Privacy impact assessment summaries

Privacy impact assessment

Introduction

FINTRAC conducted an evaluation of its activities related to money services businesses (MSBs) as mandated by the Treasury Board's Secretariat Privacy Impact Assessment Policy (PIA). The report from this evaluation was shared with the Office of the Privacy Commissioner in December 2007.

The privacy analysis identified that even though FINTRAC continues to place privacy and security of information as an overarching and fundamental consideration in every aspect of its operations including the Money Services Business Registration Program, there were three privacy risks identified where FINTRAC could improve its compliance with the Privacy Act and related policies.

Objective

Under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), FINTRAC is mandated to receive, collect, analyze, use and disclose personal financial information with respect to money laundering, terrorist activities financing and threats to the security of Canada.

An amendment to the PCMLTFA, through Bill C-25, required FINTRAC to develop and implement a new function - notably the Registration of Money Services Businesses. Pursuant to this, FINTRAC has created a registry of MSBs operating in Canada.

The MSB application will continue to evolve to meet business requirements through various updates and releases. FINTRAC is committed to its adherence to the Privacy Act and in the future will continue to assess the MSB registration's compliance with the Privacy Act and its regulations and periodically update the associated PIA.

Description

To establish and manage this new legislated function, FINTRAC developed a web-based application specifically designed to facilitate the registration of MSBs.

The purpose of the MSB application was to permit FINTRAC to meet the legislated requirement of collecting information about the MSBs and allow MSBs to fulfill their obligations of registering and maintaining their own information up to date, as required by the legislation.

Conclusion

FINTRAC has taken a proactive approach to address or mitigate any potential risk to privacy for each area identified.

1. No Personal Information Bank (PIB) exists with respect to the personal information collected about MSBs and users of the registration system.

   While most of the information collected for registration purposes may be business contact information, some information (e.g. date of birth) is personal information about the agents or mandataries of the MSB. Therefore, FINTRAC has submitted a PIB to Treasury Board Secretariat for registration.

2. A Threat Risk Assessment (TRA) has not yet been done on the MSB Registration system.

   A TRA was conducted on the MSB registry before it became operational in June 2008.

3. No procedure has been established to record and review the nature, frequency and resolution of complaints.

   FINTRAC has a procedure in place with respect to Privacy Act complaints that has been updated to include the management and periodic review of all complaints to ensure that any issues have been addressed.

Privacy impact assessment

Introduction

The Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) is Canada's financial intelligence unit. It is a specialized agency created to collect, analyze and disclose financial information and intelligence on suspected money laundering, terrorist activities financing and threats to the security of Canada. Created pursuant to the Proceeds of Crime (Money Laundering) Act (PCMLA) in July 2000, the Centre is an integral part of Canada's engagement in the global fight against money laundering and the financing of terrorist activities.

The PCMLA was subsequently amended by the Anti-Terrorism Act, which was proclaimed in force on December 24, 2001. The amendments allowed for the extension of the mandate of FINTRAC to cover matters involving the detection and deterrence of the financing of terrorist activity and matters relating to the security of Canada. The amendments also changed the name of the Act to the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA or the Act).

Further amendments to the PCMLTFA contained in Bill C-25 which received Royal Assent on December 14, 2006. Some of those amendments increase FINTRAC's ability to deliver its compliance mandate, such as Money Services Business Registration, and the Administrative Monetary Penalty (AMP) regime, both of which are now in force as of December 30, 2008.

Under the PCMLTFA, FINTRAC has a mandate to receive, collect, analyze, use and disclose personal financial information with respect to money laundering, terrorist activities financing and threats to the security of Canada. To ensure that those parties that are required by the Act to report financial transactions are complying with their obligations, FINTRAC carries out a Compliance Program.

Objective

As activities associated with the Compliance Program involve sensitive personal information, FINTRAC initiated a privacy impact assessment (PIA). The objective of this report is to present the findings of that PIA process.

Description

Previously the PCMLTFA allowed for serious criminal penalties if the Act were contravened. With the amendments to the PCMLTFA contained in Bill C-25 FINTRAC now has the ability to levy civil penalties to deal with lesser contraventions in order to take a more balanced and graduated approach to compliance enforcement. Under the amendments FINTRAC created the Administrative Monetary Penalty (AMP) system, whereby civil penalties can be applied to reporting entities (RE) for non-compliance.

Conclusion

The Treasury Board Secretariat's Privacy Impact Assessment Guidelines were used as the basis for this PIA, which consists of three components:

• Data analysis of the flows of personal information
• Privacy analysis designed to identify compliance with privacy principles
• Privacy issues and recommendations including action items to address identified risks

The privacy analysis examined its adherence to the 10 fair information principles and identified that even though FINTRAC continues to place privacy and security of information as an overarching and fundamental consideration in every aspect of its operations including the Compliance Program of which the Administrative Monetary Penalty (AMP) regime is a part, there were three privacy risks identified where FINTRAC could improve its compliance with the Privacy Act and related policies.

FINTRAC has taken a proactive approach to address and/or mitigated for each area identified as requiring varying degrees of modification:

1. FINTRAC has not, to date, implemented a process for periodically assessing the performance of its staff against its internal compliance process-specific privacy performance standards.

   Considered a moderate risk it was suggested that FINTRAC develop and implement internal oversight processes for assessing compliance with the privacy-related obligations of staff.

   Given that FINTRAC is mandated to protect the personal information with which it is entrusted, all FINTRAC staff including compliance officers are trained and reminded of the requirements of appropriate use and protection of personal information in a number of different formats:

   • Policies and procedures have been developed, which are specifically built into the compliance function.
   • Rigorous Compliance Officer authorization training, which focuses on the collection, use and protection of information.
   • Biennial review by the Office of the Privacy Commissioner as part of a larger, institution-wide assessment of FINTRAC's privacy-related practices.

2. FINTRAC has not completed the process of obtaining a disposal authority for records containing compliance-related personal information from the Librarian and Archivist of Canada.

   Considered a moderate risk, it was suggested that FINTRAC complete discussions necessary to obtain a disposal authority for records containing compliance-related personal information from the Librarian and Archivist of Canada.

   • FINTRAC Info Management met with Library and Archives Canada to discuss putting in place Record Disposition Authorities for all FINTRAC records, including compliance information. Discussions on this matter are on-going.

3. FINTRAC's compliance-related documentation does not fully comply with Treasury Board notice requirements as stated in the Privacy Protection Policy and the Common Look and Feel for the Internet.

   Considered a low risk, it was suggested that FINTRACinsert appropriate notices on electronic and paper forms and Web screens to ensure compliance with the Treasury Board's Privacy Protection Policy and the Common Look and Feel for the Internet.

   • FINTRAC is continually updating its privacy notices on its web-site as well as on our paper reports, and will review all related Common Look and Feel requirements and adjust its privacy notices and statements accordingly.

Introduction

FINTRAC is governed by the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA). This Act authorizes the Centre to collect information that it considers relevant to money laundering activities or the financing of terrorist activities, and that is stored in databases maintained by the federal or provincial governments for purposes related to law enforcement or national security. Given FINTRAC's legislated authority to access these databases, the Centre is a partner in the National Integrated Interagency Information (N-III) system, which will employ a phased approach for federal departments and agencies to access index information from the databases of Canadian police agencies.

FINTRAC has completed a privacy impact assessment (PIA) report concerning its access to index information from the Police Information Portal (PIP) through the Integrated Query Tool (IQT) as part of the N-III system. Although the report was completed as an appendix to the Overarching Cross-Jurisdictional Information Sharing Privacy Impact Assessment (PIA) Report for IQT, coordinated by Public Safety Canada, it relates directly and overlaps with the FINTRAC baseline Reports and Analysis PIA.

Objective

It serves to report on the outcome of the privacy evaluation specific to FINTRAC's business processes and data flows of personal information resulting from the Centre's access to specific index information in the PIP database through the IQT.

Description

The IQT now allows FINTRAC to query and retrieve index information from databases of Canadian police agencies that will be accessible through PIP. FINTRAC's access to PIP will further expand the amount of police information available to analysts, which will allow for more comprehensive and complete intelligence analysis. Accessing PIP information in IQT will also improve efficiency in the Centre's case building because analysts will be able to run queries and receive index information from the various record systems simultaneously.

Conclusion

The TBS'Privacy Impact Assessment Guidelines were used as the basis for this PIA, which consists of three components:

• Data analysis of the flows of personal information
• Privacy analysis designed to identify compliance with privacy principles
• Privacy issues and recommendations including action items to address identified risks

The privacy analysis examined the Centre's adherence to the 10 fair information principles and identified that FINTRAC continues to place privacy and security of information as an overarching and fundamental consideration in every aspect of its operations. There were three low impact privacy risks identified that relate to FINTRAC's compliance with the Privacy Act and related policies.

FINTRAC has taken a proactive approach to address and/or mitigated for each area identified as requiring varying degrees of modification:

1. FINTRAC has not completed the process of obtaining a disposal authority for records containing personal information acquired through IQT from the Librarian and Archivist of Canada
   • MOU has been signed between FINTRAC Information Management and Library and Archives, Canada in November 2009. In 2010, FINTRAC has commenced formal discussions to obtain a record disposal authority (RDA) for all its records, including those containing personal information, from the Librarian and Archivist of Canada.
   • FINTRAC Information Management is defining its full information architecture to ensure that all of the information for which LAC will need to grant RDAs will be ready for their review.
   • FINTRAC ATIP will update its Personal Information Bank with the necessary information regarding the retention and disposal of records containing personal information acquired through government databases (such as PIP).
2. FINTRAC's Personal Information Bank (PIB) PPU 220 Financial Analysis and Disclosure does not contain reference to its access to the IQT query tool.
   • Given its intelligence mandate, FINTRAC must be careful when considering revealing specific sources of information. In order to keep confidential certain government databases to which FINTRAC does not have access FINTRAC is unable to include, in its PIB, a complete list of those databases to which it does have access.
   • The maintenance of such confidentiality can reasonably be expected given FINTRAC's legislated mandate and role as an intelligence agency.
3. FINTRAC has requested an exemption from the IQT policy clause requiring the validation of the information it receives in response to a query.
   • Without the exemption, the required validation would entail a disclosure contrary to the legislative prohibition against unlawful disclosure of information under 55(1) of the PCMLTFA.
   • FINTRAC does not conduct investigations, but rather it provides intelligence leads to law enforcement to assist in their investigations. Law enforcement agencies ensure the accuracy and validity of the information both in their databases and in their investigation case file before actions are take against an individual.

Introduction

In 2023, the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) implemented a new system to manage its human resources (HR) activities. The new system replaced its legacy HR applications with more modern workplace tools that aligned with the Government of Canada's digital transformation initiatives. “Software as a service (SaaS)” tools are the future of Human Capital Management products, and Workday, which is one of them, aligns with the Government of Canada IM/IT strategy. The new HR system provides an efficient and secure means for HR personnel to address recruiting, learning, compensation, absence and time tracking, talent and performance management, and analytics. It also greatly reduces administrative burden particularly in removing manual processes, and improves data management, integrity, privacy and security.

FINTRAC has completed a privacy impact assessment (PIA) concerning its new HR management solution in compliance with the Directive on Privacy Impact Assessments. FINTRAC shared the PIA report with the Office of the Privacy Commissioner in 2023.

Objective

FINTRAC procured the Workday Human Capital Management Solution Suite, which provides its HR Directorate (People, Culture and Workplace) with a single common solution for core functionality, new efficient workflows and self-service, and improved automated reporting capability.

Aside from addressing immediate business needs, the key drivers for upgrading to the Workday solution include:

• ease of use for HR service providers, end users and executives; and,
• advanced security and privacy features.

Privacy risk summary

An important aspect of FINTRAC's mandate under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) is the explicit legal obligation that FINTRAC ensures the protection of personal information under its control. In meeting this obligation, FINTRAC's commitment to privacy protection is an overarching consideration in all of its activities from its intelligence and compliance operations to the delivery of its corporate programs. Along with safeguards established for high security organizations in their agreement with Workday, FINTRAC's implementation of the solution has undergone layered security assessments to ensure that when it was deployed all security risks were identified, mitigated and that FINTRAC employee information is well protected. Along with extensive security requirements and safeguards, there is a non-disclosure agreement in place between FINTRAC and Workday Inc. as well as detailed plans to ensure the timely identification and response to security incidents. These include procedures outlining rolls and responsibilities, risk analysis, communication and documentation of incidents.

Workday is modernizing how People, Culture and Workplace conducts its work and supports its employees. The use of Workday does not introduce new collections or uses of employee personal information; rather it simply modifies and brings greater transparency to how HR transactions are managed. Workday brings program efficiencies by integrating established HR processes and gives FINTRAC employees better access and control of their own information while also providing assurances to employees that their information is safeguarded from unauthorized access and use. Workday has built-in privacy-by-design and security configurations that prevent users from accessing information that is not their own or that they do not have a business requirement to access. Furthermore, unlike FINTRAC's legacy HR processes, since employees are in control of their personal information and have full visibility of their data and records, they are able to ensure that their information is kept accurate and up-to-date.

As such, FINTRAC has assessed that the minor inherent risks of utilizing a third-party solution are far outweighed by the benefits that adopting Workday brings to employees, and their privacy.