Information Risk Assessment

Aim

The aim of 蓝莓视频鈥檚 Information Risk Assessment program is to:

  1. identify and understand potential privacy and security risks of new or redesigned university business processes or services that use Restricted and Highly Restricted information (including Personal Information), or other sensitive information;
  2. prevent or mitigate negative privacy and security consequences;
  3. enhance privacy and security protection; and
  4. help Information Stewards decide whether to proceed with the initiative.听

When to engage an Information Risk Assessment

The Information and Privacy Commissioner (IPC) of Ontario, has identified examples of the that would benefit from an Information Risk Assessment.听 According to IPC, these initiatives involve substantial change to the processing (i.e., collection, use, or disclosure) of personal information.

To know whether you should engage the Information Risk Assessment process, then please answer all of the following questions which stem from IPC guidance:

  1. Is this a new program(s) that will involve significant collection, use, or disclosure of Restricted or Highly restricted information, including Personal Information? In particular, these would be enterprise-wide initiatives or those involving multiple programs or partners?

听 听 听 听 听 听 鈽 Yes听听听听听听听听听听听听听 鈽 No

  1. Will it involve major changes to existing programs that will involve a significant change in the collection, use and disclosure of Restricted or Highly Restricted information, including Personal Information? In particular, those resulting from: an integration of programs; broadening of target population; change in service delivery channels; expansion of amount or type of data collection; constraining or eliminating opportunities for anonymity or pseudonymity; or major shift toward indirect collection of personal information?

听 听 听 听 听 听听鈽 Yes听听听听听听听听听听听听听 鈽 No

  1. Will it involve use of new technology or one known to impact privacy that could raise significant privacy risks (e.g., biometrics, smart cards, drug testing, or technology with surveillance capabilities)?

听 听 听 听 听 听 鈽 Yes听听听听听听听听听听听听听 鈽 No

  1. Will it involve major changes to technology that will alter: the functionality of information management; access to Restricted or Highly Restricted Information, including Personal Information; or security features?

听 听 听 听 听 听 鈽 Yes听听听听听听听听听听听听听 鈽 No

  1. Will it involve creation or modification of databases that will contain Restricted or Highly Restricted Information, including Personal Information? In particular, where the data is sensitive or relates to a significant number of people, or that will link separate databases or create files that index or point to Personal Information on such databases?

听 听 听 听 听 听 鈽 Yes听听听听听听听听听听听听听 鈽 No

  1. Will it involve creation or modification of identification and authentication schemes that will involve multi-purpose identifiers, biometrics or identity cards? This includes integration with central University systems such as WATIAM, ADFS, and/or LEARN.

听 听 听 听 听 听 鈽 Yes听听听听听听听听听听听听听 鈽 No

  1. Will it involve another significant collection, use, or disclosure of Restricted or Highly Restricted information, including Personal Information that is not captured by the previous 6 questions?

听 听 听 听 听 听 鈽 Yes听听听听听听听听听听听听听 鈽 No

If 鈥測es鈥, complete the Information Risk Assessment intake form

If you responded 鈥測es鈥 to any of questions listed above, then please fill out and submit this intake听听form.听 This will engage the Information Risk Assessment Process for your new or redesigned university business process or service.

If you responded 鈥渘o鈥 to all of the questions listed above, then your initiative does not require that you engage the Information Risk Assessment Process and you do not need to complete the intake form.听 You would be free to proceed with your project with the proviso that you immediately re-evaluate should it be determined that your initiative does involve substantial changes to how restricted or highly restricted information, including Personal Information is processed.

What happens after you submit the Information Risk Assessment intake form?

Intake forms are reviewed听by the Privacy Officer and the Information Security Officer, recommendations are made thereon, and ownership of the findings resides with the relevant Information Stewards.

Timeline

Typically 2-4 weeks (depending on initiative听complexity)

Making Changes

After submitting the Information Risk Assessment intake form, you will receive a re-take link to make any changes to your response.