Federal Community Housing Initiative — Phase 2 (FCHI2) (October 2020)
Description of program
FCHI-Phase 2 will provide $462 million in funding from September 1,
2020 to March 31, 2028. The two FCHI-2 funding streams are Rental Assistance
and Transitional Funding. The rental assistance stream provides financial
assistance for low-income households. Housing providers may apply for this
rental support, which aims to fund the gap between 30% of an assisted
household’s gross monthly income and the occupancy charge. The transitional
funding stream is available to housing providers having trouble transitioning
to the new program. The temporary funding will cover eligible operating costs
for up to 24 months following the expiration of past federal agreements.
This funding stream has a limited budget and is reserved for the most
vulnerable groups, such as deep subsidy projects or urban Indigenous projects.
Findings
The PIA identified 1 high priority risk (Compliance Review Procedure). The
priority finding required immediate attention and resulted in recommendations
for remediation summarized in a Management Action Plan (MAP). The mitigation
strategies for this risk were completed in 2020.
Equifax (October 2020)
Description of program
CMHC uses Equifax to obtain electronic credit bureau information for National
Housing Act related to the requirements of the Privacy Act, TBS guidelines,
regulatory expectations and privacy best practices in order to better
understand our privacy risk posture and address any areas of identified risk
before we roll out or implement our initiative.
Findings
The PIA identified 1 low priority risk. The priority finding required
immediate attention and resulted in recommendations for remediation summarized
in a Management Action Plan (MAP). The mitigation strategies for this risk
have been completed in 2020.
Research (October 2020)
Description of program
Internal and external Research activities including data related to
housing needs and conditions, household composition, and past and
current housing needs and conditions. Research, expertise and
experience is obtained from individuals and organizations.
Findings
The PIA identified 6 low priority risk. The priority finding required
immediate attention and resulted in recommendations for remediation summarized
in a Management Action Plan (MAP). The mitigation strategies for this risk
will be completed in 2021.
Image on Demand (September 2020)
Description of program
Image on Demand is an alternative document delivery service for retrieval of information stored off-site at Iron Mountain warehouse. The service enables CMHC to gradually digitize physical records that are still referenced and minimize our dependency on these physical records, as well as reduce our off-site storage footprint. It serves as a method for converting paper or film-based information to a digital format.
Findings
The PIA has identified no findings hence, a Management Action Plan (MAP) is not required.
Compensation and Benefits Program (Manulife) (August 2020)
Description of program
CMHC collects, uses, and shares of personal information from employees
required as a condition of employment to administer the various human
resources-related functions such as employee benefits administration,
compensation and benefits, which has been outsourced to an outside supplier —
Manulife Company.
Findings
The PIA identified 1 high priority risk (Compliance Review Procedure).
The priority finding required immediate attention and resulted in
recommendations for remediation summarized in a Management Action Plan (MAP).
The mitigation strategies for this risk were completed in 2020.
Business Continuity Management (Rave Mobile Safety) (August 2020)
Description of program
Rave Alert software is a business continuity alert system used for internal
employees. It is a license-based a fully hosted, web-based emergency mass
notification technology system. The system is owned by Rave Mobile
Safety, operated in Canada by a Canadian Team against the requirements of
the Privacy Act, TBS guidelines, regulatory expectations and privacy
best practices in order to better understand our privacy risk posture and
address any areas of identified risk before we roll out or implement our
initiative.
Findings
The PIA identified 1 high priority risk (Compliance Review Procedure).
The priority finding required immediate attention and resulted in
recommendations for remediation summarized in a Management Action Plan (MAP).
The mitigation strategies for this risk have been completed in 2020.
Canada Emergency Commercial Rent Assistance (July 2020)
Description of program
Canada Emergency Commercial Rent Assistance (CECRA) for small businesses
provides relief for small businesses experiencing financial hardship due to
COVID‑19. CECRA for small businesses offers you a forgivable loan worth 50% of
the value of your small business’ rent each month. The loans will be forgiven
if you comply with all applicable program terms and conditions.
Findings
The PIA identified 1 high priority risk (Compliance Review Procedure).
The priority finding required immediate attention and resulted in
recommendations for remediation summarized in a Management Action Plan (MAP).
The mitigation strategies for this risk have been completed in 2020.
MyHR Systems (CMHC’s branded instance of SAP SuccessFactors) (June 2020)
Description of program
CMHC collects, uses, and shares HR data about its employees and prospects who
are seeking employment at CMHC in the context of employment at CMHC utilizing
myHR. MyHR is solely used for human resources planning which is detailed in
the privacy notice presented to employees and prospects who are
seeking employment at CMHC. HR data is disclosed with programs or
activities of the Canadian Government in compliance with the primary
purpose of human resources planning. Examples of HR data disclosure to
the Canadian Government are “Official Languages in Federal Institutions
Report” and “Workplace Equity Information Management System Report”.
Findings
This PIA focused on CMHC’s collection and use of various personal information
as part of a decision-making process directly affecting individuals.
The PIA identified 1 high priority risk (Compliance Review Procedure).
The priority finding required immediate attention and resulted in
recommendations for remediation summarized in a Management Action Plan (MAP).
The mitigation strategies for this risk will be completed by the end of the
2020 calendar year.
Granville Island Volunteer Program (Better Impact Software) (June 2020)
Description of program
CMHC collects and uses personal information in the Better Impact Software that
was provided on a voluntary basis from the participation in the Granville
Island Volunteer Program.
Findings
This PIA focused on CMHC’s collection and use of various personal information
as part of a decision-making process directly affecting individuals.
The PIA identified 2 high priority (Breach Management Process and Logical
Access) and 2 low priority risks that were all remediated in 2020.
Client Relationship Management (CRM) System (February 2020)
Description of program
CMHC’s Dynamics 365 Client Relationship Management (CRM) system is a central
database that provides a single source of client contact information to enable
external client-facing teams to work better together by sharing contacts,
dashboard and reports. The CRM system centralizes data and standardizes
processes across the regions to improve productivity, enable decision-making
and improve the client experience. The CRM system is used to store client
contact information and records of correspondence that provide CMHC employees
with the insights to develop, improve, and retain client relationships and
build custom dashboards to analyze data.
Findings
The PIA identified 9 high priority (Compliance Review Procedure, Privacy
Training Program, Training and Guidelines, Third Party Disclosure Agreements,
User Guide, Records Retention Schedule, Unique Identifiers, Limited Retention,
and Disposition) and 14 low priority risks resulting in recommendations
for remediation summarized in a Management Action Plan (MAP). The mitigation
strategies for these risks will be completed by the end of the
2021 calendar year.
Data Lake PIA (January 2020)
Description of program
CMHC’s Data Lake is a centralized repository that stores data across all CMHC
programs. The Data Lake is CMHC’s single data source, which increases data
security, facilitates integration and improves sharing and collaboration
between business lines. The largest amount of data in the Data Lake comes from
emili, which is CMHC’s online mortgage insurance application system. The scope
of this assessment focused on CMHC’s emili, in addition to a total of seven
systems that feed into the Data Lake. Namely, we assessed the data inputs into
emili, Collibra, Success Factors, CRM, Dynamics 365, ERP and data warehouses.
Findings
The PIA identified 15 high priority (Contact Person, Compliance Review
Procedure, Privacy Training Program, Data Owners, Third Party Disclosure
Agreements, Privacy Notice, Consistent Use, Original Consent, Secondary Use,
Anonymize Data, Access, Identified Purpose, Records Retention Schedule,
Limited Retention, User Authentication) and 26 low priority risks,
resulting in recommendations for remediation summarized in a Management Action
Plan (MAP). The mitigation strategies for these risks will be completed by the
end of the 2021 calendar year.
Done!
Link copied
Share via Email
