Canadian privacy & access decisions

An anonymous complainant alleged that Statistics Canada (StatCan) improperly disclosed confidential census information to Shared Services Canada (SSC) when it transferred its informatics infrastructure, contravening the Statistics Act and risking unauthorized disclosure. The complainant raised concerns about StatCan's supervision over SSC employees, the storage of data in shared data centers, and the potential for disclosure during decryption. StatCan argued that SSC took over infrastructure, not data, and that SSC employees with access were 'deemed employees' under the Statistics Act, sworn to confidentiality, and subject to high security clearances. The Office of the Privacy Commissioner (OPC) found that StatCan was legally required to use SSC's services and, under section 16 of the Shared Services Canada Act, StatCan retained control and accountability for the data. The OPC concluded that StatCan took reasonable measures, including comprehensive agreements and security assessments, to define its relationship with SSC and protect the census data. Therefore, the complaint was deemed not well-founded.

• Whether Statistics Canada improperly disclosed confidential census information to Shared Services Canada by transferring its informatics infrastructure.
• Whether the sharing of census information with SSC contravenes the Statistics Act.
• Whether Statistics Canada maintains sufficient supervision over SSC employees accessing census data.
• Whether the storage of census data in SSC data centers shared with other federal institutions creates a risk of unauthorized disclosure.
• Whether there is a risk of disclosure of confidential census data when it is decrypted for processing.
• Whether Statistics Canada has taken sufficient steps to oversee SSC’s handling of census data on its behalf, consistent with its obligations under the Privacy Act.
• Whether the transfer of personal information by StatCan to SSC for IT infrastructure services is authorized by the SSCA and consistent with the Privacy Act.
• Whether StatCan has implemented appropriate privacy protection clauses and safeguards in its agreements with SSC.
• Whether SSC employees with access to confidential census data have been properly sworn in as "deemed employees" under the Statistics Act.