Good morning.
Thank you very much, Mr. Chair and members of the committee, for the invitation to describe the framework that Shared Services Canada has put in place to comply with the Privacy Act. We are pleased to be joining you this morning.
My name is Monique McCulloch. I am the director of the access to information and privacy protection division, which is within the corporate services branch at Shared Services Canada. I act as the coordinator for the whole department, and I am responsible for administering all ATIP legislative and policy obligations.
I would like to add that I am also here on behalf of Violaine Sauvé, who is Shared Services Canada's chief privacy officer.
Before describing the ATIP framework, I would like to provide some context on the mandate of Shared Services Canada.
Shared Services Canada was created to modernize information technology infrastructure services so as to ensure a secure and reliable platform for the delivery of digital services to Canadians. The department aims to deliver one email system, consolidated data centres, reliable and secure telecommunications networks, and 24/7/365 protection against cyber threats
Shared Services Canada currently provides information technology infrastructure services across 43 departments, 50 networks, 485 data centres, and 23,000 servers.
For fiscal year 2015-16, while still growing its capacity, the ATIP office employed four full-time employees, as well as two part-time employees—one casual and one student—to carry out Privacy Act business. Shared Services Canada spent just over $411,000 to administer the Privacy Act portion of the ATIP program.
Since its creation in August 2011, Shared Services Canada has put in place a framework, anchored by internal policies, instructions and training, that identifies the procedures and processes for handling requests for personal information as well as all policy matters under the Privacy Act
The ATIP division introduced an ATIP management framework, which sets out a comprehensive governance and accountability structure. A total of 14 ATIP policy instruments have been established within Shared Services Canada, including a directive on conducting privacy impact assessments, as well as a standard on how to manage privacy breaches. These reflect Shared Services Canada's responsibilities under both the Access to Information Act and the Privacy Act with respect to access rights, and with regard to the collection, use, disclosure, retention, and disposal of personal information.
The ATIP division is responsible for developing, coordinating, implementing, and monitoring compliance, with effective ATIP-related policies, guidelines, systems, and procedures across Shared Services Canada. This enables the department to meet the requirements and to fulfill its obligations under the Access to Information Act and the Privacy Act.
In terms of the volume of requests for personal information, I would now like to share some statistics from the fiscal year 2015-2016 annual report on the Privacy Act.
In all, there were 123 formal requests for records under the Privacy Act, of which 120 were completed before the end of the reporting period. All 120 requests were completed within the prescribed time limits, and no complaints were filed.
The Shared Services Canada ATIP division weekly tracks its turnaround times in processing requests, and monitors the time limits of their completion. Performance reports are communicated to senior management each month.
In 2013, Shared Services Canada was also part of the initial ATIP online pilot project, led by the Department of Citizenship and Immigration and the Treasury Board Secretariat, to facilitate and expedite Canadians' rights of access. Today, the majority of ATIP requests received by the departments are made online as part of open government initiatives.
Mr. Chair, I will end here, and will now answer the committee members' questions.