MyCFP Enhancements, Release 1, Program Increment 1

Government institution

Royal Canadian Mounted Police

Head of the government institution or delegate for section 10 of the Privacy Act

Danielle Golden
Director of Privacy
Access to Information and Privacy Branch

Senior official or executive responsible for the privacy impact assessment

Kellie Paquette
Director General
Specialized Policing Services, Canadian Firearms Program

Name and description of the program or activity of the government institution

Canadian Firearms Program

Legal authority for the program or activity

Firearms Act

Standard or institution-specific personal information bank

Canadian Firearms Program, RCMP PPU 100
Canadian Firearms Information System (CFIS), RCMP PPU 037
Inquiries by Firearms Owners, Licence Applicants, and the general public, RCMP PPU 007

Description of the project, initiative or change

The Royal Canadian Mounted Police Canadian Firearms Program is modernizing its service delivery, a period of transformation and automation expected to evolve over five years. The upcoming changes are driven by government priorities led by the Minister of Public Safety and the Minister of Justice and Attorney General of Canada to improve the safety of our cities and communities and reduce gun violence by modernizing systems that are aging and can no longer support functionalities needed, are largely paper-based, and prone to significant error rates. These issues are further compounded by the inability of existing systems and processes to easily adapt to changing legislation, and by client expectations that services should be faster, easier and available at any time.

The MyCFP enhancements provide new functionalities to the cloud-based solution, the Canadian Firearms Digital Services Solution (publicly branded as "MyCFP"), a large scale initiative to digitize services provided by the Canadian Firearms Program. The Canadian Firearms Digital Services Solution will require the collection and use of personal information to determine eligibility for the licensing and registration requirements of firearms as is required today by existing paper or electronic methods. The Canadian Firearms Digital Services Solution is a Microsoft cloud-based service that will coexist with the existing Canadian Firearms Information System until all functionalities are fully integrated. Information collected in the MyCFP Portal is stored and will operate in the RCMP's secure cloud Protected B environment and will interface with the on-premise Canadian Firearms Information System.

Purpose and scope of the privacy impact assessment

This Privacy Impact Assessment on the MyCFP Portal is the third in a series of Privacy Impact Assessments that is being developed incrementally as the program's new online public-facing system evolves, to ensure that the Royal Canadian Mounted Police meets its legal obligations under the Privacy Act, and to ensure that privacy risks are identified, assessed, and mitigated. This initiative provides further functionality that substantially modify the system to provide submission of online applications for a Minor's Licence, for applications under the Aboriginal Peoples of Canada Adaptations Regulations (Firearms), and Fee and Photo Waivers. The Portal is also updated to provide for technological updates for automating and verifying addresses and secure communication between the applicant and the Canadian Firearms Program.

The scope of the Privacy Impact Assessment is restricted to changes in how the Canadian Firearms Program collects personal information related to these enhancements in this release. The same personal information for paper-based services will be collected by the Portal in accordance with the Firearms Act. Personal information collected in the Portal will only be used to determine the existence of an existing client/individual profile in the Canadian Firearms Information System. Data linkages against the Canadian Firearms Information System exist to verify individual identity only.

Privacy analysis

Based on this assessment, privacy impacts associated with the collection and use of personal information in the MyCFP Enhancements, Release 1, Program Increment 1 are expected to be Moderate. Recommendations from the privacy impact assessment process, once fully completed, are expected to reduce these risks to a low (or acceptable) level. In addition, opportunities to improve the Canadian Firearms Program's privacy practices through policy and technical measures were considered throughout the development of the Privacy Impact Assessment.

A) Type of program or activity

Personal information is used for the administration of the Firearms Act (for example to facilitate legislative requirements) and may involve compliance and enforcement activities (for example as required for reasons of public safety and law enforcement).

Level of risk to privacy: Low to moderate risk

B) Type of personal information involved and context

Personal information, with or without contextual sensitivities, for example, personal information collected from or about minors, or representatives of minors, and personal information collected about one's aboriginal or religious community may be collected.

Level of risk to privacy: Moderate risk

C) Program or activity partners and privacy sector involvement

Within the institution, with other government institutions, federal, provincial or territorial, and municipal governments and private sector organizations, international organizations and/or foreign governments.

Level of risk to privacy: Elevated risk

D) Duration of the program or activity

Long-term program or activity

Level of risk to privacy: Moderate risk

E) Program population

The program's use of personal information for external administrative purposes affects certain individuals.

Level of risk to privacy: Moderate risk

F) Technology and privacy

1. Does the new or substantially modified program or activity involve implementation of a new electronic system or the use of a new application or software, including collaborative software (or groupware), to support the program or activity in terms of the creation, collection or handling of personal information?

   Risk to privacy: Yes

2. Does the new or substantially modified program or activity require any modifications to information technology legacy systems?

   Risk to privacy: Yes