Joint Audit and Evaluation of Privacy Practices at Treasury Board of Canada Secretariat

Privacy in the Government of Canada

Canada’s Privacy Act came into force in 1983.^{Footnote 1} Its purpose is “to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution and that provide individuals with a right of access to that information.”^{Footnote 2} Government institutions are prohibited from collecting personal information unless such information is directly related to the delivery of a program or activity for which the institution has parliamentary authority.

“Personal information” is defined in section 3 of the Privacy Act as “information about an identifiable individual that is recorded in any form.” Examples of personal information include a person’s race, age, medical information, financial information and government correspondence. The Privacy Act provides direction to institutions on the collection, right to correction, retention, use, disclosure and disposal of personal information under their control.

Privacy management at TBS

Historically, TBS has collected personal information as part of its role as employer. The information collected includes human resources and people management information about public servants. In recent years, however, the work of TBS has expanded to include outreach and engagement activities, such as social media, surveys and forums. This expansion is a result of the government’s commitment to open government and increased digital access to government data. The expansion has led to a substantial increase in the collection of personal information from both public service employees and the Canadian public.

The Privacy Policy Unit:

• is led by the director of the ATIP Office, who is responsible for both the department’s access to information and privacy activities
• operates under the Strategic Communications and Ministerial Affairs sector

The Information and Privacy Policy Division:

• is a policy centre on privacy practices and access to information
• operates under the Office of the Chief Information Officer
• provides advice and support to other government institutions on issues that concern access to information, privacy and proactive disclosure initiatives

The Information and Privacy Policy Division also participates in monitoring the institutional compliance required in the Access to Information Act and the Privacy Act.

Program activities

The Privacy Policy Unit offers a variety of services including:

• advice on privacy impact assessments, privacy breaches and privacy notice statements
• document reviews
• internal consultations
• training and awareness activities and events

See Appendix B for definitions of the above services.

Roles and responsibilities

The Privacy Policy Unit manages privacy through a suite of policy instruments including:

• the Policy on Privacy Protection
• the Directive on Privacy Practices
• the Guideline for Privacy Breaches
• the Guide to Privacy Breach Management

The Privacy Policy Unit is designed to be an advisory body rather than a monitoring body.

The following parties also play a role in the management of privacy within TBS:

• The Privacy Commissioner of Canada:
  • reviews compliance with and adherence to the principles outlined in the Privacy Act
  • makes recommendations after reviews or investigations
• The Secretary and/or delegated officials at TBS:
• keep the Privacy Commissioner notified of planned initiatives
• establish privacy protocols for non-administrative purposes
• monitor and report on compliance^{Footnote 3}
• Senior program officials (heads of sectors or branches):
• are responsible for the information that they collect, use and disclose
• must comply with privacy requirements^{Footnote 4}

Legal Services is engaged in the event that the program or activity is unclear or where potential issues related to the Charter of Rights and Freedoms have been raised.^{Footnote 5}

Functional partners

Functional partners provide expertise and often work with the Privacy Policy Unit to meet client needs when, for example, developing a privacy impact assessment or responding to a privacy breach. The list provided below of functional partners and their responsibilities is not exhaustive, but it does provide insight into how the partners interact:

• Legal Services is responsible for providing strategic legal advice
• Security Services is responsible for marking and classifying documents, safeguarding protected and classified information, and managing assets
• Information Management and Technology and Telecommunications is responsible for the retaining and disposing of authorities
• Procurement and Contracting is responsible for procuring goods and services
• Communications and Ministerial Services is responsible for providing advice and guidance on social media and developing media lines

3.1 Objectives

The objective of the evaluation was to assess the performance of privacy practices at TBS. Relevance was not included as TBS has a legislative requirement to implement the Privacy Act. The objective of the audit was to assess the adequacy and effectiveness of privacy practices and controls to support TBS priorities.

3.2 Scope

The joint evaluation and audit scope covered the period from April 2016 to April 2018. Specific documents and data dating back to the 2013 to 2014 fiscal year were examined in order to provide context on program maturity, and additional information received by the team until October 2018 was considered in analyses.

The joint evaluation and audit did not address:

• information technology: network access, security assessments and authorization protocols
• information management: the retention and disposition authorities for personal information
• document marking and classification
• TBS’s central agency role and the activities of the Information and Privacy Policy Division

3.3 Methodology

The lines of evidence used to inform joint results were proportional to the program’s risk and materiality and included:

• a review of program documentation
• a literature review that examined privacy and its application in government
• a review of administrative data, including testing
• key informant interviews

Due to the low materiality of this joint evaluation and audit, an employee survey was not undertaken. A survey would have been an effective method to fully assess understanding and awareness. The multiple lines of evidence consulted mitigated this limitation.

By conducting the audit and evaluation jointly, the team took advantage of opportunities to reduce duplication of effort. While interviews were conducted jointly, analysis was done separately by the evaluators and the auditors before they came together again to reach joint conclusions and recommendations.

3.4 Statement of conformance

The Joint Evaluation and Audit Privacy Practices Report was undertaken:

• in accordance with the Treasury Board Policy on Results and Policy on Internal Audit
• in conformance with professional standards for evaluation and internal audit

The reporting was supported by the Internal Audit and Evaluation Bureau’s quality assurance and improvement program.

5.1 Privacy awareness

Expected outcome: Employees, managers and sector heads understand and are aware of their respective roles and responsibilities with regard to privacy.

Conclusion: Privacy awareness and understanding across TBS is inconsistent and depends on the extent to which a sector has been engaged in privacy activities.

5.1.3 Findings

Privacy Management Framework

TBS has created a Privacy Management Framework, which has been posted on the TBS InfoSite. The InfoSite is accessible to TBS employees only. This framework supports TBS practices with regard to the creation, collection, retention, use, disclosure, accuracy and disposition of personal information under TBS control. The framework includes the following guidance materials:

• a Code of Privacy Principles
• a Guide to Privacy Breach Management
• an Internal Privacy Breach Report Form
• a Privacy Impact Assessment Framework
• a Privacy Impact Assessment Checklist

These guidance materials were found to reflect the key elements of privacy protection contained in the Privacy Act and supporting policy and directive. Roles, responsibilities, and procedures and protocols for privacy practices are adequately defined and documented.

Understanding and awareness of privacy requirements, including privacy breaches

Interview results showed that understanding of privacy roles and responsibilities varies according to the degree to which individuals have been involved in privacy activities.

Administrative data showed that the majority of TBS sectors have engaged the Privacy Policy Unit at some point during the period examined (2013 to 2018). Figure 2 shows the number of individual privacy services received by TBS sectors. While the majority of TBS has had some interaction with the Privacy Policy Unit, approximately one third interact with the Privacy Policy Unit more regularly. The program data is consistent with interview results, which indicate that awareness varies across the department.

Figure 2 - Text version

Figure 2 is composed of a bar graph that indicates the number of privacy services provided to each sector and dots that indicate the number of privacy breaches reported by each sector.

The number of privacy services provided by the Privacy Policy Unit to TBS sectors^{Footnote 6} and the number of privacy breaches reported by the sectors

Sector	Number of privacy services provided by the Privacy Policy Unit	Number of privacy breaches reported
Strategic Communications and Ministerial Affairs	56	0
Office of the Chief Information Officer	43	3
Corporate Services Sector	36	0
Office of the Chief Human Resources Officer	33	3
Office of the Comptroller General	17	1
Internal Audit and Evaluation Bureau	17	0
Human Resources Division	14	2
Priorities and Planning Sector	12	0
Expenditure Management Sector	6	1
Economic Sector	3	0
Social and Cultural Sector	2	0
Regulatory Affairs Sector	2	0
International Affairs, Security and Justice Sector	2	0
Government Operations Sector	2	0
Secretary’s Office	1	0
Associate Secretary’s Office	1	0
Office of the Deputy Minister Public Service Accessibility	0	0
Legal Services	0	0
Centre for Greening Government	0	0
Canadian Digital Service	0	0

Figure 2 also shows which sectors have reported privacy breaches. Program data is consistent with interview results on awareness, which indicated that privacy awareness increased after employees engaged the Privacy Policy Unit to identify a privacy concern, assess the concern and take action.

Between the 2016 to 2017 fiscal year and the 2017 to 2018 fiscal year, 10 privacy breaches were reported within TBS. To date, when privacy breaches do occur, they have been reported as:

• unintentional
• a result of human or technological error

Upon review, all 10 breaches were deemed by the Privacy Policy Unit to be non-material.

The Privacy Policy Unit suspects that privacy breaches at TBS are over-reported. However, as noted by some interviewees, it is difficult to determine whether the over-reporting stems from a lack of understanding, or whether it indicates risk aversion. A lack of understanding of privacy requirements makes both over- and under-reporting of breaches more likely.

Outreach and engagement, including training

A large part of the Privacy Policy Unit’s day-to-day operations involves providing privacy advice to sectors. Staff at the Privacy Policy Unit estimate that they spend a quarter of their time on reviews and consultations related to the privacy needs of various sectors.

Staff estimate that another 5% of their time is spent delivering presentations to raise awareness at TBS. Presentations are given upon request or in response to a privacy breach. For example, a general presentation on privacy management was provided to all TBS executives in order to raise awareness and support sound privacy management across the organization.

An estimated 10% of staff time is spent developing tools for use at TBS. These tools are posted on the TBS InfoSite, which is accessible to TBS employees only.

Almost all interviewees felt that they received excellent service when communicating with the Privacy Policy Unit. The unit is often sought out by the Office of the Chief Information Officer’s Information and Privacy Policy Division and other departments and agencies for their expert advice on designing and delivering privacy services in the federal government. Interviewees also noted the informal network that the unit has built with its functional partners, which has helped to ensure that consultation occurs on potential privacy issues where needed.

While outreach and engagement activities are evident, the Privacy Policy Unit acknowledges that more awareness is needed based on what they have learned from networking within TBS and from other ATIP functions in the government.

Best practices according to the generally accepted privacy principles^{Footnote 7} suggest that privacy training for all employees should be done annually. Such a training schedule is not currently in place at TBS.

Interviewees noted that awareness could be improved by:

• delivering customized privacy presentations to small groups that are repeated consistently in order to keep the privacy conversation alive
• creating daily reminders that embed privacy in day-to-day business

5.2 Ability to support decision-making and embed privacy in TBS culture

Expected outcome: Employees, managers and sector heads address privacy risks in decision-making and privacy is embedded in the organization’s culture.

Conclusion: Improvements can be made to the privacy impact assessment process and tools to effectively identify, manage and report on privacy risks.

Source: Privacy Policy Tracker

Time to complete selected privacy impact assessments, by TBS sector and project - Text version

Figure 3: time to complete selected privacy impact assessments, by TBS sector and project

Figure 3 is a complex chart that indicates:

• specific sectors and projects
• how long it took for a project to undergo a privacy impact assessment
• whether a given privacy impact assessment is ongoing (as of October 10, 2018)

Time to complete selected privacy impact assessments, by TBS sector and project.

Sector	Project	Time to complete a privacy impact assessment	Assessment completed or ongoing (as of October 10, 2018)
Corporate Services Sector	Claims process for out-of-pocket expenses due to Phoenix	7 months	Completed
	Financial and Materiel Management Transformation Solution	8 months	Ongoing
Office of the Chief Human Resources Officer	MyGCHR	49 months	Ongoing
	Government of Canada Workplace Charitable Campaign	46 months	Ongoing
	Low income relief provision	34 months	Ongoing
	Relocation program	11 months	Completed
Office of the Chief Information Officer	Talent Cloud	14 months	Completed
	ATIP Online Request Service	10 months	Completed
Strategic Communications and Ministerial Affairs	Common use of official social media accounts	43 months	Ongoing

Interviewees cited limited privacy risk awareness in some sectors, which can lead to late identification of privacy impact assessment requirements, and the administrative burden of the privacy impact assessment process (that is, the rigorous and labour intensive process that often requires hiring external consultants) as inhibiting the timely completion of privacy impact assessments.

Interviewees highlighted three ways in which the privacy impact assessment process could become more efficient:

1. TBS should combine risk assessments across all functional partners where possible (for example, privacy, information management and information technology, security). Currently, these assessments are managed in silos. A combined assessment, managed through a single-window:
   • could systematically identify the necessary functional partners in the design phase
   • would avoid key partners being inadvertently omitted and provide assurance that risks are monitored once the project is in operation
2. TBS should re-examine the privacy impact assessment template to reduce the complexity of the assessment and the time it takes to complete the assessment. The following examples show that the gap between privacy requirements and the needs of agile initiatives can be bridged even if legislation is outdated and outside the Privacy Policy Unit’s control:
   • Talent Cloud is completing a privacy impact assessment in stages in order to satisfy privacy considerations within shorter time frames
   • The Canadian Digital Service has created a framework and online tool that proactively considers key privacy variables that impact users when conducting research or product testing
3. TBS should create an annotated privacy impact assessment as a guide to clarify the process and the relevant roles and responsibilities.

5.3 Resources

Expected outcome: The department has appropriate resources and succession planning to manage current and evolving privacy activities.

Conclusion: The resources to effectively manage privacy risks and the requirements of the department are inadequate, particularly in light of the new initiatives and lines of business that TBS is undertaking, as well as the new or changing skills required to support the evolution of privacy risks at TBS.

Joint evaluation and audit of privacy practices

The Access to Information and Privacy (ATIP) Office, Strategic Communications and Ministerial Affairs (SCMA), has reviewed the joint evaluation and audit report and agrees with the recommendations. Proposed actions to address the recommendations of the report are outlined below.

Note: SCMA’s ATIP Office recently hired a dedicated senior ATIP advisor whose primary focus will be to further advance the implementation and ongoing activities of the action plan, including addressing the audit and evaluation recommendations outlined below.

Recommendation 1a

Develop a formal outreach and engagement plan and include mechanisms to monitor its effectiveness. (5.1.2)

Recommendation 1b

Expand its promotional efforts to ensure that:

1. privacy requirements are communicated to those sectors that are not regularly involved in privacy initiatives
2. training continues to be offered to sectors with more in-depth or specialized needs. (5.1.2)

Recommendation 2

The Privacy Policy Unit should re-examine the design and implementation of its privacy impact assessment procedures in consultation with the Office of the Chief Information Officer’s Information and Privacy Policy Division. (5.2.2)

Recommendation 3

Privacy Policy Unit should supplement the business case with a formal human resources plan to identify the resources, competencies and skills needed to support the current volume of work and the requirements for the future. (5.3.2)