Practises, that 1) personal information is only created, collected, retained, used, disclosed and disposed of in a manner that respects the provisions of the Privacy Act and the Regulations, 2) PIBs and classes of personal information of the OSB are described in a manner that facilitates the process for individuals to request access to and correction of personal information and 3) the purposes for which the OSB collects personal information and the privacy practices that support the administration OSB programs and activities which are described in the OSB PIS and classes of personal information, were fully considered and followed in the design of the Application.
- limited use, disclosure and retention of the information to the individual owner (LITs and LIT candidates) of the information and OSB employees with proper training.
- the LIT personal information displayed in the Trustee Directory is only that information selected by the owner of the information (the LIT) and that the LIT has online help and hints to assist with their selection.
- a Threat & Risk Assessment was completed confirming that attempts to gain unauthorized access or to elevate privileges within the system were unsuccessful.
- the ISED Privacy Notice is published on OLAA to ensure users are aware of the policy.
- access to the LITs and LIT candidates to the information retained by the OSB about them.
Privacy Principles
The findings and recommendations relating to potential privacy risks for OLAA below are presented in a framework consistent with the ten privacy principles of the CSA Model Code for assessing fair information handling practices.
Principle 1: Accountability
OSB has assigned the accountability for privacy risks and their mitigation.
Principle 2: Collection of Personal Information
The OSB collects personal information pursuant to authority and for the purposes identified in the Bankruptcy and Insolvency Act and related Directives.
OSB has prepared communication material to explain OLAA to LITs and LIT candidates. Notice identifying the purpose of OLAA is available online.
Principle 3: Consent
The information is collected with the specific consent of the individual proving the information.
Principle 4: Use of Personal Information
The authority for the use of personal information is found in the Bankruptcy and Insolvency Act, regulations and related Directives.
Personal information is scheduled for retention and disposition pursuant to the BIA, Rules and Directives.
Principle 5: Disclosure and Disposition of Personal Information
Licensed Insolvency Trustees select what of their personal information is disclosed to the public in the Trustee Directory. Personal information is scheduled for retention and disposition pursuant to the BIA, Rules and Directives.
Principle 6: Accuracy of Personal Information
LITs are required, annually, to attest that the information retained by the OSB is accurate, complete and up-to-date. OLAA maintains a history of all activity including the date of the last information update.
Principle 7: Safeguarding Personal Information
A penetration test was conducted and an ISED Cyber Security Event Management Plan is in place.
Principle 8: Openness
OLAA was developed for the use of a small segment of the public who are Licensed Insolvency Trustees and candidates for licensing. Policies and practices affecting these stakeholders are available on the OSB Website.
Principle 9: Individual's Access to Personal Information
OLAA allows Licensed Insolvency Trustees to see and provide updates to their personal information on record at the OSB. The system is designed to send notification to the owner when their information is changed.
Principle 10: Challenging Compliance
The OSB is responsible for keeping a record of all complaints received regarding an insolvency matter and for conducting a review of such complaints, as needed. Complaints can be lodged concerning privacy issues either through the complaint handling system outlined on the OSB Website by phone, email, fax or in person or could be lodged through OLAA.
Conclusion
This PIA received final approval from Kimberley Eadie, Access to Information and Privacy Coordinator, who is the official responsible for Section 10 of the Privacy Act at Industry Canada, on March 10, 2017.