Section 5: Privacy Compliance Analysis

5.1.1 Overall accountability

Under the Statistics Act, the Chief Statistician, under the direction of the Minister Responsible for Statistics Canada, is accountable for the operations and staff of Statistics Canada. The Statistics Act provides Statistics Canada with the mandate to collect, compile, analyse, abstract and publish statistical information relating to the commercial, industrial, financial, social, economic and general activities and condition of the people. Data collected by Statistics Canada are used for statistical, research and analytical purposes, but not for administrative purposes^{Footnote 1}. The Statistics Act provides the legal basis for maintaining the confidentiality of the statistical information (personal, business and institutional) that Statistics Canada collects. Divisional directors are delegated to act on behalf of the Chief Statistician with respect to specific responsibilities for the control of and access to confidential information which includes both personal and business information.

5.1.2 Organizational accountability

The Director, Information Management Division, is responsible for the development of Statistics Canada's policies related to information, including all aspects of information classification, control, and access and for providing advice, guidance, and assistance in the implementation of information security measures. The director is Statistics Canada's Privacy Coordinator and is accountable for the department's compliance with the principles contained in this document.

5.1.3 Divisional custodial accountability

Divisional directors are responsible for controlling and protecting all confidential information obtained by their division in the pursuit of its program objectives, as defined in the Statistics Canada Directive on the Security of Sensitive Statistical Information.

5.1.4 Performance and compliance reviews

The Internal Audit Division provides a systematic and independent review function to advise management on the adequacy of the Agency's control framework for its operational, financial and administrative activities, in terms of compliance, efficiency, and economy.

5.1.5 Data sharing agreements

The Statistics Act provides Statistics Canada with the legal authority to enter into an agreement with provincial and territorial statistical agencies for the sharing of information collected from a respondent by Statistics Canada where those agencies administer legislation containing protection for information provided by respondents, equivalent to federal law (section 11). The Act also allows for agreements with any federal or provincial/territorial government department, municipal government or other incorporated body such as an association or university (section 12).^{Footnote 2} This is done to reduce respondent burden and additional costs to Canadians where information is needed by another government department. The receiving organization (i.e., provincial/territorial statistical agency, department or municipal or other corporation) is accountable under the terms of the agreement with respect to the use and protection of any information it receives.

Statistics Canada has standard templates that it uses to formalize data-sharing agreements. Such agreements were developed, and reviewed regularly, in coordination with legal advisors in the Department of Justice to ensure that they meet all legal and policy requirements, including the TBS Guidance on Preparing Information Sharing Agreements Involving Personal Information.

5.1.6 Statistics Canada's Policy Suite

Statistics Canada has in place a framework of policies and related instruments to protect confidential personal, business and institutional information, to receive and respond to complaints and enquiries, to train and inform staff about these policies and procedures, and to explain the policies and procedures. As applicable, these are described in the sections that follow. As well, Appendix 5 provides a graphical link between the policy suite and the GSBPM.

5.3.1 Statistics Canada Directive on Informing Survey Respondents

Statistics Canada provides all respondents, prior to or at the time of collection, with information about the purpose of the survey (including the expected uses and users of the statistics to be produced from the survey), the authority under which the survey is taken, the mandatory or voluntary nature of the survey, confidentiality protection, the known record linkage plans and the identity of the parties to any agreements to share the information provided by those respondents, where applicable.

5.3.2 Mandatory or voluntary nature of the survey

The Agency's Directive on Informing Survey Respondents requires that respondents be advised explicitly whether taking part in the survey is mandatory or voluntary. Messages about the voluntary nature must be presented or available to respondents before they make a decision whether or not to participate in the survey. The information as to the mandatory/voluntary nature of the survey may be provided in various modes, such as on the questionnaire, in the introduction letter, orally by an interviewer, along with a clear description of the survey purpose. As well, the Information for survey participants module on the Statistics Canada web site is organized according to the survey title/program name, and includes this same information, as well as more detailed information that cannot be effectively and efficiently communicated in other ways.

In the case of voluntary household or business/institutional surveys, respondents are to be informed explicitly that their response is voluntary. Other information about the survey may be communicated first, but the voluntary nature of the survey must be communicated prior to any survey questions being asked. Should enquiries about the nature of the survey be made at any time, a direct response is to be provided immediately.

Even after having agreed to participate in a voluntary survey, respondents may choose not to answer specific questions they find sensitive or where they feel uncomfortable providing a response. As well, they may decide to stop participating part way through the collection.

In the case of mandatory household surveys, respondents are advised in a factual and non-threatening manner that their response is required by law. Traditionally, the Census of Population and the Labour Force Survey are the only household surveys Statistics Canada undertakes on a mandatory basis.

In the case of mandatory business/institutional surveys, respondents are informed that their response is required by law. In the case of surveys which include small businesses, the administration of the mandatory nature of the survey is carried out with due regard to the reporting burden of the business. Statistics Canada has an Ombudsman for Businesses, whose job is to liaise with businesses regarding their reporting to Statistics Canada, and with managers of business surveys regarding their data requests, to reach a balance between the two.

5.3.3 Record linkage plans

Statistics Canada's Directive on Record Linkage requires that respondents must be notified of planned and/or potential linkage of their survey responses to data from other surveys or administrative files. Notification may be specific or general, as explained in the directive. Planned linkages are those that are an integral part of the survey and are envisaged as the methodology is being developed.

Statistics Canada does not seek consent from respondents to conduct a record linkage, unless required by legislation or policy. The linked dataset will be used only for statistical purposes, and not for regulatory or administrative purposes. There is legal authority in the Statistics Act to "collect, compile, analyze, abstract and publish statistical information." The same Act obliges Statistics Canada to protect the confidentiality of "any information obtained under the Act in such a manner that it is possible to relate the particulars obtained from any individual return to any identifiable person, business or organization." In addition, Statistics Canada advises all its survey respondents that the collected information may be used for other statistical purposes.

If a respondent objects to having his/her information used for record linkage, the objection is recorded and no future record linkage will use this information.

For certain studies involving record linkage (for example, in the case of long-term health studies), Statistics Canada may determine that it is necessary to consult with appropriate representative groups before the linkage is approved. If the linkage involves a particular group and relates to a potentially sensitive issue, Statistics Canada may consult with representatives of the group involved, and with the Office of the Privacy Commissioner (OPC). As well, major new linkage projects are discussed with the OPC and, while the OPC does not formally approve record linkage projects, feedback from this consultation process in the past has proven to be very useful. In certain cases, a separate assessment may be undertaken to supplement the generic PIA.

5.3.4 Data Sharing Pursuant to Section 12 of the Statistics Act

Section 12 of the Statistics Act provides for the sharing of information, collected for statistical purposes by Statistics Canada, with any federal or provincial/territorial government department, municipal government or other incorporated body such as an association or university. Sharing of data is conditional on giving respondents prior notification of the proposed sharing, and giving them the right to refuse to allow their information to be shared.^{Footnote 3} Indeed not even the names of objecting respondents are provided to the other party in a share agreement. These agreements have terms and conditions that limit the use of information and provide for security requirements that are equivalent to those employed by Statistics Canada.

In many cases, such an agreement means that the other agency will not have to collect similar information through its own survey. The shared information is used for statistical purposes, except where the other party is authorized by law to require the respondent to provide this information. In such cases, the data are normally used for administrative or regulatory purposes by the other party, who are responsible for the access, use, storage, retention and disposition of the information.

Statistics Canada has standard templates that it uses to formalize data-sharing agreements. Such agreements were developed, and reviewed regularly, in coordination with legal advisors in the Department of Justice to ensure that they meet all legal and policy requirements, including the TBS Guidance on Preparing Information Sharing Agreements Involving Personal Information.

5.3.5 Information on the Statistics Canada website related to consent

The Statistics Canada website provides information related to privacy and consent:

• privacy notice to survey respondents, clients, third party social media and visitors to the web site, along with contact information for the departmental privacy officer;
• privacy-related policies and practices at Statistics Canada;
• what record linkage is and how it is used at Statistics Canada;
• approved record linkages at Statistics Canada, with their purpose, description and output.

The website provides information about Privacy impact assessments, providing a link to this generic PIA as well as summary descriptions of all approved specific PIAs.

As well, the web site provides "Information for survey participants":

• the various surveys that Statistics Canada undertakes are listed, and information is provided for each one;
• what Statistics Canada tells respondents when undertaking a survey;
• what Statistics Canada asks for in responses to a survey;
• the assurances that Statistics Canada makes in undertaking a survey.

5.3.6 Children: Obtaining information and seeking consent

Occasionally, Statistics Canada determines that it can best meet the objectives of a specific program by collecting information directly from children. Although circumstances may lead to a different approach in certain situations, the following general approach is used:

• Children are defined as persons under a survey-specific age;
• Consent is obtained from a parent or guardian to collect the information from the child;
• Assent is obtained from the child, and furthermore, the child is told that he/she may choose to not answer any particular question.

Each survey determines its own definition of the age under which a person is considered a child. Factors considered in determining this age are definitions used by other programs, the nature of questions and the nature of the concepts. Overall, the decision aims to divide the survey respondents into those who can best provide the information; in some cases, it will be the person and in other cases it will be that person's parent or guardian.

With respect to seeking consent for data sharing or other statistical operations, Statistics Canada may decide to seek consent from the child or from the parent/guardian, regardless of who will be asked to respond to the survey questions.

5.4.1 Statistics Canada Directive on Informing Survey Respondents

It is the policy of Statistics Canada to provide all respondents, prior to or at the time of collection, with information about the purpose of the survey (including the expected uses and users of the statistics to be produced from the survey), the authority under which the survey is taken, the mandatory or voluntary nature of the survey, confidentiality protection, the record linkage plans and the identity of the parties to any agreements to share the information provided by those respondents, where applicable.

5.4.2 Information on the Statistics Canada website related to the collection of confidential personal and business information

The Statistics Canada website contains the following information:

• how Statistics Canada ensures relevance through consultation with and advice from various groups and individuals;
• the various stakeholders in Statistics Canada data;
• how statistical information is used;
• protection of confidentiality and privacy;
• what Statistics Canada does and its authority to do so.

The Statistics Canada website contains information for survey respondents:

• the various surveys that Statistics Canada undertakes are listed, and information is provided for each one;
• what Statistics Canada tells respondents when undertaking a survey;
• what Statistics Canada asks for in responses to a survey;
• the assurances that Statistics Canada makes in undertaking a survey.

5.5.1 Statistics Canada Directive on Record Linkage

Statistics Canada recognizes the significant benefits of record linkage in meeting its mandate, while also recognizing the inherent privacy-invasive nature of the activity. Record linkage is a recognized important statistical tool. It results in the generation of a new dataset and new information, of which an individual is usually unaware^{Footnote 5}. The benefits of a specific record linkage may include cost savings, higher data quality as compared to other options to obtain the information, and reduced burden on individuals who otherwise would be asked to supply the information themselves. When used for statistical analysis, record linkage cannot directly impact an individual as by nature, statistical analysis combines information from many individuals.

To achieve an appropriate balance between the statistical benefits and privacy invasiveness, Statistics Canada sets the following conditions for record linkage activities:

• the purpose of the record linkage activity is statistical (as opposed to administrative) and is consistent with the mandate of Statistics Canada as described in the Statistics Act; and
• the benefits to be derived from such a linkage are clearly in the broad public interest; and
• in the case of research projects, the proposed analysis is methodologically sound and the linked dataset and analytical techniques are appropriate for the intended objectives; and
• the products of the record linkage activity will be released only in accordance with the confidentiality provisions of the Statistics Act and with any applicable requirements of the Privacy Act; and
• the record linkage activity has demonstrable cost or respondent burden savings over other alternatives, or is the only feasible option; and
• the record linkage activity is judged not to jeopardize the future conduct of Statistics Canada's programs; and
• the linkage satisfies a prescribed review and approval process; this includes formal approval by the Chief Statistician and, in cases where the linkage presents additional privacy concerns, review by Statistics Canada's Executive Management Board (its most senior management committee).

The directive recognizes that there are certain record linkage activities that are essential elements of programs and are regularly conducted. These omnibus approvals are not subject to the usual review and approval notice, having been pre-approved by Statistics Canada's Executive Management Board.

The first omnibus approval relates to the economic statistics program. All record linkage activities for this program are covered, except:

• Linkages that would have significant privacy implications since they involve a high proportion of small and/or unincorporated businesses;
• All linkage activities of the Agriculture Division;
• Linkages that involve client-supplied lists of businesses;
• Linkages that present a significant risk of residual disclosure.

The overriding considerations behind this authority are:

• No linkage should damage our relationship with the business respondents.
• No privacy-invasive linkages shall be carried out without a demonstrated public good. Privacy concerns are present when information from unincorporated businesses is linked.
• If the linkage involves an externally-specified group of businesses, no files are to be linked if the results might harm the interests of that group.

Any linkages not meeting these criteria are not approved.

The second omnibus approval relates to the population and household statistics programs, and to privacy-sensitive economic statistics programs. There are two Parts to this second omnibus approval.

PART A: Linkages whose primary purpose is not to contribute directly to statistical outputs that are disseminated outside Statistics Canada

The purpose of linkages covered in this part is to do one of the following:

• Obtain information that benefits a survey, such as for stratification in survey design, but that does not directly contribute to estimates;
• Study and assess survey data quality, for example, by comparing survey data to data from other sources; and
• Aid in data collection, such as to provide addresses to mail introductory letters or to provide telephone numbers to reduce collection costs by permitting data collection through a telephone interview.

PART B: Linkages whose primary purpose is to contribute directly to statistical outputs that are disseminated outside Statistics Canada

The following types of linkages are approved:

• Linkage of supplementary surveys to the main survey: This is a situation where a second household survey is designed to use all or part of the sample of another household survey, and to reduce response burden by using content collected in the original survey. This second survey may be collected at the same time as the initial survey or at a later time, but the planned linkage for the second survey must be clearly planned prior to data collection begins for the main survey. Examples of surveys with supplements are the Labour Force Survey (LFS) and the Canadian Community Health Survey (CCHS). Another example is the linkage of the Census of Population data to that for a postcensal survey.
• Longitudinal surveys: The linkage of survey information for the same individual but collected at different times. This applies to surveys that are designed to be longitudinal, and specified in the prescription order.
• Linkage of administrative data to survey data when the linkage is clearly defined as part of the survey: This applies to situations where essential survey content is not collected as part of the direct data collection, but is planned to be taken from administrative files. An example is household surveys which do not ask questions on sources and amounts of personal income, but plan to link to income tax files to obtain the required income information.
• Longitudinal linkage of personal administrative information: This applies to the longitudinal linkage of the same administrative file over time. An example is the Longitudinal Administrative Database (LAD), which links personal income tax files over time. Linkages of different administrative files, either longitudinally or cross-sectionally, are not included.

All linkages not covered by the omnibus linkage authority must follow the prescribed process to obtain approval.

Linkage projects that have been carried out which involve personal information are listed in the annual report to Parliament on the implementation of the Privacy Act. In addition, Statistics Canada also makes summaries of all approved record linkages (not just those involving personal information) available on its website (Statistics Canada)^{Footnote 6}.

5.5.2 Informing respondents of record linkage plans

As part of the communications to persons whose information is requested, Statistics Canada informs respondents that record linkage is a standard tool used in the production of statistical information, and that Statistics Canada undertakes record linkages to meet its program objectives for reasons of greater efficiency and higher data quality. On its web site, Statistics Canada posts summaries of approved record-linkage projects, with the exception of most of the record linkage activities related to the omnibus linkage authorities.

5.5.3 Use of administrative records

The Statistics Act contains a broad provision, set out in section 13, for accessing records held by other organizations, both public and private, where those records are required for purposes of the legislation. Specifically, section 13 details the statutory authority for Statistics Canada to obtain access to records in any department (federal or provincial) or in any municipal office, corporation, business or organization where those records are required for purposes of the Statistics Act.

Statistics Canada's use of records obtained under section 13 is limited to statistical purposes only. It reduces the burden of statistical enquiries on respondents and provides an alternative to the more costly traditional survey-taking activities. At the same time, a major issue that inevitably arises from the use of administrative records for statistical purposes is the issue of privacy. This is because information obtained by one institution for its own purposes (administrative) is used by another institution for a secondary purpose (statistical^{Footnote 7}), without the knowledge of the individuals to whom the information relates. The privacy concern is mitigated by the fact that the statistical uses of the information do not result in a direct impact on any specific individual.

As well, section 24 of the Statistics Act gives Statistics Canada a specific right of access to federal income tax and excise tax records and section 25, the right of access to import and export records. The manner and times of the Agency's access to these records require the approval of the Governor in Council and are set out in MOUs between Statistics Canada and the Canada Revenue Agency and the Canadian Border Services Agency, respectively. Statistics Canada also has access to corporate tax records by way of the Corporations Returns Act which Statistics Canada administers.

There are also a number of specific provisions in the legislation giving Statistics Canada access to records relating to crime and justice statistics. Section 26 requires officials of criminal justice courts or tribunals to provide information. Similarly, section 27 requires sheriffs and penitentiary and reformatory wardens to provide Statistics Canada with information on prisoners, in the manner directed. Section 28 requires that court officials, sheriffs and wardens who are requested by Statistics Canada to provide information, ensure that they keep records that will enable them to provide that information. Finally, section 29 requires that the Solicitor General of Canada ensure that statistical information on pardons be provided to Statistics Canada.

5.5.4 Information on the Statistics Canada website related to the use of confidential personal and business information

The Statistics Canada website contains information about:

• the relevance and use of the data;
• what record linkage is and how it is used at Statistics Canada;
• approved record linkages at Statistics Canada, with their purpose, description and output.^{Footnote 8}

Under "Information for survey participants" on the Statistics Canada website, there is information about:

• the various surveys that Statistics Canada undertakes are listed, and information is provided for each one;
• what Statistics Canada tells respondents when undertaking a survey;
• what Statistics Canada asks for in a survey;
• the assurances that Statistics Canada makes in undertaking a survey.

5.5.5 Mandate of Statistics Canada

Statistics Canada collects only information which it uses to meet its mandate.

The Statistics Act provides Statistics Canada with the mandate to collect, compile, analyze, abstract and publish statistical information relating to the commercial, industrial, financial, social, economic and general activities and condition of the people. Data collected are used for statistical, research and analytical purposes, but not for administrative purposes.

5.5.6 Obligation to protect confidentiality

The Statistics Act provides the legal basis for maintaining the confidentiality of personal and business information that Statistics Canada collects. Section 17(1) of the Act requires that:

1. No unauthorized person^{Footnote 9} may examine any identifiable information collected under the Act; and
2. no authorized person may "disclose or knowingly cause to be disclosed any information collected under the Act in such a manner that it is possible to relate the particulars to any identifiable individual person, business or organization".

The Access to Information Act, in section 24, also provides for this confidentiality, recognizing that information collected under the Statistics Act and protected by section 17 of that act cannot be made available to anyone attempting to obtain it using the Access to Information Act.

The Privacy Act also generally protects collected personal information from disclosure. The provisions under subsection 8(2), which permit the disclosure of personal information, without the consent of the individual, cannot be applied in the case of personal information collected under the Statistics Act. Subsection 8(2) of the Privacy Act is subject to other Acts of Parliament, in this case the Statistics Act, and therefore does not take precedence over the specific statutory confidentiality protection found in the Statistics Act.

Statistics Canada will not disclose confidential personal information other than with the consent of the respondent or the original data provider, and as permitted by the Statistics Act^{Footnote 10}. Identifiable personal information is retained only as necessary for the fulfillment of Statistics Canada's mandate and, in the case of Census of Population records, as required by the Library and Archives of Canada Act.

5.5.7 The oath of office

As legally required by Section 6 of the Statistics Act, before taking up duties under the Statistics Act, all employees must take an oath or solemn affirmation that they will conform to the requirements of the Act and will not, without due authority, disclose or make known any confidential information.

5.5.8 Penalties for violations

Employees who contravene the confidentiality provisions of the Statistics Act are subject to prosecution and are liable on summary conviction to a fine and/or imprisonment, as described in sections 30 and 34 of the Statistics Act.

5.5.9 Confidentiality measures at Statistics Canada

The following measures are in place at Statistics Canada to maintain confidentiality in the statistical information the Agency produces and to keep the principle of confidentiality in the forefront of all its employees' consciousness:

• the Oath of Office, in addition to being a requirement of the Statistics Act, is also designed to impress upon each employee the need for preserving the confidentiality of information;
• courses for new employees that emphasize confidentiality and mandatory refresher courses of ongoing employees;
• dissemination of information containing quantity and frequency distributions are subjected to confidentiality edit procedures;
• all public-use microdata files^{Footnote 11} are reviewed by the Microdata Release Committee before their release to ascertain that the files do not contain any information that could lead to the identification of any respondent;
• the Microdata Release Committee systematically reviews the various disclosure control strategies practiced by program areas in terms of their adequacy and consistency and promotes sound principles and best practices relating to confidentiality and inferential disclosure;
• Statistics Canada's Disclosure Control Resource Centre provides advice and assistance to Statistics Canada programs on methods of disclosure risk assessment and control; develops disclosure control methods; maintains an inventory of methods for assessing and controlling the risks of disclosure for data products disseminated by Statistics Canada; supports the work of the Microdata Release Committee, particularly with respect to disclosure review procedures; fosters a better appreciation among respondents, data users and the general public of Statistics Canada's disclosure control practices;
• training is provided to specialists, interviewers and survey managers in the areas of disclosure control, data quality, confidentiality and security;
• documents on confidentiality are readily available to all employees on Statistics Canada's Internal Communications Network and the Confidentiality Awareness Program website including Statistics Canada's Security Practices Manual and Statistics Canada's Policy Suite;
• detailed training and relevant documentation is provided to deemed employees working on research projects in an RDC or in CDER;
• The Statistics Act, the Privacy Act, the Corporations Returns Act, the Access to Information Act and other relevant legislations are available to employees;
• breaches of confidentiality, should they occur, are reported formally to the Departmental Security Officer as specified in the departmental Information and Privacy Breach Protocol (see section 8 below).

5.5.10 Retention of personal identifiers

It is Statistics Canada's practice to remove personal identifiers from statistical master files when they are no longer required for data processing. If retained for future use, the personal identifiers are to be stored separately from the statistical master file.

In the case of linked files, the requirement to maintain personal identifiers (e.g., name or unique identification number such as health number) is based on need. Linked files will be retained until no longer needed.

5.5.11 Disclosure of confidential personal and business information

The disclosure of confidential personal and business information collected under the Statistics Act is limited to the following circumstances:

Data sharing agreements

Section 11 of the Statistics Act recognizes the special status of provincial and territorial statistical offices that administer their own statistical legislation. It provides the authority for the Minister, with the approval of the Governor in Council, to enter into agreements to share data collected jointly with the statistical agencies of provinces and territories for statistical purposes. Thus, information can be shared with these agencies if (i) respondents were notified at the time of collection, (ii) the agencies has the statutory authority to collect the information on their own on a mandatory basis, (iii) the agencies' confidentiality protection requirements are substantially the same as those of Statistics Canada, and (iv) the Chief Statistician approves the data sharing. Agreements must be in place at the time the information is being collected. In other words, information cannot be shared retroactively.

Section 12 of the Statistics Act provides for the sharing of information, collected for statistical purposes by Statistics Canada, with any federal or provincial/territorial government department, municipal government or other incorporated body such as an association or university. Sharing of data is conditional on giving respondents prior notification of the proposed sharing, and giving them the right to refuse to allow their information to be shared.^{Footnote 12} Indeed not even the names of objecting respondents are provided to the other party in a share agreement. A respondent's right of refusal to the sharing of information does not apply if the department is authorized by law to require the respondent to provide that information. As is the case for agreements with provincial and territorial statistical agencies, agreements must be in place prior to data sharing. These agreements have terms and conditions that limit the use of information and provide for security requirements.

In many cases, such an agreement means that the other agency will not have to collect similar information through its own survey. The shared information is used for statistical purposes, except where the other party is authorized by law to require the respondent to provide this information. In such cases, the data are normally used for administrative or regulatory purposes by the other party. After Statistics Canada provides the information to the other party, the information is subject to the applicable legislation.

Statistics Canada has standard templates that it uses to formalize data-sharing agreements. Such agreements were developed, and reviewed regularly, in coordination with legal advisors in the Department of Justice to ensure that they meet all legal and policy requirements, including the TBS Guidance on Preparing Information Sharing Agreements Involving Personal Information.

Discretionary disclosure

The Statistics Act (subsection 17(2)) gives discretion to the Chief Statistician to release certain types of identifiable information. This discretion is limited and specific and includes the following types of information:

• information collected by persons, organizations or government departments for their own purposes and communicated to Statistics Canada as long as the secrecy requirements to which this information was subjected when first collected are adhered to, and an agreement for disclosure is made between the Chief Statistician and the collector;
• information relating to a person, organization or business if the person, organization or owner of the business consents to the disclosure in writing.

In exercising this discretion, the Chief Statistician is guided by the Directive on Discretionary Disclosure which sets out a review and approval process for all requests for disclosure of information under sub-section 17(2) of the Statistics Act.

According to the Directive on Discretionary Disclosure, the Chief Statistician may authorize disclosure when:

• the information is needed for statistical or analytical purposes; and
• the information released does not disadvantage Statistics Canada's respondents and does not harm the relationship between the Agency and its respondents.

Ultimately, it is only the Chief Statistician who can authorize disclosure and then, only within the limits set out in sub-section 17(2) of the Statistics Act. By law, the Chief Statistician must sign an Order to authorize the disclosure.

Work-in-progress and Advanced Release

Work-in-progress datasets, analytical products and information products may be provided in advance of official release by Statistics Canada to designated individuals of external organizations for the purposes of data validation. These are cases where it can be shown that the receiving individual or organization is qualified to provide the required validation, and where significant benefits to data quality are anticipated or have been previously demonstrated.

Work-in-progress datasets may contain personal information^{Footnote 13}, whereas analytical products and information products do not.

When providing work-in-progress data to external organizations for data validation, divisions are required to provide only the information that requires validation for a pre-established review period that is as brief as possible. The method of providing advance release information to external organizations must meet Statistics Canada's security requirements for transmission of sensitive statistical information.

Organizations receiving protected release information from Statistics Canada must:

• safeguard the confidentiality of the protected release information provided to them;
• limit access to the protected information to those designated officials within their organizations for work-related purposes ('need-to-know' basis);
• undertake not to further disseminate the protected release information;
• destroy the protected information once the review is completed, prior to official release.

Advance release of the text of an official release may occur under certain specific and restrictive situations. Texts of official release do not contain personal information, so there are no privacy risks associated with advanced release.

5.5.12 Access to confidential information by researchers as deemed employees of Statistics Canada

The Statistics Act permits Statistics Canada to use the services of persons outside Statistics Canada to carry out any function or perform work pursuant to the Statistics Act. Such persons are considered to be "deemed employees" of Statistics Canada. One area where Statistics Canada employs deemed employees is in conducting statistical research that requires access to confidential microdata. Such access is subject to Statistics Canada's Directive on the Use of Deemed Employees.

Located in most Canadian universities, Research Data Centres (RDCs) provide researchers with access, in secure premises, to microdata from population and household surveys, as well as to certain administrative datasets. The centres are staffed by Statistics Canada employees. They are operated under the provisions of the Statistics Act in accordance with all the confidentiality rules and are accessible only to researchers with approved projects who have been sworn an oath under the Statistics Act as deemed employees.

Similar to a RDC, the Statistics Canada Canadian Centre for Data Development and Economic Research (CDER) provides access to business microdata. The centre is located within Statistics Canada's Head Office. Deemed employees are not permitted to examine individual microdata, and work closely with a Statistics Canada employee to meet the objectives of the research project. The business microdata, particularly those for large firms, are considered to require this additional protection.

5.5.13 Real Time Remote Access (RTRA)

Another approach to provide researchers with access to detailed microdata is the Real Time Remote Access (RTRA) Application, already used by a number of other statistical agencies throughout the world. This application is essentially an on-line remote access facility allowing users to run, in real time, data analyses on microdata or lightly masked microdata sets, defined as confidential under the Statistics Act, that are kept in a central and secure location under the control and care of Statistics Canada, with the output vetted for confidentiality.

A limited number of researchers in other federal government departments are issued a username and password so they can remotely submit SAS^{Footnote 14} programs to a secure Statistics Canada server. The submitted job requests use a modified version of SAS that will place limits on their requests and the subsequent outputs. Before being sent back to these researchers, results will be vetted to prevent disclosure of confidential information.

5.5.14 Retention of statistical information

As part of its Information Management program, Statistics Canada has a directive and a guideline that address the retention of statistical information:

• Directive on the Management of Statistical Microdata Files
• Guideline on the Management of Statistical Microdata Files and Aggregate Statistics

Generally, target retention periods are assigned to different types of statistical information. On an exception basis, a different retention period may be assigned when the information is created. Statistical information is disposed of once it has served its purpose or its retention period has expired.

The general philosophy is that information is retained only as long as is operationally required. With only a few exceptions, all files types have very short retention periods (a few years). Specifically two types of files have longer retention periods:

• Internal master (analytical) files with direct personal identifiers removed: Indeterminate. With very few exceptions, these files never lose their statistical value. Their use is governed by the Statistics Act and supported by Statistics Canada's policies and procedures to protect the information.
• Identifier files (Files containing direct identifiers that have been separated from statistical information): Retain as long as operational requirements remain. In many cases, this information is used only to support contacting individuals to collect information. In the case where future studies are planned that require the use of direct identifiers, very specific security procedures apply. The files containing direct identifiers are stored in Statistics Canada Head Office, and access to these files is limited to only a few people for work-related purposes.

5.6.1 Statistics Canada's commitment to quality

Given the widespread use of its data by the Canadian public and media, various levels of government, businesses and labour unions, the academic sector, foreign and international bodies, Statistics Canada strives to build quality into all its programs and products. Its quality assurance framework identifies six primary elements of quality: accuracy, relevance, timeliness, accessibility, interpretability and coherence.

To help ensure the accuracy of the confidential personal and business information that it collects from respondents, Statistics Canada has in place the following policies, guidelines and practices:

• requirements for the testing of new and revised questionnaires in both official languages before implementation and for the periodic evaluation of questionnaires used in ongoing surveys (Policy on the Review and Testing of Questionnaires);
• consultation with interviewers to identify problem areas where questionnaires can be improved (Policy on the Review and Testing of Questionnaires);
• the adoption of standard concepts and definitions for the collection of data and consistent collection and processing methods for the production of statistical data across surveys (Policy on Standards);
• quality guidelines for all its statistical projects, including activities related to the specification of objectives and uses in consultation with users, questionnaire design, data collection operations, editing of data records that are potentially in error and data quality evaluation (Quality Guidelines).

5.7.1 Technology and privacy issues

Program managers must:

• identify any changes to the business requirements that have an impact on the system, software of program application and, consequently, may affect the current access controls and privacy practices related to the creation, collection, retention, use, disclosure and disposition of personal information, and implement changes as deemed necessary.
• Determine whether the current IT legacy systems and services that will be retained or those that will be substantially modified are compliant with privacy requirements, and implement changes as deemed necessary.
• Develop and implement, for program staff, awareness activities related to the protection of privacy requirements in the new electronic environment.

5.7.2 Legal obligation to protect confidentiality

The Statistics Act provides the legal basis for maintaining the confidentiality of personal and business information that Statistics Canada collects. Section 17(1) of the Act requires that:

1. No unauthorized person^{Footnote 15} may examine any identifiable information collected under the Act; and
2. no authorized person may "disclose or knowingly cause to be disclosed any information collected under the Act in such a manner that it is possible to relate the particulars to any identifiable individual person, business or organization".

5.7.3 The oath of the office

Before taking up duties under the Statistics Act, all employees must take an oath or solemn affirmation that they will conform to the requirements of the Act and will not, without due authority, disclose or make known any confidential information.

5.7.4 Penalties for violations

Any actions that contravene the security policies of the Government of Canada or Statistics Canada could lead to administrative, disciplinary or statutory penalties when misconduct or negligence is involved. The nature of the penalties will depend on the nature of the offence. Employees who contravene the confidentiality provisions of the Statistics Act are subject to prosecution and are liable on summary conviction to a fine and/or imprisonment.

5.7.5 Security measures at Statistics Canada

The following describes some of the security measures in place at Statistics Canada to maintain a secure environment and to keep the principle of security in the forefront of all its employees' and deemed employees' consciousness:

• access to Statistics Canada buildings is controlled by a combination of physical measures and access procedures;
• all external visitors are escorted to the work area, accompanied while in the work area, and escorted back to the building entrance at the end of the visit;
• employees' and visitors' identification cards must be visible at all times;
• all staff undergo a reliability check;
• only those Statistics Canada employees with a "need to know" have access to confidential information and then only to that information required for them to do their job;
• within Statistics Canada, inter-divisional access to confidential information must be approved by the director of the division holding the information;
• disposal of confidential information is carried out under secure conditions according to government-approved procedures;
• non-computerized confidential data are stored in security-approved containers;
• Statistics Canada's IT Security Policy outlines the safeguards the Agency has put in place to ensure that its information systems are kept secure, including:
  • data processing and communications networks are configured to prevent physical and electronic access to confidential information from outside Statistics Canada's facilities;
  • access to files is protected through access controls, passwords and servers located in access-controlled areas;
  • communications between Statistics Canada locations are facilitated through the use of secure data transmission lines and services specifically approved for that purpose;
  • computing devices with external wireless connections may not be connected to any Statistics Canada network;
  • electronic transmission of confidential information under specific special circumstances must adhere to approved security procedures;
  • transmission of microdata files containing confidential information to Statistics Canada Regional Offices, Research Data Centres or to data-sharing partners must follow approved security procedures; such information must be encrypted;
  • storage of confidential information on any removable storage media must follow approved security procedures; such information must be encrypted;
• confidential information may not be taken out of Statistics Canada's secure premises;
• after they are no longer required for data processing, direct personal identifiers are removed from statistical master files;
• breaches of security are reported formally to the Departmental Security Officer, who will implement the departmental Information and Privacy Breach Protocol.

Information on security is readily available to all employees on Statistics Canada's Internal Communications Network.

5.8.1 Statistics Canada Directive on Informing Survey Respondents

It is the policy of Statistics Canada to provide all respondents with information about: the purpose of the survey (including the expected uses and users of the statistics to be produced from the survey), the authority under which the survey is taken, the mandatory or voluntary nature of the survey, confidentiality protection, the record linkage plans and the identity of the parties to any agreements to share the information provided by those respondents, where applicable. This information is communicated to respondents in different modes, depending on the survey. All information is available on the Statistics Canada web site.

5.8.2 Information on the Statistics Canada website related to policies and procedures

On the Statistics Canada website, there is information about:

• protecting confidential information and privacy at Statistics Canada;
• privacy-related policies and practices at Statistics Canada;
• what record linkage is and how it is used at Statistics Canada;
• Statistics Canada's Record Linkage Directive;
• approved record linkages^{Footnote 16} at Statistics Canada, with their purpose, description and output.

Under Information for survey participants on the Statistics Canada website, there is information about:

• the various surveys that Statistics Canada undertakes, and information is provided for each one;
• what Statistics Canada tells respondents when undertaking a survey;
• what Statistics Canada asks for in a survey;
• the assurances that Statistics Canada makes in undertaking a survey.

5.8.3 Info Source: Sources of Federal Government information

As required by the Privacy Act, all Statistics Canada surveys that collect and retain personal information in identifiable form are registered as personal information banks and are included in Info Source: Sources of Federal Government Information. Info Source contains the identification and description of the personal information bank, its registration number, a description of the group of individuals to whom personal information contained in the bank relates, the name of the government institution that has control of the bank, the purposes and consistent uses of the information bank, the retention and disposal standards applied to information in the bank and the contact person to whom requests relating to personal information should be sent. See Appendix 1 for specific details on Statistics Canada's specific personal information banks related to its statistical operations. Requests about personal information held by Statistics Canada should be directed to Statistics Canada's Access to Information and Privacy Coordinator as noted in Principle 9.

5.8.4 Record linkage activities

Linkage projects that have been carried out which involve personal information are listed in the annual report to Parliament on the implementation of the Privacy Act. In addition, a list of all approved record linkages at Statistics Canada^{Footnote 17}, with their purpose, description and output, is available on the Statistics Canada website.

5.8.5 Partnerships

Consultation with stakeholders, users, experts and advisory groups is an integral part of the planning and development of Statistics Canada surveys. The National Statistics Council advises the Chief Statistician of Canada on the full range of Statistics Canada's activities, particularly on overall program priorities. A network of Professional Advisory Committees in major subject areas ensures the continuous review of the Agency's statistical outputs and helps set priorities and foster program relevance. Statistics Canada also maintains, on a continuing basis, a close bilateral relationship with key federal departments and agencies to foster an awareness of each department's needs and their information priorities. The Federal-Provincial-Territorial Consultative Council on Statistical Policy, and its subcommittees, comprises a network of 13 provincial/territorial official representatives who collaborate with Statistics Canada to determine data requirements, consult on current statistical activities and coordinate the dissemination of Statistics Canada products to provincial and territorial governments.