Measures contemplated or being taken to prevent a recurrence (e.g. training, new policies or procedures) Additional information: Context Type of personal information Name Biographical information Biometric information Citizenship status Contact information Credit information Criminal checks/history Date of birth Date of death Educational information Employment equity information Employee identification Employee personnel information Financial information Medical information Physical attributes Place of birth Place of death Signature Social Insurance Number Other identification numbers Other: Sensitivity of the information (If unsure, consult Security) Protected A (Low sensitive – injury) Protected B (Particularly sensitive injury) Protected C (Extremely sensitive – life threatening and/or extremely grave injury) Format of the information Paper (mail, sensitive waste, etc.) Electronic (email, website, database, laptop, tablet, USB key, CD-ROM, etc.) Other Security measures in place at the time of the breach Technical (encryption, password, etc.) Physical (locks, alarm systems, etc.) Organizational (security clearances, policies, training, contractual provisions, etc.)
RISK MATRIX Probability of occurrence Rare (Very infrequent) Unlikely (Infrequent) Likely (Occasional) Very Likely (Frequent) Almost certain (Continuous) Impact rating Severe Significant Major High Severe Severe High Moderate Significant Major High Severe Moderate Low Moderate Significant Major High Low Negligible Low Moderate Significant Major Negligible Negligible Negligible Low Moderate Significant Low Risk Zone Medium-Risk Zone High-Risk Zone
POTENTIAL IMPACTS TO THE INSTITUTION Impact rating Reputation and relationships with clients and the public Legal and policy compliance National interest, public safety and security Operations and capacity to deliver programs Financial resources and assets Severe Event consequences require the organization to make a large-scale, long-term realignment of operations, objectives or finances Complete loss of public trust Embarrassment for the minister or the government Non-compliance with various Government of Canada laws or policies may result in substantial legal liabilities or penalties (civil or criminal) and/or imprisonment Extensive impacts on and/or international relationships, resulting in threats to public safety and security National security put in jeopardy Consequences threaten survival of program and organization Service interruption of more than six months Loss, error or omission of greater than $25 million, or greater than 25 per cent of total managed funds High Event consequences can be endured by the organization but could result in significant impact Significant loss of client group trust Public outcry for removal of the minister and/or departmental officials Subject to an audit and/or investigation by the Office of the Privacy Commission (OPC) Strong criticism by central agencies Scrutiny by a parliamentary committee Non-compliance with Government of Canada laws or policies may result in significant legal liabilities or penalties (civil or criminal), such as a lawsuit Substantial impact to and/or international relationships Substantial impact on public safety and security Consequences threaten survival and continued effective functioning of the program, or require intervention by senior management or by elected representatives Service interruption of one to six months Loss, error or omission of between $15 million to $25 million, or between 25 per cent and 15 per cent of total managed funds
Moderate Event consequences can be absorbed with proper management to minimize the impact Some loss of client group trust Media outcry for replacement of the minister and/or departmental officials Moderate criticism by central agencies Non-compliance with Government of Canada laws or policies, which may result in limited legal liabilities or penalties (civil or criminal), such as a lawsuit Disruption to and/or international relationships Moderate impact on public safety and security Consequences do not threaten the program, but administering the program could be subject to significant review or change in operation Service interruption of up to a month Loss, error or omission of between $5 million to $15 million, or between 15 per cent and 5 per cent of total managed funds Low Event consequences can be absorbed with managed effort Setback in building of client group trust Negative media attention May be subject to an investigation by OPC Minor criticism by central agencies and/or OPC Non-compliance with Government of Canada policies without legal liabilities or penalties (civil or criminal) Minor disruptions to relationships Minimal impact on public health and security Consequences threaten efficiency or effectiveness of some aspects of the program but can be dealt with internally Service interruption of one day to one week Loss, error or omission of between $1 million to $5 million, or between 1 per cent and 5 per cent of total managed funds Negligible Event consequences can be absorbed through normal activity No relationship damage Some unfavourable media attention Some unfavourable observation by central agencies and/or OPC Non-compliance with Government of Canada policies without legal liabilities or penalties (civil or criminal) Negligible impact on relationships Negligible impact on public safety and security Consequences are dealt with through routine operations Service interruption of less than a single day Loss, error or omission of less than $1 million, or less than 1 per cent of total managed funds
NOTIFICATIONS REQUIREMENTS Breach impact Division Head VP CorpServ DGMWS CDS and/or CMP Minister’s office OPC and TBS Affected individuals Low May be informed May be informed May be informed May be informed May be informed May be informed Must be informed (within 5 working days) Moderate Must be informed Must be informed High Must be informed Must be informed Must be informed Must be informed Must be informed (NM ATIP to determine timing) Severe Responsibility OPI NM ATIP VP CS DGMWS DGMWS via CDS and/or CMP NM ATIP OPI Form of notification Verbal Verbal Verbal Verbal and/or Briefing Note Briefing Note Privacy Act Breach Report by email Letter