Frequently Asked PIA Questions

A PIA Request must be submitted for a new project or an existing project that is being substantially modified. A “project” refers to any system, process, program or activity that supports University business.

Start the PIA as early as possible after initiating the project, even before the rest of the project has started. This helps to prevent substantial re-work and project delays later on. If key elements of the project change, the Self-Assessment must be re-submitted.

Examples of substantial modifications that require a PIA include, but are not limited to:

• New types of PI will be collected
• Significant changes will be made to the way PI is collected, used or disclosed
• PI will be linked with information from third parties, another department or application
• System access will be changed so that new categories or groups of individuals will have access to PI (e.g. granting access to other units within the department, other departments or external parties). Note: this does not include day-to-day operational changes or routine due to personnel changes
• Storage or Access to PI will be moved outside Canada, or to a vendor or cloud service
• PI management or security will be outsourced
• The PI retention period will change

Yes. Academic research projects do not require a PIA, but a Security Threat Risk Assessment (STRA) is required to assess any third-party tools used to collect, use, and/or store personal information for academic research. For more information, please visit ARC’s website. A PIA is required when a research tool:

• may also be used for other (non-research) university business;
• will contain data compiled by UBC for various, unknown future research purposes;
• or will integrate with other UBC Systems.

If any tool has identity and access management (IAM) integration (single-sign-on), then a Data Access Request (DAR) is required.

In addition, some academic research projects may involve a privacy and confidentiality review by the Research Ethics Board (REB), who approve projects and data usage. For more information, please visit the Office of Research Ethics.

The following case studies illustrate various research scenarios to clarify when a PIA is or is not required. Some cases also include instances where a third party may request a PIA. If there is any doubt please submit an inquiry via privacymatters.ubc.ca/pia-stra.
 

A PIA is a legal requirement of FIPPA and not completing one may result in non-compliance with provincial legislation, UBC policies, standards, and other legal and regulatory requirements. A PIA helps identify and build privacy and security requirements in advance of a launch, thereby helping projects avoid costly program, service or process redesign and minimize potential privacy or security breaches.

If this relates to a PIA you submitted, use the UBC Self-Service Portal and navigate to View My Requests Incidents. The incident will include updates and provide the ability for you to add comments and questions for the Risk Advisor to review.

• If you are inquiring about a historical PIA, you can refer to the PIA Guidelines for reviews completed on common UBC tools.
• If you are inquiring about an active PIA that you did not submit, you can use the PIA Inquiry.

A project is required to complete a PIA regardless of whether the system already had a PIA completed. The PIA review process is focused on use cases. This ensures that vulnerabilities and issues are known to minimize potential privacy breaches. If you have any questions, please use the PIA Inquiry .

If you are at the concept or idea stage, a PIA Inquiry can be submitted to discuss privacy and information security risks and review existing UBC tools that may be able to provide the required capabilities.

If the project is approved but the product or system has not yet been selected, a PIA Request should be submitted based on the business case and information known at the time. The initial risk level will help inform the procurement process that may be required for product selection and service contracts.

If the product or system changes the Self-Assessment answers significantly, the Risk Advisor may require a new PIA Request submission to be submitted once the product or system is selected.

The project owner should be a UBC employee who has the authority to make decisions and approve work. This is often an administrative or departmental head of unit or senior manager.

Within the Self-Assessment, the project owner list is regularly updated to populate senior managers. If you cannot find the appropriate person, select an project owner higher in the organization or save the survey and discuss it with the project lead.

The project owner and the Project Lead are responsible for:

1. Ensuring that the Initiative is planned and implemented in a manner that complies with the Freedom of Information and Protection of Privacy Act (FIPPA), UBC Policy #SC14 Acceptable Use and Security of UBC Electronic Information and Systems, and the UBC Information Security Standards
2. Informing the PIA team of any material omissions or inaccuracies in the information provided in self-assessment
3. Initiating a new PIA request if there are any significant changes to the Initiative as it pertains to collection, use, or disclosure of Personal Information (PI)
4. Ensuring the on-going compliance with UBC Information Security Standards privacy and security policies

The PIA team may require additional information to determine compliance with FIPPA and the Information Security Standards.

Examples of information that may be requested include, but are not limited to:

• A full description of all data elements in the project
• Data flow diagrams which illustrates how information is collected, used and disclosed. For more instruction, please view How do I create a Personal Information (PI) flow table and diagram?
• Validation of adherence to privacy and security requirements throughout testing and other methods
• Third-party attestation reports such as SOC reports, ISO 27001 certifications etc.
• Privacy and security clauses in contracts and agreements with vendors and other third parties, and/or consent statements

You will need to complete a Data Access Request (DAR) form, for any new access to UBC data. If you already had previous access to the same set of data, the DAR will allow for the access to be registered for historical tracking of data access.

A PIA reference number may be requested depending on the nature of you request. For API data requests related to new systems, a PIA must be initiated so that the Data Steward Reviewers understand the application review status and identified risks. They may confirm that any request for PI aligns with the PI elements identified in the target system PIA. For more information on the Data Access Request process, please refer to Access UBC Data.

Sharing the results of your PIA within UBC is acceptable. All other requests for information about a PIA must be forwarded to the Office of the University Counsel. Do not respond to or acknowledge the request, but rather forward the request to: access.and.privacy@ubc.ca

The following can answer questions about privacy or information security:

• For fundamentals training on how to protect the privacy and information security of the UBC community, please enroll in the Fundamentals Training
• For questions about the PIA process, use the PIA Inquiry
• For specific advice about security, refer to the Information Security Standards or contact it.security@ubc.ca
• For specific advice about privacy, refer to the Privacy Fact Sheets or contact access.and.privacy@ubc.ca
• For general privacy / security questions not related to the PIA process, contact privacy.matters@ubc.ca

If you are identified as a project owner, you may receive an email request to approve the PIA report. The requestor and project lead will be identified, allowing you to discuss the PIA results with them prior to approving or reject. When you are ready, navigate to the UBC Self-Service Portal and use the Approval option that is found under “View My Records”.

To get started:

UBC Self Service Portal → My Requests → My Approvals

Review the information available and click on the Approve or Reject button. If rejecting, please include a comment regarding the reason.

If rejected, the PIA will return to the Risk Advisor for further review.

If accepted, the PIA will be closed with notice to the requestor and project owner.

For more support, please view How do I approve a PIA report and risk plan?

The final reports are posted online to a restricted audience, primarily project owners, Data Stewards, and Client Services Managers.

To get started:

UBC Self Service Portal → Search Knowledge

Enter in the project, product, or key descriptor in the search box

You can also use the drill down by selecting PIA Private Knowledge (if the button is not visible, you do not have required access for viewing PIA reports)

Project owners are based on senior role assignments within the organization. If you are a senior manager and you do not have access, please submit a PIA Inquiry that includes your role and required access.

The RCT is a retired tool. It was used to determine a project’s privacy and information security risk classification. The PIA process now uses a Self-Assessment survey as part of the PIA request.