Annual Report to Parliament on the Administration of the Privacy Act 2016-2017

Table of contents

Chapter 1 – Report on the Privacy Act

About Public Safety Canada

The Department of Public Safety and Emergency Preparedness (PSEP) plays a key role in discharging the Government's fundamental responsibility for the safety and security of its citizens. The Minister of PSEP is responsible for the Department. Legislation governing the Department sets out three essential roles: (i) support the Minister's responsibility for all matters related to public safety and emergency management not assigned to another federal organization; (ii) exercise leadership at the national level for national security and emergency preparedness; and (iii) support the Minister's responsibility for the coordination of Public Safety's Portfolio entities.

The Department provides strategic policy advice and support to the Minister of PSEP on a range of issues including: national security, border strategies, countering crime, and emergency management. The Department also delivers a number of grant and contribution programs related to emergency management, national security and community safety.

Public Safety Canada is organized into five branches: Emergency Management and Programs, Community Safety and Countering Crime, Portfolio Affairs and Communications, National and Cyber Security, Corporate Management; it also has a Chief Audit and Evaluation Executive and are supported by the Legal Services Unit. The Department has regional presence in all provinces, as well as in the North, in order to deliver a coordinated federal response to emergencies; facilitate the effective delivery of emergency management, Indigenous policing and crime prevention programs; and improve partnerships with other levels of government and key regional stakeholders.

About the Public Safety Portfolio

The Public Safety Portfolio encompasses nine organizations which directly contribute to the safety and security of Canadians. While Portfolio agencies deliver public security operations according to their mandates, Public Safety Canada, in its portfolio coordination role, brings strategic focus to the overall safety and security agenda. Each organization in the portfolio administers its own access to information and privacy programs, under authorities delegated to them by the Minister.

Public Safety Portfolio

About the Privacy Act

The Privacy Act protects the privacy of all Canadian citizens and permanent residents of Canada regarding personal information held by a government institution against unauthorized use and disclosure. The Privacy Act also gives Canadians, including those in Canada who are not permanent residents or citizens, the right to access personal information held by the government.

Section 72 of the Privacy Act requires that the head of every government institution submit an annual report to Parliament on the administration of the Act during the financial year. This report outlines how Public Safety Canada administered the Privacy Act throughout fiscal year 2016-2017.

The Access to Information and Privacy (ATIP) Office

The ATIP Office is part of Public Safety Canada’s ATIP and Executive Services Division within the Department’s Portfolio Affairs and Communications Branch. The Director of ATIP and Executive Services, supported by one Administrative Assistant, is responsible for ATIP as well as Ministerial Correspondence and Secretariat Services. The ATIP Office consists of 12 full-time positions with two streams of ATIP-related work: (1) the ATIP Operations Unit consisting of one ATIP Manager, two Team Leaders, five Analysts, one Junior Analyst, and one Administrative Officer; and, (2) the Privacy Policy and Training Unit (PPTU) consisting of one Team Leader and one Advisor.

The ATIP Office is responsible for the coordination and implementation of policies, guidelines and procedures to ensure departmental compliance with the Access to Information Act and the Privacy Act. The team is also responsible for responding to requests made under the Acts, as well as providing the following services to the Department:

Delegation of Authority

During the reporting period, the ATIP Office operated under the delegation order signed by the Minister on January 8, 2016, delegating his powers and responsibilities under the Access to Information Act.

New or Revised Policies, Guidelines or Procedures

During the reporting period, there was one new privacy-related guidance document created. The Information Sharing Agreement (ISA) Guidelines were created to assist program officials in creating ISAs.

Additionally, the Privacy Protocol was updated to better ensure departmental officials are aware of their privacy responsibilities when they are implementing new or modifying programs that involve a non-administrative use of personal information.

Training

In 2016-17, the ATIP Office provided 33 training or information sessions on the Access to Information Act and Privacy Act regarding retrieving and reviewing records in response to an Access to Information (ATI) request, Privacy Impact Assessments, and the new Statement of Completeness. 451 people were trained at these sessions.

Monitoring Performance

Reports on compliance and retrieval statistics are reported to the Executive Committee weekly in the Weekly ATIP Report. Additionally, the number of training sessions, privacy breaches and completed Privacy Impact Assessments are reported to the Executive Committee quarterly.

Challenges/Complexities

Following an internal audit of the personal information holdings of Public Safety Canada, several recommendations were made for improving the management of personal information. During the reporting period, a plan was created to fulfil the recommendations and progress was made. Addressing the recommendations has added to the workload of the PPTU, which has provided additional training, advice and recommendations to all branches regarding privacy best practices.

Volume and Capacity

The number of requests received under the Privacy Act increased 90 per cent from the last reporting period, and the complexity of the requests received remains challenging due to the interwoven information of multiple individuals.

Key Issues Raised as a Result of Complaints/Investigations/Audits

In response to the recommendations of the internal audit of the personal information holdings of Public Safety Canada in 2014-15, information holdings were examined to ensure the proper management of personal information. The Information Sharing Agreement (ISA) Review Process was completed; and guidance was provided to departmental officials on how to safeguard the personal information in the department.

Material Privacy Breaches

There were no material privacy breaches reported this fiscal year.

Appeals to the Court

There were no appeals to the Federal Court this fiscal year.

Privacy Impact Assessments Completed During the Year

There were no Privacy Impact Assessments (PIAs) completed this fiscal year.

Chapter II – Privacy Act Statistical Report

Summary

In 2016-17, Public Safety Canada received 67 requests under the Privacy Act, an increase of approximately 91 per cent over the previous year. Public Safety Canada completed 100 per cent on time, the eighth consecutive year of over 90 per cent on time completion. It took the department an average of 13 days to process a request made under the Privacy Act.

Overall Workload Trends

Annex B provides a summarized statistical report on Privacy Act requests processed by Public Safety Canada between April 1, 2016 and March 31, 2017. The following section provides an overview and interpretation of this information.

The overall workload for ATIP has increased by 12.3% over the 2015-16 fiscal year, and increased by 26.8% over the 2014-15 fiscal year.  

The following table provides an overall breakdown of workload by category for the past five years.

2012-2013

2013-2014

2014-2015

2015-2016

2016-2017

ATI requests received by
Public Safety Canada

494

465

 310

 346

417

Privacy requests received by Public Safety Canada

30

68

23       

 35

67

ATI consultations received from other institutions

248

255

238

271

247

Privacy consultations received from other institutions

10

9

9

3

4

Total workload

782

797

580

655

735

Requests Received under the Privacy Act

The number of privacy requests remains small compared to the volume of access to information requests. Public Safety Canada collects little information directly from Canadians in comparison to portfolio agencies whose mandates are more operational in nature, such as the Royal Canadian Mounted Police (RCMP) and Correctional Service of Canada (CSC) who receive thousands of privacy requests annually

Public Safety Canada received 67 new Privacy Act requests throughout the 2016-17 fiscal year, representing an increase of approximately 91 per cent over the number of requests received during previous year (35). No requests were carried forward from the previous fiscal year and no requests were carried forward to the 2017-18 reporting year.

Extensions

Section 15 of the Privacy Act allows institutions to extend the legal deadline for processing a request if a search for responsive records would unreasonably interfere with the operations of the government institution, or consultations are necessary to comply with the request that cannot reasonably be completed within the original time limit. During the 2016-17 fiscal year, the department invoked two extensions of 16 to 30 days. The extensions were invoked to conduct required consultations.

Performance in Meeting Statutory Response Deadlines

Of the 67 completed requests, 46 were completed within 15 days, 19 were completed between 16-30 days, and two between 61 to 120 days. All 67 requests were completed within the statutory deadline.

Disposition of Requests for 2016-2017

There were five requests received under the Privacy Act that were disclosed without exemptions applied, four requests disclosed in part, one request that was exempted in its entirety, two requests that were abandoned, 55 requests where no records existed and no requests where the existence of records was neither confirmed nor denied.

Consultations from other Institutions

During fiscal year 2016-17, a total of four consultations from other institutions were received.

Disclosures Pursuant to paragraph 8(2)(m) of the Privacy Act

Paragraph 8(2)(m) of the Privacy Act provides the head of the institution with the authority to disclose personal information where the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure, or where the disclosure would clearly benefit the individual to whom the information relates. No disclosures pursuant to paragraph 8(2)(m) of the Privacy Act were made by Public Safety Canada in 2016-17.

Appendix A – Delegation of Authority for the Privacy Act and Regulations

The Minister of Public Safety and Emergency Preparedness, pursuant to section 73 of the Privacy Act*, hereby designates the persons holding the positions set out below, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Minister as the head of the Department of Public Safety and Emergency Preparedness, under the section of the Act and related regulations set out opposite each position.  This designation replaces all previous delegation orders.

Delegation Order – Privacy Act and Regulations
(signed July 15, 2014)
Section/Article Action Deputy Minister; Associate Deputy Minister Assistant Deputy Minister, Portfolio Affairs and Communications; Director General, Cabinet, Parliamentary and Executive Services; Assistant Deputy Ministers; Chief Audit Executive ATIP Manager; Director, Executive Services Senior ATIP Advisors and ATIP Analysts
8(2)(j) Disclosure for research purposes
8(2)(m) Disclosure in the public interest or in the interest of the individual
8(4) Copies of requests under 8(2)(e) to be retained
8(5) Notice of disclosure under  8(2)(m)
9(1) Record of disclosures to be retained
9(4) Consistent uses
10 Personal information to be included in personal information banks
14 Notice when access requested
15 Extension of time limits
17(2)(b) Language of access
17(3)(b) Access to personal information in alternative format
18(2) Exemption (exempt bank) – Disclosure may be refused
19(1) Exemption – Personal information obtained in confidence
19(2) Exemption – Where authorized to disclose
20 Exemption – Federal-provincial affairs
21 Exemption – International affairs and defence
22 Exemption – Law enforcement and investigations
22.3 Exemption– Public Servants Disclosure Protection Act
23 Exemption– Security clearances
24 Exemption – Individuals sentenced for an offence
25 Exemption – Safety of individuals
26 Exemption– Information about another individual
27 Exemption – Solicitor-client privilege
28 Exemption – Medical record
31 Notice of intention to investigate
35(1) Findings and recommendations of Privacy Commissioner (complaints)
35(4) Access to be given
36(3) Report of findings and recommendations (exempt banks)
37(3) Report of findings and recommendations (compliance review)
51(2)(b) Special rules for hearings
51(3) Ex parte representations
70 Confidences of the Queen's Privy Council for Canada
72(1) Annual report to Parliament
Privacy Regulations
9 Reasonable facilities and time provided to examine personal information
11(2) Notification that correction to personal information has been made
11(4) Notification that correction to personal information has been refused
13(1) Disclosure of personal information relating to physical or mental health may be made to a qualified medical practitioner or psychologist for an opinion on whether to release information to the requester
14 Disclosure of personal information relating to physical or mental health may be made to a requester in the presence of a qualified medical practitioner or psychologist

Delegation Order – Privacy Act and Regulations
(signed June 8, 2016)
Section/Article Action Deputy Minister; Associate Deputy Minister Assistant Deputy Minister, Portfolio Affairs and Communications; Director General, Cabinet, Parliamentary and Executive Services Assistant Deputy Ministers; Chief Audit Executive ATIP Manager; Director, ATIP and Executive Services Team Leaders, ATIP Operations and ATIP Analysts
8(2)(j) Disclosure for research purposes
8(2)(m) Disclosure inthe public interest or in the interest of the individual
8(4) Copies of requests under 8(2)(e) to be retained
8(5) Notice of disclosure under  8(2)(m)
9(1) Record of disclosures to be retained
9(4) Consistent uses
10 Personal information to be included in personal information banks
14 Notice when access requested
15 Extension of time limits
17(2)(b) Language of access
17(3)(b) Access to personal information in alternative format
18(2) Exemption (exempt bank) – Disclosure may be refused
19(1) Exemption – Personal information obtained in confidence
19(2) Exemption – Where authorized to disclose
20 Exemption – Federal-provincial affairs
21 Exemption – International affairs and defence
22 Exemption – Law enforcement and investigations
22.3 Exemption– Public Servants Disclosure Protection Act
23 Exemption– Security clearances
24 Exemption – Individuals sentenced for an offence
25 Exemption – Safety of individuals
26 Exemption– Information about another individual
27 Exemption – Solicitor-client privilege
28 Exemption – Medical record
31 Notice of intention to investigate
35(1) Findings and recommendations of Privacy Commissioner (complaints)
35(4) Access to be given
36(3) Reportof findings and recommendations (exempt banks)
37(3) Report of findings and recommendations (compliance review)
51(2)(b) Special rules for hearings
51(3) Ex parte representations
70 Confidences of the Queen's Privy Council for Canada
72(1) Annual report to Parliament
Privacy Regulations
9 Reasonable facilities and time provided to examine personal information
11(2) Notification that correction to personal information has been made
11(4) Notification that correction to personal information has been refused
13(1) Disclosure of personal information relating to physical or mental health may be made toa qualified medical practitioner or psychologist for an opinion on whether to release information to the requester
14 Disclosure of personal information relating to physical ormental health may be made to a requester in the presence of a qualified medical practitioner or psychologist

Appendix B – Statistical Report for 2015-2016 on the Privacy Act

Statistical Report on the Privacy Act

Reporting period: 2016-04-01 to 2017-03-31

Part 1: Requests Under the Privacy Act

Part 1: Requests Under the Privacy Act
  Number of Requests

Received during reporting period

67

Outstanding from previous reporting period

0

Total

67

Closed during reporting period

67

Carried over to next reporting period

0

Part 2: Requests Closed During the Reporting Period

2.1 Disposition and completion time

Disposition of Requests

Completion Time

 

 

1 to 15 Days

16 to 30 Days

31 to 60 Days

61 to 120 Days

121 to 180 Days

181 to 365 Days

More Than 365 Days

Total

All disclosed

1

4

0

0

0

0

0

5

Disclosed in part

1

1

0

2

0

0

0

4

All exempted

0

1

0

0

0

0

0

1

All excluded

0

0

0

0

0

0

0

0

No records exist

43

12

0

0

0

0

0

55

Request abandoned

1

1

0

0

0

0

0

2

Neither confirmed nor denied

0

0

0

0

0

0

0

0

Total

46

19

0

2

0

0

0

67

 

2.2 Exemptions

Section

Number of Requests

Section

Number of Requests

Section

Number of Requests

18(2)

0

22(1)(a)(i)

1

23(a)

0

19(1)(a)

0

22(1)(a)(ii)

0

23(b)

0

19(1)(b)

0

22(1)(a)(iii)

0

24(a)

0

19(1)(c)

0

22(1)(b)

0

24(b)

0

19(1)(d)

0

22(1)(c)

0

25

0

19(1)(e)

0

22(2)

0

26

4

19(1)(f)

0

22.1

0

27

1

20

0

22.2

0

28

0

21

2

22.3

0

0 0

 

2.3 Exclusions

Section

Number of Requests

Section

Number of Requests

Section

Number of Requests

69(1)(a)

0

70(1)

0

70(1)(d)

0

69(1)(b)

0

70(1)(a)

0

70(1)(e)

0

69.1

0

70(1)(b)

0

70(1)(f)

0

0 0

70(1)(c)

0

70.1

0

 

2.4 Format of information released

Disposition

Paper

Electronic

Other formats

All disclosed

3

2

0

Disclosed in part

2

2

0

Total

5

4

0

2.5 Complexity

2.5.1 Relevant pages processed and disclosed

Disposition of Requests

Number of Pages Processed

Number of Pages Disclosed

Number of Requests

All disclosed

105

105

5

Disclosed in part

716

700

4

All exempted

20

0

1

All excluded

0

0

0

Request abandoned

0

0

2

Neither confirmed nor denied

0

0

0

Total

841

805

12

 

2.5.2 Relevant pages processed and disclosed by size of requests

Disposition

Less Than 100
Pages Processed

101-500
Pages Processed

501-1000
Pages Processed

1001-5000
Pages Processed

More Than 5000
Pages Processed

Number of Requests

Pages Disclosed

Number of Requests

Pages Disclosed

Number of Requests

Pages Disclosed

Number of Requests

Pages Disclosed

Number of Requests

Pages Disclosed

All disclosed

5

105

0

0

0

0

0

0

0

0

Disclosed in part

1

30

3

670

0

0

0

0

0

0

All exempted

1

0

0

0

0

0

0

0

0

0

All excluded

0

0

0

0

0

0

0

0

0

0

Request abandoned

2

0

0

0

0

0

0

0

0

0

Neither confirmed nor denied

0

0

0

0

0

0

0

0

0

0

Total

9

135

3

670

0

0

0

0

0

0

 

2.5.3 Other complexities

Disposition

Consultation Required

Legal Advice Sought

Interwoven Information

Other

Total

All disclosed

0

0

0

0

0

Disclosed in part

2

0

0

0

2

All exempted

0

0

0

0

0

All excluded

0

0

0

0

0

Request abandoned

0

0

2

2

4

Neither confirmed nor denied

0

0

0

0

0

Total

2

0

2

2

6

2.6 Deemed refusals

2.6.1 Reasons for not meeting statutory deadline

Number of Requests Closed Past the Statutory Deadline

Principal Reason

Workload

External Consultation

Internal Consultation

Other

0

0

0

0

0

 

2.6.2 Number of days past deadline

Number of Days Past Deadline

Number of Requests Past Deadline Where No Extension Was Taken

Number of Requests Past Deadline Where An Extension Was Taken

Total

1 to 15 days

0

0

0

16 to 30 days

0

0

0

31 to 60 days

0

0

0

61 to 120 days

0

0

0

121  to 180 days

0

0

0

181 to 365 days

0

0

0

More than 365 days

0

0

0

Total

0

0

0

 

2.7  Requests for translation

Translation Requests

Accepted

Refused

Total

English to French

0

0

0

French to English

0

0

0

Total

0

0

0

Part 3: Disclosures Under Subsections 8(2) and 8(5)

Disclosures Under Subsections 8(2) and 8(5)

Paragraph 8(2)(e)

Paragraph 8(2)(m)

Subsection 8(5)

Total

0

0

0

0

Part 4: Requests for Correction of Personal Information and Notations

Requests for Correction of Personal Information and Notations

Disposition for Correction Requests Received

Number

Notations attached

0

Requests for correction accepted

0

Total

0

Part 5: Extensions

5.1 Reasons for extensions and disposition of requests
Disposition of Requests Where an Extension Was Taken 15(a)(i)
Interference With Operations
15(a)(ii)
Consultation
15(b)
Translation or Conversion
Section 70 Other

All disclosed

0

0

0

0

Disclosed in part

0

0

2

0

All exempted

0

0

0

0

All excluded

0

0

0

0

No records exist

0

0

0

0

Request abandoned

0

1

0

0

Total

0

1

2

0

 

5.2 Length of extensions
Length of Extensions 15(a)(i)
Interference with operations
15(a)(ii)
Consultation
15(b)
Translation purposes
Section 70 Other

1 to 15 days

0

0

0

0

16 to 30 days

0

1

2

0

Total

0

1

2

0

Part 6: Consultations Received From Other Institutions and Organizations

6.1 Consultations received from other Government of Canada institutions and other organizations

Consultations

Other Government of Canada Institutions

Number of Pages to Review

Other Organizations

Number of Pages to Review

Received during the reporting period

4

45

0

0

Outstanding from the previous reporting period

0

0

0

0

Total

4

45

0

0

Closed during the reporting period

4

45

0

0

Pending at the end of the reporting period

0

0

0

0

 

6.2 Recommendations and completion time for consultations received from other Government of Canada institutions

Recommendation

Number of Days Required to Complete Consultation Requests

1 to 15 Days

16 to 30 Days

31 to 60 Days

61 to 120 Days

121  to 180 Days

181 to 365 Days

More Than 365 Days

Total

All disclosed

3

0

0

0

0

0

0

3

Disclosed in part

1

0

0

0

0

0

0

1

All exempted

0

0

0

0

0

0

0

0

All excluded

0

0

0

0

0

0

0

0

Consult other institution

0

0

0

0

0

0

0

0

Other

0

0

0

0

0

0

0

0

Total

4

0

0

0

0

0

0

4

 

6.3 Recommendations and completion time for consultations received from other organizations

Recommendation

Number of days required to complete consultation requests

1 to 15 Days

16 to 30 Days

31 to 60 Days

61 to 120 Days

121  to 180 Days

181 to 365 Ddays

More Than 365 Days

Total

All disclosed

0

0

0

0

0

0

0

0

Disclosed in part

0

0

0

0

0

0

0

0

All exempted

0

0

0

0

0

0

0

0

All excluded

0

0

0

0

0

0

0

0

Consult other institution

0

0

0

0

0

0

0

0

Other

0

0

0

0

0

0

0

0

Total

0

0

0

0

0

0

0

0

Part 7: Completion Time of Consultations on Cabinet Confidences

7.1 Requests with Legal Services

Number of Days

Fewer Than 100 Pages Processed

101-500 Pages Processed

501-1000
Pages Processed

1001-5000
Pages Processed

More than 5000
Pages Processed

Number of
Requests

Pages Disclosed

Number of
Requests

Pages Disclosed

Number of
Requests

Pages Disclosed

Number of
Requests

Pages Disclosed

Number of
Requests

Pages Disclosed

1 to 15

0

0

0

0

0

0

0

0

0

0

16 to 30

0

0

0

0

0

0

0

0

0

0

31 to 60

0

0

0

0

0

0

0

0

0

0

61 to 120

0

0

0

0

0

0

0

0

0

0

121 to 180

0

0

0

0

0

0

0

0

0

0

181 to 365

0

0

0

0

0

0

0

0

0

0

More than 365

0

0

0

0

0

0

0

0

0

0

Total

0

0

0

0

0

0

0

0

0

0

 

7.2 Requests with Privy Council Office

Number of Days

Fewer Than 100 Pages Processed

101‒500 Pages Processed

501-1000
Pages Processed

1001-5000
Pages Processed

More than 5000
Pages Processed

Number of
Requests

Pages Disclosed

Number of
Requests

Pages Disclosed

Number of
Requests

Pages Disclosed

Number of
Requests

Pages Disclosed

Number of
Requests

Pages Disclosed

1 to 15

0

0

0

0

0

0

0

0

0

0

16 to 30

0

0

0

0

0

0

0

0

0

0

31 to 60

0

0

0

0

0

0

0

0

0

0

61 to 120

0

0

0

0

0

0

0

0

0

0

121 to 180

0

0

0

0

0

0

0

0

0

0

181 to 365

0

0

0

0

0

0

0

0

0

0

More than 365

0

0

0

0

0

0

0

0

0

0

Total

0

0

0

0

0

0

0

0

0

0

Part 8: Complaints and Investigations Notices Received

Complaints and Investigations Notices Received

Section 31

Section 33

Section 35

Court action

Total

 

1

0

0

0

1

 

 

Part 9: Privacy Impact Assessments (PIAs)

Number of PIA(s) completed

0

 

Part 10: Resources Related to the Privacy Act

10.1 Costs

Expenditures

Amount

Salaries

$175,951

Overtime

$0

Goods and Services

$18,972

• Professional services contracts

$0

• Other

$18,972

Total

$194,923

 

10.2 Human Resources

Resources

Person Years Dedicated to Privacy Activities

Full-time employees

2.80

Part-time and casual employees

0.00

Regional staff

0.00

Consultants and agency personnel

0.00

Students

0.00

Total

2.80

Note: Enter values to two decimal places.

Date modified: