Publications web application: Privacy impact assessment summary

Introduction

Part of the mandate of the Public Works and Government Services Canada's Consulting, Information and Shared Services Branch is to inform Canadians about the federal programs and services available to them. To assist in this mandate, the Consulting, Information and Shared Services Branch's Publishing and Depository Services Program has created a web application to provide an integrated computerized solution for the management, publishing, promotion and sales of Government of Canada publications.

The Government of Canada Publications website is designed to leverage the publishing, marketing and cataloguing expertise of the Public Works and Government Services Canada's Publishing and Depository Services Program to create "one-stop-shopping" for Government of Canada publications.

This website supports other Government of Canada primary portals (the Canada site, 1-800 O-Canada and the Service Canada in-person centres) through providing e-access to bibliographical information, publication availability, distribution sources and ordering information.

Benefits

Visitors benefit from end-to-end services for searching, ordering, and purchasing Government of Canada publications.

Credit card purchasing activities are accomplished through the use of the Receiver General Buy Button, a secure shared government service.

The Publishing and Depository Services Program employs external service providers to deliver its services such as shipping, warehousing and distribution services.

Information about the Crown copyright and licensing section and its activities is also made available on the Government of Canada Publications website. Visitors may request permission to reproduce, adapt, revise and translate any Government of Canada works by downloading the application form accessible from the website in PDF format or by applying online using the web form. The web form provides a fast and easy way to fill out and submit requests for copyright clearance on Government of Canada works.

Report objective

A privacy impact assessment for this on-going initiative was conducted to determine if there were any privacy, confidentiality and security issues associated with the Government of Canada Publications website and its various components/interfaces, and if so, to make recommendations for their resolution or mitigation.

Description

For information on Government of Canada Publications, customers can send their questions or their comments through the Government of Canada Publications website using the Contact Us form or call directly the Publishing and Depository Services Program Customer Service. Personal information collected includes name, telephone number and email address if the visitor wants to receive an answer.

Customers can purchase Government of Canada Publications through the Government of Canada Publications website in addition to traditional channels (that is, mail, fax and telephone).

Only personal information needed for order fulfillment is requested from individuals.

Personal information collected by the Web order form is the same information that the program has been collecting via paper form, and is typical of personal information collected for order fulfillment. The personal information includes individual's name, and either the individual's home or office contact details such as mailing address, email address, fax number and telephone number.

Ordering from the Government of Canada Publications website is a matter of choice by the customer and, therefore, consent is inherent with that choice.

Customers who select to pay by credit card through the Government of Canada Publications website are directed to the Receiver General Buy Button web interface. This secure web interface collects and validates the customer's credit card information. If the credit card payment is accepted, the Receiver General Buy Button web interface returns the authorization number for the payment.

The authorized credit card order is then submitted via an automated interface to the inventory, order and sales management application for order fulfillment. The authorization number is stored in the inventory, order and sales management application and used to process the payment.

The Government of Canada Publications web application does not process, capture or store any credit card information.

Existing customers who have pre-established credit with the program can charge their order on account through the Government of Canada Publications website. Such orders are automatically submitted to the inventory, order and sales management application for order fulfilment. The customer's shipping data is then sent to the external warehouse.

At any time prior to confirm their online order or payment, customers have the option of canceling the transaction and can choose another channel such as mail, fax or telephone to submit their order.

Customers who select to pay by cheque or money order through the Government of Canada Publications website are informed to print the completed order form and mail it along with their payment to the program.

Customers who prefer to use the paper-based order form can mail or fax their order to Publishing and Depository Services Program's customer service. Customers may also contact the customer service desk directly to request publications of their choice. Faxes are received in a restricted access room.

The Receiver General Buy Button also provides a web console service where telephone, mail or fax orders with credit card payments are authorized and captured. The authorization number returned from the Receiver General Buy Button is recorded with the order. All correspondence received is secured in a locked cabinet with restricted access.

The program discloses personal information in accordance with section 8(2)(a) of the Privacy Act, for the completion of inquiries and orders pertaining to Government of Canada Publications.

Financial transactions such as sales and account receivables are submitted to the departmental finance system. Customer information such as name, address, telephone number and email is also provided and stored in the departmental financial system for the purpose of adjustments and reconciliation, should the customer need to be contacted.

Visitors are being informed of the purpose for which their personal information is being collected at every point of collection throughout the Publications website.

Occasionally, the program promotes Government of Canada publications to subscribers to its mailing list. New customers as well as current ones are being informed of the Government of Canada Publication's mailing list for promotional material and have the opportunity to sign up to receive promotional material while they place an order.

Data analysis

Privacy risk management

Table 2: Privacy risks raised in the Publications website's privacy impact assessment
Since many of the risks are currently under mitigation a status is also reported.

Conclusion

This privacy impact assessment of the Government of Canada Publications web application did not identify any privacy risks that cannot be managed using either current safeguards or others that have been specifically developed for the implementation of the system.

The Government of Canada Publications web application poses few privacy risks to Canadians, all of which are considered to be low in severity as they relate mostly to process documentation.

These risks have been mitigated with the implementation of the recommendations in the Privacy Risk Management Plan.