Introduction
The Drone Management Portal (DMP) is a secure online service platform where users can manage their Remotely Piloted Aircraft (RPA) (i.e. drones), including registering or deregistering a drone, transferring drone ownership, and viewing any certificates of registration issued. In addition, the DMP allows users to: take online exams and view their results, access their flight review results, apply for and access their drone pilot certificate, and update their address and contact information.
Why a privacy impact assessment was completed
This privacy impact assessment (PIA) was carried out in accordance with section C.2.2.9.1 – Appendix C of the Treasury Board of Canada Secretariat (TBS) Directive on Privacy Practices, which requires a PIA upon a new program or activity that will involve the creation, collection, use, disclosure, retention or disposal of personal information for an administrative purpose.
The Drone Management Portal (DMP) is a secure online service platform where users can manage their Remotely Piloted Aircraft (RPA), including registering or deregistering a drone, transferring drone ownership, and viewing any certificates of registration issued. Personal information may include: name, contact information, citizenship status and date of birth.
It should be noted that verification of citizenship status is required because DMP account registration and certification processes only apply to Canadian citizens or permanent residents.
The purpose of this PIA is to identify and assess the privacy risks associated with administering the DMP. This PIA will also recommend mitigation strategies for any identified privacy risks so that they may be managed to an acceptable level.
PIA risk summary and mitigation strategies
Based on available information, the PIA identified the following potential risk to the privacy of personal information related to the collection, use, disclosure and retention of personal information:
- Retention and Disposal: Risk level – Low
Recommendation: The program should develop and implement a process for the secure disposal of transitory records containing personal information. This process should align with Government of Canada information management policies.
Mitigation measures: Program officials have established and are improving upon various measures to protect the retention and disposal of personal information. Examples include, but are not limited to:
- Consultation with Transport Canada’s Information Management branch on appropriate retention and disposition processes for personal information used by the DMP
- Documentation of the procedures for the collection, transmission, storage and disposal of personal information
- Clearly defined limitations of access rights to personal information to only those for whom it is required to carry out program administration
- Logging of user's accesses and actions within the system
- An established offboarding process for staff who leave their access-based roles
- Periodic checks of access controls
- Training of staff on privacy awareness, best practices on protection of privacy and personal information and access to the departmental Privacy Incident Response Plan
- Ongoing consultation with Transport Canada’s Privacy and Access to Information (ATIP) branch
Related personal information bank: TC PPU 007
For more information about this privacy impact assessment please contact TC.RPASInfo-InfoSATP.TC@tc.gc.ca