Agreement to Amend the Canada- Nunavut Labour Market Development Agreement

The purpose of this Annex is to set out the mutual understanding and agreement of the parties on:

1. The performance management strategy
2. The target setting process, results reporting and results targets.

Canada and Nunavut recognize the importance of performance measurement for tracking the progress of clients of labour market programs; and for reporting to the public on results achieved under this Agreement.

Pursuant to section 6.2 of the Agreement, the parties agree to the following Performance Measurement Strategy.

The Performance Measurement Strategy was developed multilaterally by Canada and the provinces and territories through the Forum of Labour Market Ministers (FLMM) Labour Market Transfer Agreements and Performance Measurement Working Group, hereinafter referred to as the “Working Group”. The strategy is informed by a logic model, performance indicators, outputs, outcomes, data elements, definitions and implementation plan.

2.1 Governance

2.2 Performance Measurement

2.3 Performance Indicators

2.4 Personal information

2.5 Reporting

2.6 Implementation

2.7 Data sharing

Beginning fiscal year 2000-01, Canada and Nunavut will jointly establish mutually agreed result targets for the primary indicators referred to in section 6.3 of this Agreement. The targets will be established with consideration to the factors outlined in Section 6 of this Agreement. Targets may require adjustment during 2000-01 and experience gained will allow for more precise targets in subsequent years.

1.1 The purpose of this Annex to the Canada-Nunavut Labour Market Development Agreement (this Agreement) is to provide for the exchange of information, including personal information, as defined in section 3 of Canada’s Privacy Act and section 2 of Nunavut’s Access to Information and Protection of Privacy Act (ATIPP Act), and “information” as defined in subsection 30(1) of the Department of Employment and Social Development Act (DESD Act), between the parties. Personal information includes social insurance numbers.

2.1 With respect to the information to be provided by Canada to Nunavut under section 3 of this Annex, Canada confirms that it is authorized under subsection 34(1) of the DESD Act to provide such personal information to Nunavut for the purposes set out in section 3. In this regard:

1. the personal information set out in section 3 consists of information obtained by the Canada Employment Insurance Commission or the Department of Employment and Social Development from persons under the Employment Insurance Act (EI Act), and of information prepared from such information;
2. subsection 34(1) of the DESD Act authorizes the disclosure of the aforementioned personal information to any person or body for the administration or enforcement of the program for which it was obtained or prepared; and
3. the personal information described in section 3 of this Annex will be disclosed to Nunavut only for the purposes described herein.

2.2 With respect to the information to be collected by Canada from Nunavut under section 4 of this Annex, Canada confirms that it is authorized under the EI Act to collect such personal information from Nunavut for the purposes set out in section 4.

Nunavut’s Authorities:

2.3 With respect to the personal information to be provided by Nunavut to Canada under section 4 of this Annex, Nunavut confirms that it is authorized under section 48 of the Nunavut ATIPP Act to provide such information to Canada for the purposes set out in section 4.

3.1 Canada will provide to Nunavut, when requested by Nunavut, on a per individual basis, the following personal information under its control from an individual’s file for the purposes of:

1. assisting Nunavut in establishing and verifying if the individual qualifies as an EI client who is not an active EI claimant (i.e. who qualifies as a former EI claimant) and is therefore eligible for, or entitled to, assistance under Nunavut’s programs:
   • name
   • social insurance number
   • address
   • postal code
   • telephone number
   • date of birth
   • federal office code – if available
   • gender
   • language (French or English)
   • EI client status, with explanatory messages
   • Provincial/Territorial Parental Benefits (P/TPB) client status, if applicable, with explanatory messages;
   • Identification if on an intervention, with explanatory messages; and
2. in respect of an individual, who has been determined to be an active EI claimant who is eligible for, or entitled to, assistance under Nunavut’s programs, assisting Nunavut in determining the nature and level of financial assistance to be provided to the EI client under Nunavut’s programs:
   • name
   • social insurance number
   • address
   • postal code
   • telephone number
   • date of birth
   • federal office code – if available
   • gender
   • language (French or English)
   • EI client status, with explanatory messages
   • P/TPB client status, if applicable, with explanatory messages
   • identification if on an intervention, with explanatory messages
   
   EI claim information:
   • benefit period commencement (BPC)
   • type of EI benefit (claim type, e.g. regular, etc.)
   • number of eligible weeks
   • number of weeks paid (number of weeks paid in special benefits and number of weeks paid in regular benefits identified if on same claim)
   • EI benefit rate – Part I
   • federal tax deducted
   • territorial tax deducted
   • week of renewal
   • latest renewable week
   • last week processed
   • expected end date of Part I
   • apprenticeship (yes/no)
   • apprenticeship waiting period waived (yes/no)
   • stop payment – yes/no
     • if yes – date of stop payment
   • disentitlements, if applicable
     • start date
     • end date
     • explanatory messages
   • disqualifications, if applicable
     • start date
     • disqualification weeks remaining
     • explanatory messages
   • allocation of earnings
     • start week
     • end week
     • allocation of earnings weekly amount
     • amount of last week of allocation of earnings

Canada, may on its own initiative, provide to Nunavut an update on any or all of the above information, for use by Nunavut in reviewing, as needed, the purpose and amount of the financial assistance provided to the EI recipient by Nunavut.

3.2 When Canada is unable to successfully process the information submitted by Nunavut pursuant to section 4.2 of this Annex, regarding the referral by Nunavut of an active EI claimant to a Nunavut benefit, for purposes of sections 25 and 27 of the EI Act, Canada will provide to Nunavut any or all of the following personal information under its control on the EI clients so referred, for use by Nunavut in reviewing and/or modifying the information previously submitted to Canada:

• name
• social insurance number
• EI client status
• P/TPB client status
• federal office code, if available
• territorial office code, if available
• intervention type (e.g. training, job creation, self-employment)
• training ID (for training interventions)
• institution code, if available
• apprentice indicator
• no claimant report code (for apprentices)
• start week(s)/date(s) of intervention
• end week(s)/date(s) of intervention
• intervention break start week/date
• intervention break end week/date
• agreement/file number
• rate (EI Part II)
• error code
• definition of error code

3.3 Canada will provide to Nunavut on a quarterly basis any or all of the following personal information under its control on all EI clients and non-EI clients who have received assistance from Nunavut under Nunavut programs, for use by Nunavut for the review, analysis and verification of the data calculated/held by Canada; planning, delivery, and administration of Nunavut programs; and for monitoring, assessing, evaluating and reporting about the effectiveness of the assistance provided. This information will be provided in a mutually agreed upon format.

3.4 Upon request, and based on the quarterly data files on EI clients and non-insured participants who are participating in Nunavut programs funded with EI Part II monies, as provided by Nunavut in section 4.3, the following personal information will be provided to Nunavut for the review and verification of Canada’s reporting of results; planning, delivery and administration of Nunavut programs; and for monitoring, assessing, evaluating and reporting about the effectiveness of the assistance provided. The personal information will be provided in two different data sets (by client and intervention):

• social insurance number
• age
• gender
• designated group indicators (persons with disabilities, members of visible minority groups, aboriginal peoples)
• territorial office code
• EI client type
• action plan ID
• action plan start date
• action plan end date
• action plan result
• action plan result date
• intervention code (type of intervention)
• intervention start date
• intervention end date

3.5 Canada will provide to Nunavut, when requested by Nunavut and based on the selection criteria identified by Nunavut, on a per individual basis, any or all of the following personal information under Canada’s control from an individual’s file for the purpose of assisting Nunavut in contacting individuals who have recently applied for benefits under Part I of the EI Act who may be interested in receiving assistance under Nunavut Benefits and Measures, in order to facilitate their return to work:

• name
• social insurance number
• address
• postal code
• telephone number
• e-mail address (if available)
• gender
• date of birth
• official language of service (French or English, written)
• official language of service (French or English, spoken)
• federal office code associated with the client’s postal code
• territorial office/catchment code associated with the client’s postal code
• referral type (occupation in demand/job-ready or other)
• referral source (Appli-web, second referral)
• referral code and reason (i.e. the targeting criteria used to refer the client)
• National Occupational Classification (NOC) code for the most recent job

3.6 On a quarterly basis, Canada will provide to Nunavut the following personal information under its control, on all EI clients residing in Nunavut who are active EI claimants and who are in receipt of regular or fishing benefits, to assist Nunavut in the strategic planning of the delivery of its programs:

• postal code (X0A 1H0 [Iqaluit]; all other X0A codes; X0B codes; X0C codes)
• territorial office code, if available
• EI economic region
• age at benefit period commencement
• preferred official language (French or English)
• gender
• disability status (where available as self-identified information)
• visible minority (where available as self-identified information)
• aboriginal group (where available as self-identified information)
• education level (where available as self-identified information)
• EI claim status
• EI claim category (long-tenured worker, occasional claimant, frequent claimant)
• regular EI claimant without declared earnings – yes/no
• seasonal user
• weekly benefit rate
• number of entitlement weeks
• renewal week
• benefit period commencement
• first week of the last claimant’s report sent
• cut-off date (first insurable week)
• insured weeks/hours
• last week processed
• total number of weeks paid
• total benefits paid since the claim began
• last week worked
• insurable earnings
• National Occupational Classification (NOC) code of last job
• North American Industry Classification System (NAICS) code of last job

Any reports created by Nunavut or Canada involving these data elements must be in cells of no less than 10.

3.7 Nunavut understands that it cannot use any of the personal information received from Canada under this Annex for research or statistical purposes.

3.8 For the purposes of detecting overpayments of financial assistance due to error, misrepresentation or fraud in relation to an individual or individuals receiving, or who have received assistance from Nunavut under Nunavut programs funded under this Agreement, Canada will provide to Nunavut where available and upon written request, on a per individual basis, any or all of the following personal information under its control about an individual:

• name
• social insurance number
• birth date
• address
• postal code
• telephone number
• type of benefits
• benefit commencement period
• waiting period weeks (in week code)
• gross weekly benefit rate (excluding the family supplement)
• net weekly benefit rate (excluding the family supplement)
• claim termination date
• number of entitlement weeks
• last week processed (in week code)
• weeks paid (in week code)
• payment indicator for each of the declarations referenced
• name and address of employer who issued the last record of employment used to establish the EI claim during which the client began participation in a Nunavut intervention
• NOC code of last job
• number of insurable hours of last job
• explanatory messages

3.9 Canada may also, on its own initiative, provide to Nunavut the information listed in section 3.8 about any individual who has received, or is receiving, assistance under Canada’s programs where it suspects that the individual was/is not entitled to that assistance, and/or may have received or be receiving insurance benefits under Part I of the EI Act to which the individual was/is not entitled.

3.10 Following amendments to Canada’s EI Act, Canada will provide to Nunavut, when requested by Nunavut, on a per individual basis, any or all of the following personal information under its control in respect of each individual who has been determined to be an active EI claimant who is receiving or has recently received financial assistance while participating in a Nunavut program, to assist Nunavut in communicating with the client and/or in determining whether any revisions to Nunavut’s financial assistance are required:

• name
• social insurance number
• address
• postal code
• telephone number
• language (English or French)
• federal office code, if available
• Part I benefit period commencement
• Part I end date
• original EI entitlement (in weeks)
• amended EI entitlement (in weeks)
• total weeks paid to date
• last week processed
• intervention type
• training ID
• start week(s)/date(s) of intervention
• end week(s)/date(s) of intervention
• agreement/file number
• benefit rate
• last renewable week

4.1 Nunavut will provide Canada, on a per individual basis, the following personal information under its control about each of its clients who has submitted an application under one of Nunavut’s benefits and measures, for the purposes of establishing and verifying if the individual qualifies as an EI client:

• social insurance number
• name
• eligibility date

4.2 Nunavut will provide to Canada the following personal information under its control about each EI client who is an active EI claimant and who is receiving assistance under Nunavut programs for the following purposes:

1. to ensure that EI clients who are active EI claimants continue to receive the insurance benefits to which they are entitled while participating in a Nunavut program (for purposes of section 25 of the EI Act):
   • name
   • social insurance number
   • territorial office code
   • intervention type (e.g. training, job creation, self-employment)
   • training ID (for training interventions)
   • institution code (if available)
   • start week(s)/date(s) of intervention
   • end week(s)/date(s) of intervention
   • intervention break start week/date
   • intervention break end week/date
   • authorization for absence from Canada during intervention, with dates, if applicable
   • agreement/file number
   • apprentice indicator
   • no claimant report code (for apprentices)
   • rate (EI Part II)
2. to allow Canada to verify the ongoing eligibility for, or entitlement to, insurance benefits (for the purposes of sections 25 and 27 of the EI Act):
   • name
   • social insurance number
   • intervention type
   • date for absence from or for leaving the intervention early, prior to completion
   • reason for absence from, for departure, for abandoning, or for cancelling participation in the intervention, if known
3. to allow Canada to determine the eligibility for, or entitlement to, employment insurance benefits under Part I of the EI Act of an individual who is authorized by Nunavut to quit their job in order to participate in a Nunavut program (for the purposes of section 25 of the EI Act):
   • name
   • social insurance number
   • date on which the individual is authorized to quit their job (last day of work)
   • start date of participation in the Nunavut program, and rationale for any gap of more than two weeks
   • name and signature of designated authority, with date

4.3 Where available, Nunavut will provide to Canada the following personal information under its control:

1. about each EI client who is participating in Nunavut programs, and
2. for each non-insured participant who is participating in Nunavut programs funded with EI Part II monies,

for the purpose of assisting Canada in monitoring, assessing and evaluating the effectiveness of the assistance provided by Nunavut under Nunavut’s programs which Canada is required to do under Articles 7 and 9 of this Agreement:

• Name
• Social insurance number
• Address
• Postal code
• Date of birth
• Telephone number
• Email address
• Gender
• Marital status
• Number of dependants
• Disability status
• Indigenous identity
• Immigrant status
• Immigration year
• Visible minority status
• Highest level of education
• Federal official language of choice (French or English)
• Federal official language of service (French or English)
• Employment status
• Precarious employment status
• Intervention name
• Intervention code
• Intervention start date
• Intervention end date
• Intervention outcome
• Credential/certificate earned
• National Occupational Classification
• Action Plan start date
• Action Plan end date
• Action Plan outcome
• Action Plan outcome date
• Increase in literacy and essential skills

The above information will be updated by Nunavut on a monthly basis, or (for periodic evaluations) upon request, when available.

4.4 For the purposes of detecting overpayments of insurance benefits under Part I of the EI Act, due to error, misrepresentation or fraud, to an individual or individuals who are participating in, or have participated in Nunavut programs funded under this Agreement, Nunavut will provide to Canada upon written request on a per individual basis, any or all of the following personal information under its control about an individual:

• name
• social insurance number
• birth date
• address
• postal code
• telephone number
• reason for separation from employment, if known (pre-intervention)
• whether or not the client reported for an interview as directed
• interview details (counsellor seen/scheduled to be seen, date, time and location of interview)
• method used to direct client to report
• reasons for not reporting
• reason client is not capable of work/intervention/service
• reason client is not available for work/intervention/service
• authorization for absence from Canada during intervention, with dates, if applicable
• date(s) absent from Canada/area without authorization
• reason absent from Canada/area without authorization
• intervention type (e.g. training, job creation, self-employment)
• training ID (for training interventions)
• institution code (if available)
• start week(s)/date(s) of intervention
• end week(s)/date(s) of intervention
• intervention break start week/date
• intervention break end week/date
• agreement/file number
• apprentice indicator
• rate (EI Part II)
• total number of weeks paid
• last week paid
• payment indicator for each EI Part II payment referenced
• reason for withdrawal from program
• reason for termination from program
• reason earnings not reported to Canada during the weeks they were earned (if known)
• date of return to work
• employer name and address
• employer telephone number
• explanatory messages

4.5 Nunavut may also, on its own initiative, provide to Canada the information listed in section 4.4 about any individual who has received, or is receiving, assistance under Nunavut’s programs where it suspects that the individual was/is not entitled to that assistance, and/or may have received or be receiving insurance benefits under Part I of the EI Act to which the individual was/is not entitled.

4.6 Following amendments to Canada's EI Act, Nunavut will provide to Canada any or all of the following personal information under its control in respect of each individual who is receiving or has recently received financial assistance while participating in a Nunavut program, in order for Canada to determine which of these individuals is receiving or has recently received Part I benefits under that Act, which in turn will assist Nunavut in communicating with the client and/or in determining whether any revisions to Nunavut’s financial assistance are required:

• name
• social insurance number
• address
• postal code
• start week(s)/date(s) of Nunavut intervention
• end week(s)/date(s) of Nunavut intervention

4.7 Nunavut will provide to Canada the following personal information under Nunavut’s control on the results of Nunavut’s efforts to contact the individuals identified by Canada under section 3.5 of this Annex, for the purpose of assisting Canada in assessing the impact of those efforts in facilitating each individual’s return to work, and verifying the individual’s ongoing eligibility for, or entitlement to, employment insurance benefits under Part I of the EI Act (for the purposes of sections 25 and 27 of the EI Act):

• social insurance number
• date of successful contact
• results of contact
• date of scheduled interview with a designated official or case manager (if applicable)
• reason why the individual did not appear for the scheduled interview (if applicable)
• comments

5.1 In the context of allowing an Nunavut employee to access Canada’s systems and personal information held by Canada, Nunavut will provide to Canada a written description of its policies and procedures relating to performing and managing Personnel Security Screening Checks (PSSC) when assigning an employee to a position that deals with personal information.

5.2 In accordance with the legislative, regulatory and policy requirements of their employer, Nunavut employees who access personal information provided by the other party under this Agreement must obtain and retain a personnel security screening level that is commensurate with the handling of personal information.

5.3 The parties will ensure that only authorized individuals have access to and use of the personal information exchanged under this Agreement and only as is required for the performance of their duties under this Agreement.

5.4 Nunavut will conduct PSSC of their employees and contractor’s employees based on standards similar or equivalent to those of the Government of Canada. Nunavut PSSC will include a nation-wide criminal records check. Once Nunavut has completed the PSSC for its own or a contractor’s employees, Nunavut will retain a copy of the PSSC and the individual’s signed written consent to initiate the PSSC.

5.5 Nunavut will provide an annual attestation that a valid PSSC for each of their employees is on file and that any risks identified during the screening process have been discussed with the other party prior to granting access. Nunavut will retain, and upon request will provide to Canada, the following personal and non-personal information under its control for each Nunavut employee who requires access to Canada’s systems and information, and who has completed the PSSC:

• name, including middle name
• date of the Personnel Security Screening Check completion
• name of approving authority
• position of approving authority
• signature of approving authority, with date

5.6 Once a Personnel Security Screening Level has been granted, it remains valid for 10 years, provided there has not been a break in employment for a period of more than 1 year. Nunavut will conduct a new Personnel Security Screening Check for their Authorized Users at least every 10 years (or more frequently, if required under Nunavut’s policy), in order to update the Personnel Security Screening Level of their Authorized Users. ESDC may suspend system access for Authorized Users whose Personnel Security Screening Level expires, until such time as their Personnel Security Screening Level is renewed.

5.7 Nunavut will promptly inform Canada when a Nunavut employee ceases to need access to any of Canada’s systems.

6.1 All personal information obtained under this Agreement shall be collected, used, maintained, stored, retained, disclosed, destroyed or disposed of and otherwise administered and protected in accordance with all applicable legislation. Personal Information is to be safeguarded at a high level of protection to ensure the integrity, privacy and security of the disclosure process.

6.2 In the event of a breach or incident involving personal information that has been accessed or collected from the other party, the party responsible for the privacy breach or incident will prompty notify the other party and following the process described in Appendix A.

7.1 Canada and Nunavut agree to enter into a separate service level agreement outlining systems requirements.

7.2 Unless otherwise specified in this Agreement, personal Information and reports covered by this Annex will be provided by each party in a mutually agreed format, frequency and manner.

7.3 Canada and Nunavut agree to notify each other within a reasonable time of any change affecting communication protocols or methods, data bank access procedures or systems. The parties agree to participate in compatibility tests when changes are made to such protocols, methods or procedures.

7.4 Nunavut may request improvements to Canada’s applications used by Nunavut. If deemed appropriate, suggested improvements will be taken into account in Canada’s priority-setting process. Nothing in this clause limits the development activities that must be pursued by both parties in order to ensure personal information exchange between the two organizations.

7.5 Canada agrees to inform Nunavut, in a timely manner, in accordance with the procedures agreed upon by both parties, of any new federal application or any new version of a federal application that is relevant to this Annex.

7.6 Canada and Nunavut are committed to ensuring that the personal information they provide to each other under this Annex is reliable and is provided in a timely, secure, and confidential manner, and they agree to work together in achieving this goal.

8.1 Canada and Nunavut undertake to use their best efforts to fully maintain and protect the confidentiality of the personal information they receive under this Annex.

8.2 Subject to sections 8.3 and 8.4, Canada and Nunavut shall not, in respect of any personal information they obtain from each other under this Annex:

1. use that information for a purpose other than that for which it was respectively provided to them; and
2. disclose that information to any person or body for a purpose other than that for which it was respectively provided to them.

8.3 Canada and Nunavut may use personal information they obtain from each other under this Annex for a purpose other than that for which it was obtained:

1. with the written consent of the individual to whom that information relates;
2. if permitted pursuant to the legislation applicable to the party that received that information and with the written consent of the party that provided that information; or
3. if required by legislation.

8.4 Canada and Nunavut may disclose personal information they obtain from each other under this Annex to any person or body for any purpose:

1. with the written consent of the individual to whom that information relates;
2. in a form that cannot reasonably be expected to identify the individual to whom that information relates; or
3. if required by legislation.

8.5 Unless otherwise required by law or authorized in writing by the other party and subject to section 8.2, a party shall not disclose any personal information, obtained from the other party under this Annex, to a third party for a purpose authorized herein unless there is a written agreement between that party and the third party imposing upon the third party obligations that are the same as those imposed upon that party under this Annex with respect to the protection of this information.

8.6 Nunavut acknowledges that it is an offence under section 42 of the DESD Act for anyone to knowingly make available information that is privileged thereunder or to knowingly use or allow such information to be used otherwise than in accordance with that Act. This provision applies to employees of Nunavut as well as employees of ESDC and third parties to whom the information is disclosed.

8.7 In the event of a request under Canada’s Access to Information Act or Privacy Act for personal information obtained from Nunavut under this Annex, Canada agrees to consult, when required, with Nunavut prior to any disclosure of such information. In the event of a request under Nunavut’s Access to Information and Protection of Privacy Act for information obtained from Canada under this Annex, Nunavut agrees to consult, when required, with Canada prior to any disclosure of such information. No consultation obligation referred to in this section will be construed as limiting any legal duty in respect of any disclosure referred to in this section.

9.1 Costs incurred by a party in carrying out its obligations under this Annex will be the responsibility of that party.

10.1 The personal information exchanged under this Annex shall be collected, used, maintained, stored, retained, disclosed, destroyed or disposed of and otherwise administered and protected in accordance with:

1. in the case of Canada, the Privacy Act, the DESD Act, the EI Act, the Library and Archives of Canada Act, and regulations thereto, and any other applicable federal legislation, the Government of Canada’s Policy on Government Security, the Electronic Documents and Records Management Solutions Standard, as well as all applicable federal and departmental policies, protocols, operating directives, and guidelines, governing the administrative, technical and physical safeguarding and disposal of the personal information; and,
2. in the case of Nunavut, the Access to Information and Protection of Privacy Act and regulations thereto, as well as all applicable territorial and departmental policies, protocols, operating directives, and guidelines governing the administrative, technical and physical safeguarding and disposal of the personal information.

10.2 The parties will investigate all cases where they have reasonable grounds to believe that any of the conditions set out in this Annex have been or are likely to be breached. This includes any cases where it is alleged, suspected, or there is evidence, that there has been unauthorized collection, access, use, disclosure, modification, disposal or destruction of the personal information exchanged under this Annex, modification of a permitted use, misuse, or breach of confidentiality, or any incident which might jeopardize or has jeopardized the security or integrity of the parties’ respective computer systems or networks used to access and transmit the personal information, as outlined in Appendix A to this Annex.

10.3 The parties will comply with their respective policies related to the conducting of Privacy Impact Assessments (PIA) and Threat and Risk Assessments (TRA) covering the exchange of personal information under this Annex. When one party is conducting a PIA or TRA, the other party will provide information upon request related to their policies and procedures for managing the personal information provided by the first party, in order to facilitate the completion of the assessment. When the PIA or TRA is completed, the parties agree to provide a copy of the relevant portions of the related reports to each other.

10.4 The parties will periodically audit their respective information management practices and procedures in the context of this Annex, to ensure:

1. compliance with the requirements of section 10.1; and
2. the security, confidentiality and integrity of the personal information exchanged under this Annex.

11.1 Each party will use its best efforts to ensure the completeness and accuracy of the personal information provided to the other under this Annex. However, it is understood and agreed that they cannot guarantee its accuracy and completeness and will, therefore, not be held responsible by the other party for any damage resulting from the transmission or use of any information that is inaccurate or incomplete.

12.1 Except as may be permitted by Nunavut’s Access to Information and Protection of Privacy Act, personal information (as defined therein) in Nunavut’s custody or under Nunavut’s control may only be stored or accessed in Canada.

12.2 Canada and Nunavut will cooperate to ensure that the provisions of Nunavut’s Access to Information and Protection of Privacy Act are respected.

13.1 This Annex can be modified with the written consent of both parties.

A.1 In the event of a security incident involving personal information or privacy breach, which for the purpose of this Agreement includes unauthorized access to or collection, use, disclosure, deletion, disposal or destruction of information, the party responsible for the privacy breach shall:

1. take immediate and reasonable steps to contain or limit the privacy breach (unauthorized access, use, disclosure, modification, destruction, disposal, misuse, or breach of confidentiality, or computer or network security breach), including but not limited to: stopping the unauthorized practice; recovering the records or personal information, where possible; shutting down access to information systems; revoking or changing computer and other access codes or correcting weaknesses in physical and/or IT security;
2. promptly investigate the cause of the privacy breach;
3. notify the other party;
4. notify the appropriate authorities if criminal activity is suspected;
5. notify the affected individual(s) whose personal information was inappropriately disclosed;
6. cooperate with the other party and its Information and/or Privacy Commissioner and its contractors and auditors in any investigation into or audit of the events;
7. following the investigation, provide a detailed written report of the circumstances related to any unauthorized access, use, disclosure, modification, destruction, disposal, misuse or breach of confidentiality or computer or network security breach to the other party;
8. take reasonable steps requested by the other party to address the current situation or prevent a reoccurrence; and,
9. notify the other party of any remedial actions taken.

A.2 Upon being notified of an instance of unauthorized access, use, disclosure, modification, misuse or breach of confidentiality, or computer or network security breach, the party so notified may:

1. review the steps proposed by the other party to address the current situation or prevent a recurrence of the non-compliance;
2. request that the other party take specific steps to address the current situation or prevent a recurrence; and/or, for serious breaches, suspend the exchange of personal information under this Annex until satisfied that the other party has complied with the Annex and with any reasonable requests made under this subparagraph.