M365 Privacy Impact Assessment Summary

Level 2: Administration of Programs / Activity & Services

The IT program is identified under the category of administration of internal programs to provide the OCL workforce with activities undertaken to achieve efficient and effective use of Information Technology (IT) to support government priorities and program delivery, increase productivity, and enhance services to the public. The project supports the efficient management of computer equipment and associated software for both institutional computer networks and employees’ workstations, electronic systems development and maintenance, technical assistance and support for networks, office systems and databases, including electronic mail systems and platforms and software acquisition. The OCL has procured an M365 “E5” enterprise-level license for the suite of cloud-based M365 office collaboration and productivity products, enterprise mobile and security (EMS), Windows 11 licences, plus advanced security solutions through the Microsoft SaaS platform.

The implementation of this project will include the use of personal information to identify and authenticate administrators and end-users to the Microsoft cloud platform; assign role-based access controls and the principle of least privilege; to create, protect and retain information system audit logs and records to enable monitoring, reporting, analysis, investigation and implementation of corrective actions, as required in accordance with TBS requirements; to configure, monitor and enforce conditional access and data loss prevention policies to safeguard personal and sensitive information from unauthorized disclosures; mobile device and application management; and provide insight and usage reporting capabilities to senior management. Personal information may also be used to evaluate application performance, manage potential security or privacy impacts, support decision making. Personal information may be compiled to support the investigation of suspected or alleged misuse, policy non-compliance, deliberate or inadvertent impairment or compromise of government electronic networks by persons employed by the OCL or by other individuals communicating from outside the institution. The personal information collected is organized or intended to be retrieved by the name of the individual or by an identifying number, or other particular assigned to a user.

If there is suspected misuse, organizational or informational policy non-compliance, or potential compromise of the OCL’s electronic network, information collected in audit and activity logs may be used to support the OCL’s electronic network monitoring sub activity. The project does not include compliance or regulatory investigations and enforcements, however, the OCL supports CSE in achieving their mandate for Cyber Defence activities in accordance with their legislated authority derived from the CSE Act. The CSE Cyber Defence program may collect and use personal information and records for the provision of cyber defence activities to monitor government networks to detect potential cyber threats and to analyze, evaluate, mitigate, and defend against cyber activities that threaten or potentially threaten the GC infrastructure and systems of importance to the GC.

Personal information may be collected directly from the administrator, end-user or from the hardware used to access the products and/or services.

Personal information may include an individual’s name (first name, Login in user and/or delegate user display name, username), contact information (email addresses, email aliases, office addresses, mobile numbers), user’s role, job profile information, work location; passwords; preferred language; unique identification numbers (Client IP addresses, device identification numbers, IMEI-number, MAC address, Client ID, Message ID, Case ID, Item ID); sign in and sign out history; date and time of access, change or modification made; location data derived from hardware/devices; content of MS Teams meetings, chat history, call history, email content; images, video and audio recordings; users search history; document or email contents as the result of security scanning and threat detection; alert or incident case status, alert severity, risk score, risk factors); or a combination of the later. Personal information received or sent through the institution’s specific programs and internal services activities may contain sensitive personal information of individuals communicating with the OCL or end-users.

Risk Level 1 - The Microsoft products and security solutions will be configured, operated, monitored, and maintained by the OCL IT program for use by OCL end-users. The various products and security solution features will be aligned with OCL organizational, security and information management policies; the IT program will provide support services for end users. The project will utilize the Exchange mailbox migration to transition to the new environment in the near future. The IT program is also responsible for the management of security incident handling ensuring that Microsoft’s security incident management processes align with GC security expectations.

Risk Level 2 – SSC is the Cloud Service Broker (CSB) facilitating the provision of Microsoft SaaS cloud services for the OCL. SSC will manage the relationship with Microsoft, including billing and monitoring and consumption of cloud services, and will deliver the network connectivity to connect the OCL on-premises environment to the Microsoft Azure Cloud Tenant platform. SSC is responsible for the creation and maintenance of the Microsoft Enterprise Agreement (MSEA) between SSC and Microsoft Canada.

Office of the Privacy Commissioner of Canada: OCL and the OPC have negotiated a long-term arrangement for the hosting of the OCL Lobbyists Registration System; OCL website; OCL desktop systems, servers, and support systems on the OPC IT infrastructure.

Communications Security Establishment: CSE will perform assessment activities in support of OCL’s infrastructure to help identify, isolate, or prevent harm to OCL computer systems or networks.

Risk Level 4 – Microsoft is the private sector solution provider (CSP) of the M365 suite of cloud-based products and services which leverages the Microsoft Azure platform and Microsoft datacenters located in Canada. Microsoft is responsible for all the underlying infrastructure, middleware, app software, and app data located in the Microsoft’s data center and will manage the hardware, and software as well as the availability and security of the app and data.

The project is a long-term activity with no clear sunset date, the Microsoft MSEA ends in 2026 with an option to renew the service for three years. The duration of the use of M365 products and services will depend on how long Microsoft supports this solution and is contingent on future technology adoption trends. 

The use of the M365 products and service offerings are mandatory for all individuals employed or contracted to the OCL. Information is used to provision and administer the M365 product offerings, enable security solutions and perform device and application management.

Personal information may be used to identify and authenticate administrators and users; manage mobile devices and applications; enable Cloud threat protection and identify security threats and unusual behavior; threats in emails, links, attachments, and collaboration tools; manage and monitor incidents and alert policies; enable automated investigation processes. Personal information may be used to help manage data services through data government solutions; enable data security solutions to help discover and protect sensitive information including data loss prevention; information barriers; information protection; insider risk management and privileged access management.

Personal information may be used to identify risky users or sign-ins, investigate, assign a risk score; enforce role-based and risk-based access control policies; assign users to specific resources. End-users who are identified as potential risky users may be monitored, tracked, and reported to senior management. Personal information may be used in aggregate form to gain insights on how the organization is adopting the various services within Microsoft 365.

The information contained in audit logs may be compiled to support the investigation of suspected or alleged misuse, policy non-compliance, or deliberate or inadvertent impairment or compromise of government electronic networks by persons employed by the institution or by other individuals from outside the institution (refer to PSU 905). Personal information may be used by CSE to assess potential threats to information technology systems subject to the assessment, and to help ensure the security of these electronic systems (refer to CSE Cyber Defence program, PPU 007).

The class of individuals affected by the M365 project includes employees of the OCL and other individuals using OCL electronic networks, including student employees; contract staff and agency personnel; members of the public; Ministerial staff; or Members of Parliament that send e-mails or attachments to individuals in the OCL.

Impacts to the organization depends on the severity, nature of the breach, breadth of personal information breached. Whether it is an internal or external breach and impact on individuals. Impacts could include:

• Managerial harm where processes might need to be changed.
• Organizational harm if the information/data is stolen, lost, misused as a result of inadequate safeguards.
• Financial harm in the case of negligence or the disclosure of confidential information could result in a lawsuit.
• Reputation harm, embarrassment, loss of credibility; decrease on public confidence, and an increase in attention on departmental and elected officials in the event of a material breach. In the case of a data breach this would likely garner criticism from the media and ultimately may result in a further loss of credibility and trust.

This has significance for OCL due to the expectations on OCL to provide a secure cloud tenant environment while respecting the expectations of the individual where messages sent to recipients are intended to remain private. An external breach is unlikely due to the security safeguards in place by OCL and Microsoft; and the underlying assessment performed by SSC.

The risk impacts are dependant on the nature and extent of the breach and could reasonably be expected to cause varying degrees of injury to individuals. The personal information and records processed by Microsoft can be considered sensitive personal information and the expectations of the individual would be that messages and attachments sent between the individual and the intended recipients are private. 

At the lower end of the spectrum, in the event of a potential threat, the user can experience inconvenience should the Microsoft Azure environment be compromised and become unavailable. Individuals may need to seek alternate forms of communication.

Individuals could experience reputational harm or embarrassment both on the professional and personal level. Personal information may be exposed and used for purposes other than the ones intended by the end-user or the program. A breach in privacy can expose individuals to risks such as embarrassment and can result in workplace-related consequences. Individuals could also experience financial harm related to identity theft or loss of employment or business opportunity and their ability to gain employment or further their employment in the workplace. Individuals could also experience physical or psychological harm if information related to confidential investigations or to an employee’s medical condition or workplace accommodations were disclosed through an external breach.

Should information contained with the on-premises environment be compromised, the resulting breach could negatively impact the privacy interests of individuals and the trust between individuals whose information is compromised and the federal government. Compromise of the personal information specific to Azure, i.e. information needed to authenticate to the Azure administrator portal would have a limited privacy impact on the administrator, as the personal information is limited to low sensitivity basic contact information.