Annual Report to Parliament on the Administration of the Privacy Act - 2015-2016

Introduction

Privacy Act

The l40Privacy Act came into effect on July 1, 1983. The Act protects the privacy of individuals with respect to their personal information held by government institutions. This establishes the rules for the collection, use, disclosure, retention and disposal of such information. It also provides individuals with a right to be given access to, and to request a correction of, their personal information.

Section 72 of the l41Privacy Act requires that the head of every government institution submit an annual report to Parliament on the administration of the qqqAct within the institution for the past fiscal year. It is under this provision that the present annual report is tabled in Parliament.

The present annual report describes how Shared Services Canada (SSC) administered the l42Privacy Act for the period from April 1, 2015, to March 31, 2016.

Institutional Mandate and Organization

Mandate

Shared Services Canada (SSC) is a federal department created on August 4, 2011, to transform how the Government of Canada manages its information technology (IT) infrastructure. SSC’s mandate was reinforced on June 29, 2012, with the passage by Parliament of the Shared Services Canada Act.

SSC’s focus is to transform how the Government of Canada manages its IT infrastructure, by delivering modern, reliable, secure, cost-effective IT infrastructure to 42 partner organizations. The aim is to maintain and improve IT services delivery across the Government of Canada, generate and reinvest savings, enhance security, and implement government-wide solutions to transform the IT infrastructure to improve services to Canadians.

SSC reports to Parliament through the Minister of Public Works and Government Services and is responsible for delivering mandated email, data centre and network services to the partner departments and agencies (“Partner Organizations”, refer to Annex A) in a modernized, consolidated and standardized manner to support the delivery of Government of Canada programs and services. During 2014–2015, SSC worked toward consolidating a new enterprise email system for the Government of Canada. In addition, the Department continued to consolidate data centres and telecommunication networks, as well as streamline the procurement of IT hardware and software used in the workplace. SSC also continued to support the achievement of Canada’s Cyber Security Strategy.

In addition, SSC contributes to the achievement of other critically important and transformational Government of Canada initiatives, such as the Perimeter Security Defence Project, the Transformation of Pay Administration initiative and the vision of the public service of the future as articulated in Blueprint 2020. As an IT security service delivery organization, SSC works collaboratively with other Government of Canada cyber security agencies to support the cyber security strategy.

Organization: The way forward

As SSC evolves to execute its Transformation Plan, a new organizational structure has helped shift the Department’s focus from its legacy environment to its new enterprise IT infrastructure. On April 1, 2015, SSC moved to a structure where single operational branches are responsible for the entire lifecycle of the services they provide. A flatter, streamlined and more horizontal structure has enabled these goals by clarifying accountabilities on major initiatives and supporting employee mobility.

Delegated Authority

With the arrival of a new President for SSC, pursuant to section 73 of the l43Privacy Act, in August 2015 the President authorized the delegation instrument by reconfirming full powers, duties and functions under the Act to levels down to and including the Director of the Access to Information and Privacy (ATIP) Protection Division, hereafter referred to as the ATIP Division (see Annex B).

ATIP Division Structure

During the reporting period, the ATIP Division structure remained the same with a Director and two Deputy Directors, each overseeing teams of analysts for the Operations side as well the Policy and Governance side. While an average of 16 person years were dedicated to the ATIP program, five person years were dedicated to the administration of the l47Privacy Act. These person years include full-time equivalents, casual employees, students and consultants.

Dedicated to Access to Information and Privacy Excellence

The ATIP Division is responsible for developing, co-ordinating, implementing and monitoring compliance with effective ATIP-related policies, guidelines, systems and procedures across SSC. This enables SSC to meet the requirements and to fulfill its obligations under the nmnmPrivacy Act and its accompanying piece of legislation, the ddseAccess to Information Act.

The main activities of the ATIP Division are:

• Receiving, coordinating and processing requests under the vbvvPrivacy Act and the lcftAccess to Information Act;
• Responding to consultations from other government institutions regarding SSC information under consideration for release;
• Developing SSC-specific policy instruments in support of access and privacy legislation;
• Developing and delivering ATIP awareness and training across SSC so that employees and management understand their roles and responsibilities;
• Supporting a network of ATIP Liaison Officers across SSC who assist with requests by coordinating the retrieval of records and recommendations from within their branch or region;
• Monitoring institutional compliance with both Acts and its regulations, as well as relevant procedures and policies;
• Preparing annual reports to Parliament on the administration of the Acts, as well as other material that may be required by central agencies;
• Representing SSC in dealings with the Treasury Board of Canada Secretariat (TBS), and the Offices of the Privacy and Information Commissioners of Canada regarding the application of both Acts as they relate to SSC;
• Supporting SSC in meeting its commitments to openness and transparency through the proactive disclosure of information and the release of information via informal avenues, such as the Open Government portal;
• Supporting the Corporate Secretariat’s Business Process Transformation by simplifying the Access to Information request process to ensure timeliness and quality review of the information;
• Monitoring ATIP tasking performance and reporting to senior management on a monthly basis; and
• Participating in whole-of-government initiatives for the federal ATIP community.

Overview of Workload (Annex C, Part 1 and Part 2, Table 2.5.1)

During the reporting period, the ATIP Division received 123 requests under the ngbPrivacy Act. There were no consultations under the vfgPrivacy Act from other government institutions and there were no requests carried forward from the previous reporting period. The ATIP Division processed a total of 120 requests and carried over three f556Privacy Act requests to the next reporting year.

While the number of requests received under the 87yPrivacy Act during this reporting period almost doubled compared to the previous reporting period (in which 71 requests had been received), many requests were misdirected to SSC. Out of 6,268 pages processed by the ATIP Division, 3,354 pages were deemed relevant to the l34rtPrivacy Act requests and either disclosed in whole or in part.

The ATIP Division closely tracks, on a weekly basis, its turnaround times in processing requests and monitors the timeliness of their completion. In this reporting period, all processed l13Privacy Act requests were completed within legislated timelines.

During this reporting period, 123 requests were received under the l13Privacy Act. No requests from the previous reporting period were carried forward, for a total of 123 requests requiring action for this reporting period.

Exemptions Invoked (Annex C, Part 2, Table 2.2)

The 1trtyPrivacy Act allows, and in some instances requires, that some personal information be exempted and not released. For example, personal information may be exempted when it relates to law enforcement investigations or another individual besides the requester, or when it is subject to solicitor-client privilege.

During the reporting period, there were 22 instances where some information was withheld because it related to another individual and was therefore exempted under section 26 of the l954lPrivacy Act.

There were three instances where some information was exempted because it related to solicitor-client privilege and was therefore exempted under section 27 of the 9dt54Privacy Act.

Exclusions Cited (Annex C, Part 2, Table 2.3)

The qw4ePrivacy Act does not apply to information that is already publicly available, such as government publications and material in libraries and museums. It also excludes material such as Cabinet confidences. There were no exclusions cited in the requests completed during the reporting period.

Disclosure of Personal Information Pursuant to Paragraphs 8(2)(e) and (m) (Annex C, Part 3)

Paragraph 8(2)(e) of the l20Privacy Act allows the head of the institution to disclose personal information without the consent of the affected individual where such information is requested in writing by a designated investigative body for law enforcement purposes. During the reporting period, SSC made no disclosures of personal information under this provision.

Paragraph 8(2)(m) of the l21Privacy Act allows the head of the institution to disclose personal information without the consent of the affected individual in cases where, in the opinion of the head, the public interest outweighs any invasion of privacy that could result from the disclosure or when it is clearly in the best interest of the individual to disclose. During the reporting period, SSC made no disclosures of personal information under this provision.

Subsection 8(5) of the bnu6Privacy Act obliges the head of the institution to notify the Office of the Privacy Commissioner of Canada prior to, or if not practical, forthwith on, any disclosure under paragraph 8(2)(m). SSC made no disclosures of personal information under this provision. Therefore, no notifications to the Privacy Commissioner’s office were required under subsection 8(5) of the Act.

During the reporting period, the ATIP Division updated its ATIP Management Framework, which sets out a comprehensive governance and accountability structure. This Framework reflects SSC’s responsibilities under both the idu8sPrivacy Act and the cd439Access to Information Act with respect to access rights and with regard to SSC’s collection, use, disclosure, retention and disposal of personal information.

In 2015–2016, several policy instruments were approved, implemented, posted on SSC’s extranet site and communicated to employees via a Communiqué from SSC’s President and Chief Privacy Officer. These policy instruments explain how SSC is organized in terms of its policies and procedures for, among other things, responding to access requests, managing privacy risks, assigning privacy responsibilities, co-ordinating privacy work and ensuring compliance with the 54ks9Privacy Act, the 5dh4qAccess to Information Act, related TBS policies and directives, and internal SSC policies. These ATIP policies also outline SSC’s ongoing efforts to promote ATIP learning and awareness as well as ensuring that all SSC employees, regardless of level, are aware of their responsibilities and obligations under both the hju74qPrivacy Act and the 8777jyAccess to Information Act.

The following ATIP policy instruments with tools were approved by the Corporate Management Board and published on SSC’s website during the reporting period:

• Directive on Access to Information and Privacy Training and Awareness with companion
  • Standard on the Delivery of Access to Information and Privacy Training and Awareness –supports SSC in embedding ATIP excellence through training and awareness.
• Directive on Monitoring Access to Information and Privacy Compliance – supports SSC in monitoring, for compliance with the t675yrPrivacy Act and the nhu22Access to Information Act, specific internal policy instruments designed to manage privacy risks and foster access to records containing information, including personal information, under SSC’s control.
  • Standard on Preventing and Managing Obstruction to the Right of Access – establishes the procedures for addressing instances of perceived or actual obstruction of lawful access to information under SSC’s control.
• Directive on Conducting Privacy Impact Assessments – supports SSC in meeting its obligations to manage privacy risks and in project-management excellence.
  • Standard on the Use of Personal Information for Non-Administrative Purposes – provides comprehensive governance and accountability in activities involving the collection, use or disclosure of personal information for non-administrative purposes with companion SSC Social Media Privacy Checklist, which determines if a PIA is required or whether an amendment to an existing PIA must be completed because of potential privacy risks with the proposed social media activity.
  • Standard on the Code of Privacy Principles – ensures that every reasonable measure is taken to reduce potential risks of privacy breaches.

In addition, the following five new policy instruments, which were approved by the Corporate Management Board in March 2016, will be published on SSC’s website in the next reporting period:

• Directive on Managing Personal Information Required for Administrative Purposes and Lawful Investigations – supports SSC’s commitment in establishing and adhering to best practices for collecting, retaining, using, disclosing and disposing of personal information in strict compliance with the hj87yPrivacy Act.
  • Standard on Facilitating Access to Data Under the Control of Partner Organizations – supports timely and effective service to SSC’s partners whose data resides on SSC’s IT infrastructure. This Standard provides comprehensive governance and accountability in facilitating partner access to their data.
  • Standard on the Use and Disclosure of Personal Information Under the Control of SSC – supports effective privacy management at SSC by providing comprehensive governance and accountability in SSC’s use and disclosure of personal information under its control.
  • Standard on eDiscovery Multi-Mailbox Searches for Access to Information and Privacy Purposes – supports access to information and privacy management at SSC by providing comprehensive governance and accountability involving the use of MMS/eDiscovery activities warranted by an ATIP request.
  • Standard on Managing Personal Information in Emergencies – supports effective privacy management at SSC by providing comprehensive direction in activities involving the handling of personal information under SSC’s control in the event of an emergency.

The ATIP Division’s process under the 10ushtsPrivacy Act is based upon the “duty to assist” principle, which is defined in the TBS Directive on Privacy Requests and Correction of Personal Information as follows:

1. Process requests without regard for the identity of the applicant;
2. Offer reasonable assistance throughout the request process;
3. Provide information on the 9tsre45Privacy Act, including information on the processing of requests and the right to complain to the Privacy Commissioner of Canada;
4. Inform the applicant as appropriate and without undue delay when the request needs to be clarified;
5. Make every reasonable effort to locate and retrieve the requested personal information under the control of the institution;
6. Apply limited and specific exemptions to the requested personal information;
7. Provide accurate and complete responses;
8. Provide timely access to the requested personal information;
9. Provide personal information in the format and official language requested, as appropriate; and
10. Provide an appropriate location within the institution to examine the requested personal information.

SSC’s ATIP process is further supported by best practices within the federal ATIP community, which enable SSC to meet the challenges of responding in a timely manner to odhdt5dPrivacy Act requests for access and consultations.

SSC also adheres to the following privacy principles:

• Accountability – an institution is responsible for personal information under its control.
• Purposes – the purposes for which personal information is collected shall be identified at or before the time the information is collected.
• Collection – information should be collected fairly and lawfully and should be necessary and relevant.
• Consent – the individual must have knowledge of the collection, use or disclosure of personal information in order to be able to consent to it, except when inappropriate (e.g. lawful investigations).
• Use – personal information is used in line with the purposes of its collection, except when the individual consents or it is required by law.
• Disclosure – personal information should be disclosed in line with the purpose of its collection, except when the individual consents or it is required by law.
• Retention – personal information is retained only as long as necessary.
• Accuracy – personal information should be accurate, complete and up to date so as to serve its purpose.
• Safeguards – security safeguards should be appropriate to the sensitivity of the information.
• Openness of information – an institution should make specific information readily available to individuals about its policies and practices on the management of personal information.
• Individual access – an individual should be able to access his or her personal information under the control of the institution.
• Challenging compliance – an individual should be able to challenge compliance with any of the above principles by contacting the ATIP Division and/or the Privacy Commissioner of Canada.

…for the purposes of the 5645rtghPrivacy Act, personal information that is collected by other government institutions as defined in that Act or by other organizations and that is, on behalf of those institutions or organizations, contained in or carried on Shared Services Canada’s information technology systems is not under the control of Shared Services Canada.

Info Source Update

isuInfo Source: Sources of Federal Government and Employee Information provides information about the functions, programs, activities and related information holdings of government institutions subject to the desd41Privacy Act and the 099876Access to Information Act. It provides individuals and current and former employees of the government with relevant information to assist them in accessing personal information about them held by government institutions subject to the 88te51Privacy Act and exercising their rights under the asuasyystPrivacy Act.

TBS requires that government institutions publish their own Info Source chapter on their Internet site. During the reporting period, SSC completed its review of its Info Source chapter and met all legislative and TBS mandatory requirements.

ATIP Online – Recognition Award

On May 21, 2015, the SSC ATIP Division was recognized at the IM-IT Community Recognition Awards for its participation in the pilot for the ATIP Online Request Service. The awards are administered by the Service and GC2.0 Policy and Community Enablement Division of TBS, on behalf of the Access to Information, Information Management, Information Technology, Security and Project Management communities across the Government of Canada.

The ATIP Online Request solution, initially a pilot led by Citizenship and Immigration Canada (CIC), with the participation of SSC and TBS, was recognized in the Excellence in the ATIP category. The ATIP Online Request service is part of the Government of Canada’s commitment to modernizing services to Canadians while increasing its open information environment.

The solution provides a faster, easier and more convenient way for Canadians to submit ATIP requests. It also reduces processing costs for institutions. In its initial pilot phase, the service allowed clients to submit requests and fees online to CIC, SSC and TBS. Given the successful implementation of the pilot, the service has now been expanded to include 33 other government institutions.

During the reporting period, SSC received 77% of its erytPrivacy Act requests online, with 95 requests received via the ATIP Online Request service. Only 28 dsfbnPrivacy Act requests were received via the postal mail service.

Complaints and Audits

Complaints

SSC was subject to one use and disclosure complaint to the Office of the Privacy Commissioner under the ghio3Privacy Act concerning the Employees’ Charitable Campaign. Corrective measures were taken to prevent the incident from reoccurring, and the individual was satisfied with the early resolution.

Audits

During the reporting period, no audits were completed by the Office of the Privacy Commissioner of Canada pursuant to section 37 of the beam33Privacy Act.

However, on December 10, 2015, the Privacy Commissioner of Canada tabled the 2014–2015 Annual Report on the ds3fbnPrivacy Act urging federal departments and agencies to develop and implement more rigorous procedures and safeguards to protect Canadians’ personal information and highlighting the results of an earlier audit of the government’s management of portable storage devices. The audit examined 17 institutions in detail, including SSC.

SSC agreed with all of the Commissioner’s recommendations and, as part of its formal follow-up process for all audit recommendations, the Department is closely monitoring the implementation of the following actions:

1. In collaboration with partner organizations, ensure that all active smart phones are captured, either by user or contact name, in a registry by January 2016;
2. Remind partner organizations of their responsibilities under the Operating Standard for the Provision of Telecommunications Devices, including the sanitization of smart phones prior to disposal;
3. Assess the risk to personal information resulting from the lack of controls on connection of unauthorized USB storage devices on servers, and implement appropriate controls to address identified gaps and weaknesses;
4. Ensure that baseline security controls are implemented on all smart phones in use at partner organizations by January 2016;
5. Amend the Provision of Telecommunication Devices and Acceptable Use of Cellular Devices Standards to instruct users to comply with their respective organizations' protocols for reporting security incidents and privacy breaches;
6. Ensure that SSC employees who have access to partner organizations' information holdings are aware of the policies governing the use of portable storage devices, and provide guidance to mitigate the privacy risks inherent to the use of the devices; and implement standardized procedures for responding to incidents involving the loss or theft of smart phones.

Parliamentary Affairs

Breaches

SSC had no material privacy breaches to report during the period.

Next Steps for the Year Ahead

Annex A – Partner Organizations

Annex B – Delegated Authority

Privacy Act Designation Order

The President of Shared Services Canada, pursuant to section 73 of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons acting in those positions, to exercise the powers and perform the duties and functions of the President of Shared Services Canada as the head of a government institution under all sections of the Privacy Act. This designation is effective immediately upon being signed.

SCHEDULE

1. Chief Operating Officer
   
2. Senior Assistant Deputy Minister and Chief Financial Officer
   Corporate Services
   
3. Corporate Secretary and Chief Privacy Officer
   
4. Director, Access to Information and Privacy Protection Division

Signed on August 06, 2015
Ron Parker

Ottawa

Annex C – Statistical Report on the Privacy Act

Name of institution: Shared Services Canada
Reporting period: 2015–04–01 to 2016–03–31

Part 1 – Requests Under the Privacy Act