Privacy impact assessment summary for Immigration National Security Screening Program

The Immigration National Security Screening Program (INSS) supports the screening of temporary and permanent residence applicants, as well as refugee claimants. It processes referrals from Immigration, Refugees and Citizenship Canada (IRCC) to the Canada Border Services Agency (CBSA) and Canadian Security Intelligence Service (CSIS) for in depth case examinations. Both CBSA and CSIS provide security assessments to IRCC.

Why a privacy impact assessment was completed

This multi-institutional assessment evaluates and analyzes the systematic exchange of data between CBSA, IRCC, and CSIS in light of modernization efforts. Unlike comprehensive PIAs, this assessment focuses specifically on the privacy considerations introduced by the automation of existing information exchanges for the development, testing, and implementation of the new automated screening solution.

Additional information

CBSA Risks:

1. There is a risk that personal information could be inadequately protected during electronic transmission, processing or storage, without appropriate IT safeguards.
Safeguard: Secure processes for transmission, processing and storage of information will be established and tested to ensure data remains private and protected.
Target date: Fiscal Year 2026 to 2027

2. There is a risk that personal information may not be handled in accordance with expected legal and policy requirements.
Safeguard: CBSA will undertake a programmatic PIA in the next fiscal year.
Target date: Fiscal Year 2026 to 2027

3.There is a risk that system users may access, collect, store, use or disclose information for purposes outside of their responsibilities.
Safeguard: Controls, procedures and role-based user profiles will be established to ensure users only access, collect, store, use or disclose information that is required for their responsibilities.
Target date: Fiscal Year 2026 to 2027

4.There is a risk that planned use and disclosure of personal information and associated rights of an individual may not be sufficiently described and in plain-language in current privacy notifications.
Safeguard: CBSA will update the Security Screening Program class of record and new personal information bank for the Immigration National Security Screening Program.
Target date: Fiscal Year 2026 to 2027

5. There is a risk that personal information obtained for the purposes of a security screening assessment may include information that is invalidated and/or inaccurate.
Safeguard: Controls and procedures will be established to ensure information obtained is valid and accurate.
Target date: Fiscal Year 2026 to 2027

Related personal information banks

IRCC:

• Refugee and Humanitarian resettlement (PPU 008)
• In-Canada Asylum (PPU 009)
• Permanent Economic Residents (PPU 042)
• International Students (PPU 051)
• International Mobility (PPU 054)
• Migration Control and Security Management (PPU 068)

CBSA:

Immigration National Security Screening (TBD)

CSIS:

Security Assessments / Advice (CSIS PPU 005)

For more information about this privacy assessment

Each partner department retains personal information collected for security screening for a set period of time (as per retention policies), which can be found in each department's PIB related to their security screening program. As the information originates with IRCC, CBSA encourages individuals to file requests for access and records correction to IRCC directly. Individuals may formally request access to their personal information, or access to corporate records related to or created by the INSS program by contacting the Access to Information and Privacy Division.