Public Sector Case Studies: THE ESTABLISHMENT OF A PRIVACY OFFICE

2AGENDA WSIB) uIntroduction to the ONTARIO WORKPLACE SAFETY & INSURANCE BOARD (WSIB) WSIB PRIVACY OFFICE uEvolution of the WSIB PRIVACY OFFICE PRIVACY INFRASTRUCTURE uBuilding a corporate PRIVACY INFRASTRUCTURE

3 The Workplace Safety and Insurance Board An Overview uThe Workplace Safety and Insurance Board (WSIB) began as the Workmen's Compensation Board in 1915 through an Act of the Ontario Legislature uThe system of no-fault collective liability provides fair compensation for injured workers and their families, while spreading individual costs among employers uToday, the WSIB administers some 340,000 claims with a staff of 4,293 located throughout Ontario u A total of 201,272 Ontario employers are covered by the WSIB

4 ENABLING LEGISLATION uWORKPLACE SAFETY and INSURANCE ACT (WSIA) –Provides for legislative authority for the collection, use, retention and disclosure of information uFREEDOM OF INFORMATION and PROTECTION OF PRIVACY ACT (FIPPA) –Provides the right of access to information under the control of institutions –Protects the privacy of individuals with respect to personal information about themselves held by institutions and provides individuals with a right of access to that information

5 CHANGE DRIVERS uWCB  WSIB (1998) THE ELIMINATION OF ALL WORKPLACE INJURIES and ILLNESSES –VISION: THE ELIMINATION OF ALL WORKPLACE INJURIES and ILLNESSES – WISB now oversees Ontario’s system of workplace safety education and training –Greater support of research efforts in the study of occupational disease and workplace safety –Emphasis on early and safe return to work uNew technologies implemented uIncreased outsourcing of business processes

6 Health Professionals Pharmacies Alternate Service Providers Employers APPLICATION SYSTEMS, TELEPHONE FAX, MAIL, , INTERNET Hospitals Researchers Safe Workplace Associations (SWAS) LMR Service Providers WSIB Employees Working Outside the Office WSIB Contracted Specialty Clinics

7 uJanuary 1, 2002 Program Privacy Group –Developed the capacity to implement Privacy Impact Assessments –Completed PIAs for key strategic projects –Educated project teams through privacy presentations PRIVACY –BUILT PRIVACY AWARENESS WITH SENIOR MANAGEMENT PRIVACY MAKING THE CASE FOR A PRIVACY OFFICE

8 PRIVACY COMPLIANCE DASHBOARD VIEW OF PRIVACY COMPLIANCE

9 ACCOUNTABILITY *Source: Information and Privacy Commissioner/Ontario (IPC)- Privacy Diagnostic Tool

10 PRIVACY PRIVACY IS ON THE CORPORATE MAP WSIB PRIVACY OFFICE uJuly 1, 2002 WSIB PRIVACY OFFICE –Legal Services Division –Integrated FOI Program –Full service ACCESS and PRIVACY OFFICE –Multidisciplined team FOI Co-ordinator, business specialists, security architect, project management experience

11 TEAMWORK “NEVER DOUBT THAT A SMALL GROUP OF THOUGHTFUL, COMMITTED PEOPLE CAN CHANGE THE WORLD. INDEED, IT IS THE ONLY THING THAT EVER HAS”.

12 PRIVACY OFFICE RELATIONSHIPS LEGAL SERVICES SECURITY ARCHITECTURE BUSINESS CONTRACTED SERVICE PROVIDERS PRIVACYOFFICE RESEARCHERS

13 PRIVACY CORPORATE PRIVACY FRAMEWORK FOI PROGRAM Governance Risk Assessments & Risk Mgmt Education & Awareness

14 PRIVACY WSIB PRIVACY DESIGN PRINCIPLES uCompliance with the Privacy Design Principles is mandatory (FIPPA) for all project staff and consultants uPurpose:  Help staff and consultants doing projects understand and meet the WSIB’s privacy obligations with respect to the design and implementation of any type of WSIB project  Enhance WSIB privacy compliance by ensuring legislated privacy requirements are met from project concept to business integration upon completion of the project.

15 PRIVACY Concept Applying the PRIVACY Concept to a Project: uWSIB Project & Program Privacy Design Principles uProject Initiation –Terms of Reference Initial Privacy Security Screening Assessent 1st step in identifying privacy requirements –Business Case

16 PRIVACY PRIVACY Review Process Initial Privacy Screening Assessment: uA questionnaire to determine if there are possible privacy implications,requiring a more detailed privacy review of the project  To be completed at the conceptual phase of a project. »Is there personal information (as defined by FIPPA) collected, used, disclosed and retained? »Who collects it? »How is it Collected? »Where does it go? (ie. Does it cross Ontario/Canadian borders? »How is it transmitted to external parties? ( ,fax) »Will the data be retained? If so, for how long? »Who will have access to the information? »What is the legislative authority for the collection, use and disclosure of personal information?

17 PRIVACY PRIVACY Impact Assessments uWhat is a PIA? A PIA is a process that measures both legislative compliance (I.e. FIPPA, WSIA) and considers the broader privacy implications of a given proposal. uPurpose The function of a PIA is to ensure that privacy risks associated with a given proposal are properly identified and addressed wherever possible, and that decision makers have been informed of these risks and the options available to mitigate them.

18 The PIA The PIA in the PROJECT LIFE CYCLE uCONCEPT and PLANNING –Project Definition Initial PIA –Conceptual Design Privacy & Security Requirements uDETAILED DESIGN & IMPLEMENTATION Interim PIAs uPOST IMPLEMENTATION Final PIA

19 The PIA The PIA in the PROJECT LIFE CYCLE The Privacy Impact Assessment Process provides for:  More detailed definition of privacy requirements  Integration of privacy requirements into project  Assurance reporting to project and business management

20 PRIVACY POSITIONING & COMMUNICATION PRIVACY PRIVACY IS NOT JUST ABOUT COMPLYING WITH LEGISLATION PRIVACY PRIVACY IS ABOUT: uBUILDING TRUSTED RELATIONSHIPS uGOOD BUSINESS PRACTICE

21

22

23 QUESTIONS/COMMENTS?

24 SPEAKER CONTACT INFORMATION Laurisa Tkachenko Director, Privacy Office Workplace Safety & Insurance Board 200 Front Street West, 20th floor Tel: (416)