When users upload a CSV of recipients we need to warn them that they must be allowed to use the email for this express purpose in order to be compliant with the Privacy Act about notification-api

[willeybryan]

We have some more work to do on this.

@YedidaZalik and @sboots need to have a meeting with TBS privacy and Legal. The current blocker is setting up the meeting.

I don't think we need to get this done this sprint, we can push it back to Alpha.

[obrien-j]

Do you have a link to the specific legislative requirement on this?

[YedidaZalik]

I don't have the link - if you have it, please send it to me! Thanks!

…

On Mon, Jul 8, 2019 at 8:24 AM obrien-j ***@***.***> wrote: Do you have a link to the specific legislative requirement on this? — You are receiving this because you were assigned. Reply to this email directly, view it on GitHub <#26>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AMKSMSLOOSMMMSSAJP7JBNDP6MWZPANCNFSM4H5GJYSA> .

-- [image: cid:[email protected]] *Yedida Zalik* Canadian Digital Service (CDS) | Service numérique canadien (SNC) Treasury Board of Canada Secretariat | Sécretariat du Conseil du Trésor du Canada *[email protected] <[email protected]>* | *[email protected] <[email protected]>* |*343-548-0657* *Please do not hesitate to reply in the official language of your choice.* *N’hésitez pas à répondre dans la langue officielle de votre choix.*

[willeybryan]

https://laws-lois.justice.gc.ca/eng/acts/P-21/page-1.html#h-397235

4 No personal information shall be collected by a government institution unless it relates directly to an operating program or activity of the institution.

(2) A government institution shall inform any individual from whom the institution collects personal information about the individual of the purpose for which the information is being collected.

https://laws-lois.justice.gc.ca/eng/acts/P-21/page-2.html#h-397260

Personal information under the control of a government institution shall not, without the consent of the individual to whom it relates, be used by the institution except

(a) for the purpose for which the information was obtained or compiled by the institution or for a use consistent with that purpose

Any personal information that may be collected is described in the Standard Personal Information Bank entitled Outreach Activities, PSU 938, which can be found in the TBS webpage Information about programs and information holdings.

https://www.canada.ca/en/treasury-board-secretariat/services/access-information-privacy/access-information/information-about-programs-information-holdings/standard-personal-information-banks.html#psu938

https://www.canada.ca/en/treasury-board-secretariat/services/access-information-privacy/access-information/information-about-programs-information-holdings/standard-classes-records.html#prn904

[timarney]

Any traction on this?

i.e. we need to add X text in a warning box to the UI on page X

[willeybryan]

I am putting this in discovery to figure out meeting, what we need to write, getting that translated. Then we can integrate in Alpha.

[willeybryan]

Still waiting on meeting with TBS Lawyer/Privacy peeps, Pushing this out