Industrial Security Program – Release of Personal Security Screening Information

Privacy Impact Assessment Summary

Purpose

This Privacy Impact Assessment (PIA) is in relation to a proposal to substantially modify Personal Information Bank (PIB) PWGSC PPU 015. Among the changes to the PIB is a thorough description of the consistent uses of personal information collected by the Industrial Security Program (ISP) of the Canadian Industrial Security Directorate (CISD). In addition to sharing personal information with the RCMP, CSIS, and credit bureaus in furtherance of determining a person's eligibility in the ISP, the consistent uses of personal information includes sharing some personal information (i.e. screening and security clearance information) to a select group of authorized persons. Those authorized persons include: PWGSC Procurement Officers, Project Authority Officials, and authorized Security Officials; authorized Security Officials are the following government officials: Departmental Security Officers and Unit Security Officers; and the following private sector officials: Company Security Officers and Alternate Company Security Officers.

The disclosure of “screening and security clearance information” will be done via two methods: telephonically and through the future expansion of the Online Inquiry Service (OIS), a web-based application currently used by some of the authorized persons in obtaining the needed “screening and security clearance information”. The expansion of OIS will include the inclusion of authorized persons who are currently not users of the system. Also, it will include the release of additional information that is not currently available to existing authorized users.

Moreover, the revised PIB includes a reference to the sharing of personal information with PWGSC’s Controlled Goods Program (CGP), which is also referenced in their PIB, PWGSC PIB PPU 045.

Project Description

The purpose of the ISP is to safeguard Protected and Classified information and assets entrusted to industry for contracts administered by PWGSC and, on request, for contracts administered by other government departments (OGDs). Part of that mandate is to assess a person's eligibility for a screening or security clearance level to work for the government, on a government contract, or to respond to a Request for Proposal (RFP).

A person typically applies for a screening or security clearance level through a Departmental Security Officer (a government authorized Security Official) or a Company Security Officer (a private sector authorized Security Official). When applying, a person's signature authorizes the sharing of personal information to facilitate the investigation of the person's eligibility to hold a particular screening or security clearance level. Once the screening or security clearance level is granted, the person's status/clearance level is “held” by the organization (governmental department or private sector company) that submitted the application.

In furtherance of it's goal to assist in facilitating the awarding of government contracts to authorized persons, it has historically been common practice for CISD to release details of a person's screening status or security clearance level regardless of which organization held the clearance. The information was released to authorized Security Officials, PWGSC Procurement Officers, and Project Authority Officials only, and contained the least amount of information possible for these persons to staff government contracts and/or respond/award bids to an RFP.

In October 2008, CISD implemented a short-term solution that required consent forms from individuals, as well as attestation forms from authorized Security officials (stating they would not misuse the information). While addressing this short-term solution PWGSC PIB PPU 015 was identified as falling far short of what is required of a PIB.

In addition to better explaining the personal information collected and its consistent uses, the scope of this project is to eliminate the need for consent forms, while also revising PIB PPU 015 (referenced on all security forms) so that it succinctly and precisely spells out the personal information collected and how and why CISD uses it.

In essence, this project desires “screening and security clearance information” to be released to authorized Security Officials, PWGSC Procurement Officers, and Project Authority Officials upon their request (after validation of their identity). The screening and security clearance information desired to be released to these persons would be done through CISD’s Call Centre, as well as the expansion of a web-based application (Online Inquiry Service) to allow users the ability to verify the information electronically. OIS would be expanded, but would also include mandatory search criteria to eliminate random searching by such indiscrete fields as “first name”.

Parallel Effort

This resulted in meetings between multiple agencies who have related PIBs involving personnel security. These meetings involved Public Works and Government Services Canada (PWGSC) (specifically CISD), Treasury Board Secretariat (TBS), Royal Canadian Mounted Police (RCMP), and Department of Defence (DND) in reference to the following PIBs:

1. PWGSC PIB PPU 015, Industry Personnel Clearance and Reliability Records
2. TBS PIB PSU 917, Personnel Security Screening
3. DND PIB PPU 834, Personnel Security Investigation File
4. RCMP PIB PPU 065, Security/Reliability Screening Records

A collaborative effort is underway among these agencies to revise Treasury Board security clearance forms (TBS/SCT 330-23 and TBS/SCT 330-60) while also aligning each agency’s PIBs with similar language. Therefore, the revised PIB may be amended to accommodate this parallel effort with TBS, DND, and RCMP. Moreover, changes to the Privacy Act Statement and consent declaration of TBS/SCT 330-23 and TBS/SCT 330-60 in Annex D and E may also occur.

Current Practices

For private sector authorized Security officials the information is provided only if the person in whom they are inquiring about is an employee of their organization, or the person has provided an appropriate consent form.

The information is obtained by contacting the Call Centre, who validates the identity of the authorized individual, verifies consent is provided (if necessary), and emails the information in the following table to the authorized individual. The Call Centre requires the authorized security official to provide the individual's name and date or birth; or name and personnel identification number. As most individuals do not know their personnel identification number, the use of an individual's date of birth is the only means available to properly identify an individual from the 350,000+ persons in the database.

For some authorized users, the information can also be obtained through the Online Inquiry Service (OIS). For private industry persons, the security currently in place allows private sector authorized Security Officials access to their own employees only. OIS capabilities are expanded for PWGSC users, wherein they can view the name of the organization that holds the clearance.

Proposed Future Explanation of Information/Data Values

CISD proposes to provide to authorized Security Officials, PWGSC Procurement Officers, and Project Authority officials on all persons in the Industrial Security Program.

An authorized person could obtain this information from the Call Centre in the same manner that is used currently, or through OIS. OIS would be expanded to include the data fields/elements below.

To avoid private companies from randomly searching on competitors, mandatory search criteria will be used. A determination regarding the types of mandatory search criteria will be determined at a later date.

Screening and Security Clearance Information Released to Authorized Persons (Proposed)

Data Field	Explanation of Data Field/Data Values
Name	Name of Individual
Date of Birth	Individual’s date of birth
Personnel ID #	Number assigned to individual by CISD and associated to CISD file.
Name of Organization Holding Person’s Screening/Clearance	Company that submitted the individual’s screening/clearance application. All users of OIS would be able to search on/view this information.
Individual Level	1. Confidential 2. Confidential with Limitations 3. Reliability Status 4. NATO Confidential 5. NATO Secret 6. COSMIC Top Secret 7. NATO Secret with Limitations 8. COSMIC Top SIGINT	9. Site Access 10. Secret 11. Secret with Limitations 12. Top Secret 13. Top Secret SIGINT 14. Top Secret with Limitations 15. Top Secret with Limitations SIGINT
Individual Status	1. Cleared 2. History	3. Close-Out 4. Pending
Individual Type	1. Original 2. Upgrade 3. Transfer 4. Duplication	5. Update 6. Update/Supplemental 7. Reactivation
Date Initiated	Date security forms were submitted to CISD
Date Completed	Date eligibility assessment was completed
Date Granted	Date the level was granted
Date of Renewal	Date the level requires renewal

As with the current practice, it is imperative to note that the status of “Denied” is not permitted to be released to anyone. Although the status is used by CISD for those persons whose application was denied, privacy issues preclude CISD from releasing that status. For those person’s whose status has been denied, CISD releases the status of “Close-Out”.

As indicated in the table, CISD wishes to continue using the same data elements with the addition of releasing the name of the organization that holds the individual’s clearance. By including this additional data element, companies that are bidding on government RFPs are able to check the status of a person’s screening or clearance, as well as the name of the organization that holds the clearance. This data is necessary in order for the many types of companies to submit a bid to an RFP, submit proposed personnel to an open contract competition, and for the Government of Canada to ensure that properly cleared individuals and companies are being chosen to perform work on contracts that include security considerations. Moreover, in some fields where government contracts include a prime contractor and multiple layers of subcontractors, it is important for the prime contractor to verify security clearance information on sub-contractors.

Elimination of the Consent Form

Through this PIA and the parallel effort of amending Treasury Board forms and the PIBS of PWGSC, TB, RCMP, and DND, CISD desires to eliminate the need for the consent forms that have been in place since October 21, 2008.

Identification of Privacy Risks

During this Privacy Impact Assessment several privacy risks were identified. In fact, privacy risks were the driving force behind the CISD management's decision to halt the current, yet long-standing practices, of the ISP. In revising the PIB and completing the PIA, the following risks were identified and addressed:

1. The current PIB Description includes an individual’s Social Insurance Number. In the past, ISP has required the SIN to obtain a credit report. Since the authoring of the PIB, a person’s SIN is not required to obtain a credit report. Therefore, the revised PIB in Annex C no longer includes SIN as a piece of personal information collected. All record of SIN’s collected in the past have been purged from CISDs database.
2. The current PIB was not all encompassing regarding the types of information collected by CISD. The proposed revised PIB provides a comprehensive categorical list of information that may be collected by CISD.
3. The current PIB did not mention that sources other than PWGSC can be used to collect personal information. It has long been acceptable for authorized Security Officials, with the consent of the individual, and on behalf of the Government of Canada, to collect personal information and provide it to CISD. The revised PIB includes the collection procedures by sources other than PWGSC.
4. The current PIB, under “Classes of Individuals” noted “industry personnel”. That distinction is also not an exhaustive list of the classes of individuals with whom CISD collects information. The revised PIB provides a complete and comprehensive list.
5. The current PIB, under “Purpose”, was not as explanatory as needed. The revised PIB provides a more thorough depiction, as well as notes that the Financial Administration Act and the Governmental Security Policy provides the authority to PWGSC to collect and share the information obtained.
6. The current PIB provided “None” under the description of Consistent Uses. This was the most glaring problem with the PIB. The revised PIB provides succinct and thorough explanation of the consistent uses of the information collected. It iterates that information collected supports decisions made by CISD regarding a person’s eligibility in the ISP. It also reflects five areas of specific information sharing: RCMP, CSIS, and credit bureau for requisite checks, as well as PWGSC’s Controlled Goods Program (CGP) and the sharing of some personal information with authorized persons for the purpose of fulfilling personnel requirements as defined in government contracts. The proposed sharing of personal information will be provided in accordance with Section 8(2)(a) of the Privacy Act. This is the most vital of the revised PIB and the reason for the PIA. It will allow CISD to disclose a person’s clearance or screening status, which will aid the Government of Canada in awarding contracts. It will also allow private sector officials with the ability to verify personnel and organization security information in order to respond to government RFPs and real property needs.
7. The current PIB provided a retention and disposal explanation that was not exhaustive. In the revised PIB, the retention standard reflects two years following the last administrative use. As some clearances are valid for 10 years, the retention schedule hinges on the term “administrative use”, which includes termination of the employee from a contract or employment, cancellation of the security clearance or screening, or expiration of the security clearance or screening. The disposal standards have also been properly identified as being sent to Library and Archives Canada for destruction, except for copies of forms kept by private industry, which destroy their documents themselves. Regarding the records held by private industry, destruction guidelines must be done in accordance with the Industrial Security Manual, section 511.
8. CISD must address the 350,000+ individuals who signed the TBS/SCT 330-23 and/or TBS/SCT 330-60 form in its current state. Representatives from PWGSC and the Office of the Privacy Commissioner are in discussions to identify any necessary notification methods. Preliminary discussions have identified one likely solution: to notify the CSOs, who will notify their employees of the revisions to the TBS forms and the PIB. As part of their role as security officials in the ISP, CISD relies on CSOs to perform a myriad of tasks. Enlisting their services is not only an extension of these duties, but is the most effective means available to ensure that 350,000 individuals are given notice of the changes to the PIB and TBS forms. Also, CISD will be posting communiqué in a prominent position on the website to assist in this notification effort. The communiqué in Annex G is a draft version of what will be posted on the website. It may be amended or altered completely once Treasury Board Secretariat revises their forms associated with personnel screening (TBS/SCT 330-23 and TBS/SCT 330-60).

To conclude, the privacy risks that exist with the current PIB and the accompanying operating procedures of CISD are being addressed as a result of this PIA, and the revised PIB, and proper communication to those affected will be ensured.