National DNA Data Bank
1. About the Program
The National DNA Data Bank (NDDB) is a national database of DNA profiles, used to identify, link and investigate individuals involved in designated offences, and to assist in the investigation of missing persons and unidentified human remains. It is administered by the Royal Canadian Mounted Police (RCMP) Forensic Science and Identification Services (FS&IS), and operates under the stewardship of the RCMP's National Police Services (NPS) program.
The NDDB was established in June 2000 through the enactment of the DNA Identification Act. It is Canada's only comprehensive database for the recording and rapid retrieval of DNA profiles related to designated offences, and is used by law enforcement officials across Canada to assist in criminal investigations.
In December 2014, the DNA Identification Act was amended to expand the NDDB and the use of DNA analysis by the RCMP so as to assist in the investigation of missing persons and unidentified human remains. These amendments came into force on March 6, 2018. Under the amended Act, the NDDB was expanded to create five new DNA indices: the Relatives of Missing Person Index (RMI), the Missing Persons Index (MPI), the Human Remains Index (HRI), the Victims Index (VI), and the Voluntary Donors Index (VDI).
The RMI, MPI and HRI were created primarily to assist investigators (law enforcement, coroners and medical examiners) in the humanitarian investigation of missing persons and identification of human remains. This provides officials with a nationally coordinated tool to advance these investigations where all other investigative options have been exhausted. The VI and VDI were created primarily for criminal investigation purposes. They allow for the collection of biological samples from victims and other volunteers.
2. Scope of the Privacy Impact Assessment (PIA)
In 2016-2017, a PIA was undertaken with respect to the NDDB. The purpose of the PIA was to identify and analyze the potential privacy impacts associated with the collection, use, disclosure and retention of personal information by the RCMP in the operation and administration of the NDDB, and to identify and mitigate new risks arising from the creation of new DNA indices under the amended DNA Identification Act.
The PIA provides evidence of the RCMP's continuing compliance with legislative requirements concerning privacy, and fulfills its obligation to report key program privacy risks and mitigation plans to senior management.
The NDDB PIA was completed under the direction of the NDDB's Director of Science and Strategic Partnerships. Its focus is on the operation and administration of the NDDB by the RCMP. Although the PIA speaks incidentally to the law enforcement activities of other police forces, including the collection of biological samples by local police agencies, it does not include a review of agency-specific practices with respect to the collection and use of those samples. Federal, provincial and municipal users of the NDDB (including those at the RCMP) are expected to conduct their own respective PIAs to ensure that their personal information handling practices are compliant with the law.
3. Privacy Analysis
As confirmed by the PIA, the inherent risks arising from the operation and administration of the NDDB are considered to be moderate to high. Recommendations from the present PIA however, as implemented by the RCMP, are expected to reduce these risks to an acceptable (or low) level.
4. Risk Area Identification and Categorization
A: Type of Program or Activity
On a scale of 1 to 4, the program (NDDB) level of risk to privacy is rated as a level 4 as it involves personal information used for investigations and enforcement in a criminal context (i.e. resulting matches may lead to criminal charges/sanctions or deportation for reasons of national security or criminal enforcement).
B: Type of Personal Information Involved and Context
On a scale of 1 to 4, the type of Personal Information involved in NDDB and the Context is rated as a level 4 as it refers to sensitive personal information, including detailed profiles, allegations or suspicions, bodily samples and/or the context surrounding the personal information is particularly sensitive.
C: Program or Activity Partners and Private Sector Involvement
On a scale of 1 to 4, the program (NDDB) activity is rated as a level 4 as it involves private sector organizations or international organizations or foreign governments in addition to federal/ provincial and/or municipal government(s), other federal institutions and within the department (amongst one or more programs within the department).
D: Duration of the Program or Activity
On a scale of 1 to 3, the duration of the program (NDDB) or activity is rated as a level 3 risk to privacy because it is a long-term program – an existing program that has been modified or is established with no clear "sunset".
E: Program Population
On a scale of 1 to 4, the program is rated as a level 3 because it affects certain individuals for external administrative purposes.
F: Technology and Privacy
The program (NDDB) or activity does not involve the implementation of a new electronic system, software or application program including collaborative software (or groupware) that is implemented to support the program or activity in terms of the creation, collection or handling of personal information.
The program or activity does not require substantial modifications to Information Technology legacy systems and/or services.
The program or activity does not involve the implementation of potentially privacy invasive technologies.
G: Personal Information Transmission
On a scale of 1 to 4, the program (NDDB) level of risk to privacy for personal information transmission is rated as a level 3 as the personal information may be printed or transferred to a portable device.
H: Risk Impact to the Individual or Employee
On a scale of 1 to 4, the program is rated as a level 4 as the impact may involve physical harm, including restrictions to an individual's freedom of movement or association.
I: Risk Impact to the Department
On a scale of 1 to 4, the program risk impact to the department is rated as a level 4 as it may involve reputation harm, embarrassment, loss of credibility. Furthermore, it may decrease confidence by the public, place elected officials under the spotlight, compromise departmental strategic outcome, compromise government priority, and impact on the Government of Canada Outcome areas.
- Date modified: