Privacy concern safeguarding of sensitive personal information collected by Statistics Canada
Dear ATIP Co-ordinator:
I am writing to raise a privacy concern about how Statistics Canada, with Shared Services Canada, safeguards the personal information it collects.
Statistics Canada collects gender identity data, which I support. Reliable statistics on people outside the gender binary matter for policy and services. My concern is that information this sensitive be protected against foreign legal access.
Public records show that Statistics Canada relies on U.S.-controlled providers for email and web hosting, alongside Shared Services Canada (Appendix A). Under the U.S. CLOUD Act, U.S. authorities can compel a U.S.-headquartered provider to disclose data in its possession, custody or control, wherever the servers are located, and neither the government nor the individuals concerned may be notified.
I do not know where survey responses, including gender identity data, are stored or processed. A Shared Services Canada evaluation indicates that SSC has had difficulty mapping applications to servers (Appendix B).
I would appreciate your answers to the following:
- Where Statistics Canada stores and processes survey responses, and which providers host them.
- How responsibility for safeguarding that data is divided among Statistics Canada, Shared Services Canada and the Treasury Board Secretariat.
- What protections exist against compelled disclosure to foreign authorities under laws such as the CLOUD Act.
- Whether these risks have been assessed, and whether Canadian-controlled alternatives should be required for sensitive survey data.
I would appreciate a response within 30 days. If you cannot provide one in that time, please let me know when you will be able to respond. If the matter is not resolved, I will bring it to the Office of the Privacy Commissioner of Canada.
Thank you for your attention to this.
Sincerely,
Reann Legge
I use the pronouns she/her
Attachments: Appendix A (public records), Appendix B (SSC evaluation)