Security and Privacy - FAQ

  1. Who has access to the information I enter when I sign up for a GCKey?
  2. How is my personal information protected?
  3. What can I do to maintain the security of my information?
  4. Can I share my GCKey with family members or others?
  5. What do I do if I think someone has obtained my Username and Password or I become aware of suspicious activity involving my account?
  6. What can I do if I forget my Username?
  7. What can I do if I forget my Password?
  8. What happens when I revoke my GCKey?
  9. What can I do to protect my computer, mobile device and personal information?
  10. Who do I contact if I have questions about privacy?
  1. Who has access to the information I enter when I sign up for a GCKey?

    The GCKey service is committed to providing measures that respect and value your privacy and security. All personal information we collect is governed by the Privacy Act and Privacy Regulations and the Treasury Board of Canada Secretariat’s policies, standards, and directives on privacy and the protection of personal information.

    Please refer to our Terms and Conditions for more information.

  2. How is my personal information protected?

    Your personal information is protected under the federal Privacy Act. To further protect your information, encryption is used to transfer your data securely over the Internet.

    Please refer to our Terms and Conditions for more information.

  3. What can I do to maintain the security of my information?

    You can help protect your information as follows:

    • do not share your Username, Password, Recovery Questions, Answers and Hints, or Codes sent to your account and password recovery email address with anyone;
    • memorize your Username, Password, and Recovery Answers instead of writing them down (if you do choose to print or record them, keep them in a safe place);
    • your Username and Password should be meaningful to you, but meaningless to others.

    To increase the security of your information, we recommend the following:

    • change your Password every three to six months;
    • do not use personal information (such as Social Insurance Number (SIN), Family name or Given name) in your Username or Password;
    • while you are signed in, do not leave your computer unattended;
    • sign out and close your browser when you are finished using the GCKey service or Enabled Services.
  4. Can I share my GCKey with family members or others?

    No, you may not.

    Your GCKey is your own unique credential. Your GCKey allows you to exchange confidential information with GCKey enabled online government programs and services. If others need access to these services, they will need to obtain their own GCKey.

  5. What do I do if I think someone has obtained my Username and Password or I become aware of suspicious activity involving my account?

    This is a serious matter.

    It means that someone else could use your GCKey to obtain or change your confidential information with the Government of Canada on your behalf. If you suspect that someone has obtained your Username or Password, you need to take the following actions:

    • Stop any possible misuse of your GCKey by:

      • changing your Password;
      • revoking your GCKey and signing up again as a new user (for more information, please refer to the What happens when I revoke my GCKey? frequently asked question).
    • Report the situation to the GCKey Service Desk:

      Canada and the United States
      1-855-438-1102

      Text Telephone (TTY/TDD)
      1-855-438-1103

      Outside Canada and the United States
      1-800-2318-6290

      Customer Service Representatives are available to assist you by phone,
      year round, 24 hours a day, 7 days a week.

  6. What can I do if I forget my Username?

    Use the Forgot Your Username? link on the GCKey Sign In page if you have forgotten your Username.

  7. What can I do if I forget my Password?

    Use the Forgot Your Password? link on the GCKey Sign In page if you have forgotten your Password.

  8. What happens when I revoke my GCKey?

    When you revoke your GCKey, you are also removing your online access to government online Enabled Services. To re-establish access to the government online Enabled Services, you must sign up for a new GCKey and re-enrol with each of the Enabled Services you wish to use.

  9. What can I do to protect my computer, mobile device and personal information?

    It is important that individuals and businesses take steps to protect personal and sensitive information on their accounts, mobile device(s), and their computer(s) and take precautions to ensure that the information remains safe and secure. We advise individuals and businesses using GCKey to read about the following security guidance.

    Safe Computing Practices

    • Always use strong passwords or passphrases to protect your accounts, computer(s) and mobile device(s). Never share your password;
    • Carefully select your personal shared secret questions. Never share them with anyone;
    • Avoid using “Remember Me” or "Save Password" features when logging into accounts;
    • Sign out of all accounts and services as you are finished using them and before leaving a computer unattended;
    • Only visit websites that use HTTPS, which are more secure than regular HTTP sites. Many popular web browsers no longer display HTTPS in their browser’s URL, in this case look for a padlock icon at the start of the URL field to know you’re on a secure site;
    • Act with caution when accessing websites, downloading, or installing software;
    • Be extremely cautious any time you receive an email or text message that asks you to reveal personal information, no matter how legitimate that message may appear on first glance. Whenever possible, you should try to verify requests for information through another means.

    Protect your computer or mobile device

    • Update and patch your computer and device operating systems and applications, including web browsers, regularly;
    • Use a firewall. Configure firewall software to help block unwanted connections to your computer and keep out hackers;
    • Use anti-virus and anti-spyware software. Prevent viruses from infecting your computer by installing and regularly updating anti-virus and anti-spyware software data files;
    • Secure your Wi-Fi network. Change the default network name (SSID). Change the default passwords for the network and the administrator account that came with your router. Disable SSID network broadcasting.
    • Avoid using public Wi-Fi networks, especially if sending sensitive information or logging into sensitive accounts.
    • Watch out for untrustworthy apps for mobile devices.  Only download  apps from trusted sources, like the App Store or Google Play. Review app permissions, check if its functionality lines up with the permissions it’s requesting. When possible, only enable the permissions you’re comfortable with;
    • Be careful with Bluetooth. Take extra care when pairing anything through Bluetooth.  Turn off Bluetooth when you’re not using it so that hackers cannot detect your device and attempt to pair with it;
    • Lock your mobile devices. Use a lock screen password and enable biometric security features, like a fingerprint scan, if available. Enable auto-lock so it always locks after a short period of time.

    Protect your information

    • Turn off your computer or lock your mobile device when not in use;
    • Manage and monitor your accounts. Review your accounts regularly and monitor them for suspicious activity;
    • Back up your files regularly. Create and store a copy of your important information and documents offsite to help protect them from loss due to viruses or hardware damage.

    Protect yourself

    • Protect your digital identity. Change your passwords regularly. Use a different password or passphrase for each account and device, especially for accounts with sensitive information;
    • On social media sites, keep private information private. Use the privacy and security settings on social media sites to control who can see what;
    • Be careful with emails from unknown senders. Never open or download files or follow links in emails from people you don't know;
    • Browse the Internet safely. Read a website's privacy policies before providing your name, age, street address, email address, phone numbers or other personal information - even when on a secure website;
    • Seek technical help and report cyber crime. If you need assistance with software maintenance or installation on your computer, or to remove a virus or malware, call a computer technician. Call local police if you suspect a computer crime, identity theft or commercial scam.

    Additional Information about cyber security

    For more information about cyber security and the simple steps you can take to protect yourself and your personal information online, please see the following:

  10. Who do I contact if I have questions about privacy?

    For questions about privacy, please contact the Access to Information and Privacy Protection Division by email at atip-aiprp@ssc-spc.gc.ca, or by writing to the following address:

    Director, Access to Information and Privacy
    Shared Services Canada
    PO Box 9808, STN T, CSC
    Ottawa ON K1G 4A8

    If you are not satisfied with our response to your privacy concern, you may want to contact the Office of the Privacy Commissioner at 1-800-282-1376, or TTY at 819-994-6591, or by online form or visit the Office of the Privacy Commissioner of Canada website.

    Each Government Program or Enabled Service has their own Privacy Policy. For more information, please refer to the Terms and Conditions of each enabled service's web page.