Guidance Document: Taking Privacy Into Account Before Making Contracting Decisions

Guidance Document: Taking Privacy Into Account Before Making Contracting Decisions is guidance issued by the Treasury Board of Canada Secretariat to federal government institutions. It applies when an institution considers contracting out an activity in which personal information about Canadians will be handled or accessed by a private-sector supplier or agency. The full text is published on canada.ca.

The document covers both the analysis an institution does before it contracts and the steps it takes while framing the contract. It is listed among the Treasury Board's privacy policies and guidance. It is written for government buyers and project authorities, not for suppliers, but its requirements shape what suppliers see in solicitations and contracts.

Pre-contract analysis the guidance expects from institutions

Before an institution contracts out work involving personal information, its analysis should address several points:

• Compliance with the Privacy Act and with Treasury Board privacy policy instruments.
• An invasion-of-privacy test.
• A core Privacy Impact Assessment, where one has not already been completed.

These steps come first. The institution works out whether and how the activity can be contracted out before any solicitation goes to market. Controls it identifies at this stage cover the collection, use, disclosure, storage, access, subcontracting and disposal of personal or sensitive information.

The Privacy Protection Checklist and procurement documents

The guidance contains a Privacy Protection Checklist. Project authorities use it to identify privacy and access-to-information measures while they frame a contract. The checklist addresses controls over collection, use, disclosure and subcontracting.

The guidance also states that restrictions on access to, use of and storage of personal information must be reflected in procurement documents. That includes the request for proposals and the statement of work. A supplier reading a solicitation will therefore find these restrictions written into the bid documents and, later, into the contract.

Links to the Privacy Act, the Policy on Privacy Protection and CanadaBuys

The guidance is associated with the federal Privacy Act, the Policy on Privacy Protection, privacy impact assessment processes and the Directive on the Management of Procurement. The Policy on Privacy Protection requires institutions to ensure that third parties under contract provide appropriate privacy protections when personal information is involved.

The CanadaBuys buyer guidance on contract security and privacy requirements directs buyers to consult the document whenever personal information will be handled or accessed by private-sector suppliers or agencies under contract. Federal organizations are also directed to consult it for contracting that involves the collection, use, disclosure, storage or disposal of personal information, as set out in the Treasury Board submissions guidance.

What it means for a supplier bidding on Canadian public contracts

The guidance is not a supplier certification, and a supplier does not apply to it or register under it. Its effect shows up in the solicitation. A bid for work involving personal information may contain privacy, confidentiality, data-handling, access, storage and subcontracting requirements, and breach-notification terms may also appear.

Bid teams should read the statement of work and contract clauses closely for these terms. They should confirm that their staff, systems and any subcontractors can meet the stated restrictions on access, use and storage. The requirements in the solicitation and the resulting contract are the ones the supplier must comply with.