The federal Algorithmic Impact Assessment (AIA) asks a lot about data. It asks where the data comes from, who collected it, who controls it, whether personal information will be shared and whether the training data is biased.
It never asks where the data is stored, how long it is kept or how it is destroyed.
The directive behind the AIA handles those duties by cross-reference to other instruments. But that means a completed, published AIA is not evidence that a system's data will be kept and disposed of lawfully. That evidence sits in the privacy impact assessment (PIA) and the retention rules behind it. Or it is missing.
Who needs an AIA
The Directive on Automated Decision-Making applies in institutions subject to the Policy on Service and Digital. It covers any automated decision system in production "used to make an administrative decision or a related assessment about a client", if developed or procured after April 1, 2020. An administrative decision is one that affects "legal rights, privileges or interests".
The definition of an automated decision system is broad: any technology that "either assists or replaces the judgment of human decision makers", from rules-based systems to machine learning. Systems used only for research or experimentation, or running in test environments, are excluded.
For a system in scope, the assistant deputy minister responsible for the program must complete, approve and publish the AIA before the system goes into production. The deputy head can name another senior official instead.
What the AIA scores
The AIA has 65 risk questions and 41 mitigation questions. Data carries more weight than any other risk area: its 16 questions are worth up to 55 of the 169 points in the raw impact score.
The data section asks whether the system uses personal information, and whether collection is limited to what is directly related to a program or activity. It asks who collected the training and input data, whether the system draws on multiple sources, what the input data's highest security classification is and who controls it. It asks whether personal information will be shared, and whether the training data is representative or biased. The mitigation sections add data quality processes, audit trails, de-identification and whether a PIA has been done.
What it never asks
No AIA question asks where data is stored or hosted, how long it is kept or how it is disposed of.
You can check this yourself, because the questionnaire's source file is public. Search its English and French text for storage, hosting, retention, destruction and deletion. The only hits are in the tool's introductory text, and they are about your own answers: they stay in your browser's local storage and are deleted when you click "Start Again".
The nearest questions stop short. Two ask whether security and privacy are designed in from the concept stage. One asks whether information will be used within a closed system. One asks whether personal information will be de-identified "at any point in the lifecycle". One asks whether a PIA has been completed or updated, and for its title, scope and date. Two more ask whether the system uses personal information consistently with the program's personal information banks and PIAs, and whether any disclosure of it is covered by an agreement with appropriate safeguards. None asks for a retention period or a disposal method.
The audit trail widens the gap. The AIA asks whether the audit trail will capture every recommendation or decision the system makes, whether overrides will be logged and whether changes to the model will be recorded. Each of those creates records. The AIA does not ask how long any of them is kept.
Where storage and destruction are covered
The rules do cover them, by cross-reference. Section 6.3.6 of the Directive on Automated Decision-Making requires measures to ensure that data "used and produced" by the system are "lawfully collected, used, retained, disclosed and disposed of". The standard comes from three other directives: Service and Digital, Privacy Practices and Security Management.
The Directive on Privacy Practices supplies the link to the PIA. Its PIA standard treats the use of an automated decision system covered by the Directive on Automated Decision-Making as a substantial modification to a program that uses personal information for an administrative purpose. A PIA must then be completed or updated. The Treasury Board of Canada Secretariat (TBS) lists what every PIA must include in its Digital Privacy Playbook. One item is "where the personal information will be stored, for how long and how it will be deleted".
Two more rules shape the answer. The Directive on Service and Digital makes the departmental chief information officer, working with other departmental officials, responsible for retention periods for all information and data, and for a documented disposition process. The Privacy Act and its regulations also set a floor. Personal information used in a decision that directly affects the person concerned must be kept for at least two years after its last use for that purpose, unless that person consents to its disposal. Deleting quickly is not automatically compliant either.
None of these retention rules appears in the AIA. A published AIA, however it scores, is not evidence that retention and destruction are handled. Nor is a PIA that says the right things, if the system never deletes anything. We wrote about testing that in Nobody owns retention until it's too late.
If you sell the system
Vendors are inside this, not outside it. The Directive on Privacy Practices covers personal information held "by a third party acting under contract". TBS's AIA guidance says the access to information and privacy (ATIP) office should be consulted. Among the benefits it lists: making sure contracts with automation vendors include "appropriate privacy protection clauses". If your platform holds personal information in the inputs, the outputs or the logs, the institution's PIA has to say where it is stored, for how long and how it is deleted. It cannot say that without you.
What to do now
- If the system uses personal information, put the published AIA and the current PIA side by side. Confirm the PIA was completed or updated for the automated decision system, not only for the program before automation.
- List every data set the system uses and produces: training data, input data, scores and recommendations, the audit trail, override logs and model versions.
- Find three answers for each one: where it is stored, how long it is kept and how it is deleted. For personal information, the PIA should say. Treat every blank as a finding.
- Check each period against your institution's retention standards and its Library and Archives Canada disposition authorities, including the two-year minimum for personal information used in decisions about people.
- If a vendor holds any of it, read the contract. It should say where the data sits, how long it stays and what happens to it when the contract ends.
- Recheck retention every time the AIA is updated. The directive requires updates on a scheduled basis and whenever the system's functionality or scope changes.