{"id":10918,"date":"2025-07-14T15:26:54","date_gmt":"2025-07-14T19:26:59","guid":{"rendered":"https:\/\/dev.nsira-ossnr.gc.ca\/publications\/access-to-information-and-privacy-atip-new-page-2\/"},"modified":"2025-07-14T15:34:10","modified_gmt":"2025-07-14T19:34:10","slug":"creation-of-the-national-security-and-intelligence-review-agency","status":"publish","type":"page","link":"https:\/\/nsira-ossnr.gc.ca\/en\/secretariat\/access-to-information-and-privacy\/privacy-impact-assessment-summaries\/creation-of-the-national-security-and-intelligence-review-agency\/","title":{"rendered":"Creation of the National Security and Intelligence Review Agency"},"content":{"rendered":"\n
\n
\n

Creation of the National Security and Intelligence Review Agency<\/h1>\n\n\n\n

SUMMARY OF THE PRIVACY IMPACT ASSESSMENT<\/h2>\n\n\n\n

CREATION OF THE NATIONAL SECURITY AND INTELLIGENCE REVIEW AGENCY (NSIRA)<\/strong><\/h3>\n\n\n\n

Government Institution<\/strong><\/h4>\n\n\n\n

National Security and Intelligence Review Agency Secretariat<\/p>\n\n\n\n

Government official responsible for the PIA<\/strong><\/h4>\n\n\n\n

Charles Fug\u00e8re<\/p>\n\n\n\n

Executive Director<\/p>\n\n\n\n

Head of the government institution or Delegate for section 10 of the Privacy Act<\/em><\/strong><\/h4>\n\n\n\n

Charles Fug\u00e8re<\/p>\n\n\n\n

Executive Director, NSIRA Secretariat<\/p>\n\n\n\n

Standard or institution specific personal information bank:<\/strong><\/h4>\n\n\n\n

Most standard PIBs apply to NSIRA\u2019s internal services.  Also, this PIA implicates the two former SIRC PIBs (Complaints, SIR PPU 005 and Contracts, SIR PPU 010).<\/p>\n\n\n\n

Legislated authority for activity:<\/strong><\/h4>\n\n\n\n

NSIRA was established pursuant to section 3 of the National Security and Intelligence Review Agency Act<\/em> (NSIRA Act), which came into force on July 12, 2019.  NSIRA is largely comprised of the main components of the former Security Intelligence Review Committee (SIRC), which had been established pursuant to the Canadian Security Intelligence Service Act<\/em>, and it also assumed the responsibilities of the former Office of the Communications Security Establishment Commissioner (OCSEC), as established by the National Defence Act<\/em>.<\/p>\n\n\n\n

The transition from the above two organizations to the new NSIRA (with an expanded mandate) is governed by the National Security Act, 2017<\/em>.<\/p>\n\n\n\n

The legal authority for NSIRA\u2019s personal information collection, use and disclosure in accordance with its mandate is derived from its enabling legislation, the NSIRA Act; <\/em>most notably, section 8.<\/p>\n\n\n\n

Summary of the project \/ initiative\/ change:<\/strong><\/h4>\n\n\n\n

Due to the creation of NSIRA through the transfer of the former SIRC and OCSEC, as well as an expanded mandate, this Privacy Impact Assessment (PIA) was intended as a high-level assessment of the NSIRA as it was developing its procedures and policies, including but not limited to, an overarching privacy policy suite. <\/p>\n\n\n\n

The intent of the PIA was to assess any risks or gaps present at the time of the assessment and to ensure proper privacy standards and safeguards are in place or improved upon in a timely manner. <\/p>\n\n\n\n

NSIRA\u2019s collection of personal information is integrated into its review process wherein it collects such information from the federal institutions for which it is conducting a review.  However, the collection of personal information for reviews is for a non-administrative purpose \u2013 NSIRA\u2019s use is to complete a review of the institution only; no decision is made in regard to the individuals whose personal information personnel access. <\/p>\n\n\n\n

NSIRA also has a complaints and investigations mandate which involves the collection of personal information directly from complainants and decisions that directly impact the individual (administrative purpose).  At the writing of the PIA, that activity was under review and change, therefore, that program was not assessed as part of this PIA.  Instead, a subsequent and fulsome PIA on that specific program activity will be performed later in FY 2021-22.  <\/p>\n\n\n\n

NSIRA\u2019s Secretariat also collects information on its employees in order to perform various employer services such as pay, benefits, and leave, as well as security screening.<\/p>\n\n\n\n

This high level PIA identified ten risks and 18 corresponding recommendations to mitigate those risks.  None of the risks were considered High and all mitigation measures will be completed before the end of FY 2021-22. <\/p>\n\n\n\n

Risk Area Identification and Categorization<\/strong><\/h4>\n\n\n\n

In its Directive on Privacy Impact Assessment<\/em>, TB has expressed that the PIA must include a completed risk area identification and categorization section, which must be made public.\u00a0 A risk rating must be assigned to each risk area named and described in Appendix C of the TB Directive on Privacy Impact Assessment<\/em>.\u00a0 The numbered risk scale is presented in an ascending order: the first level (1) represents the lowest level of potential risk for the risk area; the fourth level (4) represents the highest level of potential risk for the given risk area.\u00a0 For this PIA the risk areas and associated risk levels vary due to the broad scope of the PIA to include HR and security screening, and other internal services, as well as the review function of the NSIRA mandate.<\/p>\n\n\n\n\n \n \n \n \n \n \n \n \n \n \n \n
\n Table: Risk Assessment of NSIRA Activities Involving Personal Information\n <\/caption>\n
Risk Area<\/th>\n Risk Level<\/th>\n <\/tr>\n <\/thead>\n
\n Type of Program or Activity:<\/strong> Criminal investigation and enforcement \/ National Security
\n Personal information is used for investigations and enforcement in a criminal context (i.e. decisions may lead to criminal charges\/sanctions or deportation for reasons of national security or criminal enforcement).<\/em>\n <\/td>\n 		4<\/strong><\/td>\n <\/tr>\n
\n Type of Personal Information Involved and Context:<\/strong> Sensitive personal information, including detailed profiles, allegations or suspicions, bodily samples and\/or the context surrounding the personal information is particularly sensitive.
\n For example: personal information that reveals intimate details on the health, financial situation, religious or lifestyle choices of the individual and which, by association, reveals similar details about other individuals such as relatives.<\/em>\n <\/td>\n 		4<\/strong><\/td>\n <\/tr>\n
\n Program or Activity Partners and Private Sector Involvement:<\/strong> With other federal institutions and, in limited instances, private sector organizations or international organizations or foreign governments.\n <\/td>\n 4<\/strong><\/td>\n <\/tr>\n
\n Duration of the Program or Activity:<\/strong> Long-term program
\n Existing program that has been modified or is established with no clear \u201csunset\u201d.\n <\/td>\n 		3<\/strong><\/td>\n <\/tr>\n
\n Program Population:<\/strong> The program affects certain individuals for non-administrative purposes, as well as NSIRA employees for internal administrative purposes.\n <\/td>\n 3<\/strong><\/td>\n <\/tr>\n
\n Technology and Privacy:<\/strong> The creation of NSIRA requires the management of new networks to manage the sensitive personal information collected by the Agency under its review mandate, as well as the personal information of Secretariat employees.\n <\/td>\n <\/tr>\n
\n Personal Information Transmission:<\/strong> The personal information is transferred to a portable device or is printed.
\n USB key, diskette, laptop computer, any transfer of the personal information to a different medium.<\/em>\n <\/td>\n 		3<\/strong><\/td>\n <\/tr>\n
\n In the Event of a Privacy Breach, Impact on the Individual:<\/strong> A privacy breach of employee information may have moderate to significant reputational or financial harm. The amount of sensitive personal details (criminal records, audio files of security interviews) and documents (credit reports) is significant and could, at times, support identity theft. However, the more likely impact is embarrassment and reputational harm. Also, the breach of any vaccination attestation, accommodation, or rapid testing information could have minor to significant reputational harm on an NSIRA Secretariat employee or GIC Appointee (Executive Director and NSIRA Members).\n <\/td>\n <\/tr>\n <\/tbody>\n<\/table>\n\n<\/div><\/div>\n<\/div><\/div><\/section>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"parent":10911,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"template-nsira-subpages.php","meta":{"inline_featured_image":false,"footnotes":""},"categories":[24],"tags":[],"class_list":["post-10918","page","type-page","status-publish","hentry","category-no-index"],"yoast_head":"\nCreation of the National Security and Intelligence Review Agency - National Security and Intelligence Review Agency<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/nsira-ossnr.gc.ca\/en\/secretariat\/access-to-information-and-privacy\/privacy-impact-assessment-summaries\/creation-of-the-national-security-and-intelligence-review-agency\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Creation of the National Security and Intelligence Review Agency - National Security and Intelligence Review Agency\" \/>\n<meta property=\"og:url\" content=\"https:\/\/nsira-ossnr.gc.ca\/en\/secretariat\/access-to-information-and-privacy\/privacy-impact-assessment-summaries\/creation-of-the-national-security-and-intelligence-review-agency\/\" \/>\n<meta property=\"og:site_name\" content=\"National Security and Intelligence Review Agency\" \/>\n<meta property=\"article:modified_time\" content=\"2025-07-14T19:34:10+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/nsira-ossnr.gc.ca\/secretariat\/access-to-information-and-privacy\/privacy-impact-assessment-summaries\/creation-of-the-national-security-and-intelligence-review-agency\/\",\"url\":\"https:\/\/nsira-ossnr.gc.ca\/secretariat\/access-to-information-and-privacy\/privacy-impact-assessment-summaries\/creation-of-the-national-security-and-intelligence-review-agency\/\",\"name\":\"Creation of the National Security and Intelligence Review Agency - National Security and Intelligence Review Agency\",\"isPartOf\":{\"@id\":\"https:\/\/nsira-ossnr.gc.ca\/#website\"},\"datePublished\":\"2025-07-14T19:26:59+00:00\",\"dateModified\":\"2025-07-14T19:34:10+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/nsira-ossnr.gc.ca\/secretariat\/access-to-information-and-privacy\/privacy-impact-assessment-summaries\/creation-of-the-national-security-and-intelligence-review-agency\/#breadcrumb\"},\"inLanguage\":\"en-CA\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/nsira-ossnr.gc.ca\/secretariat\/access-to-information-and-privacy\/privacy-impact-assessment-summaries\/creation-of-the-national-security-and-intelligence-review-agency\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/nsira-ossnr.gc.ca\/secretariat\/access-to-information-and-privacy\/privacy-impact-assessment-summaries\/creation-of-the-national-security-and-intelligence-review-agency\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Secretariat\",\"item\":\"\/secretariat\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Access to Information and Privacy (ATIP)\",\"item\":\"\/secretariat\/access-to-information-and-privacy\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Privacy Impact Assessment Summaries\",\"item\":\"\/secretariat\/access-to-information-and-privacy\/privacy-impact-assessment-summaries\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Creation of the National Security and Intelligence Review Agency\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/nsira-ossnr.gc.ca\/#website\",\"url\":\"https:\/\/nsira-ossnr.gc.ca\/\",\"name\":\"National Security and Intelligence Review Agency\",\"description\":\"Official Website\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/nsira-ossnr.gc.ca\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-CA\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Creation of the National Security and Intelligence Review Agency - National Security and Intelligence Review Agency","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/nsira-ossnr.gc.ca\/en\/secretariat\/access-to-information-and-privacy\/privacy-impact-assessment-summaries\/creation-of-the-national-security-and-intelligence-review-agency\/","og_locale":"en_US","og_type":"article","og_title":"Creation of the National Security and Intelligence Review Agency - National Security and Intelligence Review Agency","og_url":"https:\/\/nsira-ossnr.gc.ca\/en\/secretariat\/access-to-information-and-privacy\/privacy-impact-assessment-summaries\/creation-of-the-national-security-and-intelligence-review-agency\/","og_site_name":"National Security and Intelligence Review Agency","article_modified_time":"2025-07-14T19:34:10+00:00","twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/nsira-ossnr.gc.ca\/secretariat\/access-to-information-and-privacy\/privacy-impact-assessment-summaries\/creation-of-the-national-security-and-intelligence-review-agency\/","url":"https:\/\/nsira-ossnr.gc.ca\/secretariat\/access-to-information-and-privacy\/privacy-impact-assessment-summaries\/creation-of-the-national-security-and-intelligence-review-agency\/","name":"Creation of the National Security and Intelligence Review Agency - National Security and Intelligence Review Agency","isPartOf":{"@id":"https:\/\/nsira-ossnr.gc.ca\/#website"},"datePublished":"2025-07-14T19:26:59+00:00","dateModified":"2025-07-14T19:34:10+00:00","breadcrumb":{"@id":"https:\/\/nsira-ossnr.gc.ca\/secretariat\/access-to-information-and-privacy\/privacy-impact-assessment-summaries\/creation-of-the-national-security-and-intelligence-review-agency\/#breadcrumb"},"inLanguage":"en-CA","potentialAction":[{"@type":"ReadAction","target":["https:\/\/nsira-ossnr.gc.ca\/secretariat\/access-to-information-and-privacy\/privacy-impact-assessment-summaries\/creation-of-the-national-security-and-intelligence-review-agency\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/nsira-ossnr.gc.ca\/secretariat\/access-to-information-and-privacy\/privacy-impact-assessment-summaries\/creation-of-the-national-security-and-intelligence-review-agency\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Secretariat","item":"\/secretariat\/"},{"@type":"ListItem","position":2,"name":"Access to Information and Privacy (ATIP)","item":"\/secretariat\/access-to-information-and-privacy\/"},{"@type":"ListItem","position":3,"name":"Privacy Impact Assessment Summaries","item":"\/secretariat\/access-to-information-and-privacy\/privacy-impact-assessment-summaries\/"},{"@type":"ListItem","position":4,"name":"Creation of the National Security and Intelligence Review Agency"}]},{"@type":"WebSite","@id":"https:\/\/nsira-ossnr.gc.ca\/#website","url":"https:\/\/nsira-ossnr.gc.ca\/","name":"National Security and Intelligence Review Agency","description":"Official Website","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/nsira-ossnr.gc.ca\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-CA"}]}},"_links":{"self":[{"href":"https:\/\/nsira-ossnr.gc.ca\/en\/wp-json\/wp\/v2\/pages\/10918","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nsira-ossnr.gc.ca\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/nsira-ossnr.gc.ca\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/nsira-ossnr.gc.ca\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nsira-ossnr.gc.ca\/en\/wp-json\/wp\/v2\/comments?post=10918"}],"version-history":[{"count":4,"href":"https:\/\/nsira-ossnr.gc.ca\/en\/wp-json\/wp\/v2\/pages\/10918\/revisions"}],"predecessor-version":[{"id":10927,"href":"https:\/\/nsira-ossnr.gc.ca\/en\/wp-json\/wp\/v2\/pages\/10918\/revisions\/10927"}],"up":[{"embeddable":true,"href":"https:\/\/nsira-ossnr.gc.ca\/en\/wp-json\/wp\/v2\/pages\/10911"}],"wp:attachment":[{"href":"https:\/\/nsira-ossnr.gc.ca\/en\/wp-json\/wp\/v2\/media?parent=10918"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nsira-ossnr.gc.ca\/en\/wp-json\/wp\/v2\/categories?post=10918"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nsira-ossnr.gc.ca\/en\/wp-json\/wp\/v2\/tags?post=10918"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}