Chapter 4.6: Respecting privacy and protecting confidentiality

1. Mandatory obligations of employees

Employees at Statistics Canada are asked to swear an oath of secrecy to make each employee fully aware and liable in terms of protecting confidentiality.

Taking an oath of secrecy under the Statistics Act is a requirement for to all employees of Statistics Canada and to persons “deemed to be employees” (according to the Statistics Act). Employees who swear in by affirming this oath promise to fulfill their duties by agreeing to respect the confidentiality requirements of the Statistics Act. Of key importance is the promise never to disclose identifiable information about any individual person, business or organization that employees learn of while undertaking their duties. This oath lasts a lifetime. Even after leaving the employment of Statistics Canada, persons must remain faithful to the oath and maintain the confidentiality of any statistical information to which they had access. Persons are liable to the penalties outlined in the Statistics Act (fines and/or imprisonment) or other sanctions that could lead to and include termination of employment if they break the oath. Refer to Box 4.6.1 (at the end of this chapter) for the wording of Statistics Canada's oath of secrecy.

2. Training

Statistics Canada has taken measures to improve its training in the areas of privacy, confidentiality and security. Flagship training courses that are mandatory for specific groups of employees contain a module on these three topics. The orientation course that all new employees must also attend includes basic training on confidentiality and security.

To address the needs of not only all new employees, but also those in the professional streams, a computer-based training module has been developed. This course is delivered to employees when they receive their user identification (ID) card for the computer system. It takes only 20 minutes to complete and it covers all the basic information on confidentiality, privacy, network use, IT security, physical security, fire safety and building evacuation practices. This course must be retaken periodically when employees renew their ID cards.

3. Strong culture of respect for the need for privacy and confidentiality

Statistics Canada is known for its strong traditions of respect for privacy and protection of confidentiality.

Directors from statistical program areas play a very important role and have direct responsibility for controlling and protecting all sensitive statistical information obtained by their respective work units in fulfilling their program objectives. For example, they must ensure that appropriate control measures regarding access to confidential microdata files are in place in their divisions. They must also determine the need to retain identifiable files and ensure that such files are referenced as required under the Privacy Act and the Access to Information Act.

4. Physical security

The Government of Canada's approach to physical security measures is to design and manage environments or facilities with specific physical security safeguards.

Physical security is implemented at various levels across the agency. The extent to which physical security measures are applied in a given work area will vary according to operations, location, type, and the nature of work, and any other factors bearing on the general work environment.

• Identification cards
  
  Electronic identification cards are issued to all employees and contractors of Statistics Canada, as well as all other employees of departments that occupy space in Statistics Canada headquarters.
  
  The electronic identification card has an expiry date (usually three years from the date issue for indeterminate employees). Prior to the card's expiry, employees are required to report to the Departmental Security Office to have their card updated to continue their access to the agency's buildings. The electronic identification card is required to enter Statistics Canada premises and it is to be visibly worn by all employees at all times.
• Areas with restricted access
  
  All three buildings at headquarters are designated as restricted-access areas, which means that safeguards are in place that will allow access to authorized personnel only. In the regional offices, restricted areas are designated in accordance with operational requirements.
  
  Security personnel are hired to protect the health and safety of employees and to safeguard departmental assets and information. Specifically, a security guard's duties include reception, building access control, patrol and escort functions, monitoring of alarm/video- and life-safety systems, and emergency response.
• Building controls and access
  
  All perimeter doors are equipped to monitor unauthorized entry or departure. These doors are to be used only in the event of a building emergency or during a scheduled building evacuation. Employees who use these doors without proper authority are subject to disciplinary action.

5. Information technology security

Information technology (IT) security addresses the protection of information during collection and transaction input, transmission, processing, storage, retrieval, output and disposal. It also includes the protection of IT systems and facilities. This protection is achieved using technical, procedural and administrative procedures and practices. Collectively, these procedures and practices are designed to prevent, detect potential loss, and enable recovery from damage to the confidentiality, integrity and availability of the agency's data, systems and facilities.

Statistics Canada has always maintained a very strict code of IT security by implementing and maintaining the following measures:

• Agency Network Use Policy
  
  All employees are required to read and accept the Network Use Policy as a condition of receiving their computer user account. In addition, they are required to sign, three times a year, a reaffirmation that indicates their understanding of the policy and acknowledges that they will follow its requirements. This policy governs their use of the IT system and covers issues such as acceptable use of email and the Internet, as well as virus protection.
• Controlled access to the database system
  
  The agency manages the various accesses through to the Corporate Access Request System (CARS), which is used to automate and control employees' access to data, applications and after-hours buildings.
• Virus protection
  
  Serious viruses can cause havoc to an information-based organization. The most up-to-date detection, isolation and irradiation methods must be in place along with employee awareness and compliance with the virus prevention and protection protocols. Statistics Canada IT staff and employees are very vigilant in this matter as data reliability, integrity and confidentiality are at risk in an event of a serious virus attack.
  
  All Statistics Canada employees must consider privacy and confidentiality when choosing email as a means of communication. The agency's email system does not currently provide security features such as encryption to protect email messages or attachments during transmission. However, confidential information can be shared through an electronic-file-transfer platform, if necessary.

6. Disclosure control

Disclosure control measures are designed to ensure that the confidentiality protection commitment of statistical organizations is met while preserving the usefulness of data outputs to the greatest extent possible. These mechanisms are usually applied as indicated below:

• During data collection and data processing, there are separation between the direct identifiers and the statistics provided; personal data and questionnaires are kept secure, and later destroyed after a required length of time.
• Prior to publishing aggregated data, information is suppressed if the number of respondents allows easy disclosure of individual data; use of standard software for checking tabulations is used; and a review is conducted by authorized staff of all data prepared for publication and possible disclosure.
• When releasing individual data, all applications must be examined in relation to access to confidential data requirements by the Disclosure Review Committee; the release of individual data are authorized as anonymized microdata only for research purposes; and releases must limit geographic detail, the number of variables, recoding and sampling.

The Disclosure Review Committee was established to share best practices across the program areas. Furthermore, the increase in the amount and complexity of analyses being undertaken—mostly through research data centres—has created new challenges for disclosure control.

Under specific circumstances, the Chief Statistician is the only official who may, by order, authorize the disclosure of confidential data, as stated in the Statistics Act.

7. Control over record linkage

According to the Directive on Record Linkage, record linkage is defined as combining two or more microrecords to form one composite record containing information about the same entity. Record linkage is an important technique used in the development, production, analysis and evaluation of statistical data. This technique reduces respondent burden because it does not make it necessary to go back to a respondent to collect the information.

Record linkage can be undertaken at Statistics Canada for research and statistical purposes only, and the linkage must lead to benefits that serve the public interest. It must also be clear how the proposed methodology could lead to results that, in turn, could be implemented to address important public issues.

Record linkage has always dealt with a balance between the competing public goods of privacy protection and the value of the information that can be delivered through linkage. Given the wide scope of record linkage within a centralized statistical system, particularly one with Statistics Canada's broad access to data holdings of other departments, the agency developed a multi-level review procedure, as well as extensive ongoing consultation mechanisms with stakeholders and the Office of the Privacy Commissioner. All linkages must be approved by the Executive Management Board, chaired by the Chief Statistician.

8. Privacy impact assessments

A privacy impact assessment (PIA) is an evaluation that looks at privacy, confidentiality and security risks associated with the collection, use or disclosure of personal information. PIAs help program areas develop measures to mitigate or eliminate the identified risks. All PIAs are to be sent to the Office of the Privacy Commissioner.