I would lay the responsibility with each individual department. It doesn't really matter what Shared Services does or what the chief information officer does. That is not going to make Citizenship Canada make sure that they are storing their addresses. Fundamentally, I would start with the need to hold the departments to account.
Yes, there may very well be a role for central agencies such as Shared Services and so on somewhere in this as well, but I think fundamentally the starting point is with the individual organizations themselves.