Integrity Assessment Program

SECTION I - OVERVIEW AND PRIVACY IMPACT ASSESSMENT (PIA) INITIATION

Government Institution

Public Works and Government Services Canada (PWGSC)

Government Official Responsible for the Privacy Impact Assessment

Margherita Finn,
Director, Special Investigations Directorate

Delegate for section 10 of the Privacy Act

Rachelle Delage
A/Manager, Access to Information and Privacy

Name of Program or Activity of the Government Institution

Program Activity: Procurement Services;
Program Name: Integrity Assessment Program

Description of Program or Activity

This program activity identifies PWGSC's primary role in the area of procurement for federal departments. The department provides timely value-added acquisitions and related common services to Canadians and the federal government.

Description of the class of records (COR) associated with the program or activity:

1. Procurement Services (ACQ 300)
   Description: Information on the provision of goods and services offered to federal organizations, the clients, from the definition of the requirements to the close-out of the contract, including a broad base of procurement solutions, such as procurement planning, solicitation planning, solicitation, suppliers selection, details on methods and tools that simplify and accelerate the acquisition of goods and services for satisfying customer's requirements in a manner that will result in the optimum product, resource, operating and contingent cost, solicitation, contract administration, specialized contracts, standing offers, supply arrangements and electronic procurement tools.
2. Commercial Retail and Letting - Parliamentary Precinct (PPB 024)
   Description: Authorize use/occupancy of available Crown inventory space by parties other than government departments or agencies; market vacant space, negotiate leases and prepare lease documentation for execution.
3. Linguistic Contracts (TRA 245)
   Description: Information on the Translation Bureau contracting and procurement process to obtain professional language services. Files include information about identifying the services to be purchased; contract development and approval processes and procedures; contract negotiations; administration of awarded contracts, including amendments if required; post-contract evaluations; information about the contractor such as the company's profile, résumés, diplomas, work experience, previous contracts completed and clients.
4. Real Property (RPB 040)
   Description: Information on the provision of accommodation and related services to government departments and agencies, including leasing activities for both the public and private sector.

Class of Record Number:
PWGSC AQ  300; PWGSC PPB 024; PWGSC TRA 245; and PWGSC RPB 040

Proposal for a New Personal Information Bank

Proposal to modify an existing Personal Information Bank (PIB) - identify PIB registration number and current description:

Note: To ensure consistency of information being shared and provided between the IAP and PWGSC's Industrial Security Sector, a slight amendment to PWGSC PIB PPU 015 (Industry Personnel Clearance and Reliability Records) is required. The modification will reflect the disclosure of information to IAP personnel to validate the existence of a company or individual security screening level. Specifically, the modification will require the following edit (underlined text) in the Consistent Uses Section of PWGSC PIB PPU 015:

“Within government, personal information may be disclosed to Departmental Security Officers, Procurement Officers, officials of the Integrity Assessment Program, and Project Authority Officials.”

The description of PWGSC PIB PPU 015 in Info Source 2011 is as follows:

Description: This bank describes information that is related to security screening assessments of individuals working or applying for work with a government institution and private industry by way of appointment, assignment or contract. Personal information may include completed Personnel Screening, Consent and Authorization Forms, applicable Security Clearance and Personal History documentation and completed Security Screening Certificate and Briefing Forms. The personal information may include biographical information, biometric information (e.g., fingerprints, digital photographs, etc), character assessments (e.g. loyalty, trustworthiness, etc.) citizenship status, contact information, credit information, criminal checks/history information, date of birth, educational information, employee identification number, employee personnel information, financial information, other identification numbers, opinions and views of, or about, individuals,  physical attributes , place of birth, signature military service information. The bank may also describe personal information about any immediate relatives, including name, contact information, date of birth and death, and relationship to applicant.

Proposed new Standard Personal Information Bank

Proposal to modify an existing Standard Personal Information Bank - identify Standard PIB number and current description:

Legal Authority for Program or Activity:
Criminal Code of Canada, subsection 750(3)
Financial Administration Act, paragraph 42(1)(c)
Department of Public Works and Government Services Act (DPWGSA), section 21

Summary of the project / initiative / change:

As stewards of public funds, it is incumbent for PWGSC to exercise due diligence in dealing with suppliers of goods and services and providers of space under leases.

To manage the reputational risk and integrity of the Department and those of the Government of Canada (GoC), PWGSC must ensure the business it is involved in is held to a high standard.

The Departmental Oversight Branch (DOB) has created the Integrity Assessment Program (IAP) to assist in this objective. The IAP will validate information from companies, their parents, subsidiaries, and affiliates to determine if they have been convicted of certain offences that will prohibit them from bidding on GoC contracts/leases. Moreover, PWGSC will continue these validation exercises after contract/lease award to monitor the company throughout the lifecycle of the contract/lease.

SECTION II - RISK AREA IDENTIFICATION AND CATEGORIZATION

A: Type of Program or Activity	Level of Risk to Privacy
Program or activity that does NOT involve a decision about an identifiable individual	1
Administration of Programs / Activity and Services	2
Compliance / Regulatory investigations and enforcement	3
Criminal investigation and enforcement / National Security	4

Details:
DOB is responsible for providing the oversight required to ensure that the Department's integrity and credibility are protected through effective management practices and sound stewardship of public funds. As part of that responsibility, employees of DOB will administer the Integrity Assessment Program (IAP) to assist other Branches of the department (e.g. Real Property Branch (RPB) and Acquisitions Branch (AB)) in ensuring that Departmental operations are being carried out with prudence, probity and transparency.

B: Type of Personal Information Involved and Context	Level of Risk to Privacy
Only personal information, with no contextual sensitivities, collected directly from the individual or provided with the consent of the individual for disclosure under an authorized program.	1
Personal information, with no contextual sensitivities after the time of collection, provided by the individual with consent to also use personal information held by another source	2
Social Insurance Number, medical, financial or other sensitive personal information and/or the context surrounding the personal information is sensitive. Personal information of minors or incompetent individuals or involving a representative acting on behalf of the individual.	3
Sensitive personal information, including detailed profiles, allegations or suspicions, bodily samples and/or the context surrounding the personal information is particularly sensitive.	4

Details:
Information regarding an individual’s criminal conviction background will be collected

C: Program or Activity Partners and Private Sector Involvement	Level of Risk to Privacy
Within the institution (amongst one or more programs within the same institution)	1
With other federal institutions	2
With other or a combination of federal/ provincial and/or municipal government(s)	3
Private sector organizations or international organizations or foreign governments	4

Details:
Information within PWGSC will be collected and shared amongst several PWGSC programs to ensure PWGSC is addressing its legislative mandated responsibility for ensuring integrity in the contracting process. First, information will be provided to and from any Branch involved in hiring a supplier; most often RPB and AB. Second, information may be collected or shared with the Industrial Security Sector, which maintains supplier and individual security screenings.

PWGSC will also collect information from other departments and agencies, such as tax evasion conviction information from Canada Revenue Agency, Competition Act convictions from the Competition Bureau, and conviction information from courts.

PWGSC will also collect information from provincial and territorial sources, such as license restrictions and revocations from the Régie du bâtiment du Québec (RBQ), and conviction information from provincial and territorial courts.

PWGSC will verify open source conviction information with provincial, territorial, and federal courts, as well as the RCMP.

PWGSC may also share conviction information with other government departments.

D: Duration of the Program or Activity	Level of Risk to Privacy
One time program or activity	1
Short-term program	2
Long-term program	3

Details:
The IAP is designed to assist in ensuring greater integrity in the contracting process. Once implemented, it will be considered a permanent solution.

E: Program Population	Level of Risk to Privacy
The program affects certain employees for internal administrative purposes.	1
The program affects all employees for internal administrative purposes.	2
The program affects certain individuals for external administrative purposes.	3
The program affects all individuals for external administrative purposes.	4

Details:
Any individual or company (including sole proprietors) desiring a contract with PWGSC or companies (including sole proprietors) currently on contract through a PWGSC contracting vehicle, as well as tenants (e.g. within the Parliamentary Precinct) will be affected by this program. Additionally, the IAP will affect the individuals of the company, its parent, subsidiaries or other affiliates wherein direct or indirect control can be established.

F: Technology and Privacy	Yes / No
1. Does the new or modified program or activity involve the implementation of a new electronic system, software or application program including collaborative software (or groupware) that is implemented to support the program or activity in terms of the creation, collection or handling of personal information?	Yes No
2. Does the new or modified program or activity require any modifications to IT legacy systems and / or services?	Yes No
3. Does the new or modified program or activity involve the implementation of one or more of the following technologies:
3.1 Enhanced identification methods Please specify:	Yes No
3.2 Use of Surveillance: Please specify:	Yes No
3.3 Use of automated personal information analysis, personal information matching and knowledge discovery techniques: Please specify: PWGSC employees will be required to perform data matching exercises to ensure accuracy of the information collected. For example, data collected from the CRA website on individuals convicted of tax evasion does not include personal data elements that would be sufficient for data accuracy. Therefore, the use of court documents and RCMP criminal records check reports will be required to ensure that any potential adverse information collected by PWGSC is validated for accuracy before any decision is made. Criminal records from the RCMP will not be collected without the individual's consent being recorded by PWGSC and/or a third party service provider.	Yes No

A YES response to any of the above indicates the potential for privacy concerns and risks that will need to be considered and if necessary mitigated.

G: Personal Information Transmission	Level of Risk to Privacy
The personal information is used within a closed system.	1
The personal information is used in system that has connections to at least one other system.	2
The personal information is transferred to a portable device or is printed	3
The personal information is transmitted using wireless technologies.	4

Details:
Conviction information collected will be stored electronically in a database, which will not be connected to the PWGSC network or have internet capability. Information transmitted to/from other Branches and other departments will be performed on the PWGSC network.

H: Risk Impact to the Individual or Employee	Level of Risk to Privacy
Inconvenience.	1
Reputation harm, embarrassment.	2
Financial harm.	3
Physical harm.	4

Details:
The types of personal information collected may cause embarrassment or financial harm to a company or an individual because adverse information being collected on a company or individual may result in a company’s bid being denied or in a company’s existing contract/lease being terminated. It also may prohibit the individual or company from submitting any further bids to any GoC contract.

I: Risk Impact to the Institution	Level of Risk to Privacy
Managerial harm	1
Organizational harm.	2
Financial harm.	3
Reputation harm, embarrassment, loss of credibility.	4

Details:
PWGSC is moving towards a more proactive means of assessing the integrity of the contractors hired/considered by the department. Consequently, PWGSC may experience financial impact if it cancels existing contracts/leases. If it cancels existing contracts/leases, it may require other firm(s) to complete the work, therefore, causing an increase in the financial commitment. These actions may also result in reputational harm to the department.