Mr. Speaker, with regard to (a), Health Canada is governed by the same communications protocols as other government departments, including the communications policy of the Government of Canada and any directives and guidelines set forth by the Treasury Board of Canada Secretariat, TBS.
With regard to (b), typically correspondence with respect to the program is mailed out by the Bureau of Medical Cannabis, which is part of the Healthy Environments and Consumer Safety Branch, or HECSB, of Health Canada. In the case of this mail-out, considering the volume of letters to be sent and the number of pages per envelope, Health Canada entered into a memorandum of agreement with Canada Post to conduct this mailing.
With regard to (c), it is not possible to accurately quantify the number of people involved in the mail-out.
With regard to (d), Health Canada has a comprehensive process that is followed in cases where a privacy breach may have occurred. When a possible breach is reported to the Access to Information and Privacy Division, ATIP, privacy and program officials work together to gather facts and assess next steps. In keeping with the TBS guidelines on privacy breaches and Health Canada’s own process, when the department assesses that a breach may have occurred, the principles of containment, notification, and mitigation are followed. Through this process a review of the incident and all associated events occurs.
With regard to (e), although it has not been determined by the courts or by the Office of the Privacy Commissioner, the OPC, that this incident constitutes a privacy breach, Health Canada has taken the expressed privacy concerns very seriously. The department is taking steps to ensure this does not happen again. Given ongoing litigation and OPC investigation, Health Canada is not in a position to comment further.
With regard to (f), Health Canada met with the Office of the Privacy Commissioner during the development of the Marihuana for Medical Purposes Regulations, MMPR, to review the new framework. In addition, as part of the implementation of the new regime, a PIA process is in progress for the MMPR. Under the MMPR, Health Canada will no longer collect personal information on program participants, who now number over 37,000 Canadians, as it did under the old program. Instead, it will be in receipt of information from those applying to become licensed producers. The PIA is focused on ensuring adequate protection mechanisms for this type of data.
With regard to (g), once the PIA process is complete as required by Treasury Board policy, the PIA will be submitted to the Office of the Privacy Commissioner and the Treasury Board of Canada Secretariat.