# Arckit Ca Pia > [COMMUNITY] Generate a Canada Privacy Impact Assessment per the Privacy Act and TBS Directive on Privacy Impact Assessment — personal-information inventory, lawful authority, necessity and proportionality, OPC notification trigger, and mitigation tracker. - Skill: `tractorjuice/arckit-ca-pia` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tractorjuice/arckit-ca-pia` - Raw SKILL.md: https://api.skillmd.com/api/skills/tractorjuice/arckit-ca-pia/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Coding & Dev Tools - Author: tractorjuice (https://skillmd.com/u/tractorjuice) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tractorjuice/arckit-ca-pia --- > ⚠️ **Community-contributed command** — not part of the officially-maintained ArcKit baseline. > Output should be reviewed by qualified Canadian counsel and the relevant departmental authority > (ATIP coordinator, ITSEC officer, OCHRO language lead, CIO branch) before reliance. Citations > may lag current text — verify against the Justice Laws Website and the issuing TBS / CSE / OPC source. ## User Request ```text $ARGUMENTS ``` You are an enterprise architect generating a Canada Privacy Impact Assessment (PIA) for a federal entity. ## Process 1. Read prerequisites: - `projects/000-global/ARC-000-PRIN-*.md` (federal principles, if present) - The project's REQ, DR, DMOD, and STKE artefacts (if present) - `.arckit/templates/_partials/RENDERING.md` 2. Read the template: - **First**, check `.arckit/templates-custom/ca-pia-template.md` (user override) - **Then**, `.arckit/templates-custom/ca-pia-template.md` - **Fallback**, `.arckit/templates/ca-pia-template.md` 3. Use `node scripts/generate-document-id.mjs PIA --filename` for the artefact filename. 4. Resolve the `` marker per `RENDERING.md` before writing the artefact. `RENDERING.md` hard-routes the CA regime to `_partials/document-control-ca.md`, which already carries the Policy on Government Security categorization ladder — no per-command classification override is needed. 5. Generate the following sections (the template provides skeletons for each): - **Programme / System Description** — what the system does, who operates it, the personal information lifecycle (collect → use → disclose → retain → dispose) and the subject populations affected. - **Lawful Authority** — Privacy Act §4 authority to collect; cite the enabling statute or regulation that authorises the collection. Where the authority is unclear, mark as `` and flag as a blocker for OPC notification — collection without statutory authority is not lawful. - **Personal Information Inventory** — for each element: source, purpose of collection, sensitivity, retention period, disclosure recipients, and link to a Personal Information Bank (PIB) entry where applicable. - **Necessity and Proportionality** — Oakes-derived four-step analysis: pressing and substantial objective, rational connection between collection and objective, minimal impairment of privacy, proportional effects (benefits versus privacy intrusion). - **Privacy Risks and Mitigations Register** — risks, likelihood, impact, mitigations, and residual risk. Cross-reference `risk` for the project-level register continuation. - **Transfers and Disclosures** — Privacy Act §7 use limited to the purpose of collection or a consistent use; §8 disclosure with §8(2)(a)–(m) routine uses analysed where applicable. Cross-border transfer flags cross-reference `ca-cloud-residency`. - **Individual Rights** — §12 access, §13 PIB registration with Treasury Board Secretariat InfoSource, correction and annotation procedures, and complaint pathways to the OPC. - **OPC Notification Trigger Analysis** — which findings warrant pre-implementation consultation with the Office of the Privacy Commissioner. The TBS Directive on PIA requires notification at least 30 days before launch for new programmes / substantial modifications. - **PIA Approval Chain** — departmental ATIP coordinator → ADM → head of institution, with TBS notification and OPC consultation positioned at the right gates. - **Action Tracker** — open mitigations with owner, due date, status, and the link back to the privacy-risk register entry. 6. Populate the External References section per `.arckit/references/citation-instructions.md`. The Privacy Act and the TBS Directive on Privacy Impact Assessment MUST appear in the Document Register with their primary URLs and verification dates. 7. Before writing the file, read `.arckit/references/quality-checklist.md` and verify all **Common Checks** plus the **PIA** per-type checks pass. Fix any failures before proceeding. 8. Write the artefact via the Write tool to `projects//`. 9. Show only a summary to the user (one paragraph plus the headline privacy risks, OPC notification decision, and any open lawful-authority items). ## Authoritative anchor Privacy Act (R.S.C., 1985, c. P-21) and the TBS *Directive on Privacy Impact Assessment* (current version). Authority: Office of the Privacy Commissioner of Canada (OPC) for consultation and review; Treasury Board Secretariat for the Directive. Primary URL for the Privacy Act: . ## Important notes - **Mandatory pre-launch consultation with OPC** for high-risk programmes — the TBS Directive on PIA requires notification a minimum of 30 days before launch of a new programme or substantial modification. Build the OPC review window into the delivery plan; do not treat it as a sign-off formality. - **Personal Information Banks (PIBs)** must be registered in TBS InfoSource. Create or update the PIB entry as part of this PIA; an unregistered PIB exposes the institution under §13 of the Privacy Act and undermines the §12 right of access. - **PIA is not a one-shot artefact** — re-trigger on substantial modifications: new data elements, new purposes, new disclosure recipients, change of contractor or processor, change of jurisdiction (including cloud region), or any change that materially shifts the privacy risk profile. - **Distinction from PIPEDA and provincial laws** — the federal Privacy Act applies to the federal public sector only. Do not conflate it with PIPEDA (federal private-sector), Loi 25 (Quebec), FIPPA (Ontario), BC PIPA, or other provincial regimes. If the programme involves provincial or private-sector partners, those regimes layer on top and require their own assessments. ## Suggested Next Steps After completing this command, consider running: - `$arckit-risk` -- PIA findings feed the privacy and regulatory entries in the risk register. - `$arckit-ca-atip` -- Personal-information disclosure register continues into the Access to Information / Privacy Act reconciliation. - `$arckit-ca-aia` -- Required when automated decision-making touches personal information; the AIA inherits the PIA personal-information inventory.