Memorandum of Understanding Concerning the Sharing of Information between Statistics Canada and Canada Energy Regulator

Memorandum of Understanding Concerning the Sharing of Information between Statistics Canada and Canada Energy Regulator [PDF 312 KB]

MEMORANDUM OF UNDERSTANDING CONCERNING

THE SHARING OF INFORMATION

BETWEEN

STATISTICS CANADA

AND

CANADA ENERGY REGULATOR

MEMORANDUM OF UNDERSTANDING CONCERNING THE SHARING OF INFORMATION (the “MOU”)

BETWEEN:

HER MAJESTY THE QUEEN IN RIGHT OF CANADA, as represented by the Minister of Industry, being the Minister for the purposes of the Statistics Act, (“Statistics Canada”),

AND:

HER MAJESTY THE QUEEN IN RIGHT OF CANADA, as represented by the Chief Executive Officer for Canada Energy Regulator, (the “Receiving Department”),

Each a “Participant”, and collectively referred to as the “Participants”

RECITALS:

1. The Participants require accurate information for the production of current statistics on topics such as, but not limited to, energy in Canada;
2. Collaboration in the collection of information will avoid duplication of surveys, thereby reducing the burden on Respondents and the costs of collecting and processing data, and will provide high quality and timely statistics;
3. Statistics Canada agrees to collect and share with the Receiving Department the information required, subject to the Statistics Act, R.S.C. 1985, c. S-19 (the “Act”) and the terms of this MOU;
4. Subsection 17(1) of the Act prohibits disclosure of certain information collected under the Act, with the exception of communicating information in accordance with any conditions of an agreement made under section 11 or 12 of the Act, or for the purposes of prosecution under the Act;
5. Section 12 of the Act permits the Minister to enter into an agreement with any department or any municipal or other corporation for the sharing of information collected from a Respondent;
6. Section 12 of the Act requires that a Respondent be informed by notice that the information is being collected on behalf of Statistics Canada and the department or corporation, as the case may be, and that Statistics Canada will not share the information with the department or corporation should the Respondent object to the sharing;
7. Subsection 18(1) of the Act states that any return and any identifying information provided to Statistics Canada pursuant to the Act is privileged and shall not be used as evidence in any proceedings.

NOW THEREFORE, the Participants agree as follows:

1. DEFINITIONS AND INTERPRETATIONS

• 1.1. Definitions

  In this MOU, a capitalized term has the meaning given to it in this section, unless the context indicates otherwise:

  “Administrative Data” « Données administratives »

  “Administrative Data” means all forms of information contained in any documents or records that are maintained in any government department or in any municipal office, corporation, business or organization, which are provided to Statistics Canada in respect to its mandate pursuant to the Act. Administrative Data, with or without Identifiers, constitutes a return or identifying information, which are protected pursuant to subsections 17(1) and 18(1) of the Act.

  “Administrative or Regulatory Purpose” « Fins administratives ou réglementaires »

  “Administrative or Regulatory Purpose” means the use of all forms of information about a Person in a decision-making process that directly affects that Person. This includes but is not limited to all uses of information for confirming identity (i.e., authentication and verification purposes), for determining eligibility of a Person for programs, and for prosecution and penalty assessment.

  “Assessment” « Évaluation »

  “Assessment” means a site inspection, a review or an audit that may be required by Statistics Canada to monitor the Receiving Department’s compliance with the terms of this MOU, as set out in section 9 of this MOU.

  “Contracting Party” « Partie contractante »

  “Contracting Party” means an individual or organization working under contract to provide a service to the Receiving Department, as described in subsection 6.2 of this MOU.

  “Data Custodian” « Administrateur de données »

  “Data Custodian” means an employee of the Receiving Department, who is designated by the Receiving Department’s Official, as required by paragraph 6.1.1, to assume the responsibilities set out in this MOU and further specified in Appendix ‘D’.

  “Identifier” « Identificateur »

  “Identifier” means a Person’s name, address, telephone number or other direct means of identifying that Person.

  “Information” « Renseignements »

  “Information” means the Survey Responses and selected Paradata shared with the Receiving Department pursuant to this MOU, and Statistical Aggregates thereof that could directly or indirectly identify a Person, all of which is protected under subsections 17(1) and 18(1) of the Act. For the purpose of this MOU, Information includes portions of linked datasets that contain Survey Responses.

  “Legal and Administrative Proceedings” « Procédure judiciaire ou administrative »

  “Legal and Administrative Proceedings” refers broadly to, but is not limited to, any action, suit, litigation, arbitration, proceeding (including any civil, criminal, administrative, investigative or appellate proceeding), audit, examination or investigation involving any court, arbitrator, arbitration panel, or other governmental body.

  “Official” « Représentant »

  “Official” means the Participants’ representatives identified in section 13 of this MOU.

  “Paradata” « Paradonnées »

  “Paradata” means information related to the Survey data collection or production process that is linked to a Person, including but not limited to whether a Person has been selected into a sample, the sample weight assigned to a Person, whether a selected Person has responded, and whether a Person has consented or objected to data sharing or record linkage.

  “Person” « Personne »

  “Person” means an individual, a partnership, an association, a post-secondary institution such as a university or college, a federal, provincial, or municipal entity, a corporation and a not-for-profit organization that is incorporated in Canada.

  “Residual Disclosure” « Divulgation par recoupement »

  “Residual Disclosure” means disclosure of Information that occurs indirectly, by inference, from multiple variables, from different sources, or from Statistical Aggregates.

  “Respondent” « Répondant »

  “Respondent” means a Person who provides information to Statistics Canada in response to a survey.

  “Statistical Aggregates” « Données statistiques agrégées »

  “Statistical Aggregates” means outputs produced from Survey Responses and selected Paradata that result from any type of statistical analysis, including but not limited to cross-tabulations, means and medians, and regression model coefficients.

  “Survey” « Enquête »

  “Survey” means a survey listed in Appendix ‘A’.

  “Survey Responses” « Réponses à l’Enquête »

  “Survey Responses” means the individual answers to a Survey provided by each Respondent, with or without Identifiers, as well as imputed responses that are not derived from other surveys or confidential Administrative Data. Survey Responses, with or without Identifiers, constitute a return or identifying information, which are protected pursuant to subsections 17(1) and 18(1) of the Act.

• 1.2. Interpretation of Appendices

  This MOU contains the following Appendices, which form an integral part of this MOU:

  • Appendix ‘A’ – Data Provided by Statistics Canada
  • Appendix ‘B’ – Security Requirements
  • Appendix ‘C’ – Statistical and Research Purposes
  • Appendix ‘D’ – Responsibilities of the Data Custodian
  • Appendix ‘E’ – Audit Terms of Reference

  In case of inconsistency or conflict between a provision contained in the part of the MOU preceding the signatures and a provision contained in any of the Appendices, the provision contained in the part of the MOU preceding the signatures will prevail.

2. DATA COLLECTION

• 2.1. The Participants acknowledge that the Survey Responses will be collected by means of the Surveys conducted by Statistics Canada and that Statistics Canada will create Paradata required by both Participants.
• 2.2. The Receiving Department acknowledges that, at the time of collection, Statistics Canada will notify Respondents that:
  • 2.2.1. Statistics Canada will share their Survey Responses with the Receiving Department, unless they object to such sharing; and
  • 2.2.2. the Receiving Department has agreed to keep their Survey Responses confidential

3. DATA SHARING

• 3.1. Statistics Canada will, subject to subsection 3.2, share with the Receiving Department the Information from each Survey specified in Appendix ‘A’. Such Information will be provided to the Receiving Department in electronic format, and transmitted in a secure manner. Timing of transmission will be in accordance with Statistics Canada’s release policy.
• 3.2. Statistics Canada will not share with the Receiving Department the Survey Responses related to any Respondent who objects to the sharing of his/her Survey Responses.
• 3.3. Statistics Canada will not share with the Receiving Department the Paradata related to non-Respondents or to a Respondent who objects to the sharing of his/her Survey Responses.

4. CONFIDENTIALITY OF THE INFORMATION

• 4.1. In keeping with Statistics Canada’s promise to Respondents to maintain the confidentiality of their Information, and as indicated in paragraph 2.2.2, the Receiving Department agrees to keep the Information confidential by applying confidentiality measures at least as robust as those of Statistics Canada, in conformity with the terms of this MOU. The Receiving Department will take any and all steps necessary to protect the Information in accordance with the security requirements set out in Appendix ‘B’.
• 4.2. The Receiving Department will not disclose the Information, except in accordance with subsection 6.2 of this MOU, or as otherwise authorized by Statistics Canada pursuant to the Statistics Act to allow disclosure by the Receiving Department.
• 4.3. Except in accordance with subsection 6.2 of this MOU, or as otherwise authorized by Statistics Canada pursuant to the Statistics Act, the Receiving Department will only release or publish Statistical Aggregates that do not directly or indirectly identify a Respondent or any other Person. The Receiving Department agrees to keep confidential those Statistical Aggregates which Statistics Canada has suppressed in its own publications and may consult with Statistics Canada prior to releasing any Statistical Aggregates.
• 4.4. In the event that the Receiving Department receives a request for disclosure under access to information or privacy or other legislation to which it is subject regarding the Information, the Receiving Department agrees to notify Statistics Canada without delay. The Receiving Department agrees to treat the Information as personal information or confidential information of a third party, and to provide Statistics Canada with the opportunity to respond prior to any disclosure of that Information.
• 4.5. The Receiving Department acknowledges that, under section 18 of the Statistics Act, the Information is privileged and inadmissible as evidence in any proceeding and the Receiving Department will never attempt to use the Information, in whole or in part, as evidence. This wide prohibition includes but is not limited to testimony, discovery, preparing an expert report and producing the expert report or any Information in a court, tribunal, or any other dispute resolution mechanism or forum.
• 4.6. The Receiving Department will notify Statistics Canada without delay, and prior to any disclosure of the Information, if the Receiving Department:
  • 4.6.1. is notified of the intent of any Person, to initiate or file any Legal and Administrative Proceedings whatsoever that may require the release of the Information, in whole or in part; or
  • 4.6.2. is ordered by a court or tribunal to disclose the Information, in whole or in part.
• 4.7. The Receiving Department acknowledges that it is of paramount importance that, before any disclosure of the Information occurs, Statistics Canada be given the opportunity to seek an injunction, a judicial protection order or an order to safeguard the Information before a competent tribunal in order to prevent the disclosure of the Information.
• 4.8. Nothing in this MOU modifies or diminishes any of the protections of the Information under the federal Statistics Act.

USE OF THE INFORMATION

• 5.1. The Receiving Department will use the Information for statistical and research purposes only, as specifically provided for in Appendix ‘C’. The Receiving Department will not use the Information for Administrative or Regulatory Purposes, including for the purposes of Legal and Administrative Proceedings.
• 5.2. The Receiving Department agrees not to match the Information that is shared without Identifiers to any other records or data files for any reason, including to identify a Person.

ACCESS TO THE INFORMATION

• 6.1. The Receiving Department may give an employee access to the Information as necessary for the employee to produce a Survey-related product or service for the sole benefit and mandate of the Receiving Department, so long as:
  • 6.1.1. the Receiving Department designates one of its employees as the Data Custodian of the Information, whose duties are described in Appendix ‘D’; and
  • 6.1.2. each employee provided with access to the Information complies with the terms of this MOU.
• 6.2. The Receiving Department agrees that it will not, by agreement or otherwise, share with or disclose the Information to any other organization, except in accordance with the following, and as long as the terms of this MOU are upheld:
  • 6.2.1. Contracting Party: The Receiving Department may provide access to the Information to a Contracting Party, provided that:
    • the Contracting Party is working under contract directly for the Receiving Department to provide a Survey-related product or service to the Receiving Department;
    • for Information shared with Identifiers, the Receiving Department agrees to remove the Identifiers from all Information the Contracting Party will access;
    • the Receiving Department ensures that the Contracting Party complies with the terms of this MOU; and
    • if access is on the premises of the Contracting Party, the Contracting Party receiving the Information undertakes by written contract with the Receiving Department:
      • to comply with the terms of this MOU;
      • to ensure that the Information remains located in Canada at all times, and that the necessary measures are in place to protect the Information in accordance with the security requirements set out in Appendix ‘B’;
      • to assist in the review or audit of compliance by granting access to the Receiving Department, or to the auditor of the Receiving Department’s choice, to their premises and records during regular business hours, and that the results of the audit will be provided to Statistics Canada;
      • to immediately inform the Receiving Department of any unauthorized use of, access to, or disclosure, loss or theft of the Information. The Receiving Department will immediately notify Statistics Canada of such breach, in writing, and inform Statistics Canada of the mitigation measures taken subsequently; and
      • to return the Information to the Receiving Department or to destroy the Information in a secure manner, as described in Appendix ‘B’, once the Information is no longer required, or when the Receiving Department is required to destroy the Information, whichever comes first.

    Otherwise the access will be controlled by the Receiving Department in accordance with the security requirements set out in Appendix ‘B’.

  • 6.2.2. Provincial/territorial or university research institute/organization: The Receiving Department may provide access to the Information, to a recognized provincial/territorial or university research institute or organization (the “Research Organization”), provided that:
    • the Research Organization is exclusively Canadian-owned/controlled and operates exclusively on Canadian territory;
    • for Information shared with Identifiers, the Receiving Department removes the Identifiers from all Information the Research Organization will access;
    • the Receiving Department informs Statistics Canada prior to entering into a contract with a Research Organization;
    • the Research Organization is working under contract directly for the Receiving Department to provide a Survey-related product or service for the sole benefit and mandate of the Receiving Department; and
    • if access is on the premises of the Research Organization, the Research Organization receiving the Information undertakes by written contract with the Receiving Receiving Department:
      • to comply with the terms of this MOU;
      • to ensure that the Information remains located in Canada at all times, and that the necessary measures are in place to protect the Information in accordance with the security requirements set out in Appendix ‘B’;
      • to assist in the review or audit of compliance by granting access to the Receiving Department, or to the auditor of the Receiving Department’s choice, to their premises and records during regular business hours, and that the results of the audit will be provided to Statistics Canada;
      • to immediately inform the Receiving Department of any unauthorized use of, access to, or disclosure, loss or theft of the Information. The Receiving Department agrees to immediately notify Statistics Canada of such breach, in writing, and the Receiving Department will inform Statistics Canada of the mitigation measures taken subsequently; and
      • to return the Information to the Receiving Department or to destroy the Information in a secure manner, as described in Appendix ‘B’, once the Information is no longer required, or when the Receiving Department is required to destroy the Information, whichever comes first.

    Otherwise the access will be controlled by the Receiving Department in accordance with the security requirements set out in Appendix ‘B’.

  • 6.2.3. Information Management and Information Technology Services: The Receiving Department may provide access to the Information, solely for information management (“IM”) or information technology (“IT”) support purposes, to employees of other departments of the Government of Canada or to contractors (“IM-IT Support”), provided that the Receiving Department accepts full responsibility for ensuring that IM-IT Support and their employer (the “Service Provider”) meet the requirements of this MOU, including that:
    • if the Service Provider is not a government department mandated by law to provide the IM or IT service:
      • the Service Provider operates within Canadian territory and all solution infrastructure, components and resources reside within Canada with no data transmission, processing, storage or access outside of the geographical borders of Canada; and
      • the Receiving Department agrees to enter into a contract with the Service Provider in which the Service Provider will undertake to abide by the terms of this MOU, including paragraphs (b) to (h).
    • any IM-IT Support to whom such access is given is subject to all of the confidentiality provisions in this MOU;
    • any IM-IT Support to whom such access is given does not use the Information for their own purposes or those of their employer;
    • any IM-IT Support to whom such access is given ensures that there is no subsequent unauthorized disclosure;
    • the Information remains located in Canada at all times, and that the necessary measures are in place to protect the Information in accordance with the security requirements set out in Appendix ‘B’;
    • the Service Provider will assist in the review or audit of compliance and implementation by granting access to the Receiving Department, or to the auditor of the Receiving Department’s choice, to their premises and records during regular business hours and that the results of the audit will be provided to Statistics Canada;
    • the Service Provider will immediately inform the Receiving Department of any unauthorized use of, access to, or disclosure, loss or theft of the Information. The Receiving Department agrees to immediately notify Statistics Canada of such breach, in writing, and the Receiving Department will inform Statistics Canada of the mitigation measures taken subsequently; and
    • the Service Provider will return the Information to the Receiving Department or destroy the Information in a secure manner, as described in Appendix ‘B’, once the Information is no longer required, or when the Receiving Department is required to destroy the Information, whichever comes first.
  • 6.2.4. The Receiving Department may provide access to the Information to another organization, provided that:
    • each has entered into a data-sharing agreement with Statistics Canada for the same Survey and the same Survey reference years, as specified in Appendix ’A’, and the agreement is still in force; and
    • the Information contains no Survey Responses from Respondents who objected to data sharing with the other organization.

    Access to the Information will be provided via a secure means of transmission, in accordance with the security requirements set out in Appendix ‘B’.

NOTIFICATION OF BREACH

The Receiving Department agrees to notify Statistics Canada in writing immediately upon becoming aware that any of the provisions of this MOU may have been breached. The selected method of communication will allow Statistics Canada to receive the notice within two (2) business days of being sent.

DOCUMENTATION

The Receiving Department agrees to document the governance, procedures, roles and responsibilities related to this MOU to help ensure that its terms are consistently met.

MONITORING

• 9.1. The Receiving Department agrees to submit to Statistics Canada the confidentiality documents, register of data files and data-access register outlined in Appendix ‘D’ within ten (10) business days of a request made by Statistics Canada, in order for Statistics Canada to assess compliance with this MOU.
• 9.2. Upon request by Statistics Canada, the Official for the Receiving Department will prepare and send a report indicating any changes to the individuals occupying the positions of:
  • 9.2.1. the signatory of the MOU;
  • 9.2.2. the Official; and
  • 9.2.3. the Data Custodian.
• 9.3. Statistics Canada may, when it determines necessary, require the performance of a selfassessment or conduct an Assessment in order to review compliance by the Receiving Department with the terms set out in this MOU.
  • 9.3.1. Where Statistics Canada opts for a self-assessment, the Receiving Department will be required to complete a questionnaire, based on criteria provided by Statistics Canada, for the purpose of evaluating its own compliance to the MOU. In such a case, the Receiving Department agrees to complete any Statistics Canada forms and provide to Statistics Canada all relevant documents requested as part of the self-assessment within the timeframe indicated by Statistics Canada.
  • 9.3.2. Where Statistics Canada opts for an Assessment, the Receiving Department will be given the option to have Statistics Canada perform the Assessment, or to select an accredited auditor of the Receiving Department’s choice and at the Receiving Department’s cost, if the conditions listed in Appendix ‘E’ are met.
  • 9.3.3. Subject to subsection 9.4 and section 16 of this MOU, where the Receiving Department chooses to have Statistics Canada perform the Assessment, Statistics Canada will pay for the Assessment and the Receiving Department will assist in any such Assessment by providing Statistics Canada access to its premises and records during regular business hours, at a time agreed upon by the Participants.
• 9.4. Statistics Canada acknowledges that the Receiving Department will not be required to provide Statistics Canada or the accredited auditor with access to any records that are not relevant to this MOU.
• 9.5. The Receiving Department agrees to ensure that the terms and conditions of this MOU respecting the use, confidentiality, protection and security of the Information, as well as Statistics Canada’s right to require an Assessment, are included in all agreements and arrangements the Receiving Department enters into, under the terms of which any other organization is granted access to the Information in accordance with subsection 6.2 of this MOU.

10. TERM AND RENEWAL

• 10.1. This MOU comes into force when signed by both Participants, for a period of two (2) years beginning on the date of the later signature, unless terminated earlier in accordance with the provisions of section 11.
• 10.2. This MOU will be automatically renewed for further periods of two (2) years, unless terminated earlier in accordance with the provisions of section 11.
• 10.3. Upon request from Statistics Canada, the Receiving Department will provide a written notice to Statistics Canada to confirm the Surveys required by the Receiving Department for statistical and research purposes.

11. TERMINATION

This MOU may be terminated for any reason by either Participant upon thirty (30) days’ notice of termination having been made in writing to the other Participant, or at a time otherwise agreed upon by the Participants. Such termination will take effect on the expiry of the notice period.

12. DESTRUCTION OF THE INFORMATION

• 12.1. Upon termination of this MOU by either Participant, the Receiving Department will destroy the Information in accordance with the security requirements set out in Appendix ‘B’ and within the period agreed to in writing by the Participants, with no copies or portion retained by the Receiving Department, unless required by law.
• 12.2. The Official for the Receiving Department will provide a written confirmation of destruction to the Official for Statistics Canada. The record of destruction will be provided to Statistics Canada by the Receiving Department within ten (10) business days after destruction of the Information.
• 12.3. If the Receiving Department breaches any terms of this MOU, Statistics Canada may require that the Receiving Department destroy all Information, in accordance with the security requirements set out in Appendix ‘B’ and within the period agreed to in writing by the Participants, with no copies or portion retained by the Receiving Department, unless required by law. The procedure outlined in subsection 12.2 will apply for any destruction of the Information.

13. OFFICIALS

• 13.1. Any notice to be given to Statistics Canada pursuant to this MOU will be addressed to:

  Director
  Environment and Energy Statistics Division
  Statistics Canada
  Jean Talon Building, 9th Floor
  150 Tunney’s Pasture Driveway
  Ottawa ON K1A 0T6

• 13.2. and any notice to be given to the Receiving Department will be addressed to:

  Director
  Energy Outlooks Team
  Energy Information Business Unit
  Canada Energy Regulator
  Suite 210, 517 Tenth Avenue S.W.
  Calgary, Alberta T2R 0A8

14. DISPUTE RESOLUTION

Where a dispute arises as to the interpretation of this MOU or of matters relating to its termination, or of performance hereunder, the Officials for both Participants will attempt in good faith to resolve the dispute through negotiation. Should negotiation prove unsuccessful, the Officials will submit the matter for resolution to the persons occupying the positions of the signatories of this MOU.

15. NOTICE OF CHANGE

The Participants will mutually inform each other, in writing, within sixty (60) days of any changes in their programs and policies that may affect this MOU.

16. PAYMENT

If applicable, any funding arrangements or payment modalities between the Participants related to the Surveys or this MOU will be outlined in separate memoranda of understanding.

17. AMENDMENT

• 17.1. No amendment to this MOU will be effective unless it is made in writing and, subject to required authorizations, executed as follows:
  • 17.1.1. the part of this MOU preceding the signatures may only be amended by the persons occupying the positions of the signatories;
  • 17.1.2. Appendix ‘A’ may be amended by the Chief Statistician for Statistics Canada and the Chief Executive Officer for the Receiving Department; and,
  • 17.1.3. Appendices ‘B’, ‘C’, ‘D’ and ‘E’ may be amended by the Officials
• 17.2 Notwithstanding subsection 17.1, the Officials identified in section 13 of this MOU may be modified by written notice between the Participants. Such change will take effect upon notice, or as otherwise indicated by the Participant.

18. GENERAL

• 18.1. No Assignment
  The Receiving Department acknowledges that this MOU will not be assigned in whole or in part by the Receiving Department without the prior written consent of Statistics Canada, and any assignment made without such consent will be void and of no effect.
• 18.2. Notices
  Unless otherwise specified in the MOU, where in this MOU any notice or other communication is required to be given or made by either Participant, it will be in writing and be effective if sent by registered mail, e-mail, facsimile, postage prepaid or delivered in person, addressed to the Officials. Any notice or other communication will be deemed to have been given: if by registered mail when the postal receipt is acknowledged by the other Participant; if by e-mail or facsimile on the day after the e-mail or facsimile was sent; if by mail on the eighth (8th) calendar day following the day of mailing.
• 18.3. Survival
  The sections of this MOU regarding restrictions on use, confidentiality, termination and general, and any other provisions which by their nature survive the termination of this MOU, will survive any termination of this MOU.
• 18.4. Termination of previous memorandum of understanding
  • 18.4.1. This MOU terminates and replaces the following memorandum of understanding between Statistics Canada and the Receiving Department:

    the Memorandum of Understanding concerning the collection and sharing of information from selected surveys between Statistics Canada and the National Energy Board that came into force on September 8th, 2015; and first amendment January 29, 2021, Memorandum of Understanding concerning the collection and sharing of information from selected surveys between Statistics Canada and the Canadian Energy Regulator (formerly National Energy Board);

• 18.5. Not legally binding
  This MOU does not impose any legally binding obligations on either of the Participants and does not create a legal partnership, a joint venture or an agency relationship between the Participants.
• 18.6. Counterparts signature
  This MOU may be signed in counterparts, each of which will be deemed an original, but all of which together will constitute one and the same instrument.

This Memorandum of Understanding has been signed in both official languages by the Participants on the dates indicated below.

FOR STATISTICS CANADA:

Anil Arora
Chief Statistician of Canada
DATED at Ottawa, Province of Ontario, this 14th day of July 2022.

FOR THE RECEIVING DEPARTMENT:

Gitane De Silva
Chief Executive Officer
DATED at Calgary, Alberta, this 19 day of August 2022

APPENDIX 'A'

DATA PROVIDED BY STATISTICS CANADA

Historical Statistics Canada Surveys

APPENDIX 'B'

SECURITY REQUIREMENTS

Statistics Canada is required to protect the Information in accordance with the Federal Policy on Government Security^Footnote 1. As such, Statistics Canada ensures that physical measures in accordance with the Royal Canadian Mounted Police specifications and that IT measures in accordance with to the Communications Security Establishment Canada guidelines and recommendations are followed.

As required by subsection 4.1 of this MOU, the Receiving Department agrees to provide similar protection of the Information. The security requirements described below are the minimum requirements that will be met by the Receiving Department. Exemptions to any of the security requirements herein must be authorized, in writing, by Statistics Canada.

Definitions in addition to those definitions found in subsection 1.1 of this MOU:

“Authorized Person” « Personne autorisée »

“Authorized Person” means a member of the staff of the Receiving Department or an individual working under contract with the Receiving Department.

“Identified Person” « Personne identifiée »

“Identified Person” means an Authorized Person whose current work-related responsibilities require access to the Information.

“Logical Access Controls” « Méthodes de contrôle d’accès logique »

“Logical Access Controls” means the process of enforcing proper identification, authentication and accountability with respect to access to a computer system, based on the latest information technology (IT) security guidance. These include:

• individual user accounts;
• long passwords (eight (8) characters minimum);
• access-based on role (privileged vs. non-privileged); and
• auditing.

“Portable Storage Devices” « Dispositifs de stockage portatifs (DSP) »

“Portable Storage Devices (PSDs)” means devices that are portable and contain storage or memory into which users can store information, including, but not limited to, laptops, CDROMs, DVDs, smart devices (e.g. cell phones and tablets), zip drives, USB storage devices (e.g., flash drives, hard drives, memory sticks),, backup media and removable hard disks.

“Secure Device”

“Secure Device” means a computing device provided by the Receiving Department to Authorized Persons for the purposes of connecting through security protocols to its secure network.

“Secure Location”

“Secure Location” means a private physical location such as a closed office, a closed conference room or meeting room, or an open workspace within the premises of the Receiving Department, or a private space within the Identified Person’s personal residence, where the Identified Person can ensure the security of the Information and where the Identified Person is not surrounded by anyone who could view the Information or overhear a conversation related to it. Access to the Secure Location is controlled by the Identified Person at all times to prevent unauthorized access to the Information.

“System” « Système »

“System” means a single IT-related device, a component of such a device or a group of ITrelated devices that may be used to receive, store, process or transmit information. This includes, but is not limited to, personal computers, servers, laptops, tablets, smart phones, virtual computers and cloud based virtual systems.

“Visitor” « Visitor »

“Visitor” means an individual, other than an Authorized Person, who has been invited into the secure area by an Authorized Person, as permitted by the Receiving Department’s access policies.

A – Security requirements

Physical Access

• 1. The Information will be accessed within a Secure Location using a Secure Device. Additional security requirements for remote access are outlined in Part B of this Appendix.
• 2. Access to the Information is limited to Identified Persons. The duties of the Data Custodian, as stated in Appendix ‘D’, include maintaining an auditable trail on access to the Information by Identified Persons.
• 3. Under no circumstances may Visitors be permitted to access the Information.

IT Storage and Transmission

• 4. All Systems with access to the Information will employ Logical Access Controls at the device and network level.
• 5. All Systems will have functional and current antivirus software.
• 6. Where the Information is held on PSDs, long passwords with encryption will be used. The encryption level will meet the latest Communications Security Establishment standards for “protected B” information. This applies equally to backups of the Information stored on PSDs.
• 7. The Information cannot be electronically transmitted, except as described in points 8 and 9. Electronic transmission includes, without being limited to, transmittal of the Information by facsimile or by e-mail.
• 8. Systems storing and transmitting unencrypted data will be located in a secure, controlledaccess area. Systems storing the Information, whether encrypted or unencrypted, will be located in Canada. Controls will be in place to ensure that only Identified Persons can access the Information. The Information will be encrypted continuously while outside the secure area, or a conduit will be used for all cabling. All cross-connect areas will be physically secured.
• 9. Network firewall rules will be in place such that no System processing the Information can communicate at the network layer with any system that can be accessed by non-Identified Persons. Network firewall rules will also be in place such that no System processing the Information can be accessed at the network layer by a system outside of the secure area. Information may be stored on and transmitted over networks not meeting these requirements, provided that it is encrypted. Alternatively, the Information may be stored on a stand-alone computer in a secure area located in Canada with no external connections, or on a closed network within the secure area. When the network transmits information that leaves a secure area (for example, when a series of buildings house employees within a single organization), the Information will be encrypted whenever it is outside the secure area.

Physical Storage

• 10. When not in use, PSDs containing the Information will be stored in secure containers. This applies equally to backups of the Information.
• 11. The Information will not be removed from the Secure Location, except as described in points 8 and 9.
• 12. When not in use, printed documents containing the Information will always be stored in secure containers.

Information Copying and Retention & Record Management

• 13. Copies and extracts of the Information may only be made for the purposes of carrying out work as covered by the MOU. When no longer needed, any such copies or extracts will be destroyed in a secure manner (as per points 13 and 14).
• 14. Paper documents containing the Information will be destroyed (shredded) in a secure manner before disposal.
• 15. All electronic storage media used in the processing of the Information, including all back-up, PDSs, photocopiers and other electronic media where the Information has been electronically stored, will be sanitized or destroyed, in accordance with the latest Communications Security Establishment standards for “protected B” information when disposing of such media, or when destruction of the Information is required pursuant to section 12 of this MOU.
• 16. The Receiving Department’s Data Custodian agrees to establish and maintain an inventory of all data files received from Statistics Canada, as stated in Appendix ‘D’.

These security requirements will be communicated to all Identified Persons prior to them accessing the Information and be available for reference, as required.

B – Security requirements for remote access

1. Identified Persons will:
   • access the Information using only the Secure Device within the Secure Location only;
   • ensure that non-Identified Persons cannot view or access the Information in the Secure Location or from outside the space (e.g., through a window or open door);
   • not export, download, print, or otherwise extract or remove any of the Information, by any electronic or other means. For clarity, this restriction also means no transcription on paper, or recording of images of the Information on any medium;
   • ensure the protection of the Secure Device from unauthorized access at all times, including securely storing the device when not in use;
   • not allow any non-Identified Person to use the Secure Device or to access the Information at any time;
   • only connect the Secure Device to a secure network, preferably by directly connecting via network cable, or by Wi-Fi secured following best practices such as the use of WPA2 or higher encryption. https://cyber.gc.ca/en/guidance/baseline-cyber-security-controls-smalland-medium-organizations
   • not attempt to compromise the security of the Secure Device or the computing environment. Without limiting the generality of the foregoing, this includes using screen capture/sharing software or devices, and allowing non-Identified Persons to view the Information;
   • not conduct any unlawful or unacceptable activity when accessing the Information. This includes but is not limited to:
     • attempting to defeat information technology security features, through such means as using anti-security programs; using someone else’s password, user-identification or computer account; disclosing one’s password, network configuration information or access codes to others; or disabling anti-virus programs.
     • destroying, altering or encrypting data without authorization and with the intent of making it inaccessible to others with a lawful need to access it.

These security requirements will be communicated to all Identified Persons prior to them accessing the Information and be available for reference, as required.

APPENDIX 'C'

STATISTICAL AND RESEARCH PURPOSES

This MOU sets out a number of requirements, including that the Information will only be used for statistical and research purposes by the Receiving Department. The Receiving Department will not use the Information for Administrative or Regulatory Purposes. Work for statistical and research purposes is defined below.

What is work for statistical and research purposes?

Phase A: Production of statistical outputs
This is the technical phase that uses Information as input and, implementing detailed specifications, produces such statistical outputs as data tabulations or regression coefficients.

Phase B: Statistical analysis to determine whether outputs are appropriate for use
In this phase, the work is to determine whether, from a statistical point of view, the statistical output is appropriate for its intended uses. This phase involves such activities as examining the influence of outliers and the analysis of residuals.

Phase C: Determination of confidentiality of statistical output
In this phase, the Receiving Department has to determine whether the statistical output can, alone or in conjunction with Statistics Canada publications and/or other publicly available sources, identify or disclose Information about a Person. At the end of this phase, all statistical outputs will be categorized as being confidential or non-confidential.

The precise methods for and complexity of determining the confidentiality of statistical outputs will vary according to the underlying distribution of Information, and the types of statistical outputs. The Receiving Department may consult Statistics Canada about the statistical outputs to ensure that no confidential Information will be released or used for Administrative or Regulatory Purposes by the Receiving Department.

Phase D: Use of statistical outputs
The Receiving Department agrees not to release or use for Administrative or Regulatory Purposes any statistical outputs identified as being confidential (these outputs are defined as “Information” throughout this MOU).

There are no restrictions on the use of non-confidential statistical outputs. This includes their use for policy development and evaluation, as well as for monitoring or regulatory purposes but only at an aggregate, non-confidential level. Non-confidential statistical outputs may be published or distributed by the Receiving Department.

Clarification of Administrative or Regulatory Purposes
Use of Information for Administrative or Regulatory Purposes means the use of confidential statistical outputs in a decision-making process that directly affects the Respondent or any other Person. This applies to all phases of work for statistical purposes.

For example, assume the Receiving Department wishes to examine the impact of changing program benefits by 10% for a particular category of Person. The first three phases conclude that the required statistical outputs are not confidential. Therefore, Phase D allows the Receiving Department to identify the number of Persons who would be affected by the change in program benefits. It is not permitted for the Receiving Department’s policy analysts, program administrators, or any other employee, to identify from the microdata obtained from Statistics Canada, whether a particular Person is included or not in the list of those who would be affected by the change in program benefits.

The Receiving Department agrees not to contact a Person (including any Respondent) to address any issue identified on the basis of the Information provided under this MOU. This includes contact to benefit a Person, such as alerting a Person to benefits or programs to which he/she could apply, or contact to conduct enforcement against a Person, such as initiating an audit or removing benefits from a Person based on the Information.

APPENDIX 'D'

RESPONSIBILITIES OF THE DATA CUSTODIAN

The Data Custodian designated by the Receiving Department pursuant to paragraph 6.1.1 of this MOU will implement the following requirements:

1. prepare a document for the use of Identified Persons, outlining the terms and conditions governing the use of the Information, as well as the procedures to send, receive, handle and store the Information (hereinafter the “Confidentiality Document”). The Confidentiality Document will include the following terms and conditions of this MOU:
   1. Confidentiality of the Information, as specified in section 4;
   2. Use of the Information, as specified in section 5;
   3. Access to the Information, as specified in section 6;
   4. Security Requirements, as specified in Appendix ‘B’; and
   5. Statistical and Research Purposes, as specified in Appendix ‘C’.

   Prior to granting access, the Data Custodian will ensure that every Identified Person who accesses the Information has agreed in writing to comply with the terms of this MOU by signing an acknowledgment that they have read, understood and agree to comply with the terms and conditions of this MOU as highlighted in the Confidentiality Document.

2. acknowledge receipt of each data file received from Statistics Canada pursuant to this MOU, and maintain a register of all such files, containing the following information:
   • Date received;
   • File name and reference period (or other information to distinguish different files from the same survey);
   • Employee who received the file from Statistics Canada;
   • Employee at Statistics Canada who sent the file;
   • Employee responsible for safekeeping of the file; and
   • Date the file was destroyed or returned to Statistics Canada (if applicable).
3. maintain a register of all persons who have been granted access to the data files received from Statistics Canada by the Receiving Department, containing the following information:
   • File name and reference period (or other information to distinguish different files from the same survey);
   • Name of Identified Person to whom access is given;
   • Justification for access;
   • Name of delegated manager who authorized access and date of authorization; and
   • Start and end dates of period for which access is authorized.

APPENDIX 'E'

AUDIT TERMS OF REFERENCE

Conditions for the Receiving Department to choose the auditor

As permitted by subsection 9.3.2 of the MOU, when Statistics Canada requires that a site inspection, a review or an audit (“Assessment”) of the compliance be performed, the Receiving Department may choose to have an accredited auditor perform the Assessment if the following conditions are met:

• 1. The Receiving Department will inform Statistics Canada of its decision within ten (10) business days of receiving Statistics Canada’s request for an Assessment;
• 2. The auditor possesses a professional accounting designation or be a Certified Internal Auditor (CIA). The audit is conducted in accordance with the Institute of Internal Audit (IIA) International Standards for the Professional Practice of Internal Auditing;
• 3. The audit is conducted using the Audit Criteria and sub criteria provided in this Appendix and the report provides exhaustive description and analysis of each point and the report is supported with engagement results for each audit criteria;
• 4. The unqualified audit report will be provided to Statistics Canada by the Receiving Department within four (4) months of the reception of a request by Statistics Canada that an Assessment be performed, and engagement working papers will be provided to Statistics Canada upon request;
• 5. Following the transmission of the audit report, the Receiving Department will provide to Statistics Canada an action plan with management response to the recommendations identified in the audit report. This action plan will be provided within two (2) weeks of the transmission of the audit report to Statistics Canada; and
• 6. The Receiving Department understands and agrees that:
  • 6.1. the results of the audit can be used for management decisions by Statistics Canada; and
  • 6.2. if Statistics Canada is not satisfied with the quality of the audit report transmitted by the Receiving Department, Statistics Canada may terminate the MOU.

Audit Criteria

• 7. Authorities, responsibilities and accountabilities, are defined, communicated, and the segregation of duties is appropriately established as follows:
  • 7.1. Responsibilities are formally defined and clearly communicated; and
  • 7.2. Authority is formally delegated and delegated authority is aligned with individuals’ responsibilities. Where applicable, incompatible functions are not combined.
• 8. The Receiving Department has established an appropriate framework to manage the requirements stipulated in the MOU as follows:
  • 8.1. Processes are in place to fulfill the requirements stipulated in the MOU;
  • 8.2. Processes are understood and are complied with; and
  • 8.3. Compliance with processes is monitored.
• 9. Management at the Receiving Department identifies, assesses the appropriateness of existing controls to effectively manage its risks, and responds to the risks that may preclude the achievement of its objectives as follows:
  • 9.1. Risks are identified;
  • 9.2. Formal processes and guidelines exist to assess the effectiveness of controls in place to manage identified risks; and
  • 9.3. Management formally responds to and monitors its risk exposure.
• 10. Data shared under the MOU is protected at the Receiving Department as follows:
  • 10.1. Access to data is limited to authorized individuals (Identified Persons) and is appropriately secured in compliance with the MOU;
  • 10.2. Access to the Information is physically restricted in accordance with the security requirements found in Appendix ‘B’;
  • 10.3. Procedures exist to safeguard the shared data upon termination of an agreement; and
  • 10.4. Procedures exist to protect the use of data from abuse or fraud.
• 11. The Receiving Department employs system application controls that meet the security requirements found in Appendix ‘B’.
• 12. Management monitors actual performance against planned results, and adjusts course as needed, to better address the requirements/ needs of the program as follows:
  • 12.1. Responsibility for monitoring is clear and communicated and results are reported to required authority levels; and
  • 12.2. Active monitoring is demonstrated.

Date modified:

2025-11-06