Annual Report to Parliament on the Administration of the Privacy Act - 2011-2012

Welcome to Shared Services Canada

Introduction

Privacy Act

Shared Services Canada (SSC) places paramount importance on privacy operations and governance. SSC provides privacy with the purpose, and manner, set forth in the Privacy Act, specifically, “to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution and that provide individuals with a right of access to that information.”

Tabled in Parliament

SSC is pleased to table its first Annual Report to Parliament on the administration of the Privacy Act (the Act) for the fiscal year 2011–2012.  This Annual report is submitted in accordance with sections 72(1) and 72(2) of the Act.

Departmental Mandate and Priorities

SSC is mandated to simultaneously operate and transform the government’s IT infrastructure. Under the umbrella of that dual authority, SSC is responsible for providing its partner organizations with modern, reliable and secure IT infrastructure services that are cost-effective and which contribute to a greener government. In the process, it is building a new organization from the ground up.

SSC has identified the following four priorities for 2012–2013:

1. From an operational perspective, SSC is stabilizing IT service delivery across the Government of Canada. With a focus on business continuity, it is maintaining existing service levels while working to improve them. SSC is supporting a significant number of projects in cooperation with its partners which will both modernize and streamline today’s IT operations. This is delivering early results, facilitating SSC’s contribution to the government’s deficit reduction efforts, and enabling it to plan and build capacity to take on the larger, more complex transformative initiatives.
   
2. SSC will be launching the renewal of the Government of Canada’s IT infrastructure. Working collaboratively with its partners, SSC is identifying an email solution and developing initial plans to consolidate data centres and networks in a whole-of-government approach. Additionally, as a key security services delivery organization, SSC will work collaboratively with other cyber-security agencies to enhance information security across the Government of Canada in order to support the implementation of the federal government’s new cyber-security strategy.
   
3. SSC will take advantage of every opportunity to work with partners to fulfill its mandate and realize its objective of improving delivery of services to Canadians in a secure, reliable and integrated manner. Partner departments and agencies have developed many innovative processes, principles and tools over the years and SSC will mine that expertise and leverage best practices. Collaborating and maintaining an open, transparent and meaningful dialogue with industry on IT modernization will also be a critical component of SSC’s success. SSC has mapped an engagement process that focuses on developing a sustainable and substantive relationship with the private sector.
   
4. As a new department, SSC is creating a dynamic corporate culture – one that builds on a broader public service ethos to embrace innovation as part of its brand. Supporting and challenging SSC employees is central to that undertaking. Working together as a community, SSC will deliver service excellence, innovation and value for money as it builds a modern, reliable and secure IT platform for the Government of Canada.

While SSC employees are currently embedded in 43 partner institutions in order to provide services relating to network infrastructure, email and telecommunications, it is understood that:

• Data housed in SSC-managed servers will be segregated by government institution and access rights will not change.
• The 43 partner institutions are responsible for the creation, maintenance, use, disclosure and disposal of their electronic information holdings.
• From an access to information and privacy (ATIP) perspective, SSC does not have control and ownership over records stored in the shared IT infrastructure.
• Processing ATIP requests of records of the partner institutions remains the responsibility of the respective ATIP Offices.
• The SSC ATIP Office will process only those records under SSC control. However, given the devolution of responsibilities to SSC and thus the shared interest, consultations with the 43 partner institutions will inevitably be a large part of our ATIP process.

Dedicated to ATIP Excellence

When Shared Services Canada (SSC) was created by Order in Council on August 4, 2011, it was also made subject to the Access to Information Act and Privacy Act. However, during the reporting period 2011-2012, SSC was assisted by Public Works and Government Services Canada (PWGSC) for the processing of requests for records relevant to SSC.

Through a Business Continuity Framework, a cooperative arrangement with partner institutions ensured the continuity of operations while SSC was being established. This framework also ensured that all corporate, administrative and other support functions continued during the transition, such as for the administration of the Access to Information Act and the Privacy Act by PWGSC.

While the PWGSC ATIP Office did not process on SSC’s behalf any Privacy Act requests for access to personal information, it did handle a few Privacy Impact Assessments pertaining to SSC initiatives.  For further details see the Statistical Reporting section on page 9.

Delegated Authority

On April 2, 2012, the President of SSC delegated full responsibilities under the Privacy Act to the Director of the Access to Information and Privacy Protection Division (the ATIP Office) pursuant to section 73 of the Acts. (The SSC Designation Order for the Privacy Act is included in Annex A.)

Start-up of SSC ATIP Office

Since April 2012, the SSC ATIP Office has been a stand-alone ATIP Office responding to requests and providing guidance concerning access to information and privacy matters.

With the first order of business completed vis-à-vis the creation of the internal delegation instruments, the second order of business was to establish the ATIP Liaison Officer process which provides a single gateway into each SSC Branch and Directorate in order to streamline the ATIP tasking process. Once the Liaison Officers were identified, the next order of business was to develop and provide hands-on training in order for them to have the necessary knowledge and understanding of their roles and responsibilities to effectively coordinate the ATIP taskings within their respective areas.

The ATIP Office is also actively working on various start-up projects to meet legislative and policy requirements such as publishing the SSC chapter for Info Source, providing annual ATIP statistical reports to the Treasury Board Secretariat (TBS) and preparing the ATIP Annual Reports to Parliament.

ATIP Office Organization

The Operations Section within the ATIP Office is responsible for processing requests under the Access to Information Act and the Privacy Act.  This includes liaising with subject-matter experts within SSC, performing a line-by-line review of records requested under the legislation and conducting external consultations as required to balance between Canadians’ rights of access and the government’s need to safeguard certain information in limited and specific cases.  The Operations Section provides briefings for senior departmental officials as required on a case-by-case basis.  This Section is also the main point of contact with the Offices of the Information and Privacy Commissioners of Canada with respect to the resolution of complaints pertaining to both Acts.

The Policy and Governance Section provides policy advice and guidance on access to information and the protection of personal information to SSC officials across its Branches and Directorates. This section also prepares and distributes weekly reports on the status of ATIP requests. It is responsible for assisting program officials when they draft personal information sharing agreements and privacy impacts assessments to ensure that the applicable privacy laws are respected. It responds to legal instruments in which the Department is asked to share personal information, (i.e., subpoenas, court orders, search warrants), and liaises with the Office of the Privacy Commissioner on issues such as privacy breaches. It has the privilege of liaising with employees and prepares/delivers training and awareness sessions throughout the Department. The Policy and Governance section coordinates the Department’s annual reporting requirements and SSC’s input into the TBS annual update of its Info Source publication. In addition, this section develops products and tools related to ATIP processing. It provides standards and guidance to the Department on keyaccess to information and privacy issues.  It also has the lead for the TBS Management Accountability Framework lines of evidence 12.4 Access to Information, 12.5 Privacy and 12.6 ATIP Governance and Capacity.

ATIP Training

SSC is building an entire department from the ground up and appreciates the importance of placing emphasis on its people and culture. That is why the ATIP Office is delivering ATIP Liaison Officer training as well as general ATIP Awareness sessions to departmental officials at all levels to ensure that employees are aware of their roles and responsibilities vis-à-vis ATIP compliance.

Underlying Principles for the ATIP Process

The SSC ATIP process is based on best practices within the federal ATIP community which will enable the division to meet the challenges of responding to Privacy Act requests in a timely manner.

Similar to the Access to Information Act process, the ATIP Office instituted its Privacy Act processes based on some of the same principles for duty to assist applicants, which are:

• offer reasonable assistance throughout the request process;
• make every reasonable effort to locate and retrieve the requested records under the control of the institution;
• apply limited and specific exemptions to the requested records;
• provide accurate and complete responses;
• provide timely access;
• provide records in the format and official language requested, as appropriate; and
• provide an appropriate location within the institution to examine the requested information.

The Privacy Principles

SSC also adheres to following privacy principles:

• Accountability: an organization is responsible for personal information under its control.
• Collection: information should be collected fairly, and lawfully; it should be necessary and relevant.
• Consent: the individual must have knowledge to consent for the collection, use or disclosure of personal information, except when appropriate (e.g., lawful investigations).
• Use: personal information is used in line with the purposes of its collection, except when the individual consents, or it required by law.  Personal information is retained only as long as necessary.
• Disclosure: personal information should be disclosed in line with the purpose of its collection, except with an individual’s consent or as lawfully required. Personal information is retained only as long as necessary to meet its purpose.
• Accuracy: personal information should be as accurate, complete and up-to-date so as to serve its purpose.
• Safeguards: security safeguards should be appropriate to the sensitivity of the information.
• Openness of information: an organization should make specific information readily available to individuals about its policies, and practices on management of personal information.
• Individual Access: an individual should be able to challenge the accuracy and completeness of the information and have it amended as appropriate.
• Challenging Compliance: an individual should be able to address a challenge to compliance.

Control of Records and 43 Partner Institutions

SSC ATIP processes those records that relate to its own internal departmental business. The 43 partner institutions’ access rights have not changed and they continue to be responsible for the creation, maintenance, use, disclosure and disposal of their electronic information holdings. (See list of partner institutions under Annex B.)

While SSC does not have control and ownership over institutions’ records stored in the shared IT infrastructure, given the devolution of responsibilities and thus the shared interest, consultations with the 43 partner institutions will inevitably be on-going when processing ATIP requests. From an operational perspective, standardized processes will need to be established to avoid inadvertent delays.