Questions and responses 42nd Parliament, 1st session December 3, 2015, to September 11, 2019

With regard to classified or protected documents, since November 4, 2015, broken down department or agency: (a) how many instances have occurred where it was discovered that classified or protected documents were left or stored in a manner which did not meet the requirements of the security level of the documents; (b) how many of these instances occurred in the offices of ministerial exempt staff, including those of the staff of the Prime Minister, broken down by ministerial office; and (c) how many employees have lost their security clearance as a result of such infractions?

With respect to data, information, or privacy breaches in government departments, institutions and agencies for 2015: (a) how many breaches have occurred in total, broken down by (i) department, institution, or agency, (ii) number of individuals affected; (b) of those breaches identified in (a), how many have been reported to the Office of the Privacy Commissioner, broken down by (i) department, institution or agency, (ii) number of individuals affected; and (c) how many breaches are known to have led to criminal activity such as fraud or identity theft, broken down by department, institution or agency?

With regard to the 2016 Census: (a) has all personal data collected from Canadians thus far been handled in a safe and secure manner; (b) how many additional resources have been dedicated to follow up on those who have not completed the Census yet; (c) have any census workers raised concerns with regard to their safety or the safety of the data they have collected from the public; (d) has the government moved forward with prosecuting any individuals for failing to respond to the 2016 request; and (e) what is the final date for those who have not completed the 2016 Census to do so before facing prosecution?

With respect to data, information, or privacy breaches in government departments, institutions, and agencies for 2017 and 2018 to date: (a) how many breaches have occured in total, broken down by (i) department, institution, or agency, (ii) number of individuals affected by the breach; (b) of those breaches identified in (a), how many have been reported to the Office of the Privacy Commissioner, broken down by (i) department, institution, or agency, (ii) number of individuals affected by the breach; and (c) how many breaches are known to have led to criminal activity such as fraud or identity theft, broken down by department, institution, or agency?

With regard to privacy breaches, since September 19, 2016, broken down by department, agency, Crown corporation, or other government entity: (a) how many privacy breaches have occurred; and (b) for each privacy breach, (i) was it reported to the Privacy Commissioner, (ii) how many individuals were affected by each breach, (iii) what were the dates of the privacy breach, (iv) were the affected individuals notified that their information may have been compromised and, if so, on what date and in what manner were they notified, (v) what was the incident summary or nature of the breach?

With regard to the personal information collected through the mydemocracy.ca website by Vox Pop Labs: (a) what are the authorized uses of this information; (b) what is considered to be (i) authorized, (ii) unauthorized, (iii) access, (iv) use, (v) modification, (vi) disclosure; (c) who has the authority to determine which uses can be authorized; (d) with respect to retention of personal information, (i) for which purposes and legal requirements will the information be retained, (ii) what is the estimated time it will take to meet these purposes and legal requirements, (iii) will the information be destroyed if these purposes and legal requirements are met, (iv) is there a maximum time that the information can be retained, (v) does the government have a means of ensuring that the information is destroyed after a reasonable time; and (e) with respect to the data collected, as related to electoral reform, what is the relevance accorded to (i) education, (ii) occupation, (iii) combined household income, (iv) interest in politics, (v) interest in current affairs?

With regard to privacy breaches since November 4, 2015, broken down by department, agency, crown corporation, or other government entity: (a) how many privacy breaches have occurred; and (b) for each privacy breach, (i) was it reported to the Privacy Commissioner, (ii) how many individuals were affected by each breach, (iii) what were the dates of the privacy breach, (iv) were the individual affected notified that their information may have been compromised, and if so, on what date and by what manner were they notified?

With regard to government data held on servers physically located outside of Canada as of September 25, 2017, broken down by department, agency, Crown corporation or other government entity: (a) which departments, agencies, Crown corporations, or other government entities had data held on servers located outside of Canada; (b) what is the highest security level (secret, top secret, etc.) of documents or data which is located on the servers; (c) where are the servers located; (d) which company owns the servers; (e) which company operates the servers, if different from (d); and (f) how is the Security of Information Act or other relevant laws regarding classified information enforced when classified information is held outside of Canada?

With regard to classified or protected documents, since January 1, 2016, broken down by department or agency, and broken down by year: (a) how many instances have occurred where it was discovered that classified or protected documents were left or stored in a manner which did not meet the requirements of the security level of the documents; (b) how many of these instances occurred in the offices of ministerial exempt staff, including those of the staff of the Prime Minister, broken down by ministerial office; and (c) how many employees have lost their security clearance as a result of such infractions?

With regard to classified and protected documents, since January 1, 2017, broken down by department or agency: (a) how many instances have occurred where it was discovered that classified or protected documents were left or stored in a manner which did not meet the requirements of the security level of the documents; (b) how many of the infractions in (a) occurred in the offices of ministerial exempt staff, including the staff of the Prime Minister, broken down by ministerial office; and (c) how many employees have lost their security clearance as a result of such infractions?

With regard to the storage of classified or protected documents since September 19, 2016, and broken down by department or agency: (a) how many instances have occurred where it was discovered that classified or protected documents were left out or stored in a manner which did not meet the requirements of the security level of the documents; (b) how many of these instances occurred in the offices of ministerial exempt staff, including staff of the Prime Minister, broken down by ministerial office; and (c) how many employees have lost their security clearance as a result of such infractions?

With regard to concerns raised by the Privacy Commissioner of Canada about information shared on Facebook: (a) what specific safeguards does each department and agency have in place to ensure that information individuals share with government entities on Facebook is not exploited; (b) does any government department or agency collect information obtained through Facebook, including on interactions individuals have with the government on Facebook and, if so, what are the details, including (i) type of information collected, (ii) number of individuals who have had information collected since January 1, 2016; and (c) what specific action, if any, has each department or agency taken to safeguard information since the concerns were raised by the Commissioner?

With regard to Statistics Canada and specifically the incident described in the March 11, 2018, CBC story, where 587 long-form census forms were stored in the trunk of an employee's vehicle that was stolen on a weekend trip to Montreal: (a) were the completed census forms ever recovered and, if so, when; (b) were the individuals whose information was stolen notified about the incident and, if so, when and how; (c) did the Statistics Canada employee who left the forms in his trunk violate any government policies or procedures and, if so, which ones; and (d) what specific changes have been made to the manner in which census information is stored as a result of this incident?

With respect to the acquisition and retention of data, including associated data, metadata, bulk data, or any other kind of data by the Canadian Security Intelligence Service (CSIS): (a) how many internal data repositories does CSIS have access to; (b) what are the different kinds of internal data repositories to which CSIS has access; (c) are there any data repositories that have been accessed by CSIS, whether internal or external, that are housed within servers that do not belong to CSIS; (d) what is the difference, according to CSIS, between the terms “associated data” and “metadata”; (e) what is the exhaustive list of organizations with which CSIS shares information, including bulk data, metadata, associated data and any other data to which CSIS has access; (f) what is the exhaustive list of organizations, including telecommunications companies, financial institutions, government departments, and other organizations, with which CSIS communicates for purposes other than the sharing of information; (g) when were Cabinet Ministers informed of CSIS’s collection of bulk data, and in relation to their notification, (i) who were those Ministers, (ii) what were the forms of communication through which they were informed, (iii) what were the dates on which each Minister was informed, starting from January 1, 2006, until December 31, 2016, inclusively; (h) when were Cabinet Ministers informed of the methodologies employed by CSIS for the purpose of the collection of bulk data, (i) who were those Ministers, (ii) what were the forms of communication through which they were informed, (iii) what were the dates on which each Minister was informed, starting from November 4, 2015, until the present time; (i) with respect to the bulk data that CSIS has collected or otherwise has or has had access to, does it include (i) communications metadata, (ii) travel information, (iii) passport data, (iv) law enforcement wiretaps, (v) arrest records, (vi) financial transactions, (vii) information collected from social media, (viii) medical data, (ix) other kinds of bulk data that CSIS has access to; (j) what are the descriptions of all the different methods through which this bulk data is collected; (k) what is the exhaustive list of sources of bulk data that CSIS has access to, and how many times was bulk data collected starting from January 1, 2006, until December 31, 2016, inclusively; (l) how many judicial warrants were given to CSIS for the purpose of the acquisition of bulk data starting from January 1, 2006, until December 31, 2016, inclusively, and when were these warrants received by CSIS; (m) how many (i) telecommunications companies, (ii) financial institutions, (iii) medical institutions, (iv) airports, (v) other companies, were compelled or requested to provide access to bulk data, associated data, metadata or any other kind of data to CSIS; (n) what kinds of leverage did CSIS employ in order to request or compel the acquisition of data from external data suppliers, (i) how many judicial warrants were obtained by CSIS for the collection of such data from private entities, (ii) has CSIS ever collected or had access to any such data without obtaining judicial warrants beforehand; (o) how many government departments or agencies were compelled or requested to (i) transfer bulk data, associated data, metadata or any other kind of data to CSIS, (ii) grant access to such data to CSIS, starting from January 1, 2006, until December 31, 2016, inclusively; (p) how many judicial warrants were obtained by CSIS for the collection of such data from government departments or entities, and has CSIS ever collected or had access to any such data without obtaining judicial warrants beforehand; (q) how many investigations has the use of bulk data helped in during the period starting from January 1, 2006, until December 31, 2016, inclusively, and how many individuals were the subjects of those investigations; (r) how many datasets or data repositories are housed within the Operational Data Analysis Centre, and how many of these data sets or data repositories include bulk data; (s) how many datasets or data repositories are housed in internal CSIS servers; (t) what are the approximate percentages of (i) bulk data, (ii) associated data, (iii) metadata, (iv) any other data that are housed within the servers mentioned in (s); (u) what is the description of the SMART data collection methodology employed by CSIS, and what kinds of data does this methodology collect; (v) what are all the steps involved in obtaining validation of authority to collect any kind of data; (w) has all information collected by CSIS since November 3, 2016, passed the “strictly necessary” test, as stipulated in Section 12(1) of the CSIS Act; (x) has all information retained by CSIS since November 3, 2016, passed the “strictly necessary” test, as stipulated in Section 12(1) of the CSIS Act; and (y) in light of the ruling by the Federal Court of Canada on the illegality of the retention of associated data by CSIS, delivered on November 3, 2016, what are the changes that CSIS has undertaken in order to ensure that the policies and practices of CSIS comply with the Court’s ruling?

With regard to the collection and retention of metadata or associated data by Canadian Security Intelligence Service (CSIS): (a) on what dates were the present or former Ministers of Public Safety informed of (i) the existence of the Operational Data Analysis Centre, (ii) the retention of metadata or associated data pertaining to third-parties or individuals who were deemed not to pose a threat, (iii) the possibility this practice could be deemed unlawful; (b) how was the information communicated for each instance in (a); (c) on what dates were the present or former Ministers of Justice informed of (i) the existence of the Operational Data Analysis Centre, (ii) the retention of metadata or associated data pertaining to third-parties or individuals who were deemed not to pose a threat, (iii) the possibility this practice could be deemed unlawful, (iv) the fact that the Federal Court had not been properly informed of this practice; (d) how was the information communicated for each instance in (c); and (e) what is the total number of Canadians whose metadata has been stored by CSIS in each year since 2006?

With respect to the September 2015 announcement of the Canada Revenue Agency (CRA) that it would effectuate a transfer of information to the United States Internal Revenue Service (IRS): (a) how many records has the CRA transferred to the IRS to date; (b) on what dates did information transfer occur and how many records were transferred on each date; (c) how many records of individuals have been transferred in total; (d) by what means were the records transferred; (e) how much did it cost the CRA to compile the records for transfer; (f) how much did it cost the CRA to complete the transfer; (g) how were the costs in (e) and (f) calculated and what is the breakdown of those costs; (h) who made the decision to transfer the records; (i) when was the decision made to transfer records; (j) when did the CRA become aware that the U.S. Treasury had extended the deadline for such transfer; (k) how was the CRA made aware that the U.S. Treasury had extended the deadline; (l) what steps were taken to assess and respond to the notice of deadline extension in (j); (m) what was the policy reason for transferring records despite the deadline extension; (n) when is the next transfer of records scheduled to take place; (o) what analysis was conducted to assess whether the transfer of records during the writ period for the 42nd General Election complied with the "Guidelines on the Conduct of Ministers, Ministers of State, Exempt Staff and Public Servants During an Election"; (p) what records exist with respect to any analysis conducted in relation to (o); (q) was information concerning the transfer of records from the CRA to the IRS included in any transition materials prepared for a potential change in government or the Ministers responsible for CRA and Foreign Affairs; (r) what documents exist in relation to (q) and what are their file numbers; (s) has the new Minister responsible for CRA been informed of information transfers to the IRS and, if so, (i) when, (ii) how, (iii) by whom, (iv) with what documents produced or prepared for this purpose; (t) has the new Minister of Justice been informed of the information transfer and been provided with any analysis of its legal implications and, if so, (i) when, (ii) how, (iii) by whom, (iv) with what documents produced or prepared for this purpose; (u) have Canadians who will be affected by the transfer been informed of the transfer of their records; (v) what plans exist with regard to informing Canadians about the transfer of their records; (w) has any proposal to inform Canadians of the transfer of their information to the IRS been evaluated by the government and, if so, with what conclusions; (x) what documents exist in relation to (w) and what are their file numbers; (y) what legal challenges does the government anticipate with respect to information transfer, and how is it preparing to respond; (z) what measures are in place to ensure the security of record transfers to the IRS; and (aa) has the Privacy Commissioner been consulted or involved in any way in the preparation or planning of record transfer to ensure conformity with applicable laws regarding the exchange of Canadians' personal information and, if so, to what extent?