Directive on Automated Decision-Making

• 1.1

  This Directive takes effect on April 1, 2019, with compliance required by no later than April 1, 2020.

• 1.2

  This Directive will have an automatic review process planned every 6 months after the date it comes into effect.

• 2.1

  This Directive is issued under the authority of section 7 of the Financial Administration Act, and under section 4.4.2.4 of the Policy on Service and Digital.

• 3.1

  Definitions to be used in the interpretation of this Directive are listed in Appendix A.

• 4.1

  The objective of this Directive is to ensure that Automated Decision Systems are deployed in a manner that reduces risks to Canadians and federal institutions, and leads to more efficient, accurate, consistent, and interpretable decisions made pursuant to Canadian law.

• 4.2

  The expected results of this Directive are as follows:

  • 4.2.1

    Decisions made by federal government departments are data-driven, responsible, and comply with procedural fairness and due process requirements.

  • 4.2.2

    Impacts of algorithms on administrative decisions are assessed and negative outcomes are reduced, when encountered.

  • 4.2.3

    Data and information on the use of Automated Decision Systems in federal institutions are made available to the public, where appropriate.

• 5.1

  This Directive applies only to systems that provide external services as defined in the Policy on Service and Digital.

• 5.2

  This Directive applies to any system, tool, or statistical models used to recommend or make an administrative decision about a client.

• 5.3

  This Directive applies only to systems in production, and excludes Automated Decision Systems operating in test environments.

• 5.4

  As per the Policy on Service and Digital, this Directive does not apply to any National Security Systems.

• 5.5

  This Directive applies to any Automated Decision System developed or procured after April 1, 2020.

The Assistant Deputy Minister responsible for the program using the Automated Decision System, or any other person named by the Deputy Head, is responsible for:

• 6.1

  Algorithmic Impact Assessment

  • 6.1.1

    Completing an Algorithmic Impact Assessment prior to the production of any Automated Decision System.

  • 6.1.2

    Applying the relevant requirements prescribed in Appendix C as determined by the Algorithmic Impact Assessment.

  • 6.1.3

    Updating the Algorithmic Impact Assessment when system functionality or the scope of the Automated Decision System changes.

  • 6.1.4

    Releasing the final results of Algorithmic Impact Assessments in an accessible format via Government of Canada websites and any other services designated by the Treasury Board of Canada Secretariat pursuant to the Directive on Open Government.

• 6.2

  Transparency

  Providing Notice Before Decisions

  • 6.2.1

    Providing notice through all service delivery channels in use that the decision rendered will be undertaken in whole or in part by an Automated Decision System as prescribed in Appendix C.

  • 6.2.2

    Providing notices prominently and in plain language, pursuant to the Canada.ca Content Style Guide.

  Providing Explanations After Decisions

  • 6.2.3

    Providing a meaningful explanation to affected individuals of how and why the decision was made as prescribed in Appendix C.

  Access to components

  • 6.2.4

    Determining the appropriate license for software components as per the requirements specified in section in A.2.3.8 of the Directive on Service and Digital.

  • 6.2.5

    If using a proprietary license, ensuring that:

    • 6.2.5.1

      All released versions of proprietary software components used for Automated Decision Systems are delivered to, and safeguarded by, the department.

    • 6.2.5.2

      The Government of Canada retains the right to access and test the Automated Decision System, including all released versions of proprietary software components, in case it is necessary for a specific audit, investigation, inspection, examination, enforcement action, or judicial proceeding, subject to safeguards against unauthorized disclosure.

    • 6.2.5.3

      As part of this access, the Government of Canada retains the right to authorize external parties to review and audit these components as necessary.

  Release of Source Code

  • 6.2.6

    Releasing custom source code owned by the Government of Canada as per the requirements specified in section A.2.3.8 of the Directive on Service and Digital, unless:

    • 6.2.6.1

      The source code is processing data classified SECRET, TOP SECRET or PROTECTED C;

    • 6.2.6.2

      Disclosure would otherwise be exempted or excluded under the Access to Information Act, if the Access to Information Act were to apply, or

    • 6.2.6.3

      An exemption is provided by the Chief Information Officer of Canada.

  • 6.2.7

    Determining the appropriate access restrictions to the released source code.

  Documenting Decisions

  • 6.2.8

    Documenting the decisions of Automated Decision Systems in accordance with the Directive on Service and Digital, and in support of the monitoring (6.3.2) and reporting requirements (6.5.1).

• 6.3

  Quality Assurance

  Testing and Monitoring Outcomes

  • 6.3.1

    Before launching into production, developing processes so that the data and information used by the Automated Decision Systems are tested for unintended data biases and other factors that may unfairly impact the outcomes.

  • 6.3.2

    Developing processes to monitor the outcomes of Automated Decision Systems to safeguard against unintentional outcomes and to verify compliance with institutional and program legislation, as well as this Directive, on a scheduled basis.

  Data Quality

  • 6.3.3

    Validating that the data collected for, and used by, the Automated Decision System is relevant, accurate, up-to-date, and in accordance with the Policy on Service and Digital and the Privacy Act.

  Peer Review

  • 6.3.4

    Consulting the appropriate qualified expert to review the Automated Decision System, as prescribed in Appendix C.

  Employee Training

  • 6.3.5

    Providing adequate employee training in the design, function, and implementation of the Automated Decision System to be able to review, explain and oversee its operations, as prescribed in Appendix C.

  Contingency

  • 6.3.6

    Establishing contingency systems and/or processes as per Appendix C.

  Security

  • 6.3.7

    Conducting risk assessments during the development cycle of the system and establish appropriate safeguards to be applied, as per the Policy on Government Security.

  Legal

  • 6.3.8

    Consulting with the institution’s legal services, from the concept stage of a project, to ensure that the use of the Automated Decision System is compliant with applicable legal requirements.

  Ensuring human intervention

  • 6.3.9

    Ensuring that an Automated Decision System allows for human intervention, when appropriate, as per Appendix C.

  • 6.3.10

    Obtaining the appropriate level of approvals prior to the production of an Automated Decision System as per Appendix C.

• 6.4

  Recourse

  • 6.4.1

    Providing clients with any applicable recourse options that are available to them to challenge the administrative decision.

• 6.5

  Reporting

  • 6.5.1

    Publishing information on the effectiveness and efficiency of the Automated Decision Systems in meeting program objectives on a website or service designated by the Treasury Board of Canada.

• 7.1

  Consequences of non-compliance with this policy can include any measure allowed by the Financial Administration Act that the Treasury Board would determine as appropriate and acceptable in the circumstances.

• 7.2

  For an outline of the consequences of non‑compliance, refer to the Framework for the Management of Compliance, Appendix C: Consequences for Institutions and Appendix D: Consequences for Individuals.

Subject to the necessary delegations, the Chief Information Officer of Canada is responsible for:

• 8.1

  Providing government-wide guidance on the use of Automated Decision Systems.

• 8.2

  Granting exceptions under any of these provisions, in consultation with the Enterprise Architecture Review Board prior to making a decision.

• 8.3

  Developing and maintaining the Algorithmic Impact Assessment and any supporting documentation.

• 8.4

  Communicating and engaging government-wide and with partners in other jurisdictions and sectors to develop common strategies, approaches, and processes to support the responsible use of Automated Decision Systems.

• 9.1

  This Directive applies to all institutions referenced in the Policy on Service and Digital, unless excluded by specific acts, regulations or Orders-in-Council;

  • 9.1.1

    Agents of Parliament are excluded from this Directive, including the:

    • Office of the Auditor General,
    • Office of the Chief Electoral Officer,
    • Office of the Commissioner of Lobbying of Canada,
    • Office of the Commissioner of Official Languages,
    • Office of the Information Commissioner of Canada,
    • Office of the Privacy Commissioner of Canada, and
    • Office of the Public Sector Integrity Commissioner of Canada.
• 9.2

  Agencies, Crown Corporations, or Agents of Parliament may enter into Specific Agreements with the Treasury Board of Canada Secretariat to adopt the requirements of this Directive and apply them to their organization, as required.

• 10.1
  • Financial Administration Act
  • Access to Information Act
  • Canadian Human Rights Act
  • Privacy Act
  • Security of Information Act
• 10.2
  • Policy on Access to Information
  • Policy on Service and Digital
  • Policy on Government Security
  • Policy on Privacy Protection
  • Directive on Open Government

• 11.1

  For interpretation of any aspect of this Directive, contact Treasury Board of Canada Secretariat Public Enquiries.

• 11.2

  Individuals from federal institutions may contact ai-ia@tbs-sct.gc.ca for any questions regarding this Directive, including the Algorithmic Impact Assessment.