{"id":8629,"date":"2023-11-02T14:45:54","date_gmt":"2025-02-03T19:45:31","guid":{"rendered":"https:\/\/dev.nsira-ossnr.gc.ca\/reviews\/our-reviews\/review-of-government-of-canada-institutions-disclosures-of-information-under-the-security-of-canada-information-disclosure-act-in-2022-2\/"},"modified":"2025-02-25T08:52:01","modified_gmt":"2025-02-25T13:52:01","slug":"report","status":"publish","type":"page","link":"https:\/\/nsira-ossnr.gc.ca\/en\/reviews\/find-a-review\/23-03\/report\/","title":{"rendered":"Review of Government of Canada Institutions\u2019 Disclosures of Information Under the Security of Canada Information Disclosure Act in 2022: Report"},"content":{"rendered":"\n
\n
\n
\n
\n
\n \n

\n Review of Government of Canada Institutions\u2019 Disclosures of Information Under the Security of Canada Information Disclosure Act in 2022 <\/h1>\n\n
\n\n \n

\n Report <\/h2>\n \n \n\n <\/div>\n <\/div>\n <\/div>\n <\/div>\n<\/div>\n\n\n
\n
\n
Table of Contents<\/div><\/div><\/div>
  1. List of Acronyms<\/a><\/li>
  2. Glossary of Terms<\/a><\/li>
  3. Executive summary<\/a><\/li>
  4. 1. Introduction<\/a>
    1. Authority<\/a><\/li>
    2. Scope of the Review<\/a><\/li>
    3. Methodology<\/a><\/li>
    4. Review Statements<\/a><\/li><\/ol><\/li>
    5. 2. Backgrounder<\/a><\/li>
    6. 3. Findings, Analysis, and recommendations<\/a>
      1. Volume and Nature of Disclosures<\/a><\/li>
      2. Record Keeping<\/a><\/li>
      3. Format of Records<\/a><\/li>
      4. Preparing and Keeping Records: Subsections 9(1) and 9(2)<\/a><\/li>
      5. Disclosure of Information<\/a><\/li><\/ol><\/li>
      6. 4. Conclusion<\/a><\/li>
      7. Annex A. Record Keeping Obligations for Disclosing and Recipient Institutions<\/a>
        1. Copy to National Security and Intelligence Review Agency<\/a><\/li><\/ol><\/li>
        2. Annex B. Sample of Disclosures<\/a><\/li>
        3. Annex C. Overview of SCIDA Disclosures in Prior Years<\/a><\/li>
        4. Annex D. Findings and Recommendations<\/a>
          1. Findings<\/a><\/li>
          2. Recommendations<\/a><\/li><\/ol><\/li><\/ol><\/div><\/div><\/div><\/section>\n\n\n\n
            \n<\/div><\/div>\n\n\n\n
            \n

            Date of Publishing:<\/strong><\/p>\n\n\n

            \n
            <\/i>Download PDF<\/span><\/a><\/span><\/div>\n<\/div><\/div>\n\n\n\n

            List of Acronyms<\/h2>\n\n\n\n\n\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t
            CBSA<\/strong><\/td>\n\t\t\tCanada Border Services Agency<\/td>\n\t\t<\/tr>\n\t\t
            CFIA<\/strong><\/td>\n\t\t\tCanadian Food Inspection Agency<\/td>\n\t\t<\/tr>\n\t\t
            CNSC<\/strong><\/td>\n\t\t\tCanadian Nuclear Safety Commission<\/td>\n\t\t<\/tr>\n\t\t
            CRA<\/strong><\/td>\n\t\t\tCanada Revenue Agency<\/td>\n\t\t<\/tr>\n\t\t
            CSE<\/strong><\/td>\n\t\t\tCommunications Security Establishment<\/td>\n\t\t<\/tr>\n\t\t
            CSIS<\/strong><\/td>\n\t\t\tCanadian Security Intelligence Service<\/td>\n\t\t<\/tr>\n\t\t
            DND\/CAF<\/strong><\/td>\n\t\t\tDepartment of National Defence\/Canadian Armed Forces<\/td>\n\t\t<\/tr>\n\t\t
            FINTRAC<\/strong><\/td>\n\t\t\tFinancial Transactions and Reports Analysis Centre of Canada<\/td>\n\t\t<\/tr>\n\t\t
            GAC<\/strong><\/td>\n\t\t\tGlobal Affairs Canada<\/td>\n\t\t<\/tr>\n\t\t
            GC<\/strong><\/td>\n\t\t\tGovernment of Canada<\/td>\n\t\t<\/tr>\n\t\t
            IRCC<\/strong><\/td>\n\t\t\tImmigration, Refugees and Citizenship Canada<\/td> \n\t\t<\/tr>\n\t\t
            NSIRA<\/strong><\/td>\n\t\t\tNational Security and Intelligence Review Agency<\/td>\n\t\t<\/tr>\n\t\t
            PHAC<\/strong><\/td>\n\t\t\tPublic Health Agency of Canada<\/td>\n\t\t<\/tr>\n\t\t
            PS<\/strong><\/td>\n\t\t\tPublic Safety Canada<\/td>\n\t\t<\/tr>\n\t\t
            RCMP<\/strong><\/td>\n\t\t\tRoyal Canadian Mounted Police<\/td>\n\t\t<\/tr>\n\t\t
            SCIDA<\/strong><\/td>\n\t\t\tSecurity of Canada Information Disclosure Act<\/td>\n\t\t<\/tr>\n\t\t
            TC<\/strong><\/td>\n\t\t\tTransport Canada<\/td>\n\t\t<\/tr>\n\t<\/tbody>\n<\/table>\n\n\n\n

            Glossary of Terms<\/h2>\n\n\n\n\n\t\n\t\t\n\t\t\t\n\t\t\t
            Contribution test<\/strong><\/td>\n\t\t\tThe first part of the two-part threshold that must be met before an institution can make a disclosure under the SCIDA: it must be satisfied that the information will contribute to the exercise of the recipient institution’s jurisdiction or responsibilities in respect of activities that undermine the security of Canada (paragraph 5(1)(a)).<\/td>\n\t\t<\/tr>\n\t\t
            Proportionality test<\/strong><\/td>\n\t\t\tThe second part of the two-part threshold that must be met before an institution can make a disclosure under the SCIDA: it must be satisfied that the information will not affect any person’s privacy interest more than reasonably necessary in the circumstances (paragraph 5(1)(b)).<\/td>\n\t\t<\/tr>\n\t<\/tbody>\n<\/table>\n\n\n\n

            Executive summary<\/h2>\n\n\n\n

            This review provides an overview of the Security of Canada Information Disclosure Act <\/em>(SCIDA)\u2019s use in 2022. In doing so, it documents the volume and nature of information disclosures made under the SCIDA; assesses compliance with the SCIDA; and highlights patterns in the SCIDA\u2019s use across Government of Canada (GC) institutions and over time.<\/p>\n\n\n\n

            In 2022, four disclosing institutions made a total of 173 disclosures to five recipient institutions. The National Security and Intelligence Review Agency (NSIRA) found that institutions complied with the SCIDA\u2019s requirements for disclosure and record keeping in relation to the majority of these disclosures. Instances of non-compliance related to subsection 9(3), regarding the timeliness of records copied to NSIRA; subsection 5.1(1), regarding the timeliness of destruction or return of personal information; and subsection 5(2), regarding the provision of a statement on accuracy and reliability. The observed non-compliance did not point to any systemic failures in GC institutions\u2019 implementation of the SCIDA.<\/p>\n\n\n\n

            NSIRA also made findings in relation to practices that, although compliant with the SCIDA, left room for improvement. These findings related to:<\/p>\n\n\n\n

              \n
            • the use of information sharing arrangements;<\/li>\n\n\n\n
            • the format of records prepared by institutions and copied to NSIRA, including the characteristics of effective records;<\/li>\n\n\n\n
            • the nature of information provided under paragraph 9(1)(e) and relied upon in the conduct of assessments under subsection 5(1);<\/li>\n\n\n\n
            • the provision of statements regarding accuracy and reliability prepared under subsection 5(2); and<\/li>\n\n\n\n
            • the timeliness of administrative processes supporting information disclosure.<\/li>\n<\/ul>\n\n\n\n

              NSIRA made six recommendations designed to increase standardization across the GC in a manner that is consistent with institutions\u2019 demonstrated best practices and the SCIDA\u2019s guiding principles.<\/p>\n\n\n\n

              Overall, NSIRA observed improvements in reviewee performance as compared with findings from prior years\u2019 reports and over the course of the review. These improvements include corrective actions taken by reviewees in response to NSIRA\u2019s requests for information in support of this review.<\/p>\n\n\n\n

              1. Introduction<\/h2>\n\n\n\n

              Authority<\/h3>\n\n\n\n

              This review was conducted pursuant to paragraph 8(1)(b) and subsection 39(1) of the National Security and Intelligence Review Agency Act<\/em> (NSIRA Act).<\/p>\n\n\n\n

              Scope of the Review<\/h3>\n\n\n\n

              This review provides an overview of the Security of Canada Information Disclosure Act <\/em>(SCIDA)\u2019s use in 2022. In doing so, it:<\/p>\n\n\n\n

                \n
              1. Documents the volume and nature of information disclosures made under the SCIDA;<\/li>\n\n\n\n
              2. Assesses Government of Canada (GC) institutions\u2019 compliance with the SCIDA\u2019s requirements for record keeping;<\/span><\/li>\n\n\n\n
              3. Assesses GC institutions\u2019 compliance with the SCIDA\u2019s requirements for disclosure, including the destruction or return of personal information, as appropriate; and<\/li>\n\n\n\n
              4. Highlights patterns in the SCIDA\u2019s use across GC institutions and over time.<\/li>\n<\/ol>\n\n\n\n

                The review\u2019s scope was defined by records provided to NSIRA under the SCIDA, subsection 9(3) (see Annex A for a copy of institutions\u2019 section 9 obligations under the Act). As such, the review\u2019s assessment of compliance was limited to the seven GC institutions identified within these records as either disclosers or recipients (Canada Border Services Agency [CBSA], Communications Security Establishment [CSE], Canadian Security Intelligence Service [CSIS], Department of National Defence\/Canadian Armed Forces [DND\/CAF], Global Affairs Canada [GAC], Immigration, Refugees and Citizenship Canada [IRCC], and the Royal Canadian Mounted Police [RCMP]); and to instances of information disclosure where the SCIDA was identified by these institutions as an authority for disclosure. The review also included Public Safety Canada (PS) in its capacity as manager of the Strategic Coordination Centre on Information Sharing, which provides SCIDA-related policy guidance and training across the GC. <\/p>\n\n\n\n

                The review satisfies the NSIRA Act\u2019s section 39 requirement for NSIRA to report to the Minister of Public Safety on disclosures made under the SCIDA during the previous calendar year.<\/p>\n\n\n\n

                Methodology<\/h3>\n\n\n\n

                The review\u2019s primary source of information was records provided to NSIRA by disclosing and recipient institutions under the SCIDA, subsection 9(3). NSIRA also identified a targeted sample of disclosures for which it requested and assessed all associated documents provided by both the disclosing and recipient institution. This information was supplemented by a document review of institutions\u2019 SCIDA policies and procedures, and related explanations.<\/p>\n\n\n\n

                NSIRA assessed administrative compliance with the SCIDA\u2019s record-keeping obligations in relation to all disclosures identified in the records provided to NSIRA under subsection 9(3) (N<\/em>=173). Where these records were incomplete, NSIRA provided an opportunity for institutions to supply the missing records. NSIRA accounted for such late submissions in its assessment of compliance with subsections 9(1) and 9(2).<\/p>\n\n\n\n

                NSIRA assessed substantive compliance with the SCIDA\u2019s disclosure requirements in relation to the sample of disclosures (n=19). The sample was designed to reflect a non-representative cross-section of the SCIDA\u2019s use, with particular attention to areas at higher risk of non-compliance. Disclosures were selected for the sample based on the content of records provided to NSIRA under subsection 9(3), according to defined parameters (see Annex B, Sample of Disclosures).<\/p>\n\n\n\n

                Review Statements<\/h3>\n\n\n\n

                NSIRA found that, overall, its expectations for responsiveness by CSE, CSIS, DND\/CAF, GAC, IRCC, PS, and RCMP during this review were met. Its expectations for responsiveness by CBSA were partially met, as CBSA required repeated follow-up to provide the requested information.<\/p>\n\n\n\n

                NSIRA was able to verify information for this review in a manner that met NSIRA\u2019s expectations.<\/p>\n\n\n\n

                2. Backgrounder<\/h2>\n\n\n\n

                The SCIDA provides an explicit, stand-alone authority to disclose information between GC institutions in order to protect Canada against activities that undermine its security. Its stated purpose is to encourage and facilitate such disclosures.<\/p>\n\n\n\n

                Section 9 of the SCIDA prescribes record-keeping obligations for all institutions who (1) disclose or (2) receive information under the Act. Each paragraph under subsections 9(1) and 9(2) identifies particular elements that must be set out in the records prepared and kept by each institution (see Annex A). Subsection 9(3) requires that these records be provided to NSIRA within 30 days after the end of each calendar year.<\/p>\n\n\n\n

                Subsection 5(1) of the SCIDA authorizes GC institutions to disclose information \u2013 subject to any prohibitions or restrictions in other legislation or regulations \u2013 to designated recipient institutions, if the disclosing institution is satisfied that (a) the information will contribute to the exercise of the recipient institution\u2019s jurisdiction or responsibilities in respect of activities that undermine the security of Canada (the \u201ccontribution test\u201d); and (b) the information will not affect any person\u2019s privacy interest more than is reasonably necessary in the circumstances (the \u201cproportionality test\u201d).<\/p>\n\n\n\n

                Subsection 5(2) requires institutions that disclose information under subsection (1) to, at the time of the disclosure, also provide information regarding its accuracy and the reliability of the manner in which it was obtained.<\/p>\n\n\n\n

                When a GC institution receives information under the Act, subsection 5.1(1) requires that the institution destroy or return any unnecessary personal information as soon as feasible after receiving it.<\/p>\n\n\n\n

                The Act\u2019s guiding principles underscore the importance of effectiveness and responsibility across disclosure activities. Of note, subsection 4(c) sets out that information sharing arrangements are appropriate in particular circumstances.<\/p>\n\n\n\n

                3. Findings, Analysis, and recommendations<\/h2>\n\n\n\n

                Volume and Nature of Disclosures<\/h3>\n\n\n\n

                In 2022, four disclosing institutions made a total of 173 disclosures to five recipient institutions (see Table 1). 79% (n<\/em>=136) of these disclosures were requested by the recipient institution. The other 21% of disclosures (n<\/em>=37) were sent proactively by the disclosing institution.<\/p>\n\n\n\n

                Table 1: Number of SCIDA disclosures made in 2022, by disclosing and recipient institution [all disclosures (proactive disclosures)]<\/h4>\n\n\n\n\n\t\n\t\t\n\t\t\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t
                 <\/td>\n\t\t\t <\/td>\n\t\t\tDesignated Recipient Institutions<\/strong><\/td>\n\t\t<\/tr>\n\t<\/thead>\n\t
                Disclosing Institution<\/strong><\/td>\n\t\t\t <\/td>\n\t\t\tCBSA<\/td>\n\t\t\tCFIA<\/td>\n\t\t\tCNSC<\/td>\n\t\t\tCRA<\/td>\n\t\t\tCSE<\/td>\n\t\t\tCSIS<\/td>\n\t\t\tDND\/CAF<\/td>\n\t\t\tFinance<\/td>\n\t\t\tFINTRAC<\/td>\n\t\t\tGAC<\/td>\n\t\t\tHealth<\/td>\n\t\t\tIRCC<\/td>\n\t\t\tPHAC<\/td>\n\t\t\tPSC<\/td>\n\t\t\tRCMP<\/td>\n\t\t\tTC<\/td>\n\t\t\tTOTAL (proactive)<\/td>\n\t\t<\/tr>\n\t\t
                CBSA<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t4
                \n\t\t\t(3)<\/td>\n\t\t\t                		–<\/td>\n\t\t\t4
                \n\t\t\t(3)<\/td>\n\t\t<\/tr>\n\t\t
                GAC<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t39
                \n\t\t\t(18)<\/td>\n\t\t\t                		2
                \n\t\t\t(2)<\/td>\n\t\t\t                		–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t12
                \n\t\t\t(12)<\/td>\n\t\t\t                		–<\/td>\n\t\t\t53
                \n\t\t\t(32)<\/td>\n\t\t<\/tr>\n\t\t
                IRCC<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t59
                \n\t\t\t(0)<\/td>\n\t\t\t                		56
                \n\t\t\t(2)<\/td>\n\t\t\t                		–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t115
                \n\t\t\t(2)<\/td>\n\t\t<\/tr>\n\t\t
                RCMP<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t1
                \n\t\t\t(0)<\/td>\n\t\t\t                		–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t1
                \n\t\t\t(0)<\/td>\n\t\t<\/tr>\n\t\t
                TOTAL (proactive)<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n–<\/td>\n\t\t\t59
                \n\t\t\t(0)<\/td>\n\t\t\t                		95
                \n\t\t\t(20)<\/td>\n\t\t\t                		2
                \n\t\t\t(2)<\/td>\n\t\t\t                		–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t1
                \n\t\t\t(0)<\/td>\n\t\t\t                		–<\/td>\n\t\t\t–<\/td>\n\t\t\t16
                \n\t\t\t(15)<\/td>\n\t\t\t                		–<\/td>\n\t\t\t173
                \n\t\t\t(37)<\/td>\n\t\t<\/tr>\n\t<\/tbody>\n<\/table>\n\n\n\n

                The total number of disclosures made under the SCIDA since its implementation reflects a slight downward trend, with a generally constant proportion of requested versus proactive disclosures for the years in which this data was collected (see Figure 1).<\/p>\n\n\n\n

                Figure 1: Number of SCIDA disclosures over time<\/h4>\n\n\n\n
                \"\"<\/figure>\n\n\n\n

                In 2022, these disclosures were made and received by institutions that had each disclosed or received information, as the case may be, in at least two prior review years (see Annex C, Overview of SCIDA Disclosures in Prior Years).<\/p>\n\n\n\n

                Finding 1:<\/strong> NSIRA found that CSE, CSIS, GAC, and IRCC regularly use the SCIDA in a manner that warrants information sharing arrangements, as encouraged by subsection 4(c) of the SCIDA.<\/strong><\/p>\n\n\n\n

                CSE, CSIS, GAC, and IRCC were the most frequent users of the SCIDA in 2022. The number of disclosures between these institutions was comparable to those observed by NSIRA in prior years (see Annex C), indicating the occurrence of regular exchange over time.<\/p>\n\n\n\n

                NSIRA also observed regular patterns in the purpose and nature of the information exchanged between these institutions in 2022, as described in Table 2. These information exchanges were not governed by up-to-date information sharing arrangements.<\/p>\n\n\n\n

                Table 2: Nature of disclosures between the SCIDA\u2019s most frequent users<\/h4>\n\n\n\n\n\t\n\t\t\n\t\t\t\n\t\t\n\t\t\t
                GAC-to-CSIS (N=39)<\/th>\n\t\t\tIRCC-to-CSIS (N=56)<\/th>\n\t\t\tIRCC-to-CSE (N=59)<\/th>\n\t\t<\/tr>\n\t<\/thead>\n\t
                \n\t\t\t
                  \n\t\t\t\t
                • GAC information holdings relevant to threats to the security of Canada<\/li>\n\t\t\t\t
                • Often (85%) made in direct response, or as a follow-up, to CSIS requests<\/li>\n\t\t\t<\/ul>\n\t\t\t<\/td>\n\t\t\t
                		\n\t\t\t
                  \n\t\t\t\t
                • \tIRCC information holdings relevant to threats to the security of Canada<\/li>\n\t\t\t\t
                • \tAlmost always (96%) made in response to CSIS requests<\/li>\n\t\t\t<\/ul>\n\t\t\t<\/td>\n\t\t\t
                		\n\t\t\t
                  \n\t\t\t\t
                • IRCC confirmation of Canadian status of named individuals of interest, required to ensure lawfulness of CSE operational activities<\/li>\n\t\t\t\t
                • All (100%) made in response to CSE requests<\/li>\n\t\t\t<\/ul>\n\t\t\t<\/td>\n\t\t<\/tr>\n\t<\/tbody>\n<\/table>\n\n\n\n

                  NSIRA has previously recommended that information sharing arrangements be updated (for GAC and CSIS) or created (for IRCC and CSE) to govern certain information exchanges made under the SCIDA.<\/p>\n\n\n\n

                  Recommendation 1: NSIRA recommends that information sharing arrangements be used to govern regular SCIDA disclosures between GAC and CSIS; IRCC and CSIS; as well as IRCC and CSE.<\/strong><\/p>\n\n\n\n

                  Record Keeping<\/h3>\n\n\n\n

                  Copy to NSIRA: Subsection 9(3)<\/h4>\n\n\n\n

                  Finding 2: NSIRA found that CBSA, DND\/CAF, and IRCC were non-compliant with subsection 9(3) of the SCIDA, as they failed to provide all records created under subsections 9(1) or 9(2) to NSIRA within the legislated timeframe.<\/strong><\/p>\n\n\n\n

                  Requests for information from NSIRA during the course of this review prompted the late production of additional records relating to paragraphs under subsections 9(1) or 9(2) from each of CBSA, DND\/CAF, and IRCC (see Table 3).<\/p>\n\n\n\n

                  Table 3: Number [and associated subsection 9(1) or 9(2) paragraph] of late records leading to non-compliance with subsection 9(3), by cause<\/h4>\n\n\n\n\n\t\n\t\t\n\t\t\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\t
                  <\/th>\t\t\t\n\t\t\tAdministrative Error<\/th>\n\t\t\tDelayed Preparation of Records<\/th>\n\t\t<\/tr>\n\t<\/thead>\n\t
                  CBSA<\/td>\n\t\t\t2 [paragraph 9(1)(e)]<\/td>\n\t\t\t–<\/td>\n\t\t<\/tr>\n\t\t
                  DND\/CAF<\/td>\n\t\t\t–<\/td>\n\t\t\t2 [paragraphs 9(2)(e-g)]<\/td>\n\t\t<\/tr>\n\t\t
                  IRCC<\/td>\n\t\t\t6 [paragraph 9(1)(e)]<\/td>\n\t\t\t1 [paragraphs 9(2)(e-g)]<\/td>\n\t\t<\/tr>\n\t<\/tbody>\n<\/table>\n\n\n\n

                  CBSA and IRCC were non-compliant with subsection 9(3) due to administrative error; the records they eventually supplied had existed at the time of the reporting deadline, but were not copied to NSIRA as required.<\/p>\n\n\n\n

                  NSIRA expected that all records would be prepared within 30 days after the end of the calendar year, in order to meet the subsection 9(3) requirement to provide a copy of those records to NSIRA within that timeframe.<\/p>\n\n\n\n

                  DND\/CAF and IRCC were non-compliant with subsection 9(3) on account of delayed preparation of records; they did not prepare the records referred to in Table 3 within 30 days after the end of the calendar year, and therefore did not provide a copy of them to NSIRA within the legislated timeframe.<\/p>\n\n\n\n

                  NSIRA underscores the importance of administrative precision and timeliness in preparing records and copying them to NSIRA.<\/p>\n\n\n\n

                  Format of Records<\/h3>\n\n\n\n

                  Finding 3: NSIRA found improved compliance outcomes in instances where departments prepared record overview spreadsheets under subsections 9(1) and 9(2) of the SCIDA that displayed the following characteristics:<\/strong><\/p>\n\n\n\n

                    \n
                  • a row for each disclosure made or received;<\/strong><\/li>\n\n\n\n
                  • columns explicitly tied to each individual paragraph under section 9; and<\/strong><\/li>\n\n\n\n
                  • additional columns to capture relevant administrative details, such as whether the disclosure was requested or proactive; the date of the request (if applicable); and any applicable file reference numbers.<\/strong><\/li>\n<\/ul>\n\n\n\n

                    The SCIDA does not specify a format for records prepared under section 9. Accordingly, in 2022, GC institutions fulfilled their record-keeping obligations in different ways.<\/p>\n\n\n\n

                    Most institutions provided NSIRA with an overview of each disclosure made or received. These overviews were submitted to NSIRA as spreadsheets that generally captured the information required in records under subsections 9(1) and 9(2).<\/p>\n\n\n\n

                    Most institutions also provided NSIRA with a copy of the disclosure itself and a selection of related documents. These documents often included email consultations with legal services, disclosure request letters, and other correspondence between disclosing and recipient institutions. The scope of requests for information in the course of the review was minimized in cases where institutions provided such documents.<\/p>\n\n\n\n

                    DND\/CAF and IRCC (for its one disclosure receipt) were the only institutions that originally provided NSIRA with a copy of the raw disclosure, including transmittal details, in the absence of a record overview or other related documents.<\/p>\n\n\n\n

                    NSIRA observed that DND\/CAF and IRCC\u2019s choice in records format for these disclosures contributed to their non-compliance with subsection 9(3), described in Table 3. The information elicited under paragraphs 9(2)(e-g) cannot by definition be found within a copy of the disclosure itself, as it relates to action taken by recipient institutions following the disclosure\u2019s receipt. A copy of the disclosure on its own is therefore insufficient to comply with all requirements under subsection 9(2).<\/p>\n\n\n\n

                    Both DND\/CAF and IRCC were infrequent recipients of disclosures under the SCIDA in 2022, accounting for only two and one disclosures, respectively. Each of the more frequent recipients of information (CSE, CSIS, and RCMP) included express columns in their record overview spreadsheets to capture whether and, if applicable, when personal information was destroyed or returned, per the requirements of paragraphs 9(2)(e-g).<\/p>\n\n\n\n

                    NSIRA also observed that CBSA and IRCC\u2019s choice in records format contributed to their non-compliance with subsection 9(3) due to administrative error. These institutions did not account for the full scope of information required under paragraph 9(1)(e) in their record overview spreadsheets.<\/p>\n\n\n\n

                    The information relied upon to satisfy the disclosing institution that a disclosure is authorized under the Act is not required to be conveyed within the disclosure itself. Completing an appropriately-specified record overview spreadsheet is therefore an effective way to ensure that the corresponding information is documented and conveyed to NSIRA ahead of the legislated deadline.<\/p>\n\n\n\n

                    The RCMP\u2019s record overview spreadsheet was particularly effective in demonstrating compliance with the Act. The spreadsheet included columns that were explicitly tied to individual paragraphs under section 9, with additional fields limited to RCMP administrative information such as file and database reference numbers.<\/p>\n\n\n\n

                    Spreadsheets designed in this way enable institutions\u2019 efficient self-assessment against the requirements of the Act. They also facilitate the task of review by clearly matching the information provided with its corresponding requirement under the SCIDA, and by organizing disclosures and receipts of information in a manner that supports cross-verification.<\/p>\n\n\n\n

                    Recommendation 2: NSIRA recommends that all GC institutions prepare record overviews to clearly address the requirements of subsections 9(1) and 9(2) of the SCIDA; and provide them to NSIRA along with a copy of the disclosure itself and, where relevant, a copy of the request.<\/strong><\/p>\n\n\n\n

                    Preparing and Keeping Records: Subsections 9(1) and 9(2)<\/h3>\n\n\n\n

                    Finding 4: NSIRA found that all GC institutions complied with their obligation to prepare and keep records that set out the information prescribed under subsections 9(1) and 9(2) of the SCIDA.<\/strong><\/p>\n\n\n\n

                    Finding 5: NSIRA found that more than half of the descriptions provided by CBSA and IRCC under paragraph 9(1)(e) of the SCIDA did not explicitly address their satisfaction that the disclosure was authorized under paragraph 5(1)(b), the proportionality test.<\/strong><\/p>\n\n\n\n

                    Although NSIRA expected an express statement describing the information that was relied on to satisfy the disclosing institution that the disclosure was authorized under the SCIDA, in this review, NSIRA considered any records that demonstrated the corresponding assessment had been conducted.<\/p>\n\n\n\n

                    IRCC n\u2019a pas fait de d\u00e9claration expresse pr\u00e9cisant que les communications demand\u00e9es par le SCRS, qui repr\u00e9sentent 57 % (n<\/em>=54) de l\u2019ensemble de ses communications, lui semblaient satisfaisantes du point de vue du crit\u00e8re de proportionnalit\u00e9. En revanche, IRCC a fourni des copies des lettres de demande et de l\u2019information communiqu\u00e9e en guise de r\u00e9ponse, ce qui confirme que la communication \u00e9tait manifestement conforme aux besoins pr\u00e9cis de la demande (et donc t\u00e9moigne d\u2019une \u00e9valuation de la proportionnalit\u00e9).<\/p>\n\n\n\n

                    L\u2019ASFC n\u2019a pas fourni de d\u00e9claration expresse concernant sa satisfaction au regard du crit\u00e8re de proportionnalit\u00e9 pour 75 % (n<\/em>=3) de ses communications. Elle a plut\u00f4t d\u00e9montr\u00e9 qu\u2019elle tenait compte du principe de proportionnalit\u00e9 en fournissant divers documents justificatifs, y compris de la correspondance interne.<\/p>\n\n\n\n

                    La feuille de calcul utilis\u00e9e par AMC pour donner une vue d\u2019ensemble de ses documents a \u00e9t\u00e9 particuli\u00e8rement efficace pour r\u00e9pondre aux exigences de l\u2019alin\u00e9a 9(1)e). L\u2019analyse d\u00e9taill\u00e9e qu\u2019elle a consign\u00e9e en ce qui concerne les crit\u00e8res de contribution et de proportionnalit\u00e9 lui a permis de remplir ses obligations en mati\u00e8re de conservation des dossiers et de d\u00e9montrer qu\u2019elle respectait en substance le paragraphe 5(1).<\/p>\n\n\n\n

                    Recommendation 3: NSIRA recommends that disclosing institutions explicitly address the requirements of both paragraphs 5(1)(a) and 5(1)(b) in the records that they prepare under paragraph 9(1)(e) of the SCIDA.<\/strong><\/p>\n\n\n\n

                    Disclosure of Information<\/h3>\n\n\n\n

                    Contribution and Proportionality Tests: Paragraphs 5(1)(a) and 5(1)(b)<\/h4>\n\n\n\n

                    Finding 6: NSIRA found, within the sample of disclosures reviewed, that disclosing institutions demonstrated they had satisfied themselves of both the contribution and proportionality tests, in compliance with subsection 5(1) of the SCIDA.<\/strong><\/p>\n\n\n\n

                    Finding 7: NSIRA found that GAC satisfied itself under the SCIDA\u2019s paragraph 5(1)(a) contribution test based on an incorrect understanding of the recipient\u2019s national security mandate in two cases.<\/strong><\/p>\n\n\n\n

                    The threshold for compliance with subsection 5(1) is that the disclosing institution has satisfied itself of the contribution and proportionality tests, and that it has done so prior to having made the disclosure.<\/p>\n\n\n\n

                    In relation to the two disclosures that it made proactively to DND\/CAF, GAC provided a rationale for the information\u2019s contribution to DND\/CAF\u2019s mandate in respect of national security. Upon receipt of the information, however, DND\/CAF did not agree with GAC\u2019s assessment and therefore assessed that the SCIDA was not an appropriate disclosure mechanism in the circumstances.<\/p>\n\n\n\n

                    Informal communication between the two institutions may have allowed DND\/CAF and GAC to resolve this issue prior to the disclosure. When such communications occur, it is important that they be limited to the information necessary to confirm that the information contributes to the recipient\u2019s mandate in respect of activities that undermine the security of Canada.<\/p>\n\n\n\n

                    Recommendation 4: NSIRA recommends that GC institutions contemplating the use of proactive disclosures under the SCIDA communicate with the recipient institution, ahead of making the disclosure, to inform their assessments under subsection 5(1).<\/strong><\/p>\n\n\n\n

                    Statement Regarding Accuracy and Reliability: Subsection 5(2)<\/h4>\n\n\n\n

                    Finding 8: NSIRA found, within the sample of disclosures reviewed, that CBSA and GAC (in one and two disclosures, respectively) were non-compliant with the SCIDA\u2019s subsection 5(2) requirement to provide a statement regarding accuracy and reliability.<\/strong><\/p>\n\n\n\n

                    Finding 9: NSIRA found, in relation to the remaining disclosures within the sample, that GAC, IRCC, and RCMP included their statements regarding accuracy and reliability within the disclosures themselves, whereas CBSA provided its statements in the disclosures\u2019 cover letters.<\/strong><\/p>\n\n\n\n

                    Providing the statement on accuracy and reliability in a cover letter for the disclosure satisfies the Act\u2019s requirement to provide the statement at the time of disclosure. However, separating the statement from the information disclosed increases the risk that the information may be subsequently used without awareness of relevant qualifiers. The location of the statement on accuracy and reliability \u2013 and not just its contemporaneous provision to the recipient \u2013 is therefore relevant to its value added.<\/p>\n\n\n\n

                    Recommendation 5: NSIRA recommends that all disclosing institutions include statements regarding accuracy and reliability within the same document as the disclosed information.<\/strong><\/p>\n\n\n\n

                    Requirement to Destroy or Return Personal Information: Subsection 5.1(1)<\/h4>\n\n\n\n

                    Finding 10: NSIRA found that DND\/CAF destroyed information under the SCIDA subsection 5.1(1), but they were non-compliant with the requirement to do so \u201cas soon as feasible after receiving it.\u201d<\/strong><\/p>\n\n\n\n

                    DND\/CAF determined, upon receipt of the two disclosures it received from GAC, that the personal information contained within the disclosures should not be retained. The information, however, was not destroyed until April 2023 \u2013 12 days following a request for information from NSIRA to provide a copy of records that set out whether and when the information had been destroyed or returned. The date of destruction was 299 and 336 days following DND\/CAF\u2019s receipt of each disclosure.<\/p>\n\n\n\n

                    Taking into consideration the elapsed time between receipt of the information and its destruction, as well as DND\/CAF\u2019s timely conclusion that the information should not be retained, DND\/CAF\u2019s ultimate destruction of the information was non-compliant with the requirement to destroy the information \u201cas soon as feasible after receiving it.\u201d Its delay in this respect was also inconsistent with the responsible use and management of the information.<\/p>\n\n\n\n

                    DND\/CAF was the only institution to identify any disclosures as containing information that was destroyed or returned under subsection 5.1(1) in 2022. NSIRA did not identify any other disclosures within the sample for which personal information disclosed should have been destroyed or returned.<\/p>\n\n\n\n

                    Purpose and Principles: Effective and responsible disclosure of information<\/h4>\n\n\n\n

                    Finding 11: NSIRA found delays between when a disclosure was authorized for sending and when it was received by the individual designated by the head of the recipient institution to receive it in at least 20% (n=34) of disclosures.<\/strong><\/p>\n\n\n\n

                    These 34 disclosures include 29 for which there was a delay between the dates provided by disclosing and recipient institutions in their section 9 records, as well as an additional five for which CSIS reported both the date of administrative receipt within the institution and the subsequent date of receipt by the person designated by the head to receive it (i.e., the relevant operational unit).<\/p>\n\n\n\n

                    NSIRA attributes most of these delays to expected dynamics in classified information sharing: the individual authorizing the disclosure is not always the same individual who administratively sends it to the recipient, and the person who administratively receives the disclosure is not always the same person who is designated by the head to receive it.<\/p>\n\n\n\n

                    In the majority of cases, the observed delays were shorter than one week. In nine cases, however, the delay ranged from 30 to 233 days.<\/p>\n\n\n\n

                    Such delays mean that information is not processed and actioned within the recipient institution until long after it was sent \u2013 or intended to be sent \u2013 by the individual authorizing the disclosure. While these delays do not amount to non-compliance with the SCIDA, they are inconsistent with the Act\u2019s purpose and guiding principles.<\/p>\n\n\n\n

                    Recommendation 6: NSIRA recommends that GC institutions review their administrative processes for sending and receiving disclosures under the SCIDA, and correct practices that cause delays.<\/strong><\/p>\n\n\n\n

                    4. Conclusion<\/h2>\n\n\n\n

                    The SCIDA\u2019s requirements for disclosure and record keeping apply to both disclosing and recipient institutions in all cases where the SCIDA is invoked as a mechanism for disclosure. This review assessed GC institutions\u2019 compliance with requirements for record keeping in respect of all 173 disclosures that were made and received in 2022. It assessed their compliance with requirements for disclosure in relation to a targeted sample of 19 disclosures.<\/p>\n\n\n\n

                    NSIRA found that institutions complied with the SCIDA\u2019s requirements for disclosure and record keeping in relation to the majority of disclosures. GC institutions\u2019 non-compliance with subsection 9(3) was driven by irregularities in the reporting of 11 disclosures. Observed non-compliance with substantive requirements under subsection 5(2) related to three disclosures; and non-compliance with subsection 5.1(1) related to two disclosures. These instances of non-compliance do not point to any systemic failures in GC institutions\u2019 implementation of the SCIDA.<\/p>\n\n\n\n

                    Within this context, NSIRA observed improvements in reviewee performance as compared with findings from prior years\u2019 reports and over the course of the review. Of note, NSIRA\u2019s requests for information in support of this review prompted corrective action by CBSA, DND\/CAF, and IRCC that would have otherwise amounted to non-compliance with requirements under section 9.<\/p>\n\n\n\n

                    NSIRA also observed several practices that, although compliant with the SCIDA, leave room for improvement. NSIRA\u2019s recommendations in this review are designed to increase standardization across the GC in a manner that is consistent with institutions\u2019 demonstrated best practices and the SCIDA\u2019s guiding principles.<\/p>\n\n\n\n

                    Annex A. Record Keeping Obligations for Disclosing and Recipient Institutions<\/h2>\n\n\n\n\n\t\n\t\t\n\t\t\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t
                    Obligation – disclosing institution<\/th>\n\t\t\tObligation — recipient institution <\/th>\n\t\t<\/tr>\n\t<\/thead>\n\t
                    9 (1) Every Government of Canada institution that discloses information under this Act must prepare and keep records that set out<\/td>\n\t\t\t(2) Every Government of Canada institution that receives information under this Act must prepare and keep records that set out<\/td>\n\t\t<\/tr>\n\t\t
                    (a) a description of the information;<\/td>\n\t\t\t(a) a description of the information;<\/td>\n\t\t<\/tr>\n\t\t
                    (b) the name of the individual who authorized its disclosure;<\/td>\n\t\t\t(b) the name of the institution that disclosed it;<\/td>\n\t\t<\/tr>\n\t\t
                    (c) the name of the recipient Government of Canada institution;<\/td>\n\t\t\t(c) the name or position of the head of the recipient institution — or of the person designated by the head — who received the information;<\/td>\n\t\t<\/tr>\n\t\t
                    (d) the date on which it was disclosed;<\/td>\n\t\t\t(d) the date on which it was received by the recipient institution;<\/td>\n\t\t<\/tr>\n\t\t
                    (e) a description of the information that was relied on to satisfy the disclosing institution that the disclosure was authorized under this Act; and<\/td>\n\t\t\t\n\t\t\t(e) whether the information has been destroyed or returned under subsection 5.1(1);\n\n\t\t\t(f) if the information has been destroyed under subsection 5.1(1), the date on which it was destroyed;\n\n\t\t\t(g) if the information was returned under subsection 5.1(1) to the institution that disclosed it, the date on which it was returned; and\n\t\t\t<\/td>\n\t\t<\/tr>\n\t\t
                    (f) any other information specified by the regulations.<\/td>\n\t\t\t(h) any other information specified by the regulations.<\/td>\n\t\t<\/tr>\n\t<\/tbody>\n<\/table>\n\n\n\n

                    Copy to National Security and Intelligence Review Agency<\/strong><\/h3>\n\n\n\n

                    Within 30 days after the end of each calendar year, every Government of Canada institution that disclosed information under section 5 during the year and every Government of Canada institution that received such information must provide the National Security and Intelligence Review Agency with a copy of every record it prepared under subsection (1) or (2), as the case may be, with respect to the information.<\/p>\n\n\n\n

                    Annex B. Sample of Disclosures<\/h2>\n\n\n\n

                    Disclosures were selected for the sample based on the content of records provided to NSIRA under subsection 9(3), according to the following parameters:<\/p>\n\n\n\n

                      \n
                    • At least two disclosures per discloser-recipient pair, if available;<\/li>\n\n\n\n
                    • At least one proactive disclosure per discloser, if available;<\/span><\/li>\n\n\n\n
                    • At least one requested disclosure per recipient, if available;<\/span><\/li>\n\n\n\n
                    • All disclosures identified by recipient institutions as including personal information that was destroyed or returned under the SCIDA, subsection 5.1(1);<\/span><\/li>\n\n\n\n
                    • All disclosures for which there is a high-level discrepancy in the discloser and recipient records (i.e., a record of receipt, but no record of disclosure; a substantive misalignment in the description of the information; greater than seven days\u2019 discrepancy in the date sent and received; date of receipt earlier than the date of sending);<\/span><\/li>\n\n\n\n
                    • All disclosures made by an institution that is not listed in Schedule 3 of the SCIDA; and<\/span><\/li>\n\n\n\n
                    • All disclosures received by institutions added to Schedule 3 in the preceding year.<\/li>\n<\/ul>\n\n\n\n

                      Annex C. Overview of SCIDA Disclosures in Prior Years<\/h2>\n\n\n\n

                      Drawing on information published in previous NSIRA reports, Table 5 summarizes the number and distribution of disclosures made under the SCIDA in prior years.<\/p>\n\n\n\n

                      Table 5: Number of SCIDA disclosures, by disclosing and recipient institution, 2019-2021<\/h4>\n\n\n\n\n\t\n\t\t\n\t\t\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t
                       <\/td>\n\t\t\t <\/td>\n\t\t\tDesignated Recipient Institutions<\/strong><\/td>\n\t\t<\/tr>\n\t<\/thead>\n\t
                       <\/td>\n\t\t\tDisclosing Institution<\/strong><\/td>\n\t\t\tCBSA<\/td>\n\t\t\tCFIA<\/td>\n\t\t\tCNSC<\/td>\n\t\t\tCRA<\/td>\n\t\t\tCSE<\/td>\n\t\t\tCSIS<\/td>\n\t\t\tDND\/CAF<\/td>\n\t\t\tFinance<\/td>\n\t\t\tFINTRAC<\/td>\n\t\t\tGAC<\/td>\n\t\t\tHealth<\/td>\n\t\t\tIRCC<\/td>\n\t\t\tPHAC<\/td>\n\t\t\tPSC<\/td>\n\t\t\tRCMP<\/td>\n\t\t\tTC<\/td>\n\t\t\tTOTAL (proactive)<\/strong><\/td>\n\t\t<\/tr>\n\t\t
                      2021<\/strong><\/td>\n\t\t\tDND\/CAF<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t2<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t2<\/strong><\/td>\n\t\t<\/tr>\n\t\t
                      GAC<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t41<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t1<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t2<\/td>\n\t\t\t–<\/td>\n\t\t\t44<\/strong><\/td>\n\t\t<\/tr>\n\t\t
                      IRCC<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t68<\/td>\n\t\t\t79<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t2<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t149<\/strong><\/td>\n\t\t<\/tr>\n\t\t
                      TOTAL<\/strong><\/td>\n\t\t\t–<\/strong><\/td>\n\t\t\t–<\/strong><\/td>\n\t\t\t–<\/strong><\/td>\n\t\t\t–<\/strong><\/td>\n\t\t\t68<\/strong><\/td>\n\t\t\t122<\/strong><\/td>\n\t\t\t–<\/strong><\/td>\n\t\t\t–<\/strong><\/td>\n\t\t\t–<\/strong><\/td>\n\t\t\t2<\/strong><\/td>\n\t\t\t–<\/strong><\/td>\n\t\t\t1<\/strong><\/td>\n\t\t\t–<\/strong><\/td>\n\t\t\t–<\/strong><\/td>\n\t\t\t2<\/strong><\/td>\n\t\t\t–<\/strong><\/td>\n\t\t\t195<\/strong><\/td>\n\t\t<\/tr>\n\t\t
                      2020<\/strong><\/td>\n\t\t\tCBSA<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t1<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t3<\/td>\n\t\t\t–<\/td>\n\t\t\t4<\/strong><\/td>\n\t\t<\/tr>\n\t\t
                      GAC<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t1<\/td>\n\t\t\t25<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t1<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t13<\/td>\n\t\t\t–<\/td>\n\t\t\t40<\/strong><\/td>\n\t\t<\/tr>\n\t\t
                      IRCC<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t60<\/td>\n\t\t\t61<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t37<\/td>\n\t\t\t1<\/td>\n\t\t\t159<\/strong><\/td>\n\t\t<\/tr>\n\t\t
                      RCMP<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t1<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t3<\/td>\n\t\t\t–<\/td>\n\t\t\t5<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t9<\/strong><\/td>\n\t\t<\/tr>\n\t\t
                      TC<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t2<\/td>\n\t\t\t–<\/td>\n\t\t\t2<\/strong><\/td>\n\t\t<\/tr>\n\t\t
                      Other<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t1<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t1<\/strong><\/td>\n\t\t<\/tr>\n\t\t
                      TOTAL<\/strong><\/td>\n\t\t\t–<\/strong><\/td>\n\t\t\t–<\/strong><\/td>\n\t\t\t–<\/strong><\/td>\n\t\t\t–<\/strong><\/td>\n\t\t\t61<\/strong><\/td>\n\t\t\t88<\/strong><\/td>\n\t\t\t1<\/strong><\/td>\n\t\t\t–<\/strong><\/td>\n\t\t\t–<\/strong><\/td>\n\t\t\t3<\/strong><\/td>\n\t\t\t–<\/strong><\/td>\n\t\t\t6<\/strong><\/td>\n\t\t\t–<\/strong><\/td>\n\t\t\t–<\/strong><\/td>\n\t\t\t55<\/strong><\/td>\n\t\t\t1<\/strong><\/td>\n\t\t\t215<\/strong><\/td>\n\t\t<\/tr>\n\t\t
                      2019<\/strong><\/td>\n\t\t\tCBSA<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t1<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t2<\/td>\n\t\t\t–<\/td>\n\t\t\t3<\/strong><\/td>\n\t\t<\/tr>\n\t\t
                      GAC<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t23<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t3<\/td>\n\t\t\t–<\/td>\n\t\t\t1<\/td>\n\t\t\t15<\/td>\n\t\t\t–<\/td>\n\t\t\t42<\/strong><\/td>\n\t\t<\/tr>\n\t\t
                      IRCC<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t5<\/td>\n\t\t\t17<\/td>\n\t\t\t1<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t36<\/td>\n\t\t\t–<\/td>\n\t\t\t59<\/strong><\/td>\n\t\t<\/tr>\n\t\t
                      RCMP<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t4<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t1<\/td>\n\t\t\t3<\/td>\n\t\t\t–<\/td>\n\t\t\t1<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t9<\/strong><\/td>\n\t\t<\/tr>\n\t\t
                      TC<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t–<\/td>\n\t\t\t1<\/td>\n\t\t\t–<\/td>\n\t\t\t1<\/strong><\/td>\n\t\t<\/tr>\n\t\t
                      TOTAL<\/strong><\/td>\n\t\t\t–<\/strong><\/td>\n\t\t\t–<\/strong><\/td>\n\t\t\t–<\/strong><\/td>\n\t\t\t4<\/strong><\/td>\n\t\t\t5<\/strong><\/td>\n\t\t\t41<\/strong><\/td>\n\t\t\t1<\/strong><\/td>\n\t\t\t–<\/strong><\/td>\n\t\t\t1<\/strong><\/td>\n\t\t\t3<\/strong><\/td>\n\t\t\t–<\/strong><\/td>\n\t\t\t4<\/strong><\/td>\n\t\t\t–<\/strong><\/td>\n\t\t\t1<\/strong><\/td>\n\t\t\t54<\/strong><\/td>\n\t\t\t–<\/strong><\/td>\n\t\t\t114<\/strong><\/td>\n\t\t<\/tr>\n\t<\/tbody>\n<\/table>\n\n\n\n

                      Annex D. Findings and Recommendations<\/h2>\n\n\n\n

                      Findings<\/h3>\n\n\n\n

                      NSIRA found that CSE, CSIS, GAC, and IRCC regularly use the SCIDA in a manner that warrants information sharing arrangements, as encouraged by subsection 4(c) of the SCIDA.<\/p>\n\n\n\n

                      NSIRA found that CBSA, DND\/CAF, and IRCC were non-compliant with subsection 9(3) of the SCIDA, as they failed to provide all records created under subsections 9(1) or 9(2) to NSIRA within the legislated timeframe.<\/p>\n\n\n\n

                      NSIRA found improved compliance outcomes in instances where departments prepared record overview spreadsheets under subsections 9(1) and 9(2) of the SCIDA that displayed the following characteristics:<\/p>\n\n\n\n

                        \n
                      • a row for each disclosure made or received;<\/li>\n\n\n\n
                      • columns explicitly tied to each individual paragraph under section 9; and<\/li>\n\n\n\n
                      • additional columns to capture relevant administrative details, such as whether the disclosure was requested or proactive; the date of the request (if applicable); and any applicable file reference numbers.<\/li>\n<\/ul>\n\n\n\n

                        NSIRA found that all GC institutions complied with their obligation to prepare and keep records that set out the information prescribed under subsections 9(1) and 9(2) of the SCIDA.<\/p>\n\n\n\n

                        NSIRA found that more than half of the descriptions provided by CBSA and IRCC under paragraph 9(1)(e) of the SCIDA did not explicitly address their satisfaction that the disclosure was authorized under paragraph 5(1)(b), the proportionality test.<\/p>\n\n\n\n

                        NSIRA found, within the sample of disclosures reviewed, that disclosing institutions demonstrated they had satisfied themselves of both the contribution and proportionality tests, in compliance with subsection 5(1) of the SCIDA.<\/p>\n\n\n\n

                        NSIRA found that GAC satisfied itself under the SCIDA\u2019s paragraph 5(1)(a) contribution test based on an incorrect understanding of the recipient\u2019s national security mandate in two cases.<\/p>\n\n\n\n

                        NSIRA found, within the sample of disclosures reviewed, that CBSA and GAC (in one and two disclosures, respectively) were non-compliant with the SCIDA\u2019s subsection 5(2) requirement to provide a statement regarding accuracy and reliability.<\/p>\n\n\n\n

                        NSIRA found, in relation to the remaining disclosures within the sample, that GAC, IRCC, and RCMP included their statements regarding accuracy and reliability within the disclosures themselves, whereas CBSA provided its statements in the disclosures\u2019 cover letters.<\/p>\n\n\n\n

                        NSIRA found that DND\/CAF destroyed information under the SCIDA subsection 5.1(1), but they were non-compliant with the requirement to do so \u201cas soon as feasible after receiving it.\u201d<\/p>\n\n\n\n

                        NSIRA found delays between when a disclosure was authorized for sending and when it was received by the individual designated by the head of the recipient institution to receive it in at least 20% (n=34) of disclosures.<\/p>\n\n\n\n

                        Recommendations<\/h3>\n\n\n\n
                          \n
                        1. NSIRA recommends that information sharing arrangements be used to govern regular SCIDA disclosures between GAC and CSIS; IRCC and CSIS; as well as IRCC and CSE.<\/li>\n\n\n\n
                        2. NSIRA recommends that all GC institutions prepare record overviews to clearly address the requirements of subsections 9(1) and 9(2) of the SCIDA; and provide them to NSIRA along with a copy of the disclosure itself and, where relevant, a copy of the request.<\/li>\n\n\n\n
                        3. NSIRA recommends that disclosing institutions explicitly address the requirements of both paragraphs 5(1)(a) and 5(1)(b) in the records that they prepare under paragraph 9(1)(e) of the SCIDA.<\/li>\n\n\n\n
                        4. NSIRA recommends that GC institutions contemplating the use of proactive disclosures under the SCIDA communicate with the recipient institution, ahead of making the disclosure, to inform their assessments under subsection 5(1).<\/li>\n\n\n\n
                        5. NSIRA recommends that all disclosing institutions include statements regarding accuracy and reliability within the same document as the disclosed information.<\/li>\n\n\n\n
                        6. NSIRA recommends that GC institutions review their administrative processes for sending and receiving disclosures under the SCIDA, and correct practices that cause delays.<\/li>\n<\/ol>\n<\/div><\/div>\n<\/div><\/div><\/section>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":2712,"parent":6325,"menu_order":1,"comment_status":"closed","ping_status":"closed","template":"template-nsira-subpages.php","meta":{"inline_featured_image":false},"categories":[6,8,9,10,14,18,19,24,28],"tags":[64,78,77,80,89,87,74,85],"yoast_head":"\nReview of Government of Canada Institutions\u2019 Disclosures of Information Under the Security of Canada Information Disclosure Act in 2022: Report - National Security and Intelligence Review Agency<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/nsira-ossnr.gc.ca\/en\/reviews\/find-a-review\/23-03\/report\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Review of Government of Canada Institutions\u2019 Disclosures of Information Under the Security of Canada Information Disclosure Act in 2022: Report - National Security and Intelligence Review Agency\" \/>\n<meta property=\"og:url\" content=\"https:\/\/nsira-ossnr.gc.ca\/en\/reviews\/find-a-review\/23-03\/report\/\" \/>\n<meta property=\"og:site_name\" content=\"National Security and Intelligence Review Agency\" \/>\n<meta property=\"article:modified_time\" content=\"2025-02-25T13:52:01+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/nsira-ossnr.gc.ca\/wp-content\/uploads\/Reports-Featured.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t<meta property=\"og:image:height\" content=\"500\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"25 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/nsira-ossnr.gc.ca\/reviews\/find-a-review\/23-03\/report\/\",\"url\":\"https:\/\/nsira-ossnr.gc.ca\/reviews\/find-a-review\/23-03\/report\/\",\"name\":\"Review of Government of Canada Institutions\u2019 Disclosures of Information Under the Security of Canada Information Disclosure Act in 2022: Report - National Security and Intelligence Review Agency\",\"isPartOf\":{\"@id\":\"https:\/\/nsira-ossnr.gc.ca\/#website\"},\"datePublished\":\"2025-02-03T19:45:31+00:00\",\"dateModified\":\"2025-02-25T13:52:01+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/nsira-ossnr.gc.ca\/reviews\/find-a-review\/23-03\/report\/#breadcrumb\"},\"inLanguage\":\"en-CA\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/nsira-ossnr.gc.ca\/reviews\/find-a-review\/23-03\/report\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/nsira-ossnr.gc.ca\/reviews\/find-a-review\/23-03\/report\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Reviews\",\"item\":\"\/reviews\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Find A Review\",\"item\":\"\/reviews\/find-a-review\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Review of Government of Canada Institutions\u2019 Disclosures of Information Under the Security of Canada Information Disclosure Act in 2022\",\"item\":\"\/reviews\/find-a-review\/23-03\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Review of Government of Canada Institutions\u2019 Disclosures of Information Under the Security of Canada Information Disclosure Act in 2022: Report\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/nsira-ossnr.gc.ca\/#website\",\"url\":\"https:\/\/nsira-ossnr.gc.ca\/\",\"name\":\"National Security and Intelligence Review Agency\",\"description\":\"Official Website\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/nsira-ossnr.gc.ca\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-CA\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Review of Government of Canada Institutions\u2019 Disclosures of Information Under the Security of Canada Information Disclosure Act in 2022: Report - National Security and Intelligence Review Agency","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/nsira-ossnr.gc.ca\/en\/reviews\/find-a-review\/23-03\/report\/","og_locale":"en_US","og_type":"article","og_title":"Review of Government of Canada Institutions\u2019 Disclosures of Information Under the Security of Canada Information Disclosure Act in 2022: Report - National Security and Intelligence Review Agency","og_url":"https:\/\/nsira-ossnr.gc.ca\/en\/reviews\/find-a-review\/23-03\/report\/","og_site_name":"National Security and Intelligence Review Agency","article_modified_time":"2025-02-25T13:52:01+00:00","og_image":[{"width":350,"height":500,"url":"https:\/\/nsira-ossnr.gc.ca\/wp-content\/uploads\/Reports-Featured.jpg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"25 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/nsira-ossnr.gc.ca\/reviews\/find-a-review\/23-03\/report\/","url":"https:\/\/nsira-ossnr.gc.ca\/reviews\/find-a-review\/23-03\/report\/","name":"Review of Government of Canada Institutions\u2019 Disclosures of Information Under the Security of Canada Information Disclosure Act in 2022: Report - National Security and Intelligence Review Agency","isPartOf":{"@id":"https:\/\/nsira-ossnr.gc.ca\/#website"},"datePublished":"2025-02-03T19:45:31+00:00","dateModified":"2025-02-25T13:52:01+00:00","breadcrumb":{"@id":"https:\/\/nsira-ossnr.gc.ca\/reviews\/find-a-review\/23-03\/report\/#breadcrumb"},"inLanguage":"en-CA","potentialAction":[{"@type":"ReadAction","target":["https:\/\/nsira-ossnr.gc.ca\/reviews\/find-a-review\/23-03\/report\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/nsira-ossnr.gc.ca\/reviews\/find-a-review\/23-03\/report\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Reviews","item":"\/reviews\/"},{"@type":"ListItem","position":2,"name":"Find A Review","item":"\/reviews\/find-a-review\/"},{"@type":"ListItem","position":3,"name":"Review of Government of Canada Institutions\u2019 Disclosures of Information Under the Security of Canada Information Disclosure Act in 2022","item":"\/reviews\/find-a-review\/23-03\/"},{"@type":"ListItem","position":4,"name":"Review of Government of Canada Institutions\u2019 Disclosures of Information Under the Security of Canada Information Disclosure Act in 2022: Report"}]},{"@type":"WebSite","@id":"https:\/\/nsira-ossnr.gc.ca\/#website","url":"https:\/\/nsira-ossnr.gc.ca\/","name":"National Security and Intelligence Review Agency","description":"Official Website","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/nsira-ossnr.gc.ca\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-CA"}]}},"_links":{"self":[{"href":"https:\/\/nsira-ossnr.gc.ca\/en\/wp-json\/wp\/v2\/pages\/8629"}],"collection":[{"href":"https:\/\/nsira-ossnr.gc.ca\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/nsira-ossnr.gc.ca\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/nsira-ossnr.gc.ca\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nsira-ossnr.gc.ca\/en\/wp-json\/wp\/v2\/comments?post=8629"}],"version-history":[{"count":5,"href":"https:\/\/nsira-ossnr.gc.ca\/en\/wp-json\/wp\/v2\/pages\/8629\/revisions"}],"predecessor-version":[{"id":8643,"href":"https:\/\/nsira-ossnr.gc.ca\/en\/wp-json\/wp\/v2\/pages\/8629\/revisions\/8643"}],"up":[{"embeddable":true,"href":"https:\/\/nsira-ossnr.gc.ca\/en\/wp-json\/wp\/v2\/pages\/6325"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nsira-ossnr.gc.ca\/en\/wp-json\/wp\/v2\/media\/2712"}],"wp:attachment":[{"href":"https:\/\/nsira-ossnr.gc.ca\/en\/wp-json\/wp\/v2\/media?parent=8629"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nsira-ossnr.gc.ca\/en\/wp-json\/wp\/v2\/categories?post=8629"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nsira-ossnr.gc.ca\/en\/wp-json\/wp\/v2\/tags?post=8629"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}