Section 5: Privacy Compliance Analysis

Principle 1: Accountability

Statistics Canada is responsible for all personal confidential information collected and used under authority of the Statistics Act. The Agency is responsible for all personal information under its control and has designated individuals who are accountable for the Agency's compliance with the obligations of federal departments to respect privacy rights as described in sections 4 to 8 of the Privacy Act.

Statistics Canada's mandate for its statistical programs is described in Section 3 of the Statistics Act. Its authority to obtain information to meet its mandate is described in Sections 7, 8, 13, 22 and 24 to 29 of the Act.

Managers of statistical programs, as directed by their line management (Divisional Director, Branch Director General and the Field Assistant Chief Statistician), are responsible for applying all relevant central Agency and Statistics Canada policies related to privacy and confidentiality protection of personal information.

Often, statistical programs seek guidance and direction from committees and groups outside the project team. Such groups include:

  • steering groups comprised of senior managers, possibly including individuals from outside Statistics Canada;
  • Provincial and Territorial statistical agencies, and provincial and territorial government departments;
  • Research Ethics Boards, to ensure that ethical research standards are maintained within the statistical program;
  • user groups comprised of key users of the information produced by the program, with significant participation from outside Statistics Canada;
  • international statistical groups, whose responsibility is to develop and maintain international standards for a particular statistical domain.

5.1.1 Overall accountability

Under the Statistics Act, the Chief Statistician, under the direction of the Minister Responsible for Statistics Canada, is accountable for the operations and staff of Statistics Canada. The Statistics Act provides Statistics Canada with the mandate to collect, compile, analyse, abstract and publish statistical information relating to the commercial, industrial, financial, social, economic and general activities and condition of the people. Data collected by Statistics Canada are used for statistical, research and analytical purposes, but not for administrative purposesFootnote 1. The Statistics Act provides the legal basis for maintaining the confidentiality of the statistical information (personal, business and institutional) that Statistics Canada collects. Divisional directors are delegated to act on behalf of the Chief Statistician with respect to specific responsibilities for the control of and access to confidential information which includes both personal and business information.

5.1.2 Organizational accountability

The Director, Information Management Division, is responsible for the development of Statistics Canada's policies related to information, including all aspects of information classification, control, and access and for providing advice, guidance, and assistance in the implementation of information security measures. The director is Statistics Canada's Privacy Coordinator and is accountable for the department's compliance with the principles contained in this document.

5.1.3 Divisional custodial accountability

Divisional directors are responsible for controlling and protecting all confidential information obtained by their division in the pursuit of its program objectives, as defined in the Statistics Canada Directive on the Security of Sensitive Statistical Information.

5.1.4 Performance and compliance reviews

The Internal Audit Division provides a systematic and independent review function to advise management on the adequacy of the Agency's control framework for its operational, financial and administrative activities, in terms of compliance, efficiency, and economy.

5.1.5 Data sharing agreements

The Statistics Act provides Statistics Canada with the legal authority to enter into an agreement with provincial and territorial statistical agencies for the sharing of information collected from a respondent by Statistics Canada where those agencies administer legislation containing protection for information provided by respondents, equivalent to federal law (section 11). The Act also allows for agreements with any federal or provincial/territorial government department, municipal government or other incorporated body such as an association or university (section 12).Footnote 2 This is done to reduce respondent burden and additional costs to Canadians where information is needed by another government department. The receiving organization (i.e., provincial/territorial statistical agency, department or municipal or other corporation) is accountable under the terms of the agreement with respect to the use and protection of any information it receives.

Statistics Canada has standard templates that it uses to formalize data-sharing agreements. Such agreements were developed, and reviewed regularly, in coordination with legal advisors in the Department of Justice to ensure that they meet all legal and policy requirements, including the TBS Guidance on Preparing Information Sharing Agreements Involving Personal Information.

5.1.6 Statistics Canada's Policy Suite

Statistics Canada has in place a framework of policies and related instruments to protect confidential personal, business and institutional information, to receive and respond to complaints and enquiries, to train and inform staff about these policies and procedures, and to explain the policies and procedures. As applicable, these are described in the sections that follow. As well, Appendix 5 provides a graphical link between the policy suite and the GSBPM.

Principle 2: Purpose

Statistics Canada will collect information only as required to fulfill its mandate, as defined by the Statistics Act.

When collecting data directly from respondents, Statistics Canada's Directive on Informing Survey Respondents requires that the principal purpose(s) of the survey (including the expected uses and users of the statistics to be produced from the survey) must be communicated to survey participants. Respondents are informed that their information may also be used by Statistics Canada for other statistical and research purposes, including record linkage.

When administrative data is collected from other organizations, Statistics Canada explains that the information will be used for statistical purposes.

Principle 3: Consent

The Agency's Directive on Informing Survey Respondents and its Directive on Record Linkage as well as the legal requirements of sections 11, 12 and 17(2) of the Statistics Act all incorporate principles related to consent. Section 8 of the Act provides the authority to the Chief Statistician to designate certain data collection activities as voluntary.

At the same time, it is recognized that there may be circumstances where information obtained by one institution for its own purposes (administrative) is used by another institution for a secondary purpose (statistical), without the knowledge of the individuals to whom the information related. The Statistics Act contains a provision, set out generally in section 13 (and for certain specific types of information in sections 24 through 29), for accessing records held by other organizations, both public and private, where those records are needed by Statistics Canada in the conduct of its statistical programs. Specifically, section 13 specifies the statutory authority for Statistics Canada to obtain access to records in any department (federal and provincial) or in any municipal office, corporation, business or organization where those records are required for purposes of the Statistics Act.

Statistics Canada's use of records obtained under section 13, as well as Sections 24 to 29, is limited to statistical purposes only. It reduces the burden of statistical enquiries on respondents and provides an alternative to the more costly traditional survey-taking activities.

5.3.1 Statistics Canada Directive on Informing Survey Respondents

Statistics Canada provides all respondents, prior to or at the time of collection, with information about the purpose of the survey (including the expected uses and users of the statistics to be produced from the survey), the authority under which the survey is taken, the mandatory or voluntary nature of the survey, confidentiality protection, the known record linkage plans and the identity of the parties to any agreements to share the information provided by those respondents, where applicable.

5.3.2 Mandatory or voluntary nature of the survey

The Agency's Directive on Informing Survey Respondents requires that respondents be advised explicitly whether taking part in the survey is mandatory or voluntary. Messages about the voluntary nature must be presented or available to respondents before they make a decision whether or not to participate in the survey. The information as to the mandatory/voluntary nature of the survey may be provided in various modes, such as on the questionnaire, in the introduction letter, orally by an interviewer, along with a clear description of the survey purpose. As well, the Information for survey participants module on the Statistics Canada web site is organized according to the survey title/program name, and includes this same information, as well as more detailed information that cannot be effectively and efficiently communicated in other ways.

In the case of voluntary household or business/institutional surveys, respondents are to be informed explicitly that their response is voluntary. Other information about the survey may be communicated first, but the voluntary nature of the survey must be communicated prior to any survey questions being asked. Should enquiries about the nature of the survey be made at any time, a direct response is to be provided immediately.

Even after having agreed to participate in a voluntary survey, respondents may choose not to answer specific questions they find sensitive or where they feel uncomfortable providing a response. As well, they may decide to stop participating part way through the collection.

In the case of mandatory household surveys, respondents are advised in a factual and non-threatening manner that their response is required by law. Traditionally, the Census of Population and the Labour Force Survey are the only household surveys Statistics Canada undertakes on a mandatory basis.

In the case of mandatory business/institutional surveys, respondents are informed that their response is required by law. In the case of surveys which include small businesses, the administration of the mandatory nature of the survey is carried out with due regard to the reporting burden of the business. Statistics Canada has an Ombudsman for Businesses, whose job is to liaise with businesses regarding their reporting to Statistics Canada, and with managers of business surveys regarding their data requests, to reach a balance between the two.

5.3.3 Record linkage plans

Statistics Canada's Directive on Record Linkage requires that respondents must be notified of planned and/or potential linkage of their survey responses to data from other surveys or administrative files. Notification may be specific or general, as explained in the directive. Planned linkages are those that are an integral part of the survey and are envisaged as the methodology is being developed.

Statistics Canada does not seek consent from respondents to conduct a record linkage, unless required by legislation or policy. The linked dataset will be used only for statistical purposes, and not for regulatory or administrative purposes. There is legal authority in the Statistics Act to "collect, compile, analyze, abstract and publish statistical information." The same Act obliges Statistics Canada to protect the confidentiality of "any information obtained under the Act in such a manner that it is possible to relate the particulars obtained from any individual return to any identifiable person, business or organization." In addition, Statistics Canada advises all its survey respondents that the collected information may be used for other statistical purposes.

If a respondent objects to having his/her information used for record linkage, the objection is recorded and no future record linkage will use this information.

For certain studies involving record linkage (for example, in the case of long-term health studies), Statistics Canada may determine that it is necessary to consult with appropriate representative groups before the linkage is approved. If the linkage involves a particular group and relates to a potentially sensitive issue, Statistics Canada may consult with representatives of the group involved, and with the Office of the Privacy Commissioner (OPC). As well, major new linkage projects are discussed with the OPC and, while the OPC does not formally approve record linkage projects, feedback from this consultation process in the past has proven to be very useful. In certain cases, a separate assessment may be undertaken to supplement the generic PIA.

5.3.4 Data Sharing Pursuant to Section 12 of the Statistics Act

Section 12 of the Statistics Act provides for the sharing of information, collected for statistical purposes by Statistics Canada, with any federal or provincial/territorial government department, municipal government or other incorporated body such as an association or university. Sharing of data is conditional on giving respondents prior notification of the proposed sharing, and giving them the right to refuse to allow their information to be shared.Footnote 3 Indeed not even the names of objecting respondents are provided to the other party in a share agreement. These agreements have terms and conditions that limit the use of information and provide for security requirements that are equivalent to those employed by Statistics Canada.

In many cases, such an agreement means that the other agency will not have to collect similar information through its own survey. The shared information is used for statistical purposes, except where the other party is authorized by law to require the respondent to provide this information. In such cases, the data are normally used for administrative or regulatory purposes by the other party, who are responsible for the access, use, storage, retention and disposition of the information.

Statistics Canada has standard templates that it uses to formalize data-sharing agreements. Such agreements were developed, and reviewed regularly, in coordination with legal advisors in the Department of Justice to ensure that they meet all legal and policy requirements, including the TBS Guidance on Preparing Information Sharing Agreements Involving Personal Information.

5.3.5 Information on the Statistics Canada website related to consent

The Statistics Canada website provides information related to privacy and consent:

  • privacy notice to survey respondents, clients, third party social media and visitors to the web site, along with contact information for the departmental privacy officer;
  • privacy-related policies and practices at Statistics Canada;
  • what record linkage is and how it is used at Statistics Canada;
  • approved record linkages at Statistics Canada, with their purpose, description and output.

The website provides information about Privacy impact assessments, providing a link to this generic PIA as well as summary descriptions of all approved specific PIAs.

As well, the web site provides "Information for survey participants":

  • the various surveys that Statistics Canada undertakes are listed, and information is provided for each one;
  • what Statistics Canada tells respondents when undertaking a survey;
  • what Statistics Canada asks for in responses to a survey;
  • the assurances that Statistics Canada makes in undertaking a survey.

5.3.6 Children: Obtaining information and seeking consent

Occasionally, Statistics Canada determines that it can best meet the objectives of a specific program by collecting information directly from children. Although circumstances may lead to a different approach in certain situations, the following general approach is used:

  • Children are defined as persons under a survey-specific age;
  • Consent is obtained from a parent or guardian to collect the information from the child;
  • Assent is obtained from the child, and furthermore, the child is told that he/she may choose to not answer any particular question.

Each survey determines its own definition of the age under which a person is considered a child. Factors considered in determining this age are definitions used by other programs, the nature of questions and the nature of the concepts. Overall, the decision aims to divide the survey respondents into those who can best provide the information; in some cases, it will be the person and in other cases it will be that person's parent or guardian.

With respect to seeking consent for data sharing or other statistical operations, Statistics Canada may decide to seek consent from the child or from the parent/guardian, regardless of who will be asked to respond to the survey questions.

Principle 4: Limiting Collection

The authority to collect information for Statistics Canada's statistical programs falls under the Statistics Act. Collection of the information is included in standard Personal Information Banks, listed in Appendix 1 below. Only personal information required for the purpose of the statistical program is collected.

The purposes for which confidential personal and business information is collected are communicated by Statistics Canada at or before the time the information is collected directly from respondents. The collection of confidential information is limited to that which is necessary to meet Statistics Canada's statistical purposes. All surveys undertaken by Statistics Canada are carried out under the authority of the Statistics Act.

An alternative approach to collecting directly from individuals is to use administrative records produced by another organization for their own uses. This alternative is usually a lower cost approach to direct collection, represents no additional response burden, and is used whenever possible if the data quality of the administrative records is sufficiently high for Statistics Canada's use in its statistical programs. Even when quality may not be as high as desired, administrative data may be used. The decision on when to use administrative information may require a decision related to data quality, respondent burden and relative costs.

In most cases, it is necessary for the other organization to transmit the information to Statistics Canada; however, in certain cases, the information is available already on the organization's web site and Statistics Canada may obtain it directly itself.

5.4.1 Statistics Canada Directive on Informing Survey Respondents

It is the policy of Statistics Canada to provide all respondents, prior to or at the time of collection, with information about the purpose of the survey (including the expected uses and users of the statistics to be produced from the survey), the authority under which the survey is taken, the mandatory or voluntary nature of the survey, confidentiality protection, the record linkage plans and the identity of the parties to any agreements to share the information provided by those respondents, where applicable.

5.4.2 Information on the Statistics Canada website related to the collection of confidential personal and business information

The Statistics Canada website contains the following information:

  • how Statistics Canada ensures relevance through consultation with and advice from various groups and individuals;
  • the various stakeholders in Statistics Canada data;
  • how statistical information is used;
  • protection of confidentiality and privacy;
  • what Statistics Canada does and its authority to do so.

The Statistics Canada website contains information for survey respondents:

  • the various surveys that Statistics Canada undertakes are listed, and information is provided for each one;
  • what Statistics Canada tells respondents when undertaking a survey;
  • what Statistics Canada asks for in responses to a survey;
  • the assurances that Statistics Canada makes in undertaking a survey.

Principle 5: Limiting Use, Disclosure and Retention

Statistics Canada will not disclose confidential personal information from its statistical programs without the consent of the respondent or unless as permitted by both the Statistics Act and the Privacy Act. Access to any information obtained under the authority of the Statistics Act is restricted to employees who must swear an oath of confidentialityFootnote 4 under the Act and who also have a need-to-know as part of their job duties.

Statistics Canada uses confidential personal and business information it collects or obtains under the Statistics Act only for statistical, research and analytical purposes, not for administrative purposes.

5.5.1 Statistics Canada Directive on Record Linkage

Statistics Canada recognizes the significant benefits of record linkage in meeting its mandate, while also recognizing the inherent privacy-invasive nature of the activity. Record linkage is a recognized important statistical tool. It results in the generation of a new dataset and new information, of which an individual is usually unawareFootnote 5. The benefits of a specific record linkage may include cost savings, higher data quality as compared to other options to obtain the information, and reduced burden on individuals who otherwise would be asked to supply the information themselves. When used for statistical analysis, record linkage cannot directly impact an individual as by nature, statistical analysis combines information from many individuals.

To achieve an appropriate balance between the statistical benefits and privacy invasiveness, Statistics Canada sets the following conditions for record linkage activities:

  • the purpose of the record linkage activity is statistical (as opposed to administrative) and is consistent with the mandate of Statistics Canada as described in the Statistics Act; and
  • the benefits to be derived from such a linkage are clearly in the broad public interest; and
  • in the case of research projects, the proposed analysis is methodologically sound and the linked dataset and analytical techniques are appropriate for the intended objectives; and
  • the products of the record linkage activity will be released only in accordance with the confidentiality provisions of the Statistics Act and with any applicable requirements of the Privacy Act; and
  • the record linkage activity has demonstrable cost or respondent burden savings over other alternatives, or is the only feasible option; and
  • the record linkage activity is judged not to jeopardize the future conduct of Statistics Canada's programs; and
  • the linkage satisfies a prescribed review and approval process; this includes formal approval by the Chief Statistician and, in cases where the linkage presents additional privacy concerns, review by Statistics Canada's Executive Management Board (its most senior management committee).

The directive recognizes that there are certain record linkage activities that are essential elements of programs and are regularly conducted. These omnibus approvals are not subject to the usual review and approval notice, having been pre-approved by Statistics Canada's Executive Management Board.

The first omnibus approval relates to the economic statistics program. All record linkage activities for this program are covered, except:

  • Linkages that would have significant privacy implications since they involve a high proportion of small and/or unincorporated businesses;
  • All linkage activities of the Agriculture Division;
  • Linkages that involve client-supplied lists of businesses;
  • Linkages that present a significant risk of residual disclosure.

The overriding considerations behind this authority are:

  • No linkage should damage our relationship with the business respondents.
  • No privacy-invasive linkages shall be carried out without a demonstrated public good. Privacy concerns are present when information from unincorporated businesses is linked.
  • If the linkage involves an externally-specified group of businesses, no files are to be linked if the results might harm the interests of that group.

Any linkages not meeting these criteria are not approved.

The second omnibus approval relates to the population and household statistics programs, and to privacy-sensitive economic statistics programs. There are two Parts to this second omnibus approval.

PART A: Linkages whose primary purpose is not to contribute directly to statistical outputs that are disseminated outside Statistics Canada

The purpose of linkages covered in this part is to do one of the following:

  • Obtain information that benefits a survey, such as for stratification in survey design, but that does not directly contribute to estimates;
  • Study and assess survey data quality, for example, by comparing survey data to data from other sources; and
  • Aid in data collection, such as to provide addresses to mail introductory letters or to provide telephone numbers to reduce collection costs by permitting data collection through a telephone interview.

PART B: Linkages whose primary purpose is to contribute directly to statistical outputs that are disseminated outside Statistics Canada

The following types of linkages are approved:

  • Linkage of supplementary surveys to the main survey: This is a situation where a second household survey is designed to use all or part of the sample of another household survey, and to reduce response burden by using content collected in the original survey. This second survey may be collected at the same time as the initial survey or at a later time, but the planned linkage for the second survey must be clearly planned prior to data collection begins for the main survey. Examples of surveys with supplements are the Labour Force Survey (LFS) and the Canadian Community Health Survey (CCHS). Another example is the linkage of the Census of Population data to that for a postcensal survey.
  • Longitudinal surveys: The linkage of survey information for the same individual but collected at different times. This applies to surveys that are designed to be longitudinal, and specified in the prescription order.
  • Linkage of administrative data to survey data when the linkage is clearly defined as part of the survey: This applies to situations where essential survey content is not collected as part of the direct data collection, but is planned to be taken from administrative files. An example is household surveys which do not ask questions on sources and amounts of personal income, but plan to link to income tax files to obtain the required income information.
  • Longitudinal linkage of personal administrative information: This applies to the longitudinal linkage of the same administrative file over time. An example is the Longitudinal Administrative Database (LAD), which links personal income tax files over time. Linkages of different administrative files, either longitudinally or cross-sectionally, are not included.

All linkages not covered by the omnibus linkage authority must follow the prescribed process to obtain approval.

Linkage projects that have been carried out which involve personal information are listed in the annual report to Parliament on the implementation of the Privacy Act. In addition, Statistics Canada also makes summaries of all approved record linkages (not just those involving personal information) available on its website (Statistics Canada)Footnote 6.

5.5.2 Informing respondents of record linkage plans

As part of the communications to persons whose information is requested, Statistics Canada informs respondents that record linkage is a standard tool used in the production of statistical information, and that Statistics Canada undertakes record linkages to meet its program objectives for reasons of greater efficiency and higher data quality. On its web site, Statistics Canada posts summaries of approved record-linkage projects, with the exception of most of the record linkage activities related to the omnibus linkage authorities.

5.5.3 Use of administrative records

The Statistics Act contains a broad provision, set out in section 13, for accessing records held by other organizations, both public and private, where those records are required for purposes of the legislation. Specifically, section 13 details the statutory authority for Statistics Canada to obtain access to records in any department (federal or provincial) or in any municipal office, corporation, business or organization where those records are required for purposes of the Statistics Act.

Statistics Canada's use of records obtained under section 13 is limited to statistical purposes only. It reduces the burden of statistical enquiries on respondents and provides an alternative to the more costly traditional survey-taking activities. At the same time, a major issue that inevitably arises from the use of administrative records for statistical purposes is the issue of privacy. This is because information obtained by one institution for its own purposes (administrative) is used by another institution for a secondary purpose (statisticalFootnote 7), without the knowledge of the individuals to whom the information relates. The privacy concern is mitigated by the fact that the statistical uses of the information do not result in a direct impact on any specific individual.

As well, section 24 of the Statistics Act gives Statistics Canada a specific right of access to federal income tax and excise tax records and section 25, the right of access to import and export records. The manner and times of the Agency's access to these records require the approval of the Governor in Council and are set out in MOUs between Statistics Canada and the Canada Revenue Agency and the Canadian Border Services Agency, respectively. Statistics Canada also has access to corporate tax records by way of the Corporations Returns Act which Statistics Canada administers.

There are also a number of specific provisions in the legislation giving Statistics Canada access to records relating to crime and justice statistics. Section 26 requires officials of criminal justice courts or tribunals to provide information. Similarly, section 27 requires sheriffs and penitentiary and reformatory wardens to provide Statistics Canada with information on prisoners, in the manner directed. Section 28 requires that court officials, sheriffs and wardens who are requested by Statistics Canada to provide information, ensure that they keep records that will enable them to provide that information. Finally, section 29 requires that the Solicitor General of Canada ensure that statistical information on pardons be provided to Statistics Canada.

5.5.4 Information on the Statistics Canada website related to the use of confidential personal and business information

The Statistics Canada website contains information about:

  • the relevance and use of the data;
  • what record linkage is and how it is used at Statistics Canada;
  • approved record linkages at Statistics Canada, with their purpose, description and output.Footnote 8

Under "Information for survey participants" on the Statistics Canada website, there is information about:

  • the various surveys that Statistics Canada undertakes are listed, and information is provided for each one;
  • what Statistics Canada tells respondents when undertaking a survey;
  • what Statistics Canada asks for in a survey;
  • the assurances that Statistics Canada makes in undertaking a survey.

5.5.5 Mandate of Statistics Canada

Statistics Canada collects only information which it uses to meet its mandate.

The Statistics Act provides Statistics Canada with the mandate to collect, compile, analyze, abstract and publish statistical information relating to the commercial, industrial, financial, social, economic and general activities and condition of the people. Data collected are used for statistical, research and analytical purposes, but not for administrative purposes.

5.5.6 Obligation to protect confidentiality

The Statistics Act provides the legal basis for maintaining the confidentiality of personal and business information that Statistics Canada collects. Section 17(1) of the Act requires that:

  1. No unauthorized personFootnote 9 may examine any identifiable information collected under the Act; and
  2. no authorized person may "disclose or knowingly cause to be disclosed any information collected under the Act in such a manner that it is possible to relate the particulars to any identifiable individual person, business or organization".

The Access to Information Act, in section 24, also provides for this confidentiality, recognizing that information collected under the Statistics Act and protected by section 17 of that act cannot be made available to anyone attempting to obtain it using the Access to Information Act.

The Privacy Act also generally protects collected personal information from disclosure. The provisions under subsection 8(2), which permit the disclosure of personal information, without the consent of the individual, cannot be applied in the case of personal information collected under the Statistics Act. Subsection 8(2) of the Privacy Act is subject to other Acts of Parliament, in this case the Statistics Act, and therefore does not take precedence over the specific statutory confidentiality protection found in the Statistics Act.

Statistics Canada will not disclose confidential personal information other than with the consent of the respondent or the original data provider, and as permitted by the Statistics ActFootnote 10. Identifiable personal information is retained only as necessary for the fulfillment of Statistics Canada's mandate and, in the case of Census of Population records, as required by the Library and Archives of Canada Act.

5.5.7 The oath of office

As legally required by Section 6 of the Statistics Act, before taking up duties under the Statistics Act, all employees must take an oath or solemn affirmation that they will conform to the requirements of the Act and will not, without due authority, disclose or make known any confidential information.

5.5.8 Penalties for violations

Employees who contravene the confidentiality provisions of the Statistics Act are subject to prosecution and are liable on summary conviction to a fine and/or imprisonment, as described in sections 30 and 34 of the Statistics Act.

5.5.9 Confidentiality measures at Statistics Canada

The following measures are in place at Statistics Canada to maintain confidentiality in the statistical information the Agency produces and to keep the principle of confidentiality in the forefront of all its employees' consciousness:

  • the Oath of Office, in addition to being a requirement of the Statistics Act, is also designed to impress upon each employee the need for preserving the confidentiality of information;
  • courses for new employees that emphasize confidentiality and mandatory refresher courses of ongoing employees;
  • dissemination of information containing quantity and frequency distributions are subjected to confidentiality edit procedures;
  • all public-use microdata filesFootnote 11 are reviewed by the Microdata Release Committee before their release to ascertain that the files do not contain any information that could lead to the identification of any respondent;
  • the Microdata Release Committee systematically reviews the various disclosure control strategies practiced by program areas in terms of their adequacy and consistency and promotes sound principles and best practices relating to confidentiality and inferential disclosure;
  • Statistics Canada's Disclosure Control Resource Centre provides advice and assistance to Statistics Canada programs on methods of disclosure risk assessment and control; develops disclosure control methods; maintains an inventory of methods for assessing and controlling the risks of disclosure for data products disseminated by Statistics Canada; supports the work of the Microdata Release Committee, particularly with respect to disclosure review procedures; fosters a better appreciation among respondents, data users and the general public of Statistics Canada's disclosure control practices;
  • training is provided to specialists, interviewers and survey managers in the areas of disclosure control, data quality, confidentiality and security;
  • documents on confidentiality are readily available to all employees on Statistics Canada's Internal Communications Network and the Confidentiality Awareness Program website including Statistics Canada's Security Practices Manual and Statistics Canada's Policy Suite;
  • detailed training and relevant documentation is provided to deemed employees working on research projects in an RDC or in CDER;
  • The Statistics Act, the Privacy Act, the Corporations Returns Act, the Access to Information Act and other relevant legislations are available to employees;
  • breaches of confidentiality, should they occur, are reported formally to the Departmental Security Officer as specified in the departmental Information and Privacy Breach Protocol (see section 8 below).

5.5.10 Retention of personal identifiers

It is Statistics Canada's practice to remove personal identifiers from statistical master files when they are no longer required for data processing. If retained for future use, the personal identifiers are to be stored separately from the statistical master file.

In the case of linked files, the requirement to maintain personal identifiers (e.g., name or unique identification number such as health number) is based on need. Linked files will be retained until no longer needed.

5.5.11 Disclosure of confidential personal and business information

The disclosure of confidential personal and business information collected under the Statistics Act is limited to the following circumstances:

Data sharing agreements

Section 11 of the Statistics Act recognizes the special status of provincial and territorial statistical offices that administer their own statistical legislation. It provides the authority for the Minister, with the approval of the Governor in Council, to enter into agreements to share data collected jointly with the statistical agencies of provinces and territories for statistical purposes. Thus, information can be shared with these agencies if (i) respondents were notified at the time of collection, (ii) the agencies has the statutory authority to collect the information on their own on a mandatory basis, (iii) the agencies' confidentiality protection requirements are substantially the same as those of Statistics Canada, and (iv) the Chief Statistician approves the data sharing. Agreements must be in place at the time the information is being collected. In other words, information cannot be shared retroactively.

Section 12 of the Statistics Act provides for the sharing of information, collected for statistical purposes by Statistics Canada, with any federal or provincial/territorial government department, municipal government or other incorporated body such as an association or university. Sharing of data is conditional on giving respondents prior notification of the proposed sharing, and giving them the right to refuse to allow their information to be shared.Footnote 12 Indeed not even the names of objecting respondents are provided to the other party in a share agreement. A respondent's right of refusal to the sharing of information does not apply if the department is authorized by law to require the respondent to provide that information. As is the case for agreements with provincial and territorial statistical agencies, agreements must be in place prior to data sharing. These agreements have terms and conditions that limit the use of information and provide for security requirements.

In many cases, such an agreement means that the other agency will not have to collect similar information through its own survey. The shared information is used for statistical purposes, except where the other party is authorized by law to require the respondent to provide this information. In such cases, the data are normally used for administrative or regulatory purposes by the other party. After Statistics Canada provides the information to the other party, the information is subject to the applicable legislation.

Statistics Canada has standard templates that it uses to formalize data-sharing agreements. Such agreements were developed, and reviewed regularly, in coordination with legal advisors in the Department of Justice to ensure that they meet all legal and policy requirements, including the TBS Guidance on Preparing Information Sharing Agreements Involving Personal Information.

Discretionary disclosure

The Statistics Act (subsection 17(2)) gives discretion to the Chief Statistician to release certain types of identifiable information. This discretion is limited and specific and includes the following types of information:

  • information collected by persons, organizations or government departments for their own purposes and communicated to Statistics Canada as long as the secrecy requirements to which this information was subjected when first collected are adhered to, and an agreement for disclosure is made between the Chief Statistician and the collector;
  • information relating to a person, organization or business if the person, organization or owner of the business consents to the disclosure in writing.

In exercising this discretion, the Chief Statistician is guided by the Directive on Discretionary Disclosure which sets out a review and approval process for all requests for disclosure of information under sub-section 17(2) of the Statistics Act.

According to the Directive on Discretionary Disclosure, the Chief Statistician may authorize disclosure when:

  • the information is needed for statistical or analytical purposes; and
  • the information released does not disadvantage Statistics Canada's respondents and does not harm the relationship between the Agency and its respondents.

Ultimately, it is only the Chief Statistician who can authorize disclosure and then, only within the limits set out in sub-section 17(2) of the Statistics Act. By law, the Chief Statistician must sign an Order to authorize the disclosure.

Work-in-progress and Advanced Release

Work-in-progress datasets, analytical products and information products may be provided in advance of official release by Statistics Canada to designated individuals of external organizations for the purposes of data validation. These are cases where it can be shown that the receiving individual or organization is qualified to provide the required validation, and where significant benefits to data quality are anticipated or have been previously demonstrated.

Work-in-progress datasets may contain personal informationFootnote 13, whereas analytical products and information products do not.

When providing work-in-progress data to external organizations for data validation, divisions are required to provide only the information that requires validation for a pre-established review period that is as brief as possible. The method of providing advance release information to external organizations must meet Statistics Canada's security requirements for transmission of sensitive statistical information.

Organizations receiving protected release information from Statistics Canada must:

  • safeguard the confidentiality of the protected release information provided to them;
  • limit access to the protected information to those designated officials within their organizations for work-related purposes ('need-to-know' basis);
  • undertake not to further disseminate the protected release information;
  • destroy the protected information once the review is completed, prior to official release.

Advance release of the text of an official release may occur under certain specific and restrictive situations. Texts of official release do not contain personal information, so there are no privacy risks associated with advanced release.

5.5.12 Access to confidential information by researchers as deemed employees of Statistics Canada

The Statistics Act permits Statistics Canada to use the services of persons outside Statistics Canada to carry out any function or perform work pursuant to the Statistics Act. Such persons are considered to be "deemed employees" of Statistics Canada. One area where Statistics Canada employs deemed employees is in conducting statistical research that requires access to confidential microdata. Such access is subject to Statistics Canada's Directive on the Use of Deemed Employees.

Located in most Canadian universities, Research Data Centres (RDCs) provide researchers with access, in secure premises, to microdata from population and household surveys, as well as to certain administrative datasets. The centres are staffed by Statistics Canada employees. They are operated under the provisions of the Statistics Act in accordance with all the confidentiality rules and are accessible only to researchers with approved projects who have been sworn an oath under the Statistics Act as deemed employees.

Similar to a RDC, the Statistics Canada Canadian Centre for Data Development and Economic Research (CDER) provides access to business microdata. The centre is located within Statistics Canada's Head Office. Deemed employees are not permitted to examine individual microdata, and work closely with a Statistics Canada employee to meet the objectives of the research project. The business microdata, particularly those for large firms, are considered to require this additional protection.

5.5.13 Real Time Remote Access (RTRA)

Another approach to provide researchers with access to detailed microdata is the Real Time Remote Access (RTRA) Application, already used by a number of other statistical agencies throughout the world. This application is essentially an on-line remote access facility allowing users to run, in real time, data analyses on microdata or lightly masked microdata sets, defined as confidential under the Statistics Act, that are kept in a central and secure location under the control and care of Statistics Canada, with the output vetted for confidentiality.

A limited number of researchers in other federal government departments are issued a username and password so they can remotely submit SASFootnote 14 programs to a secure Statistics Canada server. The submitted job requests use a modified version of SAS that will place limits on their requests and the subsequent outputs. Before being sent back to these researchers, results will be vetted to prevent disclosure of confidential information.

5.5.14 Retention of statistical information

As part of its Information Management program, Statistics Canada has a directive and a guideline that address the retention of statistical information:

  • Directive on the Management of Statistical Microdata Files
  • Guideline on the Management of Statistical Microdata Files and Aggregate Statistics

Generally, target retention periods are assigned to different types of statistical information. On an exception basis, a different retention period may be assigned when the information is created. Statistical information is disposed of once it has served its purpose or its retention period has expired.

The general philosophy is that information is retained only as long as is operationally required. With only a few exceptions, all files types have very short retention periods (a few years). Specifically two types of files have longer retention periods:

  • Internal master (analytical) files with direct personal identifiers removed: Indeterminate. With very few exceptions, these files never lose their statistical value. Their use is governed by the Statistics Act and supported by Statistics Canada's policies and procedures to protect the information.
  • Identifier files (Files containing direct identifiers that have been separated from statistical information): Retain as long as operational requirements remain. In many cases, this information is used only to support contacting individuals to collect information. In the case where future studies are planned that require the use of direct identifiers, very specific security procedures apply. The files containing direct identifiers are stored in Statistics Canada Head Office, and access to these files is limited to only a few people for work-related purposes.

Principle 6: Accuracy

To the extent possible, managers of statistical programs follow standard procedures that adhere to Statistics Canada's policy suite related to the accuracy of personal information.

The accuracy of information collected under the Statistics Act is dependent on our survey respondents and data providers. It is important to remember, however, that unlike other government departments that may use confidential personal or business information to make decisions, for example on eligibility for benefits, Statistics Canada uses information to produce statistical aggregates that are then disseminated for statistical, analytical and research purposes.

Statistical programs have edit and corrections processes to collected data to ensure accuracy for statistical purposes.

In cases where respondents request corrections to information they have provided to Statistics Canada, the Agency will consider these on a case-by-case basis. It is important to remember, however, that once individual survey responses are received and processed, it would not be possible to locate specific records of individuals after names or other identifiers have been removed from the survey file. As well, there may be other situations where the copy of the original records exists in a format that does not permit changes to be made (for example, microfilm, in the case of historical census records).

Starting with the 2006 Census, Canadians were given the opportunity to decide whether they will allow their personal census records to be made public 92 years after the census. Census records will be made public only when consent has been given. In cases where someone later decides to change their response, Statistics Canada will accept any such request. There is no time limit on when such a request will be accepted, up to the point at which the information is released.

5.6.1 Statistics Canada's commitment to quality

Given the widespread use of its data by the Canadian public and media, various levels of government, businesses and labour unions, the academic sector, foreign and international bodies, Statistics Canada strives to build quality into all its programs and products. Its quality assurance framework identifies six primary elements of quality: accuracy, relevance, timeliness, accessibility, interpretability and coherence.

To help ensure the accuracy of the confidential personal and business information that it collects from respondents, Statistics Canada has in place the following policies, guidelines and practices:

  • requirements for the testing of new and revised questionnaires in both official languages before implementation and for the periodic evaluation of questionnaires used in ongoing surveys (Policy on the Review and Testing of Questionnaires);
  • consultation with interviewers to identify problem areas where questionnaires can be improved (Policy on the Review and Testing of Questionnaires);
  • the adoption of standard concepts and definitions for the collection of data and consistent collection and processing methods for the production of statistical data across surveys (Policy on Standards);
  • quality guidelines for all its statistical projects, including activities related to the specification of objectives and uses in consultation with users, questionnaire design, data collection operations, editing of data records that are potentially in error and data quality evaluation (Quality Guidelines).

Principle 7: Safeguarding Personal Information

Statistics Canada takes seriously its legal obligation to safeguard the personal information of all Canadians. Therefore, for many years, the Agency has had in place a framework of policies, directives, procedures and practices to protect confidential information, including personal information, against loss, theft, unauthorized access or disclosure; they are supported by physical, organizational and technological measures that protect all the personal information that Statistics Canada holds.

Statistics Canada's Security Practices Manual details required specific administrative, physical and technical safeguards against loss or theft, unauthorized access or use of personal information. The Directive on the transmission of protected information describes security procedures that are necessary when transmitting confidential information into and out of Statistics Canada's Head Office.

5.7.1 Technology and privacy issues

Program managers must:

  • identify any changes to the business requirements that have an impact on the system, software of program application and, consequently, may affect the current access controls and privacy practices related to the creation, collection, retention, use, disclosure and disposition of personal information, and implement changes as deemed necessary.
  • Determine whether the current IT legacy systems and services that will be retained or those that will be substantially modified are compliant with privacy requirements, and implement changes as deemed necessary.
  • Develop and implement, for program staff, awareness activities related to the protection of privacy requirements in the new electronic environment.

5.7.2 Legal obligation to protect confidentiality

The Statistics Act provides the legal basis for maintaining the confidentiality of personal and business information that Statistics Canada collects. Section 17(1) of the Act requires that:

  1. No unauthorized personFootnote 15 may examine any identifiable information collected under the Act; and
  2. no authorized person may "disclose or knowingly cause to be disclosed any information collected under the Act in such a manner that it is possible to relate the particulars to any identifiable individual person, business or organization".

5.7.3 The oath of the office

Before taking up duties under the Statistics Act, all employees must take an oath or solemn affirmation that they will conform to the requirements of the Act and will not, without due authority, disclose or make known any confidential information.

5.7.4 Penalties for violations

Any actions that contravene the security policies of the Government of Canada or Statistics Canada could lead to administrative, disciplinary or statutory penalties when misconduct or negligence is involved. The nature of the penalties will depend on the nature of the offence. Employees who contravene the confidentiality provisions of the Statistics Act are subject to prosecution and are liable on summary conviction to a fine and/or imprisonment.

5.7.5 Security measures at Statistics Canada

The following describes some of the security measures in place at Statistics Canada to maintain a secure environment and to keep the principle of security in the forefront of all its employees' and deemed employees' consciousness:

  • access to Statistics Canada buildings is controlled by a combination of physical measures and access procedures;
  • all external visitors are escorted to the work area, accompanied while in the work area, and escorted back to the building entrance at the end of the visit;
  • employees' and visitors' identification cards must be visible at all times;
  • all staff undergo a reliability check;
  • only those Statistics Canada employees with a "need to know" have access to confidential information and then only to that information required for them to do their job;
  • within Statistics Canada, inter-divisional access to confidential information must be approved by the director of the division holding the information;
  • disposal of confidential information is carried out under secure conditions according to government-approved procedures;
  • non-computerized confidential data are stored in security-approved containers;
  • Statistics Canada's IT Security Policy outlines the safeguards the Agency has put in place to ensure that its information systems are kept secure, including:
    • data processing and communications networks are configured to prevent physical and electronic access to confidential information from outside Statistics Canada's facilities;
    • access to files is protected through access controls, passwords and servers located in access-controlled areas;
    • communications between Statistics Canada locations are facilitated through the use of secure data transmission lines and services specifically approved for that purpose;
    • computing devices with external wireless connections may not be connected to any Statistics Canada network;
    • electronic transmission of confidential information under specific special circumstances must adhere to approved security procedures;
    • transmission of microdata files containing confidential information to Statistics Canada Regional Offices, Research Data Centres or to data-sharing partners must follow approved security procedures; such information must be encrypted;
    • storage of confidential information on any removable storage media must follow approved security procedures; such information must be encrypted;
  • confidential information may not be taken out of Statistics Canada's secure premises;
  • after they are no longer required for data processing, direct personal identifiers are removed from statistical master files;
  • breaches of security are reported formally to the Departmental Security Officer, who will implement the departmental Information and Privacy Breach Protocol.

Information on security is readily available to all employees on Statistics Canada's Internal Communications Network.

Principle 8: Openness

Statistics Canada makes readily available specific information about its policies and practices relating to the management and protection of personal information. Information regarding the use of personal information in the form of a Privacy notice can be found on the agency's website at Statistics Canada.

Summaries of approved Privacy Impact Assessments are also available from the website.

5.8.1 Statistics Canada Directive on Informing Survey Respondents

It is the policy of Statistics Canada to provide all respondents with information about: the purpose of the survey (including the expected uses and users of the statistics to be produced from the survey), the authority under which the survey is taken, the mandatory or voluntary nature of the survey, confidentiality protection, the record linkage plans and the identity of the parties to any agreements to share the information provided by those respondents, where applicable. This information is communicated to respondents in different modes, depending on the survey. All information is available on the Statistics Canada web site.

5.8.2 Information on the Statistics Canada website related to policies and procedures

On the Statistics Canada website, there is information about:

  • protecting confidential information and privacy at Statistics Canada;
  • privacy-related policies and practices at Statistics Canada;
  • what record linkage is and how it is used at Statistics Canada;
  • Statistics Canada's Record Linkage Directive;
  • approved record linkagesFootnote 16 at Statistics Canada, with their purpose, description and output.

Under Information for survey participants on the Statistics Canada website, there is information about:

  • the various surveys that Statistics Canada undertakes, and information is provided for each one;
  • what Statistics Canada tells respondents when undertaking a survey;
  • what Statistics Canada asks for in a survey;
  • the assurances that Statistics Canada makes in undertaking a survey.

5.8.3 Info Source: Sources of Federal Government information

As required by the Privacy Act, all Statistics Canada surveys that collect and retain personal information in identifiable form are registered as personal information banks and are included in Info Source: Sources of Federal Government Information. Info Source contains the identification and description of the personal information bank, its registration number, a description of the group of individuals to whom personal information contained in the bank relates, the name of the government institution that has control of the bank, the purposes and consistent uses of the information bank, the retention and disposal standards applied to information in the bank and the contact person to whom requests relating to personal information should be sent. See Appendix 1 for specific details on Statistics Canada's specific personal information banks related to its statistical operations. Requests about personal information held by Statistics Canada should be directed to Statistics Canada's Access to Information and Privacy Coordinator as noted in Principle 9.

5.8.4 Record linkage activities

Linkage projects that have been carried out which involve personal information are listed in the annual report to Parliament on the implementation of the Privacy Act. In addition, a list of all approved record linkages at Statistics CanadaFootnote 17, with their purpose, description and output, is available on the Statistics Canada website.

5.8.5 Partnerships

Consultation with stakeholders, users, experts and advisory groups is an integral part of the planning and development of Statistics Canada surveys. The National Statistics Council advises the Chief Statistician of Canada on the full range of Statistics Canada's activities, particularly on overall program priorities. A network of Professional Advisory Committees in major subject areas ensures the continuous review of the Agency's statistical outputs and helps set priorities and foster program relevance. Statistics Canada also maintains, on a continuing basis, a close bilateral relationship with key federal departments and agencies to foster an awareness of each department's needs and their information priorities. The Federal-Provincial-Territorial Consultative Council on Statistical Policy, and its subcommittees, comprises a network of 13 provincial/territorial official representatives who collaborate with Statistics Canada to determine data requirements, consult on current statistical activities and coordinate the dissemination of Statistics Canada products to provincial and territorial governments.

Principle 9: Individual Access

The Privacy Act provides the right of every individual to be given access to any personal information about that individual contained in a personal information bank, and any other personal information about that individual under the control of a government institution. Where the personal information is used for administrative purposes, the individual is entitled to request correction of the error or omission. However, as the personal information collected from survey respondents is not used for administrative purposes at Statistics Canada and can never be used to make a decision about the individuals to whom the information relates without their consent, it is rare that individuals will request corrections to the personal information that they provided to Statistics Canada. Where possible, Statistics Canada accommodates requests to change personal information.

The collection of personal information through one of Statistics Canada's statistical programs falls under one of the specific personal information banks. The Personal Information Banks and a description for each one are published in Statistics Canada's Info Source chapter. After the need for direct personal identifiers is no longer present, direct personal identifiers are deleted. This means that usually the information for a specific individual is not retrievable, and the information is no longer covered under a PIB.

Upon request, Statistics Canada will provide individuals or businesses with access to their confidential personal or business information, where that information is held in identifiable form.

Requests for access are to be made in writing to Statistics Canada with the specific personal information bank identified or with sufficiently specific information provided on the location of the information. To locate a statistical record, Statistics Canada requires, in most cases, not only an identifier, but also additional information such as the time period in which the individual responded to a survey, the title of the survey or his/her street address.

Requests may be made in either official language and access is to be given in that language, if the personal information already exists in that language. Where the personal information does not exist in that language, it is translated or interpreted if necessary for the individual to be able to understand the information. Where required, access is to be given in an alternative format.

To access one's own personal information under the Privacy Act, a formal request may be made to:

Linda Howatson-Leo
Access to Information and Privacy Coordinator
R.H. Coats Building, 2nd Floor
100 Tunney's Pasture Driveway
Ottawa, Ontario K1A 0T6
Telephone: 613-951-0466
statcan.atip-aiprp.statcan@canada.ca

Principle 10: Challenging Compliance

An individual is able to address a challenge concerning compliance by Statistics Canada with the above principles.

Complaints may be addressed to:

Linda Howatson-Leo
Access to Information and Privacy Coordinator
R.H. Coats Building, 2nd Floor
100 Tunney's Pasture Driveway
Ottawa, Ontario K1A 0T6
Telephone: 613-951-0466
statcan.atip-aiprp.statcan@canada.ca

In addition, under the Privacy Act, individuals may make a complaint to the Office of the Privacy Commissioner of Canada, who may undertake an investigation.

Footnotes:

Footnote 1

As defined in the TBS Policy on Privacy Protection, the term "administrative purposes" is defined as the use of personal information about an individual "in a decision making process that directly affects that individual" (section 3). This includes all uses of personal information for confirming identity (i.e. authentication and verification purposes) and for determining eligibility of individuals for government programs. Non-administrative purposes are the use of personal information for a purpose that is not related to any decision-making process that directly affects the individual. This includes the use of personal information for research, statistical, audit and evaluation purposes.

Return to footnote 1 referrer

Footnote 2

In essence, the provincial and territorial statistical agencies are permitted to obtain confidential information pursuant to Section 11 to use for their own statistical purposes. All other organizations, including private organizations are legally permitted to obtain confidential information pursuant to Section 12. The key difference is that consent is required to receive information pursuant to Section 12, but not for Section 11.

Return to footnote 2 referrer

Footnote 3

In practice, Statistics Canada seeks consent for data sharing of personal information from its respondents, rather than give them the right to refuse.

Return to footnote 3 referrer

Footnote 4

This oath of confidentiality lasts for the person's lifetime, not just as long as he or she is an employee of Statistics Canada.

Return to footnote 4 referrer

Footnote 5

Summaries of approved record linkage projects are posted on the Statistics Canada web site.

Return to footnote 5 referrer

Footnote 6

Linkages falling under the omnibus authorities for the economic statistics program and Part A of the household statistics program are not provided on the Statistics Canada web site, since the privacy risk is low.

Return to footnote 6 referrer

Footnote 7

This includes record linkage activities.

Return to footnote 7 referrer

Footnote 8

Record linkages conducted under the omnibus provisions of the Record Linkage Directive are not posted on the web site.

Return to footnote 8 referrer

Footnote 9

The Statistics Act describes the conditions that must be met to obtain authorization to access the information. Within the federal government, confidential information is designated as Protected B, meaning that individuals must respect the requirements for this level of information, including undergoing a personal security review. Finally, Statistics Canada procedures require that persons may only access information for which they have a work-related "need to know".

Return to footnote 9 referrer

Footnote 10

Such situations are described in Section 5.5.11 of this document.

Return to footnote 10 referrer

Footnote 11

Public-use microdata files are data files of individuals that are available for public use. Prior to their release, these files must meet the confidentiality requirements of the Statistics Act. This requires the removal of all direct identifying information, such as name, address and Social Insurance Number. As well, certain combinations of information may not be released if they could lead to the identification of an individual whose information is on the file.

Return to footnote 11 referrer

Footnote 12

In practice, Statistics Canada seeks consent for data sharing of personal information from its respondents, rather than give them the right to refuse.

Return to footnote 12 referrer

Footnote 13

In such cases, information is released only as permitted by the Statistics Act (i.e., data-sharing agreement, discretionary disclosure).

Return to footnote 13 referrer

Footnote 14

SAS is a statistical analysis software.

Return to footnote 14 referrer

Footnote 15

The Statistics Act describes the conditions that must be met to obtain authorization to access the information. Within the federal government, confidential information is designated as Protected B, meaning that individuals must respect the requirements for this level of information, including undergoing a personal security review. Finally, Statistics Canada procedures require that persons may only access information for which they have a work-related "need to know".

Return to footnote 15 referrer

Footnote 16

Record linkages conducted under the omnibus provisions of the Record Linkage Directive are not posted on the web site.

Return to footnote 16 referrer

Footnote 17

Record linkages conducted under the omnibus provisions of the Record Linkage Directive are not posted on the web site.

Return to footnote 17 referrer

Date modified: