Quebec Economic Development Program

Executive summary

Introduction

This report presents the analysis, results, findings, conclusions and recommendations stemming from the Privacy Impact Assessment (hereinafter referred to as the “PIA” or “the assessment”) of the Quebec Economic Development Program (QEDP) conducted by Yvon Gauthier Info Training Inc. The QEDP was implemented on April 1, 2012, to replace the Business and Regional Growth and Community Diversification programs. The assessment was conducted at the request of the Economic Development Agency of Canada for the Regions of Quebec (hereinafter referred to as “the Agency”).

About the QEDP

The QEDP came into effect on April 1, 2012, in accordance with Treasury Board Submission No. 836423, to replace the Business and Regional Growth and Community Diversification programs, but retained their essential objectives and characteristics. It is intended to guide the implementation and management of grants and contributions, which aims to promote the long-term economic development of the regions of Quebec by giving special attention to those where slow economic growth is prevalent or opportunities for productive employment are inadequate.

Reasons for the decision to conduct this PIA

The Directive on Privacy Impact Assessment published by the Treasury Board Secretariat of Canada (TBS) on April 1, 2010, states that all government institutions subject to the Privacy Act that create, sponsor or fund programs, projects or initiatives involving the collection, use or disclosure of personal information should consider conducting a PIA before proceeding with their projects and initiatives.

Thus, in accordance with advice received from the Treasury Board Secretariat (TBS), a PIA was therefore conducted during fiscal year 2013-2014, and the December 23, 2013 report mentioned that " the collection of personal information for the purposes of QEDP is very limited and, even if it happens that personal information is taken into account by the Agency, decisions from this process are not taken against individuals concerned by this information but rather with regard to the viability of proposed projects. Therefore personal information collected in regards with activities related to QEDP is not used for "administrative purposes" within the meaning of the Privacy Act " Thereby, the report concluded that " There is consequently no need to create a personal information bank about them. "

However, in at least one case in 2014, the Agency collected personal information that could possibly be used for administrative decision-making with consequences for an individual. Although unlikely, it is not impossible that other client’s files result in the collection of similar personal information that could be used for decisions affecting individuals.

Consequently and in accordance with the requirements of subsection 9 (4) of the Privacy Act, the Agency decided to create a personal information bank and requested an update of the PIA report of 23 December, 2013 in order to reflect the new operating environment QEPD.

This report therefore presents the results of the analysis, the findings, the conclusions and the recommendations of the Agency's new practices related to PDEQ,

PIA Objectives

This PIA was intended to

  • verify the legal basis of the QEDP;
  • determine whether all aspects of the QEDP are in line with the requirements and, in particular, the spirit of the relevant provisions of the Privacy Act and generally accepted privacy principles;
  • identify risks associated with its implementation; and
  • when necessary, make recommendations to ensure that the QEDP complies with the applicable legislative and policy framework and eliminates or, at the very least, mitigates the risks identified.

Findings and conclusions

Privacy management framework

At the time of the PIA’s conclusion, the Agency was also developing various instruments to comprise its personal information and privacy management framework. These instruments will allow the Agency to meet the objectives established by the Privacy Commissioner of Canada and the TB.

Protecting personal information under the QEDP

The assessment established that the personal information collected under the QEDP is very limited and that, even when the Agency takes personal information into account, the decisions stemming from this process do not relate to the persons to whom the information pertains, but rather the organizations, based on the proposed projects. Personal information collected for QEDP activities is therefore not used for an “administrative purpose,” as defined in the Privacy Act.

Furthermore, the personal information in question is used solely for the QEDP and only the contact information of certain client representatives will be shared with (external) consultants for QEDP assessment purposes (satisfaction with the process, client approach, etc.).

The results of the risk factor analysis suggest that the QEDP does not pose significant risks to individuals’ privacy and that, as long as the Agency exercises due vigilance, there is no reason for special measures to be taken to protect privacy.

Conclusion

The administration of QEDP relies on the collection and the creation of an extremely small volume of personal information. The evaluation also confirmed that personal information is used only rarely for an administrative purpose within the meaning of Paragraph 3 of the Privacy Act ("use of personal information about an individual in the context of a decision that directly affects the").

That said, it is possible that personal information of a financial nature relating to individuals who agreed to act as surely for the reimbursement of a contribution granted by the Agency are also collected.

Consequently, this PIA has led to the formulation of the following recommendations:

Recommendation 1 – Creation of a Personal Information Bank:

That the Agency include, as provided below and as soon as possible, the personal information bank in its chapter of Info Source, in accordance with the requirements of Subsection 10 (1) of the Privacy Act.

Quebec Economic Development Program

Description: This bank describes the personal information required for the administration of the Quebec Economic Development Program (QEDP). Personal information may include: names, titles, contact information, financial or credit information, biographical information, as well as the opinions and views of, or about, individuals.

Note: The information is kept in the Hermès internal database (which is used for the administration of the (QEDP) and in the financial system of the Agency.

Class of Individuals: Individuals and their spouses who have agreed to stand as surety for the reimbursement of contributions granted by the Agency.

Purpose: Personal information is collected under paragraphs 11 (1) b), e), f), h) and j) of the Economic Development Agency of Canada for the Regions of Quebec Act and is used to evaluate a contribution or grant application submitted by a business.

Consistent Uses: In the cases where an individual has agreed to act as surety for the reimbursement of a contribution granted by the Agency to a company, his/her personal information can be used for the recovery of the contribution or the grant, and be conveyed by the Agency to the following institutions and organizations: funding providers, financial institutions, accounting firms, funding agencies, credit reporting agencies, courts and other judicial bodies, records of personal and movable real rights. Personal information may also be shared with the Canada Revenue Agency (CRA PPU 050 Collection Actions).

Retention and Disposal Standards: Records are kept for a period of 6 years after the last administrative action and then destroyed.

RDA Number: 2015/003
Related Record Number: CED 111, CED 112, CED 121, CED 122, CED 133
Registration (TBS): 20150228
Bank Number: CED PPU 1001

Recommendation 2 - Use and Disclosure of Personal Information:

The use and disclosure of personal financial information relating to individuals who agreed to act as surely for the reimbursement of a contribution granted by the Agency may have the following consequences:

  • credit file affected by the actions of the agency - foreclosures, legal proceedings, etc.;
  • deterioration of relations with other creditors of the individual;
  • loss of reputation;
  • reduced opportunities for economic content;
  • personal bankruptcy or business failure, or both.

It is therefore important that the Agency ensures that individuals who agree to act as surely for the reimbursement of a contribution granted by the Agency to a company are fully informed, at the time of the signing of the contribution agreement and / or the guarantee contract, of the consequences that could possibly result from their commitment.

Recommendation 3 - Retention and Disposition of Personal Information:

That the Agency establish and submit to Library and Archives Canada a retention schedule and disposition with respect to personal information collected for the purposes of PDEQ.

Recommendation 4 - Accuracy of Personal Information:

That the Agency is reviewing its information validation procedures to ensure that in all cases where personal information has to be used for decision making about an individual, they are subject to a rigorous validation process from multiple sources, including individual himself, before proceeding.

Date modified: