Audit of Personal Information Management for Policy Analysis, Research and Evaluation

Definitions of PARE

Approval of submissions

According to the Governance Protocol for Conducting Policy Analysis, Research, and Evaluation Activities, as well as the DRWG and PISC Terms of Reference, PARE activities requiring the use of unmasked personal identifiers and/or the linkage of two or more internal or external databanks are to be approved by the DM following the review and recommendation by PISC.

The review of the sample of submissions indicated that 3 out of 13 (or 23%) submissions were approved by the Senior Associate Deputy Minister (SADM) of ESDC and Chief Operating Officer (COO) for Service Canada. A further review of the total number of approved submissions indicated that submissions channeled through the DRC were all approved by the DM; while 62% of submissions channeled through the DRWG to PISC were approved by the SADM of ESDC and COO for Service Canada. The audit team was unable to find any documentation supporting the change to the approval process. Through additional inquiries, the audit team was informed by departmental officials that a decision was made to have the SADM of ESDC and COO for Service Canada approve the submissions. During the review of PARE files, the auditors found that approval has since been reverted to the DM for the latest submissions.

Updates to PARE projects

The DRWG, as specified in its Terms of Reference, reviews amendments to previously approved projects and receives periodic updates from project authorities. Major amendments such as requests for additional databank linkages are reviewed by the DRWG and forwarded to the DM for approval. Minor and clerical amendments such as increasing the sample size, extending the project end date, or minor writing errors are approved by the DRWG chair. Project authorities may be required to give updates on their project and present to PISC if necessary.

During the file review, the audit team found it challenging to identify the current project authority for 8 of the 13 (or 62%) submissions selected for review as they had left ESDC. In addition, the audit team was informed that one of the 13 projects was cancelled as members on the project had left the Department. We were also informed that the project never started; however, we were unable to confirm whether information had been collected, stored or destroyed prior to the cancellation of the project.

Access to personal information

Projects in our sample for which databank connections were provided by DMD on behalf of Skills and Employment, Citizen Service and SSP branches had a signed Access to Personal Information (API) on file.

Interviews with DMD indicated that access to personal information is provided only after authorization by the Senior Assistant Deputy Minister of SSP through the signing of a completed API form. This form must be completed by ESDC officials seeking to access data containing personal information held in SSP Branch for PARE activities. Access to data files is granted under the general supervision of DMD. This procedure only exists at DMD.

The audit team believes this is a good practice and constitutes an added control to ensure that only authorized staff can access personal information for the purposes of PARE.

Our sample also included PARE projects from the Learning Branch for which databank connections were not provided by DMD, but by the Learning Branch data analyst. Interviews with the data analyst indicated that access to data is restricted to authorized staff only and that electronic data files are stored on a restricted folder in the Common Drive.

Managing data and databank connections

The Governance Protocol for Conducting Policy Analysis, Research, and Evaluation Activities had assigned the responsibility for linking databanks and masking personal identifiers to DMD for SSP and other branches and regions where required. The same Protocol also stated that other branches and regions, however, had the authority to perform data linkages and mask personal identifiers for PARE activities when authorized and in accordance with the principles outlined in the Guidelines for Managing Data and Databank Connections for Policy Analysis, Research, and Evaluation Activities ^{Footnote 6} .

DMD has established a Data Access, Integration and Development Project Checklist, a tool that is currently used by its analysts for each PARE project to confirm that proper processes have been performed for the production and release of PARE data set extracts from the Statistical Analysis System - Data Integration Server (SAS-DIS).

However, since the Protocol has not been updated and is no longer available, and in the absence of guidelines for managing data and databank connections for PARE activities in the newly implemented Departmental Policy on Privacy Management, branches and regions do not currently have any guidelines to follow when performing data linkages and masking personal identifiers for PARE activities.

Storage of personal information

Masked personal information is stored by DMD on SAS-DIS, a dedicated server. For each project, an extract is run and the data moved to the required location by DMD analysts. The SAS-DIS can only be accessed by six analysts as well as a certain number of Shared Services Canada maintenance employees. DMD analysts are required to complete API annually which allows them overall access to the databanks.

SAS-DIS does not have a built-in “auditing of access” feature. Monitoring is performed and controlled at the Operating System and Metadata Server level. However, DMD is looking into acquiring and implementing new features to create access reports which can include flagging irregular access to the server such as access outside of working hours.

Project authorities and members of the PARE projects safeguard masked personal information either on the C drive under the individual user’s restricted folder, the U drive restricted to the Branch or Directorate, on a stand-alone server, on Compact Disk or an encrypted key held in a secured cabinet with a combination lock.

With respect to PARE projects conducted by consultants, the audit team found that contracts had clauses for the protection of personal information including privacy breaches while in storage with the consultants. Although a good practice, the auditors were unable to confirm whether data containing personal information was appropriately handled and stored when under custody with the consultants.

Disclosing personal information

Interviews with DMD as well as the network visual verification of PARE project files, when applicable, indicated that personal information was only released to project authorities after the approval of the PARE submission by the DM (or the SADM of ESDC and COO for Service Canada) and the signing of the API when required. However, the auditors found two projects which involved consultants where contracts were awarded prior to the approval of the PARE submission, and for one of them, data files were requested from the program areas and received at DMD prior to the approval of the PARE submission. Furthermore, some of the data files were provided to the project authority prior to the approval of the submission by the DM.

Destroying personal information

The date for destroying information created as a result of PARE projects is set by the project authority. Information is to be destroyed in accordance with the appropriate Records Disposition Authority. 10 out of the 13 sampled project data files are still active and they are not due for destruction yet. For one of them, the audit team found that the date for destroying data files has not been set.

In our sample, there were three project data files due for destruction. The audit team was unable to confirm destruction due to lack of historical information on two projects. For the third project, the audit team found that the project authority had not destroyed the project data files at the time of the audit.

According to the terms and conditions of contracts, data used by consultants should be disposed of at the completion of the contract with a written confirmation to the project authority. For 6 out of the 8 projects with consultants, the audit team was unable to find the written confirmation that was supposed to be received.