Privacy impact assessment summary — Parks Canada online sales of passes and permits program

Description of program/activity

The online sales website allows visitors from around the world to purchase passes for admission and permits for lockage and mooring (hereafter referred to simply as passes and permits) for Parks Canada administered locations and has been implemented in response to the continued increase in expectations from PC’s visitors to provide a positive experience when working through their trip cycle from beginning (trip planning) to end (remembering).

This program provides visitors to national parks, national urban parks, national historic sites, and national marine conservation areas with opportunities to enjoy and appreciate these places in safe and meaningful ways.

The program includes a range of activities, such as; trip planning, reception, camping, accommodations, visitor safety, visitor services, interpretive activities, merchandise, compliance, support for visitor facilities, recreational activities, support for inclusive and accessible places.

Overview and PIA Initiation

The purpose of this Privacy Impact Assessment (PIA) report is to provide evidence of the Agency’s and the Contractor's compliance to legislative requirements and an assessment of the privacy related risks. This PIA refers to online sales made around the world and analyzes the privacy risks/issues associated with the overall solution, and provides recommendations.

As of 2022, PCA operates a public Business to Consumer (B2C) website for online orders of admission passes and lockage and mooring permits. This includes online orders that are shipped worldwide for the Discovery Pass, six single-location passes, as well as various boating and canal permits.

Summary of analysis and recommendations

PC at large is adequately accountable in terms of privacy and the protection of personal information. Individuals are informed of the purpose of the collection at the time of the collection in the Privacy Notice Statement and also in a new institution-specific personal information bank (PIB) for the Online Sales of Passes and Permits Program. Overall, PC is in compliance with the Privacy Act and the Treasury Board of Canada's Policy on Privacy Protection.

More information

The Privacy Impact Assessment (PIA) identified some low residual risks that require further and/or continued mitigation to manage exposure to privacy risk. It will also be important for ongoing by PC staff/project authorities to ensure that the contractor consistently meets its contractual obligations regarding privacy and security of personal information. As such, mitigation measures have been documented in the PIA to address all revealed risks.