Moderate Some loss of client Non-compliance with Disruption to Consequences do not Loss, error or group trust Government of threaten the program, omission of between Event consequences Canada laws or and/or international but administering the $5 million to can be absorbed Media outcry for policies, which may relationships program could be $15 million, or with proper replacement of the result in limited legal subject to significant between 15 per cent management minister and/or liabilities or penalties Moderate impact on review or change in and 5 per cent of total to minimize the impact departmental officials (civil or criminal), such public safety and operation managed funds as a lawsuit security Moderate criticism by Service interruption of central agencies up to a month Low Setback in building of Non-compliance with Minor disruptions to Consequences Loss, error or client group trust Government of threaten efficiency or omission of between Event consequences Negative media Canada policies relationships effectiveness of some $1 million to can be absorbed with attention without legal liabilities aspects of the program $5 million, or between managed effort or penalties (civil or Minimal impact on but can be dealt with 1 per cent and May be subject to an criminal) public health and internally 5 per cent of total investigation by OPC security managed funds Service interruption of Minor criticism by one day to one week central agencies and/or OPC Negligible No relationship Non-compliance with Negligible impact on Consequences are Loss, error or damage Government of dealt with through omission of less than Event consequences Some unfavourable Canada policies relationships routine operations $1 million, or less than can be absorbed media attention without legal liabilities 1 per cent of total through normal activity or penalties (civil or Negligible impact on Service interruption of managed funds Some unfavourable criminal) public safety and less than a single day observation by central security agencies and/or OPC
Moderate Event consequences can be absorbed with proper management to minimize the impact Some loss of client group trust Media outcry for replacement of the minister and/or departmental officials Moderate criticism by central agencies Non-compliance with Government of Canada laws or policies, which may result in limited legal liabilities or penalties (civil or criminal), such as a lawsuit Disruption to and/or international relationships Moderate impact on public safety and security Consequences do not threaten the program, but administering the program could be subject to significant review or change in operation Service interruption of up to a month Loss, error or omission of between $5 million to $15 million, or between 15 per cent and 5 per cent of total managed funds Low Event consequences can be absorbed with managed effort Setback in building of client group trust Negative media attention May be subject to an investigation by OPC Minor criticism by central agencies and/or OPC Non-compliance with Government of Canada policies without legal liabilities or penalties (civil or criminal) Minor disruptions to relationships Minimal impact on public health and security Consequences threaten efficiency or effectiveness of some aspects of the program but can be dealt with internally Service interruption of one day to one week Loss, error or omission of between $1 million to $5 million, or between 1 per cent and 5 per cent of total managed funds Negligible Event consequences can be absorbed through normal activity No relationship damage Some unfavourable media attention Some unfavourable observation by central agencies and/or OPC Non-compliance with Government of Canada policies without legal liabilities or penalties (civil or criminal) Negligible impact on relationships Negligible impact on public safety and security Consequences are dealt with through routine operations Service interruption of less than a single day Loss, error or omission of less than $1 million, or less than 1 per cent of total managed funds
3-EN-Privacy_breach_report_and_risk_assessment.docx