Appendix A: Preliminary Analysis Questionnaire
1. Project and Institution
Project Title		
Institution 		
Department 		
Project Lead		

2. PIA Lead 

Name and Title		
Institution 		
Department 		
Phone Number		
e-mail		

3. Project Description
Describe the project, that is, the program, system, application or activity, that is the subject of the PIA including its purpose, scope and key objectives. Attach relevant project documentation, if necessary.

4. Collection, Use and Disclosure
4.1	Identify the kinds of information involved in the project (check all that apply).
	Yes	No	Unknown	
Information about individuals in their personal capacity				
Information about individuals acting in their business, professional or official capacity, for example, name, job title, and business contact information				
Information about institutions, for example, for profit and not-for-profit institutions and government institutions				
Aggregated, anonymized or de-identified information. Outline in the row below the process followed to aggregate, anonymize or de-identify the information and whether it is possible to identify/re-identify individuals from that information.				

4.2	Identify the kinds of personal information that will be collected, used, retained, disclosed, secured and disposed of (check all that apply).
	Collect	Use	Retain	Disclose	Secure	Dispose	
No personal information							
Unknown at this time (Please explain why in row below.)							

List the types of personal information involved in the project and indicate in the columns on the right whether this personal information will be collected, used, disclosed, retained, secured or disposed of. (Add rows as necessary.) If third parties will be involved in the project, think about what they may be doing with personal information as well. (Add rows as necessary.)							
							
List each element of non-personal information that, when combined or linked, may enable identification of an individual, and indicate in the columns on the right whether that information will be collected, used, disclosed, retained, secured or disposed of. (Add rows as necessary.)							

4.3	To whom does the personal information relate? List all the individuals whose personal information will be involved in the project, that is, the data subjects.

	

5. Privacy Legislation
5.1 Identify applicable privacy legislation (check all that apply).

	Yes	No	Unknown	
Freedom of Information and Protection of Privacy Act				
Municipal Freedom of Information and Protection of Privacy Act				
None or other (Please explain below.)				

5.2 Public Records and Excluded Personal Information
	Yes	No	Unknown	
Identify any personal information that will be maintained for the purpose of creating a record that is available to the general public. What is the type of personal information, and why and how is it made available to the general public? (Please explain in row below.)				

Identify any personal information that will be excluded from the application of the acts by section 65 of FIPPA and section 52 of MFIPPA. What is the type of personal information and why is it excluded? (Please explain in row below.)				

6. Conclusion 
Indicate whether or not you will proceed with the PIA process and the reasons for your decision.	

	

Appendix B: Project Analysis Questionnaire
1. Scope of PIA 
Define the scope of the PIA review and analysis, that is, what aspects of the project are in and out of scope. 

	

2. Project Authority 
Describe the regulatory and legal framework for the project (for example, applicable legislation and regulations, bylaws, memoranda of understandings, agreements, contracts and other relevant instruments).

	

3. Project Characteristics 
3.1	Identify key characteristics of the project (check all that apply).
	Yes	No	Unknown	
Involves creating a new program, process, service, technology, information system or other type of IT application				
Involves a change to an existing program, process, service, technology, information system or other type of IT application				
Involves procuring goods or services 				
Involves outsourcing or contracting for services related to the collection, use, disclosure, processing, retention, storage, security or disposal of personal information 				
Involves developing a request for bids, proposals or services				
Involves a process, system or technology for which the privacy risks are not known or well documented				
Involves creating an information system or database containing personal information, and/or the matching, merging, combining or centralizing of databases				
Involves information sharing (internal and external) 				
Involves the need to identify, authenticate or authorize users – public and/or internal staff				
Other activities that may impact privacy. (Please explain below.)				

	

3.2	If you answered yes to any of the above, explain the identified process or activity. Attach all relevant documentation to your completed Project Analysis Questionnaire. 

	

3.3	Identify any changes that will result from the project (check all that apply).
	Yes	No	Unknown	
Involves a change in business owner				
Involves a change to legislative authority				
Involves a change in users (internal and external) of a related process or system				
Involves a change in partners or service providers (internal and external)				
Involves a change in the amount, type of or ways that personal information is collected, used, disclosed, retained, secured or disposed of				
Involves a change to the purposes for which personal information will be collected, used or disclosed				
Involves a change from direct to indirect collection of personal information				
Involves a change in roles and responsibilities, that is, who can do what, when, where, why and how with personal information				
Involves a change to, or elimination of, existing practices of anonymizing or de-identifying information 				
Involves a change in the process or technology used to collect, use, disclose, retain, secure or dispose of personal information, for example, hardware and software				
Involves a change to an information system or database containing personal information				
Involves a change of medium or service delivery channels, for example, the automation of manual process, conversion from paper to electronic records or the, creation of a new website to provide services to clients				
Involves a change in the security requirements or measures				
Other (Please specify change or proposed change below.)				

	

3.4	If you answered yes to any of the above, explain the change, that is, what specifically will change and why it is necessary. Attach all relevant documentation to your completed Project Analysis Questionnaire. 

	

3.5 Document any additional business processes identified from your analysis of the factors identified in the guide. Attach all relevant documentation to your completed Project Analysis Questionnaire. 

4. Technology
4.1	Identify technology-related characteristics of the project (check all that apply).
	Yes	No	Unknown	
Involves technology designed to monitor, track or observe an individual or their transactions, for example, video cameras, cell phones and geospatial or location-based services				
Involves logging information, usage or preferences, for example, IP addresses, traffic data, access or transaction logs, cookies, or other mechanisms for recording an individual’s use of technology				
Involves public-facing Internet communications, services or transactions, including websites, blogs, forums, bulletin boards, or social media 				
Involves using analytics or performance measurements, for example, web analytics, social media analytics, or business intelligence tools				
Involves processing or storing of personal information in a virtual environment, for example, cloud computing				
Involves acquiring, or customizing, commercial software, hardware or IT support services by external vendors 				
Involves developing, or customizing, software, hardware or IT support services “in-house”				
Involves creating information systems or other types of IT applications that will be populated by others, for example, clients of system or service will supply information				
Involves a system or application that will automatically collect, use, disclose or retain personal information				
Other (Please explain below.)				

4.2	If you answered yes to any of the above, provide an explanation of the technology (that is, purposes, why necessary and how used). Include your answers to the technology questions in the guide. Attach all relevant documentation to your completed Project Analysis Questionnaire. 

5. roles and responsibilities
5.1	List other institutions or other third parties involved in developing or implementing the project and describe their role.
Institution/Third Party	Project Role	

		

5.2	List all institutions or other third parties that will collect, use/process, retain, store, disclose secure or dispose of personal information on behalf of your institution. 
Institution/Third Party	Relationship to Institution	Project Role	

			

5.3	Identify any location outside of Ontario where personal information may be retained or stored and the third parties involved.
Personal Information	Location	Third Party	

			

5.4	List all other parties that will have access to, or use, the personal information, for example, other program areas, IT staff, legal counsel, etc.
Party	Relationship to Project	Project Role	

			

5.5	Identify how other institutions or third parties will be bound to follow relevant privacy and security requirements (check all that apply).
	Name of Institution or Third Party	In Place	Being Developed	Unknown	
Contracts					
Memoranda of Understanding					
Agreements (service level and trade)					
Other (Please explain below.)					

6. Relevant Information
Document what and how all types of information relate to each business process and activity relevant to the project. Consider the factors identified in the guide. Attach all related documentation to your completed Project Analysis Questionnaire.

	

7. Personal Information Flows
7.1 	Document, in detail, the lifecycle of the personal information involved in the project in a manner that suits the project’s and your institution’s needs. This can be done by an information flow table or diagram. Specify the personal information involved in the project from creation and collection to final disposition. Attach any documentation needed to support your definition of personal information flow throughout the project to your completed Project Analysis Questionnaire.

Appendix C: Privacy Analysis Checklist 
Answering the following questions can help you to identify the privacy risks that need to be addressed and the steps to be taken to ensure compliance with FIPPA or MFIPPA. You can use the table below to organize your work or it can be adapted to your own purposes and needs. Adapt to meet the needs of the project and your institution, while ensuring you address all the identified questions. Consider each instance of how personal information is involved when completing the checklist. For example, when asked about authority to collect, consider all types of personal information you will collect. 

Privacy Requirement Questions	Findings	
Privacy Impact	
Action Items	
	
Put a check mark (√) in the appropriate column for each question.
This will create a visual representation of how the project will comply with FIPPA or MFIPPA. 
If your findings differ depending upon the type of personal information involved, add rows to document and explain the differences for each type.

Y	N	IP	NA	Explanation			
Review each question and determine how each relates to the project. 
Note: Do not use the checklist as a substitute for the legislation. The statutory provisions have been summarized here. 
					Outline how you arrived at your findings. 
Provide as much information as is available, particularly if action is planned, but not yet implemented. 
Outline any options or alternatives that were, or need to be, considered.
Explain why no action has been taken or planned for each “N” finding, and why requirements are “NA” to the project. 	For each finding, outline the potential impact on privacy, for example, non-compliance with FIPPA or MFIPPA, increased intrusiveness into the private lives of individuals or it does not meet the public’s expectation of privacy.	For each finding, identify the action(s) necessary for compliance with the privacy requirement or to mitigate or avoid a potential privacy impact.

A. Collection 
Key Requirements:
•	For each collection of personal information, ensure that the institution collects personal information only if it has the authority to do so. Consider the following:
o	Is the collection expressly authorized by statute?
o	Will the personal information be used for law enforcement purposes? 
o	Is the collection necessary for the proper administration of a lawfully authorized activity?
•	Personal information should be collected directly from the individual to whom it relates, unless another manner of collection is authorized by the individual or statute.
•	Notify the individual of the collection, including legal authority, purpose(s), and contact information of a person who can answer questions about the collection.
•	See sections 28 and 29 of MFIPPA and sections 38 and 39 of FIPPA.

Privacy Requirement Questions	Findings	
Privacy Impact	
Action Items	
	Y	N	IP	NA	Explanation			
Authority	
Is the collection of personal information authorized under FIPPA or MFIPPA or another act? 								
Do all parties collecting personal information have legal authority for the collection?								
Has responsibility for the collection been assigned to program staff or third party service providers?								
Purpose of Collection	
Has the purpose of the collection been defined? What is the purpose of the collection?								
Notice to Individual	
Will notice of collection be provided to the individual(s)? Explain timing, method, and exemptions from notice, where authorized.								
Will the notice of collection comply with FIPPA or MFIPPA? Explain how or missing components. 								
Manner of Collection/Source of Personal Information	
Will personal information be collected directly from the individual? Explain the form of collection (for example, orally, hardcopy form, online portal, etc.)								
Will personal information be collected indirectly from another source, or covertly? Why?								
Will indirect collection comply with FIPPA or MFIPPA? Explain authority for indirect collection.								
Controls	
Will the project only collect personal information for which there is legal authority?								
Will there be periodic reviews of the collection controls to ensure effectiveness?								
Data Minimization	
Is personal information necessary for the project to proceed? 								
Is collection of all the personal information necessary? Why or why not?								

B. Use 
Key Requirements: 
•	For each use of personal information, ensure that all parties involved in the project, for example, your institution, partners and other third parties, use personal information only with the authority to do so.
o	Is the use for the purpose it was collected or for a consistent purpose?
o	Is the use authorized by the individual to whom it relates?
o	Does the use comply with another statute? 
o	Is the use for other purposes permitted by M/FIPPA? 
•	See section 31 of MFIPPA and section 41 of FIPPA.

Privacy Requirement Questions	Findings	
Privacy Impact	
Action Items	
	Y	N	IP	NA	Explanation			
Authority	
Do all parties using personal information have the legal authority for the use(s)?								
Purpose(s) of use	
Has the purpose of the use been defined? Explain purpose(s).								
Will personal information be used for other purposes? 								
Will uses of personal information be for purposes stated in the notice of collection or for a consistent purpose?								
Manner of Use	
Have all parties using personal information been defined, for example, program staff, consultants, agents, third party service providers, etc.?								
CONTROLS	
Will there be procedural, technical, and physical measures in place to ensure personal information will be used only for authorized purposes and by authorized parties? Explain measures.								
Will there be periodic reviews of the use controls to ensure effectiveness?								
Data Minimization	
Is use of all the personal information necessary for the project to proceed? Why or why not?								

C. Disclosure 
Key Requirements:
•	For each disclosure of personal information, ensure that all parties involved in the project, for example, your institution, partners and other third parties, disclose personal information only with the authority to do so. Consider the following:
o	Is the disclosure for the purpose for which it was collected or for a consistent purpose?
o	Is the disclosure authorized by the individual to whom the personal information relates?
o	Does the disclosure comply with another statute? 
o	Is the disclosure for other purposes permitted by M/FIPPA?
•	See section 32 of MFIPPA and 42 of FIPPA.

Privacy Requirement Questions	Findings	
Privacy Impact	
Action Items	
	Y	N	IP	NA	Explanation			
Authority	
Do all parties disclosing personal information have the legal authority for the disclosures?								
Purpose(s) of Disclosure	
Has the purpose of the disclosure been defined? Explain purpose(s).								
Will personal information be disclosed for other purposes? 								
Will disclosures of personal information be for purposes stated in the notice of collection or for a consistent purpose?								
Manner of Disclosure	
Have all parties disclosing personal information been defined, for example, program staff, consultants, agents, third party service providers, etc.?								
Has the manner of disclosure been defined, for example, oral, mail, email, etc.?								
Will the disclosures be documented and how?								
Information Sharing Agreement	
Will disclosures be documented and controlled by information sharing agreements or other means?								
controls	
Will there be controls in place to ensure personal information will be disclosed for authorized purposes, by and to authorized parties? Explain controls.								
Will there be periodic reviews of the disclosure controls to ensure effectiveness?								
Data Minimization	
Is disclosure of all the personal information necessary for the project to proceed?								
Disclosure for Research Purposes	
Is it reasonably likely that personal information will need to be disclosed for research purposes?								
Disclosure for Fundraising Purposes	
Is it reasonably likely that personal information will need to be disclosed for fundraising purposes?								

D. Accuracy and Correction
Key Requirements:
•	Take reasonable steps to ensure personal information is not used or disclosed unless it is accurate, complete and up-to-date.
•	Ensure that every individual is able to:
o	correct their personal information, 
o	have a statement of disagreement attached to the personal information if the correction is not made and 
o	require a notice of the correction or the statement of disagreement to be sent to anyone to whom the personal information was disclosed within the year before the above action was taken.
•	See sections 30(2) and 36 of MFIPPA and 40(2) and 47 of FIPPA.

Privacy Requirement Questions	Findings	
Privacy Impact	
Action Items	
	Y	N	IP	NA	Explanation			
Standard of Accuracy	
Will there be measures in place to make sure personal information is not used, unless it is accurate, complete and up-to-date? Provide details of measures.								
Correcting the Personal Information	
Will there be a defined and documented process for the processing of a request for the correction of personal information? Provide details of process.								
Correction Requests/Statement of Disagreement	
Will there be a defined and documented process for individuals to request the correction of their personal information? Provide details of process.								
Controls	
Will controls be in place to ensure that only authorized personnel will be able to add, change or delete personal information?								
Will there be periodic reviews of the controls to ensure effectiveness?								

E. Security 
Key Requirements:
•	Take all reasonable measures to prevent unauthorized access to personal information in your custody or control, taking into account the nature of the record to be protected.
•	Access should be restricted to only those individuals who need the personal information for the performance of their duties.
•	Take all reasonable measures to protect personal information against loss or theft, unauthorized access, use or disclosure, inadvertent modification, destruction or damage, taking into account the format of the record to be protected. 
•	See Ontario Regulation 823, section 3 of MFIPPA and Ontario Regulation 460, sections 3 and 4 of FIPPA.

Privacy Requirement Questions	Findings	
Privacy Impact	
Action Items	
	Y	N	IP	NA	Explanation			
Security Measures	
Will measures be used to secure the personal information? Explain each physical, technical and procedural measure.								
Controls	
Will security policies and procedures be defined and documented to protect the confidentiality, integrity and availability of personal information?								
Will testing and periodic reviews be conducted to ensure that personal information is only collected, accessed, used, disclosed, retained and disposed of when authorized?								
Will all actions relating to the collection, use, disclosure, retention, correction, copying or disposal be logged and subject to auditing and monitoring?								
Will procedures be defined and documented on how to identify, report, investigate and address the unauthorized access, collection, uses and/or disclosure of personal information?								

F. Requesting Access to Personal Information 
Key Requirements:
•	Ensure that every individual has a right of access to their personal information in the institution’s custody or control.
•	Make sure that personal information in the institution’s custody or control is retrievable.
•	Verify the identity of persons requesting access to their personal information.
•	See section 36 of MFIPPA and section 47 of FIPPA.

Privacy Requirement Questions	Findings	
Privacy Impact	
Action Items	
	Y	N	IP	NA	Explanation			
Access Requests	
Will the management of personal information change or restrict individuals’ right of access to their personal information? 								

G. Retention 
Key Requirements:
•	Personal information should be retained for at least one year after use to provide the individual with a reasonable opportunity to access their personal information.
•	The individual’s consent should be obtained in order to dispose of personal information prior to one year after use.
•	Ensure compliance with other relevant records retention laws, regulations, bylaws or other requirements.
•	See MFIPPA section 30(1) and Ontario Regulation 823, section 5; FIPPA section 40(1) and Ontario Regulation 460, section 5.

Privacy Requirement Questions	Findings	
Privacy Impact	
Action Items	
	Y	N	IP	NA	Explanation			
Retention Schedules	
Will there be defined and documented policies, procedures, and other requirements related to the retention of personal information?								
Reasonable Opportunity for Access	
Will measures be in place to ensure that personal information will be retained for a minimum of one year after its last use? 								
Medium and Location of Retention	
Has the medium and format of the personal information to be retained been defined? 								
Retention Period	
If the personal information has not been used, will it be retained for only as long as necessary to meet its purpose?								
Controls	
Will procedures be defined and documented related to consent for early disposal of personal information?								
Will there be periodic reviews of the retention requirements and consent procedures to ensure effectiveness?								

H. Disposal and Destruction 
Key Requirements:
•	Personal information must be disposed by either securely destroying it or transferring it to the appropriate archives.
•	Make sure personal information is only destroyed when authorized by an appropriate party and in accordance with records retention regulations/bylaws applicable to the institution.
•	Take all reasonable steps to protect the security and confidentiality of personal information to be destroyed throughout the process, that is, when personal information is stored, transported, handled and destroyed.
•	Take all reasonable steps to protect the security and confidentiality of personal information to be transported to archives throughout the process, that is, when personal information is stored, transported and handled.
•	Take all reasonable steps to destroy personal information so it cannot be reconstructed or retrieved.
•	Keep an accurate record of the disposal, including what personal information was destroyed or transferred and on what date it was destroyed or transferred.
•	Do not include personal information in your record of disposal.
•	See Ontario Regulation 823 and section 30(4) of MFIPPA, section 3 of MFIPPA and Ontario Regulation 459 and section 40(4) of FIPPA.

Privacy Requirement Questions	Findings	
Privacy Impact	
Action Items	
	Y	N	IP	NA	Explanation			
Manner of Disposal	
Will procedures be defined and documented for the secure disposal, for example, transfer to archives or destruction of personal information in accordance with applicable records retention schedules, regulations/bylaws? Explain disposal process.								
Devices/Equipment	
Will procedures be defined and documented for disposal of devices and equipment containing personal information?								
Controls	
Will controls be defined and documented to ensure only appropriate personal information will be disposed of or destroyed, and only by authorized parties after obtaining appropriate approval?								
Will there be periodic reviews of the disposal controls to ensure effectiveness?								
Record-Keeping	
Will details of the disposal of personal information be recorded?								
Will measures be defined and documented to ensure no personal information is captured in the disposition record?								

I. Privacy Management 
The questions in this section relate to privacy management throughout your institution. They are not limited to the project’s information system, technology or program, but address your institution’s privacy maturity, capability and readiness to undertake the project. The emphasis is on accountability and training.
Key Requirements:
•	You should apply common management principles, for example, planning, directing, controlling and evaluating the personal information collected, used, disclosed, retained and destroyed by institutions.
•	Establish and follow disciplined and consistent practices for the management of personal information.
•	Educate staff about privacy, as well as legislative and other relevant requirements.
•	Periodically review privacy policies and practices, and commit to ongoing improvement in compliance.

Privacy Requirement Questions	Findings	
Privacy Impact	
Action Items	
	Y	N	IP	NA	Explanation			
Accountability	
Will accountability for managing personal information throughout its lifecycle be defined to include parties involved in the project, for example, your institution, partners, vendors and other third parties? Explain accountability.								
Training	
Will operational policies, procedures or practices related to the protection of personal information be needed?								
Have all parties requiring training on operational, security and privacy aspects of the project been identified?								
Has the individual responsible for ensuring that all parties receive appropriate training been identified?								
Audits	
Will procedures and protocols be developed and documented to evaluate whether the personal information is accessed, collected, used, retained, disclosed, secured and disposed of in a manner that is consistent with FIPPA or MFIPPA?