Joint audit of the Access to Information and Privacy consultation process in Cabinet Confidences

Final report
January 28, 2019

Executive summary

Introduction

Rooted in the principles of openness and transparency, the Access to Information Act (ATIA) and the Privacy Act (PA) give the Canadian public a right of access to most records under the control of the Government of Canada. The ATIA and PA provide for access to all information in records controlled by government institutions unless there is a specific provision that permits or requires the head of the government institution to refuse to disclose the information, or unless the records (or part thereof) are excluded altogether by the Acts. These limited exclusions apply in cases where the need to restrict access to information has been deemed greater than the need to grant it, as in the case of confidences of the Queen’s Privy Council for Canada (commonly referred to as “Cabinet confidences”). In order to preserve the rule of confidentiality, section 69 of the ATIA and section 70 of the PA each provide that those Acts do not apply to Cabinet confidences. Cabinet confidences include Cabinet meeting agendas, Memoranda to Cabinet, and Records of Cabinet Decisions, among others, as identified in Appendix A.

Justice legal counsel and legal counsel of the Privy Council Office (PCO) play a key role in the application of Cabinet confidence exclusions. Prior to July 2013, all records identified as potentially containing Cabinet confidences by Access to Information and Privacy (ATIP) officials were subsequently reviewed by Justice legal counsel to determine whether the record may constitute a Cabinet confidence. Following Justice legal counsel’s provision of advice on potential Cabinet confidences, all records containing potential Cabinet confidences were subsequently sent to PCO’s legal counsel for a final decision as to whether a document was a Cabinet confidence.

Consultation requests with PCO legal counsel steadily increased in volume and complexity over the years, creating a backlog and delays in the consultation process. In 2013, PCO introduced a decentralized consultation process whereby ATIP officials consult Justice legal counsel on whether records contain Cabinet confidence exclusions, and consultation with PCO legal counsel is limited to specific records and circumstances. Under this new decentralized model, Justice Canada’s Centre for Information and Privacy Law (CIPL) and PCO’s Office of the Counsel to the Clerk of the Privy Council - Cabinet Confidentiality Legal Unit (CCLU) work collaboratively to continuously improve the process for consultation with regard to the application of Cabinet Confidence exclusions from disclosure.

The objective of this joint audit was to provide assurance on the management control framework over the process for consultation with legal counsel from Justice Canada and PCO with regard to the application of the Cabinet confidence exclusion from ATIP disclosure.

To achieve this objective, the processes and practices established by PCO and Justice Canada were assessed to support the review of records for exclusion from disclosure. However, the audit did not assess legal advice provided by Justice and PCO Counsel regarding what is or is not, a Cabinet confidence. Within Justice Canada, the audit included CIPL, the department’s centre of expertise in this area of the law, and a sample of Departmental Legal Services Units (DLSU) that are consulted by their client departments on the application of Cabinet confidence exclusions in response to ATIP requests. Within PCO, the audit included the CCLU of the Office of Counsel to the Clerk of the Privy Council.

Strengths

Overall, the process for consultation with PCO and Justice Canada legal counsel is well-managed. It operates effectively and in a timelier fashion than was the case prior to the 2013 change in process. Management at PCO and Justice Canada established measures to support consistent determinations of Cabinet confidence exclusions. In 2014, the Security Operations Division of PCO also revised and communicated the PCO Policy on the Security of Cabinet Confidences in relation to the proper handling and treatment, amongst others, of documents containing Cabinet confidences. In addition, there are monitoring mechanisms in place.

Areas for improvement

While the consultation process related to the application of Cabinet confidence exclusions is supported by sound management practices, there is room for improvement in the published guidance on complaint investigations. Despite clear guidance on the consultation process for the application of Cabinet confidence exclusions, Justice legal counsel would benefit from complementary guidance for consultations related to complaints about the refusal of access to Cabinet confidence records.

Audit opinion and conclusion

In our opinion, PCO and Justice jointly established a management control framework over the process for consultation with legal counsel from Justice and PCO with regard to the application of Cabinet confidence exclusions from ATIP disclosure. With the introduction of the new decentralized model in 2013, effective controls have been established that improved the timeliness of consultations. Controls are designed to support consistent determinations of Cabinet confidence exclusions by PCO and Justice legal counsel in a decentralized model. Justice legal counsel, in collaboration with CIPL, consults PCO legal counsel in circumstances such as complex determinations in line with the requirements set forth in the Treasury Board of Canada Secretariat’s (TBS) ATIP Manual. The Security Operations Division of PCO also revised and communicated the PCO Policy on the Security of Cabinet Confidences. Furthermore, PCO and Justice Canada collaboratively established monitoring mechanisms at the strategic and operating levels to maintain awareness of the state of management practices and controls, and support decision-making. An opportunity exists to develop complementary guidance for complaint-related consultations to foster a common approach across DLSUs.

Management response

1. Statement of conformance

In our professional judgment, the audit was conducted in conformance with the Institute of Internal Auditors' International Standards for the Professional Practice of Internal Auditing and with the Treasury Board Policy and Directive on Internal Audit, as supported by the results of the Quality Assurance and Improvement Program.

Submitted by:

• Anne Weldon-Lacroix
  Chief Audit Executive
  Privy Council Office
• Inanc Yazar, CPA, CGA, CIA, CRMA
  Chief Audit Executive
  Department of Justice Canada

2. Acknowledgement

The Chief Audit Executive, Privy Council Office (PCO), and the Chief Audit Executive, Justice Canada, would like to thank the audit teams and those individuals who contributed to this engagement, and particularly, employees who provided insights and comments as part of this audit.

3. Background

Authority for the audit

This Joint Audit of the Access to Information and Privacy (ATIP) Consultation Process in Cabinet Confidences was conducted collaboratively by the Audit and Evaluation Division at PCO and Internal Audit Services at Justice Canada. This joint audit was approved by the Clerk of the Privy Council and by the Deputy Minister of Justice in their respective departments’ 2016-2017 to 2018-2019 Risk-based Audit Plans.

Canada’s Cabinet and the principle of Cabinet secrecy

Canada’s Cabinet, by constitutional convention, is the body of advisors that sets the federal government’s policies and priorities for the country. It is the Prime Minister’s forum for creating consensus among the government’s ministers.

During Cabinet meetings, the Prime Minister and fellow Ministers engage in candid discussions on various matters. This freedom of expression is one of the basic ground rules for the conduct of Cabinet business, and was recognized by the Supreme Court of Canada in 2002 as essential to good government.

Scope of protection for Cabinet confidences

Rooted in the principles of openness and transparency, the Access to Information Act and the Privacy Act give the Canadian public a right of access to most records under the control of the Government of Canada. The ATIA provides this right of access in accordance with the principles that government information should be available to the public, that necessary exceptions to the right of access should be limited and specific, and that decisions on the disclosure of government information should be reviewed independently of government. The purpose of the PA is to protect the privacy of individuals with respect to personal information about themselves held by a government institution and to provide individuals with a right of access to that information.

Together, the ATIA and PA provide for access to all information in records controlled by government institutions unless there is a specific provision that permits or requires the head of the government institution responsible for the information to refuse to disclose the information, or unless the records (or part thereof) are excluded altogether from the Acts. These limited exclusions apply in cases where the need to restrict access to information has been deemed greater than the need to grant it, as in the case of confidences of the Queen’s Privy Council for Canada (commonly referred to as “Cabinet confidences”). In order to preserve the rule of confidentiality, section 69 of the ATIA and section 70 of the PA each provide that those Acts do not apply to Cabinet confidences.

Cabinet confidences are defined in the ATIA and PA by way of examples of records that are considered Cabinet confidences (see Appendix A). Cabinet confidences include information contained in Cabinet documents administered by PCO. These documents, which are part of the Cabinet Papers System, include Cabinet meeting agendas, Memoranda to Cabinet, and Records of Cabinet Decisions, among others. Cabinet confidences may also appear in other records outside the Cabinet Papers System, including draft legislation, correspondence between ministers on matters relating to government decisions, and briefing material and/or advice to ministers on matters that are before, or are proposed to be brought, before Cabinet.

While the ATIA and PA include lists of records that are considered Cabinet confidences, the determination as to whether or not an individual document (or part thereof) is a Cabinet confidence and should or should not be excluded from an access to information or privacy request can be quite complex. It is therefore necessary to carefully examine the content of the record and to consider its purpose and context in determining if it qualifies for exclusion under the ATIA or PA as a Cabinet confidence. As described in the Treasury Board of Canada Secretariat’s (TBS) Policy on Access to Information and its Policy on Privacy Protection, the Clerk of the Privy Council is responsible for policies on the administration of Cabinet confidences. To support the Clerk in the discharge of this responsibility, PCO established a consultation process for reviewing records where information that may qualify as a Cabinet confidence is identified in response to an ATIP request.

Consultation processes – 1983 to July 2013

When the ATIA and the PA were enacted in 1983, government institutions were given administrative authority to identify records that constituted Cabinet confidences and to apply the exclusions found in section 69 of the ATIA and section 70 of the PA. They would only consult with Justice legal counsel, who in turn would consult with PCO’s legal counsel, when in doubt as to whether a document was a Cabinet confidence.

In 1986, PCO assumed a greater role in determining what constitutes a Cabinet confidence. Under this new process, Justice legal counsel were required to consult with PCO’s legal counsel in all cases where a potential Cabinet confidence was identified in the context of an access request. The expansion of PCO’s role was attributed to institutions claiming Cabinet confidence exclusion for documents that did not qualify as such.¹

TBS guidance issued in 1993, and in effect until 2013, further reinforced the role of PCO in the exercise of Cabinet confidence exclusions for ATIP requests. Each government institution, when reviewing records under an ATIP request, was required to determine whether all or parts of these records may constitute a Cabinet confidence. All records identified as potential Cabinet confidences were required to be submitted to Justice legal counsel for review. In cases where Justice legal counsel agreed that the records may constitute a Cabinet confidence, the records were sent to PCO’s legal counsel. The decision as to whether a document was a Cabinet confidence was made by PCO legal counsel; as per policy, government institutions were not permitted to decide on application of the Cabinet confidence exclusion. Consultation requests with PCO legal counsel steadily increased in volume and complexity over the years, creating a backlog and delays in the consultation process. In 2013, PCO announced changes to the consultation process.

Current consultation process – July 2013 to present

The current ATIP consultation process in Cabinet confidences came into effect on July 1, 2013. In contrast to its predecessor, the current process employs a more decentralized approach, premised on a more efficient use of resources and a desire to reduce delays in responding to ATIP requests involving Cabinet confidences.

ATIP offices within government institutions continue to be required to consult with their Justice legal counsel in all instances where information that may qualify as a Cabinet confidence has been identified in response to a request under the ATIA or PA. When consulting their Justice legal counsel, the ATIP office provides Justice’s legal counsel with an explanation indicating why the record (or part thereof) should be excluded. Justice’s legal counsel, in their role as legal advisor, advise their clients if, in their opinion, the Cabinet confidence exclusion is applicable. PCO’s ATIP office continues to consult with PCO legal counsel as to whether records include Cabinet confidences.

When more complex questions arise, Justice legal counsel in Departmental Legal Services Units (DLSU) can seek legal advice on the application of the Cabinet confidence exclusion from the Centre for Information and Privacy Law (CIPL). CIPL’s mandate includes facilitating the work being carried out by Justice legal counsel who specialize in this area of the law across the Department of Justice. In contrast to the former process that required DLSUs to forward all potential Cabinet confidences to PCO for review and final determination, under the current process, Justice counsel, in collaboration with CIPL, must consult PCO’s legal counsel in the following three situations:

• If there is any doubt as to whether a record is a Cabinet confidence in cases involving complex situations;
• If there is a disagreement between the DLSU and the ATIP office about the nature of the information; or
• If the DLSU is of the view that the exception to the Cabinet confidence exclusion for discussion papers is applicable.

Complaints process and exclusions applied

In the event that a requestor is denied access to records to which he or she believes they have a right of access, he or she has the option to file a complaint. In such cases, an investigator from the Office of the Information Commissioner of Canada or the Office of the Privacy Commissioner of Canada may ask to see the records to which the requestor was refused access. The investigator cannot, however, have access to the records (or parts thereof) for which an exclusion was claimed under section 69 of the ATIA or section 70 of the PA, as applicable. In these situations, the investigator may only request confirmation that records (or parts thereof) are Cabinet confidences and a brief description of the records for which the exclusion was applied, which constitute representations of the institution as required under the applicable Act.

When a government institution receives a request for confirmation from the Information Commissioner “Notice of Intention to Investigate and Summary of Complaint” or the Privacy Commissioner, they are required to consult their Justice legal counsel to prepare the response. If there is any doubt concerning the preparation of the response to a complaint, legal counsel may contact CIPL for advice. Together, they must consult with PCO counsel in the Office of the Counsel to the Clerk of the Privy Council if PCO was involved in the initial consultation.

The Office of the Information Commissioner notifies PCO when they commence an investigation into the application of the Cabinet confidence exclusion. In 2016, the Office of the Information Commissioner also began to include CIPL on these notifications. When a notification is received by CIPL, it is forwarded to the DLSU for follow up with the ATIP office.

Consultation requests

TBS compiles annual statistical information about requests made under the ATIA and the PA to government institutions.

Number of government-wide consultations on Cabinet confidences (completed requests)

4. Audit objective

The objective of this joint audit was to provide assurance on the management control framework over the process for consultation with legal counsel from Justice Canada and PCO with regard to the application of the Cabinet confidence exclusion from ATIP disclosure.

5. Audit scope

The scope of this joint audit included the framework of internal controls (i.e., the management control framework) established and maintained by PCO and Justice Canada with respect to the review of records for exclusion from disclosure under section 69 of the Access to Information Act and section 70 of the Privacy Act. However, the audit did not assess legal advice provided by Justice and PCO counsel regarding what is, or is not, a Cabinet confidence.

For purposes of the audit, the ATIP consultation process in Cabinet confidences begins following the identification of potential Cabinet confidence exclusions by departmental officials responding to ATIP requests. Thus, the audit did not examine the role performed by other government departments’ officials (e.g., ATIP offices) in the initial identification of potential Cabinet confidences. Additionally, audit activities performed by TBS officials were excluded.

Within Justice Canada, the audit included CIPL, the department’s centre of expertise in this area of the law, and a sample of DLSUs that are consulted by their client departments on the use of the Cabinet confidence exclusion in response to ATIP requests. Within PCO, the audit included the CCLU of the Office of Counsel to the Clerk of the Privy Council, which plays a central role in the government-wide consultation process and also provides advice to the PCO ATIP office on the use of the Cabinet confidence exclusion in response to ATIP requests.

File testing included a sample of ATIP consultations for Cabinet confidence exclusions completed during 2015-2016.

6. Audit approach

The joint audit team carried out its mandate in accordance with Treasury Board’s Policy on Internal Audit and the Internal Audit Standards for the Government of Canada. The principal audit techniques used included:

• A risk assessment of the audit entity;
• Interviews with key management and counsel from PCO’s CCLU, Justice CIPL, and a sample of Justice DLSUs;
• Review of relevant documentation related to the ATIP consultation process in Cabinet confidences;
• A brief survey of designated counsel in Justice DLSUs;
• Analyses of statistics on the Access to Information Act and Privacy Act published on the Open Government website and in the TBS Access to Information and Privacy Statistical Reports 2011-12 to 2014-15; and
• A detailed examination of Cabinet confidence consultation files closed in 2015/16 from PCO and a sample of Cabinet confidence files closed in 2015-16 from eight other departments (comprising over 55 percent of all Cabinet confidence consultations for the period).

7. Findings, recommendations and management response and action plan

This section provides the findings and recommendations resulting from the audit work carried out. The audit was conducted based on the lines of enquiry and audit criteria identified in the planning phase presented in Appendix B.

7.1 Timeliness

Finding 1

The introduction of a decentralized model in 2013 improved the timeliness of consultations related to the application of Cabinet confidence exclusions from disclosure.

The process for consultation with legal counsel from Justice must be completed in a timely manner to meet the requirements of the ATIA, and to provide Canadians who filed requests under the ATIA with a timely response.

A key objective of the current decentralized model, where DLSU counsel review records that may contain Cabinet confidences, was to decrease delays in the processing of ATIP requests.

Our analysis of the duration of Cabinet confidence consultations revealed that overall, consultations are being completed in a timelier manner. Figure 1 illustrates the significant reductions in completion times since the implementation of the new decentralized model in 2013. The percentage of consultations completed within 30 days has more than doubled between 2012-2013 and 2014-2015. Moreover, our file analysis of 2015-16 consultations found that, on average, consultations performed by the sampled DLSUs were completed in 23 days, thereby fulfilling the 30-day time limit requirement stipulated in the ATIA. In conclusion, the current decentralized model improved processing times of Cabinet confidence consultation requests, which contributes to more timely responses to ATIP requests from Canadians.

The new model has had a positive impact at PCO as well. Audit results indicated that the new model has reduced the workload of PCO’s CCLU. During the last fiscal year before the changes were made (2012-2013), PCO’s CCLU received 1,308 ATIP consultation requests consisting of 121,622 pages from all departments. For the 2015-2016 fiscal year, CCLU received 124 ATIP consultation requests consisting of 10,396 pages from all departments. This new activity level represents a reduction of over 90 percent in the number of ATIP consultation requests and pages submitted to CCLU from all departments. While the reduction in the formal ATIP consultations-related workload at PCO’s CCLU was offset by increased consultations at Justice Canada’s DLSUs, efficiencies were gained with the timeliness of consultation requests by leveraging a whole-of-government approach.

7.2 Consistency of advice

Finding 2

PCO and Justice established mechanisms to support consistent determinations of Cabinet confidence exclusions.

The model for managing Cabinet confidence exclusions shifted from a centralized to a decentralized model. The increased number of counsel involved in consultations under a decentralized model warrants the establishment of measures to support consistent determinations of Cabinet confidence exclusions.

PCO and Justice have committed to maintaining consistent determinations of Cabinet confidence exclusions. As a result, PCO and Justice designed and implemented several controls to support consistent determinations of Cabinet confidence exclusions across DLSUs. They include: developing expertise; supplementary consultations; continuous training; documented guidance; and the establishment of working groups.

PCO introduced a best practice of developing counsel as experts in the determination of Cabinet confidence exclusions by designating specialized legal counsel in the CCLU at PCO to advise PCO’s ATIP office on all potential Cabinet confidence exclusions. Justice Canada adopted this best practice by designating at least one lawyer in DLSUs to advise their ATIP clients on all potential Cabinet confidence exclusions with the assistance of CIPL when required. Designated counsel are offered special training, which was jointly developed by PCO and CIPL to ensure consistency in the determinations of Cabinet confidence exclusions. An analysis of Cabinet confidence consultations revealed that the majority of consultations from 2011-12 to 2014-15 were processed in the DLSUs of 12 departments. Our survey of these DLSUs indicated that, in 2015-16, most of these DLSUs assigned Cabinet confidence consultations only to counsel designated to advise on Cabinet confidence exclusions.

PCO and Justice identified the need for Justice legal counsel to engage in supplementary consultations with PCO legal counsel, in exceptional cases, to further support consistency in the determinations of Cabinet confidence exclusions. As prescribed in Chapter 13 of TBS’ ATIP Manual, Justice legal counsel, in collaboration with CIPL, are required to consult their counterparts at PCO in the following circumstances:

• If there is any doubt as to whether a record is a Cabinet confidence in cases involving complex situations;
• If there are differing opinions between the DLSU and the ATIP office about the nature of the information; or
• If the DLSU is of the view that the exception to the Cabinet confidence exclusion for discussion papers is applicable.

These supplementary consultations contribute to consistent provisions of legal advice by leveraging the central expertise on Cabinet confidence exclusions of PCO’s legal counsel in exceptional circumstances to make a final determination on Cabinet confidence exclusions. A review of files related to supplementary consultations between PCO and Justice legal counsel confirmed that Justice legal counsel consulted PCO legal counsel in the aforementioned circumstances as per the requirements set forth in the ATIP Manual.

As part of the commitment to support consistency in the application of Cabinet confidence exclusions, PCO and Justice worked together to develop internal training sessions for counsel designated to advise on Cabinet confidence exclusions. These training sessions are offered several times annually to address key concepts and procedures for counsel to follow, and have been well-attended. An analysis determined that the majority of Justice counsel designated to advise on Cabinet confidence exclusions received periodic training on Cabinet confidences. In addition, upon implementation of the decentralized model in 2013-2014, some Justice counsel worked on assignment at PCO’s CCLU to gain more exposure to PCO’s application of Cabinet confidence exclusions.

The Government of Canada’s Policy on Access to Information states that the Clerk of the Privy Council is responsible for policies on the administration of Confidences of the Queen’s Privy Council for Canada. PCO, Justice and TBS worked together to update chapter 13 of TBS’ ATIP Manual. Furthermore, with the assistance of CCLU, CIPL provided a number of guidance documents such as presentation decks, protocols and a frequently asked questions document to support consistent provisions of legal advice.

Justice recognizes the complexity inherent in Cabinet confidence matters, and the diligent reviews of records that are required to support consistent provisions of legal advice. To this end, Justice proactively established a Cabinet confidence working group, to which CCLU generally participates, to discuss emerging issues, complex cases, and to identify common challenges related to the provisions of legal advice. The working group meets two to three times a year and counsel designated to advise on Cabinet confidence exclusions generally consider the sessions helpful.

Together, these mechanisms are a means to preserve consistent provisions of legal advice in the course of consultations. In summary, mechanisms were collaboratively established by Justice and PCO to support consistent determinations of cabinet confidence exclusions. This helps to protect Cabinet confidences, and to support the operation of the decentralized consultation model.

7.3 Complaint process

Finding 3

Chapter 13 of the ATIP Manual provides detailed guidance on the process for consultation related to the application of Cabinet confidence exclusions. However, it conveys limited procedural guidance for justice legal counsel to apply during consultations related to the investigations of complaints. An opportunity exists to develop complementary guidance for complaint-related consultations to support a common approach across DLSUs.

According to TBS’ ATIP Statistical Reports, 1,312 Cabinet confidence consultation requests were completed across government institutions in 2014-15. The ATIA allows requestors to file complaints about the refusal of access to records. In 2014-15, the Office of the Information Commissioner reported that 35 complaints were filed about the refusal of access to records deemed to be Cabinet confidences. When complaints are filed, government institutions may be asked to confirm if a record or parts of a record are Cabinet confidences. Chapter 13 of the TBS ATIP Manual conveys responsibilities, authorities and accountabilities of PCO and Justice in relation to the exclusion of Cabinet confidences from ATIP requests. It also provides general guidance on the complaint process which includes a requirement for consultation with counsel designated to advise on Cabinet confidence consultations in the event of a complaint. However, it does not contain procedural guidance on the approach that must be followed by counsel designated to advise on Cabinet confidence consultations during complaint-related consultations.

Counsel designated to advise on Cabinet confidence exclusions reported different approaches during complaint-related consultations. For example, upon receipt of a complaint, the same counsel would re-perform the review to validate their initial recommendations. Another approach focused solely on the review of ATIP’s response to the Information Commissioner to confirm that it did not contain any Cabinet confidences.

Without clear expectations for the treatment of complaint-related consultations, these consultations may not be consistently processed using a common approach across DLSUs. Counsel designated to advise on Cabinet confidence exclusions would benefit from explicit complementary guidance to support a common approach for the treatment of complaint-related consultations.

Recommendation 1

It is recommended that the Assistant Deputy Minister, Public Law and Legislative Services Sector work in collaboration with Counsel to the Clerk of the Privy Council to:

Develop guidance to support a common approach for Justice Canada’s legal counsel’s review of excluded records that are the subject of complaints.

7.4 Monitoring

Finding 4

Monitoring mechanisms are in place to support the operations of the Cabinet confidences consultation process.

Management’s engagement in monitoring activities is critical to maintain continuous awareness of the state of management practices and controls. It also enables a better understanding of the effectiveness of management practices which provides sound information for decision-making.

Mechanisms are in place to facilitate monitoring of the consultation process for Cabinet confidences. PCO and Justice have established strong communication channels between the departments with respect to the consultation process. PCO’s CCLU and Justice CIPL convene bi-weekly meetings to discuss specific files as well as process-related issues. In addition, PCO’s CCLU and Justice CIPL also meet monthly with TBS to discuss matters related to the consultation process. Justice CIPL is also kept abreast of operational challenges and/or opportunities related to Cabinet confidence consultations using Justice Canada’s Cabinet confidence working group. This forum provides collaborative opportunities for counsel designated to advise on Cabinet confidence exclusions, which increase awareness of Cabinet confidence issues and/or opportunities observed during consultations to support continuous improvements. Together, these monitoring measures are intended to maintain management’s ability to provide timely consultations going forward, based on the consistent application of professional judgment.

In summary, the aforementioned mechanisms support management’s awareness of the state of the Cabinet confidence consultation process by providing sound information for decision-making.

7.5 Security protocols

Finding 5

PCO revised and communicated its Policy on the Security of Cabinet Confidences.

Cabinet confidences are protected by legislative provisions in the Canada Evidence Act, the Access to Information Act, and the Privacy Act. These legislative requirements warrant the establishment of security measures such as a security policy with protocols to protect Cabinet confidences from unauthorized disclosure or other forms of compromise.

Audit results indicated that the security policy for handling documents which contain Cabinet confidences is in place, and well-understood both at PCO and across the various departments. The policy was revised by PCO’s Security Operations Division in consultation with PCO’s CCLU and covers a wide range of areas including preparation, storage, transmission and classification of materials which contain Cabinet confidences. The security policy is widely disseminated, and is easily accessible on the intranet. Audit testing indicated that at PCO, requests with Cabinet confidences implications are duly submitted to CCLU using the approved security mechanisms. Interviews with senior management of the CCLU, senior management of PCO’s ATIP function, and counsel from Justice Canada’s DLSUs confirmed there is overall satisfaction with the security policy in place.

8. Audit opinion

In our opinion, PCO and Justice jointly established an effective management control framework over the process for consultation with legal counsel from Justice and PCO with regard to the application of Cabinet confidence exclusions from ATIP disclosure. With the introduction of the new decentralized model in 2013, effective controls have been established that improved the timeliness of consultations. Controls are designed to support consistent determinations of Cabinet confidence exclusions by PCO and Justice legal counsel in a decentralized model. Justice legal counsel, in collaboration with CIPL, consults PCO legal counsel in circumstances such as complex determinations in line with the requirements set forth in the ATIP Manual. The Security Operations Division of PCO also revised and communicated the PCO security policy for handling documents which contain Cabinet confidences. Furthermore, PCO and Justice Canada collaboratively established monitoring mechanisms at the strategic and operating levels to maintain awareness of the state of management practices and controls, and to support decision-making. An opportunity exists to develop complementary guidance for complaint-related consultations to foster a common approach across DLSUs.

Appendix A – Access to Information Act and Privacy Act

Cabinet confidences are defined in section 69 of the Access to Information Act by way of a non-exhaustive list of documents that are considered confidences of the Queen’s Privy Council for Canada (Cabinet confidences).

Section 69 of the Access to Information Act

Confidences of the Queen’s Privy Council for Canada

69 (1) This Act does not apply to confidences of the Queen’s Privy Council for Canada, including, without restricting the generality of the foregoing,

1. (a) memoranda the purpose of which is to present proposals or recommendations to Council;
2. (b) discussion papers the purpose of which is to present background explanations, analyses of problems or policy options to Council for consideration by Council in making decisions;
3. (c) agenda of Council or records recording deliberations or decisions of Council;
4. (d) records used for or reflecting communications or discussions between ministers of the Crown on matters relating to the making of government decisions or the formulation of government policy;
5. (e) records the purpose of which is to brief ministers of the Crown in relation to matters that are before, or are proposed to be brought before, Council or that are the subject of communications or discussions referred to in paragraph (d);
6. (f) draft legislation; and
7. (g) records that contain information about the contents of any record within a class of records referred to in paragraphs (a) to (f).

Definition of Council

(2) For the purposes of subsection (1), Council means the Queen’s Privy Council for Canada, committees of the Queen’s Privy Council for Canada, Cabinet and committees of Cabinet.

Exception

(3) Subsection (1) does not apply to

1. (a) confidences of the Queen’s Privy Council for Canada that have been in existence for more than twenty years; or
2. (b) discussion papers described in paragraph (1)(b)
   1. (i) if the decisions to which the discussion papers relate have been made public, or
   2. (ii) where the decisions have not been made public, if four years have passed since the decisions were made.

Cabinet confidences are also defined in section 70 of the Privacy Act by way of a non-exhaustive list of documents that are considered confidences of the Queen’s Privy Council for Canada (Cabinet confidences). Note that there is no equivalent to Access to Information Act paragraph 69(1)(g) in section 70 of the Privacy Act.

Section 70 of the Privacy Act

Confidences of the Queen’s Privy Council for Canada

70 (1) This Act does not apply to confidences of the Queen’s Privy Council for Canada, including, without restricting the generality of the foregoing, any information contained in

1. (a) memoranda the purpose of which is to present proposals or recommendations to Council;
2. (b) discussion papers the purpose of which is to present background explanations, analyses of problems or policy options to Council for consideration by Council in making decisions;
3. (c) agenda of Council or records recording deliberations or decisions of Council;
4. (d) records used for or reflecting communications or discussions between ministers of the Crown on matters relating to the making of government decisions or the formulation of government policy;
5. (e) records the purpose of which is to brief ministers of the Crown in relation to matters that are before, or are proposed to be brought before, Council or that are the subject of communications or discussions referred to in paragraph (d); and
6. (f) draft legislation.

Definition of Council

(2) For the purposes of subsection (1), Council means the Queen’s Privy Council for Canada, committees of the Queen’s Privy Council for Canada, Cabinet and committees of Cabinet.

Exception

(3) Subsection (1) does not apply to

1. (a) confidences of the Queen’s Privy Council for Canada that have been in existence for more than twenty years; or
2. (b) discussion papers described in paragraph (1)(b)
   1. (i) if the decisions to which the discussion papers relate have been made public, or
   2. (ii) where the decisions have not been made public, if four years have passed since the decisions were made.

Appendix B – Audit criteria

3.1 Comprehensive training and development opportunities on the ATIP consultation process in Cabinet confidences are developed and provided by CIPL and PCO for designated counsel in DLSUs.

3.2 Information necessary to support the functioning of internal control over the ATIP consultation process in Cabinet confidences is communicated.

3.3 PCO communicates protocols for the security of Cabinet confidence information.

4.1 Control activities for the ATIP consultation process in Cabinet confidences have been selected and developed to treat risks deemed to be unacceptable by management.

4.2 Designated counsel working in DLSUs review and advise their clients on all potential Cabinet confidence exclusions identified by their clients in response to ATIP requests.

4.3 Legal counsel in the Cabinet Confidentiality Legal Unit, PCO review and advise the PCO ATIP office on all potential Cabinet confidence exclusions identified by the PCO ATIP office in response to ATIP requests.

4.4 Justice legal counsel consults with PCO as required in section 13.4.5 (b) of the Access to Information Manual.

4.5 Complaints about the application of the Cabinet confidence exclusion are appropriately reviewed by Justice legal counsel, including consultation with the Cabinet Confidentiality Legal Unit, PCO in situations when there is doubt concerning the preparation of the response.

Appendix C – Acronyms