Appendices

Appendix A: Example of outcomes in child protection services

Using the anti-racism data standards to track and monitor outcomes at different stages of a program, service, or function can help public sector organizations understand where potential systemic racial barriers or disadvantages may be occurring. Visit the Ontario Association of Children’s Aid Societies for an example of a typical pathway through the child protection system.

Appendix B: Security Safeguards

Organizations should implement appropriative administrative, technical and physical measures to secure personal information, including safeguards such as:

1. Administrative safeguards:
   • Develop, document and implement security management plans, policies and procedures including user access management, access controls and authorization
   • Develop, document and implement security incident management response protocols
   • Develop, document and implement a third party service provider management plan that defines security requirements for service providers including contract provisions, confidentiality agreements, training and education, use of sub-contracting, audits requirements, and appropriate management of personal information when creating, receiving, maintaining, or disposing of it on behalf of the PSO.
   • Define accountability in accordance with Standard 2 to ensure security rules are defined, documented and consistently implemented.
   • Ensure employees, officers, consultants and agents have appropriate security training so they understand required security measures, including appropriate encryption, proper information handling procedures, defenses against improper password use, phishing, malware and ransomware (in accordance with Standard 3).
   • Develop a contingency plan to identify, protect and recover personal information in event of a natural disaster, or loss of power.
   • Monitor and evaluate security plans, policies and procedures, including security incident management response protocols and, when necessary, update and revise.
2. Physical Safeguards:
   • Limit physical access to PSOs' premises and, within premises, to where personal information is used and stored (e.g.electronic information systems, workstations, etc.).
   • Restrict access to authorized users of personal information (i.e. use access cards and key, ID badges, screen and supervise visitors, etc.).
3. Technical Safeguards:
   • Restrict access only to those individualswho have been granted access rights by using strong authentication and access controls such as:
     • detailed logging, auditing, monitoring;
     • strong passwords, encryption;and
     • verifying identity prior to access.
   • Record and examine activity in information systems containing or using personal information through detailed logging, auditing, monitoring.
   • Protect personal information from improper alteration or destruction through such measures as:
     • patch and change management;
     • firewalls, anti-virus, anti-spam, anti-spyware;
     • protection against malicious code; and
     • Threat Risk Assessments.
   • Guard against unauthorized access to personal information transmitted over an electronic communications network (i.e. ensure secure transmission of personal information).

Appendix C: De-identification of Personal Information

It is important to note that there are different levels of de-identification. The appropriate level depends upon the context (i.e. type of information, proposed use or disclosure, etc.).Also, de-identification does not reduce the risk of re-identification to zero. Rather, the process can produce data sets for which the risk of re-identification is very small.

Classifying and treating information for de-identification

“De-identification” refers to the process of removing or transforming personal information in a record or data set so that there is no reasonable expectation in the circumstances that the information could be used, either alone or with other information, to identify an individual.

Direct identifiers

are information that can be used to uniquely identify an individual; for example names, street addresses, telephone numbers, email addresses, Internet protocol (IP) addresses, any other unique identifying number, characteristic, or code.

Masking is the removal of information classified as direct identifiers and/or replacement of direct identifiers with pseudonymous or encrypted information (i.e. unique identification key) to enable linking back to the original data set, if appropriate. Data sets with direct identifiers masked is called a pseudonymous data set.

Indirect, or quasi-identifiers

are information that can be used individually or in combination, usually by someone with background knowledge, to re-identify an individual in the data set. Some examples are gender, dates of events (e.g. birth, marriage, etc.), income, education, language, etc. Classifying personal information that may be quasi-identifiers requires understanding what other information or data is available, how much someone is motivated to re-identify an individual, and what they know about one or more individuals in the data set.

De-identification techniques

There are a number of de-identification techniques that can be applied to quasi-identifiers, such as removing, suppressing, generalizing or transforming the personal information. Depending on the level of re-identification risk, de-identification techniques may be applied to individual data points (i.e. a specific variable for a specific individual), to a specific variable for all individuals, or to the entire record for a specific individual. Organizations should apply the appropriate techniques necessary to de-identify personal information while maintaining the usefulness of data about Indigenous identity and race.

The de-identification of personal information involves applying different techniques on direct or indirect identifiers to reduce the risk of re-identification to an acceptably low level.Techniques to achieve this include:

Masking

the removal of personal information classified as direct identifiers or replacement of direct identifiers with pseudonymous or encrypted information.

Removal

eliminating the variable from the data set

Suppression

removing or withholding the values of a sensitive cell or variable for particular individual(s), or removing all the personal information of individual(s) from the data set.

Generalization

reducing precision in the values of a variable, for example, by recording as age intervals instead of exact age; 10-14 years, 15-19 years, etc.

Top- or bottom coding

restricting the upper and lower range of a variable

Collapsing categories and/or combining variables

merging two or more categories of a variable, or combining two variables to create a new variable

Sampling

rather than providing all of the original data, releasing a random sample of sufficient size to yield reasonable inferences

Swapping

matching unique cases on the indirect identifier, then exchanging the values of key variables between the cases to limit disclosure risk

Disturbing

adding random variation or stochastic error to the variable.

Types of release models

Organizations may need to consider various release models for use and disclosure for research purposes, with the necessary de-identification and security controls applied.

The following release models represent a spectrum of ways that data can be made available that range from restricted (non-public) to open (public):

Non-public (restricted)

Data is available only to authorized users with specified conditions and terms regarding the privacy and security of the data (i.e. oaths of confidentiality, data-sharing agreements). Personal information is masked and security controls are in place (i.e. administrative, technical, or physical controls to protect privacy and confidentiality of information used).

Quasi-public (semi-restricted)

Data is released with some controls over access, such as requirement to register and/or agree to some restrictions or conditions for the release of data (e.g. terms-of-use agreements). Personal information is de-identified, and security controls are in place (i.e. administrative, technical, or physical controls to protect privacy and confidentiality of information used).

Public (open data)

Data is released to the public with minimal controls, conditions or limits over public access. Users may be requested to agree to terms under an open license. Personal information is fully de-identified.

Appendix D: Using Statistics Canada data sets for benchmarking

The Ontario race categories in the Standards are compared to the appropriate Statistics Canada population group categories as follows:

Table 2. Conversion Table of Categories Collected

Statistics Canada’s Immigration and Ethnocultural Diversity Highlight tables contain derived categories for multiple race responses. In order to benchmark appropriately, it is important to be aware of the methodology that Statistics Canada applies to individuals who select more than one population group; for example, someone who identifies as Black and White is classified only as Black, under the Visible Minority variable, and more generally as a “visible minority.” Those who select multiple non-white backgrounds are classified as “multiple visible minorities,” or “VM n.i.e.”

Wherever feasible, PSOs should use public use microdata files which contain disaggregated multiple response data. Disaggregated data allows analysts and researchers to parse out the specific combinations of multiple ‘visible minority’ responses, and apply consistent methodology to the data used for benchmarking and analyses. The microdata are available only through Statistics Canada Research Data Centres or by subscription.

In using Statistics Canada population group as benchmarks, it is important to recognize differences in the way race is framed and categorized in Ontario’s standard, compared to Statistics Canada’s “population groups” (see Table 3).

Table 3. Comparisons between theStandards and Statistics Canada’s approach

The objective of Ontario’s approach is to capture race and racialization as experienced in Ontario for the purposes of identifying and monitoring systemic racism. This includes asking Indigenous peoples about the racial diversity that exists in their communities, in addition to their Indigenous identification. The 2016 Census results for Ontario show that about 80% of respondents with Indigenous (First Nations, Métis, and Inuit) ancestries also reported non-Indigenous origins.

Appendix E: Using racial disproportionality and disparity indices

Depending on the question you want to answer, either a disproportionality, or a disparity index may be more appropriate. For example, the desired equity outcome may be that individuals of specific racial groups should be represented in a given program or service at the same proportion as their presence in the wider population. In this case, the racial disproportionality index is appropriate to assess whether there might be an overrepresentation or underrepresentation of racial groups in a service, program or function.

A racial disproportionality index however, does not help answer questions about whether individuals served by a PSO are receiving equitable treatment or outcomes in a program, service, or function.

If the desired equity outcome is that individuals are receiving the same treatment or outcomes within a given program, service, or function, regardless of their race, then a racial disparity index is the appropriate measure to use to identify and track any potential racial inequalities.

In some contexts, both racial disproportionality and racial disparity indices may be used to evaluate different outcomes within a program or service, and to understand systemic racial barriers or inequalities.

For example, where racialized children are shown to be over-represented in the child welfare system using the racial disproportionality index, the racial disparity index may be used to identify whether there is equal access to supervised family visits for the children within the system.

Using disproportionality and disparity indices to identify racial inequalities

A disproportionality or disparity index of ‘1’ indicates equal representation or parity in outcomes within a given program, service, or function, and any number over or under ‘1’ represents an inequality.

For example, if children from Group A are 10% of the general population, but consist of 20% of the child welfare population, the disproportionality index is 2.0. This means that children from Group A are over-represented in the child welfare system, and are two times more likely to be in the child welfare system than their presence in the general population would predict.

Conversely, if students from Group A are 15% of the high school graduating class, but make up only 7% of those receiving diplomas that year, then the disproportionality index is 0.47. This means that students from Group A are under-represented among those graduating, and are about half as likely to complete high school, than would be expected given their presence in the graduating class.

Disparity indices may also be represented as rates.For example, if the homicide rate for Group A is 5 per 100,000 and the homicide rate for Group B is 1 per 100,000, the disparity indicator would be 5.0, meaning that the homicide rate for Group A is 5 times greater than the homicide rate for Group B.

Other kinds of analyses using disproportionality and disparity indices

The disproportionality and disparity equations can be readily adapted for intersectional analyses of race with other factors, such as Indigenous identity, ethnic origin, religion, or other socio-demographic categories.

For example, compare children of Group A from religion X with children of Group B from religion X; or males from Group A with males from Group B, and females from Group A with females from Group B.

Disproportionality and disparity matrices may be constructed to evaluate systemic trends in outcomes across different events in a program or system. The representation of a racial group, or disparities between groups, at a particular decision point in a system or program can be compared to their representation or disparities at a prior decision point.

Consider the example of outcomes in the child protection system presented earlier. Below is a chart showing how to construct a disproportionality matrix to analyse a specific pathway and outcomes for Group A. In the example chart below, Group A’s percentage in the general population is P_A. The benchmark for comparison at each decision point is the percentage of Group A at a prior decision point.

Table 4. Racial Disproportionality Matrix - Example

Disparity matrices may also be constructed to analyse systemic trends in outcomes for different groups across various stages of a program, service, or function. Below is a chart to show how to construct a disparity matrix to compare Group A against Group B along a specific pathway and outcomes. The percentage of Group A and Group B in the general population is P_A and P_B, respectively.

Table 5. Racial Disparity Matrix - Example