Summary of the Social Media Monitoring with Agility Privacy Impact Assessment

Description

Justice Canada’s Communications Branch uses a social media monitoring and analysis tool from Agility PR Solutions to search and monitor public conversations on issues relevant to the Department. Given the volume of social media content, Agility enables efficient, targeted searches and consolidated reporting. It supports the development of communications products, helps monitor sentiment and identify misinformation/disinformation, in alignment with the Government of Canada’s Policy on Communications and Federal Identity.

Why a privacy impact assessment was completed

Agility provides access to publicly available information and summarizes trends in a more convenient way. Although the data is public, its aggregation and analysis raise privacy concerns. A privacy impact assessment was conducted to support transparency, ensure responsible data handling, and alignment with privacy principles.

Additional information

  1. There is a risk of collecting personal information beyond what is necessary. This is mitigated through strict usage and reporting protocols to limit the risk of searching for, collecting or reporting personal information. Reports are reviewed by the Manager of Media Relations before distribution.
  2. Individuals may be unaware of monitoring activities, which could involve the inadvertent collection, use, and disclosure of personal information. A public notice will be posted on Justice Canada’s website and linked to social media terms of use.
  3. Personal information will be collected without obtaining consent from the individual prior to the collection. It is not possible to obtain consent prior to collecting personal information, resulting in a residual risk. However, a notice will be published on Justice Canada’s website to inform individuals of this activity undertaken by the Department of Justice.
  4. Justice cannot apply its own retention and disposal schedule to this data, as the personal information that may be inadvertently collected is governed by the retention policies of the third-party tool. Justice will not be the contracting authority. It is not intended to modify or request changes to specific clauses or provisions at this time.
  5. There is a risk of unauthorized disclosure of personal information. To mitigate this, access to the tool is limited to authorized users who will follow established protocols and granted only once employees have read and agree to the usage protocol, PIA and team-specific procedures. Any data collection or reporting using the tool will be reviewed by the manager before being circulated. Reports will be stored in the Digital Workspace which allows of the tracking of individuals having generated the report, and access to the reports is restricted to individuals on a need-to-know basis. Circulation of reports is limited to departmental officials that require the information for their duties. Privacy breaches will be reported to ATIP immediately upon discovery.
  6. Employees using the tool have not received privacy training, therefore they may be unaware of best practices. This limited awareness increases the risk of a privacy breach. Monitoring must focus on issues, not individuals, as outlined in the usage protocol. Personal information cannot form the basis of any searches using the tool. The team will engage with Justice’s ATIP Privacy, Policy and Programs Unit to seek resources and obtain training on privacy best practices.
  7. There are currently no contingency plans or procedures in place to identify and respond to security and privacy breaches. To counter this risk, users of the tool will be informed on how to respond to breaches. Also, a one-pager protocol will be developed to further inform individuals on steps to be taken in the event of a breach.
  8. Agility has not yet undergone a security assessment conducted by the Department of Justice. A full security assessment isn’t needed because the tool only handles public or unclassified information. However, Security will still be consulted because of how the tool will be used. The supplier is part of a government-approved list for media monitoring services. Although the current contract wasn’t awarded through that list, a new contract through the government of Canada supply arrangement is expected to be established in the Fall of 2025.
  9. There’s currently no formal process for handling privacy complaints, which poses a risk to public trust and compliance. To counter this risk, guidelines will be developed for employees using the tool to inform them of privacy considerations and of how to respond to a privacy complaint. Additionally, the privacy notice made available on Justice’s website will inform individuals of their right to complain to the Office of the Privacy Commissioner should they feel that their personal information is mishandled.

Related personal information banks

Personal information bank:

Class of personal information:

For more information about this privacy impact assessment

Access to Information and Privacy (ATIP) Online Request