Statistics Canada takes reasonable measures to safeguard census data transferred to Shared Services Canada
An anonymous complainant alleged that Statistics Canada (StatCan) improperly disclosed confidential census information to Shared Services Canada (SSC) when it transferred its informatics infrastructure, contravening the Statistics Act and risking unauthorized disclosure. The complainant raised concerns about StatCan's supervision over SSC employees, the storage of data in shared data centers, and the potential for disclosure during decryption. StatCan argued that SSC took over infrastructure, not data, and that SSC employees with access were 'deemed employees' under the Statistics Act, sworn to confidentiality, and subject to high security clearances. The Office of the Privacy Commissioner (OPC) found that StatCan was legally required to use SSC's services and, under section 16 of the Shared Services Canada Act, StatCan retained control and accountability for the data. The OPC concluded that StatCan took reasonable measures, including comprehensive agreements and security assessments, to define its relationship with SSC and protect the census data. Therefore, the complaint was deemed not well-founded.
- 1Whether Statistics Canada improperly disclosed confidential census information to Shared Services Canada by transferring its informatics infrastructure.
- 2Whether the sharing of census information with SSC contravenes the Statistics Act.
- 3Whether Statistics Canada maintains sufficient supervision over SSC employees accessing census data.
- 4Whether the storage of census data in SSC data centers shared with other federal institutions creates a risk of unauthorized disclosure.
- 5Whether there is a risk of disclosure of confidential census data when it is decrypted for processing.
- 6Whether Statistics Canada has taken sufficient steps to oversee SSC’s handling of census data on its behalf, consistent with its obligations under the Privacy Act.
- 7Whether the transfer of personal information by StatCan to SSC for IT infrastructure services is authorized by the SSCA and consistent with the Privacy Act.
- 8Whether StatCan has implemented appropriate privacy protection clauses and safeguards in its agreements with SSC.
- 9Whether SSC employees with access to confidential census data have been properly sworn in as "deemed employees" under the Statistics Act.
- Disclosure of confidential information: No improper disclosure found
- Supervision of deemed employees: Measures taken were reasonable
- Data storage in shared centers: Measures taken were reasonable
- Risk of disclosure during decryption: Measures taken were reasonable
- Overall complaint: Not well-founded
Complaint not well-founded
The OPC found that StatCan was legally obliged to use SSC's services and retained control and accountability for the data, and that StatCan had taken reasonable measures and exercised due diligence to protect the data through agreements, security controls, and oversight.
- s.3 Privacy Act
- s.8 Privacy Act
- s.5 Statistics Act
- s.6 Statistics Act
- s.6 Shared Services Canada Act
- s.16 Shared Services Canada Act
This summary is for informational purposes only and not legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro