Canadian Document Access System (CDAS)

The CDAS Project supports the administration of CIPO's Patent Program by laying open for public inspection Patent Application, Patent Prosecution and Patent Case file records in accordance with section 10 of the Patent Act, which states:

10. (1) Subject to subsections (2) to (6) and section 20, all patents, applications for patents and documents filed in connection with patents or applications for patents shall be open to public inspection at the Patent Office, under such conditions as may be prescribed.

Since it was established, the Patent Program has made the entire Patent Application, Patent Prosecution and Patent Case file records available to program participants and the public by allowing individuals to request and inspect records onsite at the office's location in the National Capital Region. The creation and launch of the CPD in 1996 has enabled the Patent Program to share Patent Application Case file records (i.e. cover page, abstract, claims, description, drawings, representative drawings) online and make them accessible to the program participants and the public regardless of geographic location. Following the implementation of the CDAS project, the Patent Program will expand the amount of Patent Application, Patent Prosecution and Patent Case file records that it shares with program participants and the public and will export additional Patent Application, Patent Examination Related case file and Patent Case file records to the WIPO CASE system.

The records that are found in Patent Application, Patent Prosecution and Patent Case file are created by the Patent Program over the course of administering applications for patents and granted patents. In support of these administrative processes, the Patent Program collects personal information directly from program participants who have been defined as:

• Inventors
• Patent applicants
• Assignees
• Patentees
• Patent Agents

The Patent Program's authority for collection and use of this information is established by sections 49 and 50 of the Patent Act and is further prescribed by sections 27.1, 37 and 42 of the Patent Rules and, in the case of patent applications that are submitted under the Patent Cooperation Treaty (PCT), article 4 of the PCT and rule 4 of the PCT Regulations.

It should be noted that the Patent Program actively collects only a limited amount of personal information for the purpose of administering patent applications and granted patents. In addition to this, the Patent Program also receives a variety of records that program participants submit at their own discretion. These records may contain personal or sensitive information that is not explicitly requested by the Patent Program, but is added to the Patent Application, Patent Prosecution and Patent Case file in accordance with the patent regulations cited above. In order to reduce the risk and impact of a privacy breach on program participants, assignment typed records, which may include documents that contain sensitive personal information, have been excluded from the scope of the CDAS project and will therefore not be disseminated online.

The design and implementation of the CDAS Project is being carried out by CIPO with assistance from the Industry Canada's information technology sector, the Chief Information Office (CIO).

The Patent Program has a long-term mandate to make Patent Application, Patent Prosecution and Patent Case file records available for public inspection in accordance with section 10 the Patent Act. Therefore, while the CDAS Project itself will have a definite end date, the outcome of the project, which is the dissemination of additional Patent Prosecution and Patent Case file records on the internet via the CPD and, the export of additional Patent Application, Patent Examination Related case file and Patent Case file records to WIPO, will be long-term.

The Patent Program collects information for external administrative purposes, i.e. the examination of patent applications and the granting and maintenance of patents, which affects program participants, namely:

• Inventors
• Patent Applicants
• Assignees
• Patentees
• Patent Agents

Question:
Does the new or substantially modified program or activity involve the implementation of a new electronic system of the use of a new application or software, including collaborative software (or groupware), to support the program or activity in terms of creation, collection or handling of personal information?

Answer:
No

Explanation:
The CDAS project does not involve the implementation of a new electronic system or the use of a new application or software. The CDAS project is leveraging CIPO's existing systems, i.e. the CPD and the Patent Program's internal system for administering patent applications and patents, TechSource system. Therefore, the uploading of additional Patent Prosecution and Patent Case file records to the CPD and the exportation of Patent Application, Patent Examination Related case file and Patent Case file records to WIPO will not result in the implementation of new applications, software, or groupware.

Question:
Does the new or substantially modified program or activity require any modification to information technology (IT) legacy systems?

Answer:
Yes

Explanation:
Modifications to the CPD, CIPO's online and searchable patent database, involve the upload of additional records, i.e. Patent Prosecution and Patent Case file records from the TechSource system. No other modifications, such as the addition of search fields are planned to the CPD system.

The addition of Patent Prosecution and Patent Case file records to the CPD is possible as a result of modifications to the TechSource system, the Patent Program's internal system for administering patent applications and patents. Screens are being added to TechSource so that additional metadata can be assigned to Patent Application and Patent Case file records to ensure that these records are accurately identified in TechSource.

Specific technological issues and privacy

Question:
Does the new or substantially modified program or activity involve implementation of new technologies or one or more of the following activities:

• Enhanced identification methods
• Surveillance; or
• Automated personal analysis, personal information matching and knowledge discovery techniques.

Answer:
No

The CPD is an online database and is therefore connected to the internet.

TechSource, the system from which Patent Application, Patent Prosecution and Patent Case file records are downloaded to the CPD sits on a secure mainframe and has no direct connections to the CPD. The same applies for the Patent Application, Patent Examination Related case file and Patent Case file records that are exported to the WIPO CASE system; no direct connection between TechSource and the WIPO CASE systems is made.

Question:
Potential risk that in the event of a privacy breach, there will be an impact on the individual or the employee?

Answer: Very Low

Treasury Board Secretariat (TBS) defines a privacy breach as the:

improper or unauthorized collection, use, disclosure, retention or disposal of personal information…a privacy breach may occur within an institution or off-site and may be the result of inadvertent error or malicious actions by employees, third parties, partners in information sharing agreements of intruders.

The Patent Program has taken several precautions to reduce the risk and impact of a privacy breach on program participants that could occur as a result of implementing the CDAS project. These precautions include:

1. Exclusion of assignment records from CPD and exportation to WIPO CASE
2. Separation of payment forms and information from case file records
3. User Authentication for payment transactions
4. Redaction of credit card numbers from incoming correspondence

Assignment records relate to the ownership of a patent application or patent. In order for an assignment to be registered, program participants are required to submit documents to the Patent Program as proof that there has been a transaction regarding the ownership of the patent application or patent. As section 50(3) of the Patent Act states: "no assignment, grant or conveyance shall be registered in the Patent Office unless it is accompanied by the affidavit of a subscribed witness or established by other proof to the satisfaction of the Commissioner…". The Patent Program does not prescribe what documents program participants must submit as proof, and therefore the selection of documents is at the discretion of program participants. While the documents submitted by program participants generally do not contain personal information other than names, addresses, and signatures, in some cases, program participants submit documents such as wills, death certificates, security agreements, etc^{Footnote 1}. Therefore, in light of the fact that sensitive personal information may be contained in the assignment records, in the scope of the CDAS project, the Patent Program has elected neither to add these records to the CPD nor to export them to the WIPO Case system at this time. The Patent Program will however continue to make assignment records available for public inspection on site at its office in the National Capital Region in keeping with its legislative mandate to do so. Furthermore, as part of the CDAS project, the Patent Program will develop an office policy and guidance informing program participants to submit only necessary documentation and to redact or remove any sensitive personal information that is not relevant to the assignment. For example, in the case of a will, redactions of sections for bequests not related to intellectual property will be acceptable. These policies will be posted on relevant webpages and communicated to program participants through other existing channels. CIPO also recognizes that at times, sensitive personal information could be contained within other documents submitted by program participants. An example of this is that occasionally inventors will provide their CVs as part of the patent program. The Patent Program will develop an office policy and guidance informing program participants to only submit necessary documentation and to redact or remove any sensitive personal information.

CIPO will also develop a policy and process to remove sensitive personal information from the CPD and communicate it to the program participants, where it may inadvertently been published.

CIPO collects financial information, such as deposit account numbers and credit card numbers which are submitted from program participants in order to administer patent applications and patents. More than 85% of program participants use a payment form to submit this information. These payment forms are not loaded into the Patent Program's systems; rather they are entered in CIPO financial systems (FITT/IFMS) and are stored in paper in a locked vault at CIPO. When these forms are not used by program participants, credit card numbers are redacted from the incoming pieces of correspondence and therefore the numbers cannot be read; deposit account numbers are unique CIPO internal numbers and are not manually redacted. These numbers can only be used internally by authorized and registered payers who have received usernames and passwords allowing them to use these numbers to pay fees. Without proper credentials, a deposit account number won't work.