PrivaSoft Access Pro Case Management and Redaction

Executive Summary

This report contains a Privacy Impact Assessment (PIA) for the AccessPro Case Management (APCM) and AccessPro Redaction systems (APR). The purpose of this PIA is to provide recommendations on measures to mitigate any privacy issues or risks that may be identified with the Access to Information and Privacy (ATIP) APCM-APR project.

The Access to Information Act   provides any Canadian citizen, permanent resident or corporation present in Canada the right to examine or obtain copies of records of a federal government institution. This information is subject to limited and specific exceptions (exemptions   and exclusions  ).

The Privacy Act   provides any Canadian citizen or permanent resident in Canada with a right to request access to, correct or attach a correction request to his/her personal information that is under the control of a federal government institution. The information is subject to limited and specific exceptions (exemptions   and exclusions  ).

The ATIP Division for Indian and Northern Affairs Canada (INAC) administers both acts and ensures the Institution's compliance with the legislation.

The Act imposes a 30-calendar day deadline to respond to requests. As a result, the department has approximately 20 working days to process a request, i.e. provide information or inform the requester the information is not accessible as it qualifies for exemption under provisions of the Act. In most cases, the Office of Primary Interest (OPI) must provide the ATIP Coordinator all relevant records that respond to a request within seven days of receipt of a retrieval notice, in order to accommodate timelines for Senior Management sign-off prior to submission to the ATIP Division at Headquarters. Due to the deadlines imposed by the Access to Information Act, ATIP requests are considered high priority; therefore, immediate action must be taken.

The Corporate Secretariat has created a Privacy Policy Division, which is under the umbrella of ATIP, to enhance the management and coordination of privacy issues across the Corporate Secretariat. The Privacy Policy Division does not collect personal information but some documents might contain personal information. It creates a formal structure to improve our personal information management, develop better privacy practices and tools, monitor privacy practices and issues, resolve or mitigate identified privacy risks, and provide accountability and consistency. The benefits for INAC are to ensure better privacy practices, increase accountability along with mitigating privacy breaches, and increase compliance with Treasury Board policies such as the Privacy Impact Assessment, Info Source and Information Sharing Agreement between institutions and internal programs.

The Privacy Policy Division is also responsible for the ongoing maintenance of the ATIP Division's internal and external websites. The internal (Intranet) website assists INAC employees in understanding ATIP legislative and policy issues and provides advice and guidance on processing ATIP requests. The INAC external (Internet) website provides information to the Public and their description of their right under both Acts. The result of the Privacy Impact Assessment is also available on the INAC - ATIP website.

The ATIP Division also provides and manages distribution of promotional messages, workshop presentations, training courses, and awareness sessions to increase the knowledge and understanding of ATIP across the Department.

Government organizations are facing an exponential increase in the demand for their information. The Access to Information Act and Privacy Act regulations (ATIP) demand fast capture, retrieval and sharing of information, and many institutions are implementing electronic imaging and document management technology to manage their information more efficiently.

The Access Pro Case Management (APCM) system from Privasoft Corporation is an automated case management solution that gives institutions a flexible and easy-to-use system for managing requests for information and project details while demonstrating accountability and maintaining employee productivity in a secure environment.

The Access Pro Redaction (APR) is imaging software that is designed specifically for information disclosure which provides severing tools in the electronic redaction process.

The personal information is collected under the authority of the Act.

The APCM will capture the requester's personal information such as first name, last name, source (Academia, Business, Consultant, Other Department, Other Government, Political Party, Lawyer, Media, Organization or Public), home address, telephone number and email address. Requests made under both acts may include other personal information. The APR will capture requested documents made under the Access to Information Act and Privacy Act, in order to respond to the requester. The ATIP Advisor will review and apply the exemptions and exclusions as per both Acts. The system which contains Privacy Policy documents such as Memorandum of Understanding, Preliminary Privacy Impact Assessment, Privacy Impact Assessment, Business Case, Legal Opinion, and Statement of Sensitivity. All documents saved in the APR system database are Protected B and below as per the designated classification. The system has an audit trail that records the user's actions, and all system users have secret level security clearance. The personal information will be kept for a period of two years and will then be destroyed.