Information & Ethics committee  My expectation, given years of working with the commissioner's office, is that the approach will likely continue to be one of an ombudsman, as the ultimate goal for the commissioner's office, as well as the institution, is to resolve the matter as quickly as possible and to the complainant's satisfaction.

Information & Ethics committee  Sometimes, for institutions to define a material privacy breach tends to be a challenge. One institution will deem something as a material breach and another will not. I know additional standardization is an ongoing effort across the government. Because the level of sensitivity is discretionary, you could have something that is extremely sensitive but implicates only one individual, whereas you could have something of very low sensitivity that implicates hundreds, sometimes thousands.

Information & Ethics committee  At times, for standardization across the government, in my view, yes. There could be some value added with more benchmarking and more criteria.

Information & Ethics committee  The majority of the Privacy Act requests we receive pertain to human resources matters. It's employees or former employees of Shared Services Canada who are looking for their information. I think the government, through various means, has made it known that Shared Service Canada manages the IT infrastructure, but that the control of the data for the purpose of individuals to exercise rights of access....

Information & Ethics committee  It connects nicely with my response to the previous question. It was made very explicit in the Shared Services Canada Act that, for the purpose of exercising rights of access under both the Access to Information Act and the Privacy Act, the data that resides within SSC's IT infrastructure, whether it's the data centres, the email solutions, the networks, is not under the control of Shared Services Canada, but in fact under the control of partner organizations.

Information & Ethics committee  The Shared Services Canada Act was made very explicit when it relates to the Access to Information Act and the Privacy Act. Shared Services Canada is responsible for managing the IT infrastructure, so managing the shell, but the content—all of the data residing in our data centres, even the content of emails within our networks—belongs to and is still under the control of the partner organization.

Information & Ethics committee  No. The partner organizations only have access to the data that is part of their mandated program activities, which is the personal information, as well as all government information holdings that are specific to their departmental program activities. Canada Revenue Agency, for example, would not have access to the personal data of the Canada student loans program, which is managed by another federal government institution.

Information & Ethics committee  Good morning. Thank you very much, Mr. Chair and members of the committee, for the invitation to describe the framework that Shared Services Canada has put in place to comply with the Privacy Act. We are pleased to be joining you this morning. My name is Monique McCulloch. I am the director of the access to information and privacy protection division, which is within the corporate services branch at Shared Services Canada.

Information & Ethics committee  That would be difficult to assess, but I personally don't expect that there would be a huge increase. There hasn't been. I worked at the Department of Foreign Affairs for a number of years. There are other channels for other countries to obtain information from the Government of Canada.

Information & Ethics committee  All federal government institutions would have very similar public-facing websites that would provide Canadians with information about how they can obtain information, whether it's formally under ATIP legislation or informally through reference material, publications, and proactive disclosure.

Information & Ethics committee  The question was particularly about whether it would reduce the workload. The reality is that, whether it is a formal Access to Information Act request or something to be published on the departmental website as a result of proactive disclosure, the ATIP divisions are always asked to review the information to ensure that there is no information there that could prove injurious if released—injurious to the government, to the national interests, or to individuals.

Information & Ethics committee  Over the course of fiscal 2014-15, certain ATIP requests, concerning an attack against the government's information technology infrastructure, were submitted. I'm sure that everyone remembers Heartbleed. Since part of Shared Services Canada's mandate is to manage the Government of Canada's infrastructure, we were heavily engaged in the situation.

Information & Ethics committee  Yes, in fact, the estimate I heard a few years ago was that a $5 cheque cost approximately $75 to process. The $5 fee would act as somewhat of a deterrent, for example, for someone with insomnia in the middle of the night just flipping one request online after another and bombarding a department.

Information & Ethics committee  Yes, very much so.

Information & Ethics committee  In fact, Shared Services Canada was one of the three pilot departments, and there are about 33 federal government institutions currently. The bulk of the ATI Act requests that are made to the federal government at this time are made online through the larger departments with this portal, and yes, the five dollars is still a requirement through this online portal.