Annual Report to Parliament on the Administration of the Privacy Act 2018-2019

Annual Report to Parliament on the Administration of the Privacy Act 2018-2019 PDF Version (1,427 KB)

Table of contents

• Introduction
  • The Privacy Act
• Overview of Public Safety Canada
  • Our Mandate, Mission and Vision
  • Three Essential Roles of the Department
• Organizational Structure
  • Our Branches
  • Our Regional Offices
  • Our Portfolio: Partner Agencies and Review bodies
  • Our Access to Information and Privacy (ATIP) Office
    
• Delegation of Authority
• Highlights of the Statistical Report and Multi-Year Trends
  • Overview of the Statistical Report
    
  • ATIP Request Volume and Workload
    
  • Requests Received under the Privacy Act
    
  • Extensions
    
  • Completion Times
    
  • Disposition of Requests
    
  • Consultations from other Institutions
    
  • Challenges/Complexities
• Training and Awareness
  
  • Training
    
  • Awareness
    
• Policies, Guidelines or Procedures and Initiatives
  
• Summary of Key Issues and Actions Taken on Complaints, Audits or Investigations
  
• Monitoring Compliance
  
• Material Privacy Breaches
  
• Privacy Impact Assessments
  • The Passenger Protect Program PIA
  • Memorial Grant Program for First Responders PIA
• Public Interest Disclosures Pursuant to paragraph 8(2)(m) of the Privacy Act
• Annex A – Delegation of Authority for the Privacy Act and Regulations
  
• Annex B: Statistical Report on the Privacy Act

Introduction

About Public Safety Canada

Each fiscal year, the head of every government institution prepares and submits an annual report to Parliament on the administration of the Privacy Act.

This report is tabled in Parliament in accordance with section 72 of the Privacy Act under the direction of the Minister of Public Safety and Emergency Preparedness. It describes how Public Safety Canada administered and fulfilled its obligations under the Privacy Act between April 1, 2018, and March 31, 2019.

The Privacy Act

The Privacy Act came into force on July 1, 1983. It protects the privacy of individuals by imposing obligation on government institutions subject to the act. These obligations limit the collection, retention, use, disclosure and disposal of personal information held by these government institutions. It also gives individuals the right of access to their own personal information, with limited and specific exemptions, and the rights to request the correction of that information. Individuals who are not satisfied with an institution’s handling of their personal information or any matter related to a formal request made under the Privacy Act are entitled to complain to the Privacy Commissioner of Canada.

Overview of Public Safety Canada

Public Safety Canada was created in 2003 to ensure coordination across all federal departments and agencies responsible for national security and the safety of Canadians.

Our Mandate, Mission and Vision

Our mandate is to keep Canadians safe from a range of risks such as natural disasters, crime and terrorism. Our mission is to build a safe and resilient Canada. Our vision is to, through outstanding leadership, achieve a safe and secure Canada and strong and resilient communities.

Three Essential Roles of the Department

1. Support the Minister’s responsibility for all matters related to public safety and emergency management not assigned to another federal organization;
2. Exercise leadership at the national level for national security and emergency preparedness; and
3. Support the Minister’s responsibility for the coordination of entities within the Public Safety Portfolio.

Organizational Structure

Our Branches

Public Safety branches are Emergency Management and Programs, Community Safety and Countering Crime, Portfolio Affairs and Communications, National and Cyber Security, and Corporate Management. The department also has a Chief Audit and Evaluation Executive and is supported by the Legal Services Unit.

Our Regional Offices

We have five Regional Offices representing the Atlantic, Quebec, Ontario, the Prairies and British Columbia and the North. Our regional offices are the primary point of contact for the Department at the provincial level. They deliver a coordinated federal response to emergencies; facilitate the effective delivery of emergency management, Indigenous policing and crime prevention programs; and improve partnerships with other levels of government and key regional stakeholders.

Our Portfolio: Partner Agencies and Review Bodies

The Canada Border Services Agency (CBSA) manages the nation's borders by enforcing Canadian laws governing trade and travel, as well as international agreements and conventions. CBSA facilitates legitimate cross-border traffic and supports economic development while stopping people and goods that pose a potential threat to Canada.

The Canadian Security Intelligence Service (CSIS) investigates and reports on activities that may pose a threat to the security of Canada. CSIS also provides security assessments, on request, to all federal departments and agencies.

The Correctional Service of Canada (CSC) helps protect society by encouraging offenders to become law-abiding citizens while exercising reasonable, safe, secure and humane control. CSC is responsible for managing offenders sentenced to two years or more in federal correctional institutions and under community supervision.

The Parole Board of Canada (PBC) is an independent body that grants, denies or revokes parole for inmates in federal prisons and provincial inmates in province without their own parole board. The PBC helps protect society by facilitating the timely reintegration of offenders into society as law-abiding citizens.

The Royal Canadian Mounted Police (RCMP) enforces Canadian laws, prevents crime and maintains peace, order and security.

The Civilian Review and Complaints Commission for the Royal Canadian Mounted Police (CRCC) investigates complaints from the public about the conduct of members of the RCMP in an open, independent and objective manner. The Commission also holds public hearings and conducts research and policy development to improve the public complaints process.

The Office of the Correctional Investigator (OCI) conducts independent, thorough and timely investigations about issues related to Correctional Service Canada. The OCI may initiate an investigation based on a complaint from (or on behalf of) an offender, as the result of a ministerial request, or on its own initiative.

The RCMP External Review Committee (ERC) is an independent agency that promotes fair and equitable labour relations within the RCMP. The Committee conducts an independent review of appeals in disciplinary, discharge and demotion matters, as well as certain kinds of grievances.

Our Access to Information and Privacy (ATIP) Office

The ATIP Office is part of Public Safety Canada’s ATIP and Executive Services Division within the Department’s Portfolio Affairs and Communications Branch. The Director of ATIP and Executive Services, supported by one Administrative Assistant, is responsible for ATIP as well as Ministerial Correspondence and Secretariat Services. The ATIP Office consists of 13 full-time employees and consists of two streams of ATIP-related work: the ATIP Operations Unit and the Privacy Policy and Training Unit (PPTU).

The ATIP Office is responsible for the coordination and implementation of policies, guidelines and procedures to ensure departmental compliance with the Access to Information Act and the Privacy Act. The team is also responsible for responding to requests made under the Acts, as well as providing the following services to the Department:

• Processing consultations received from other institutions;
• Providing advice and guidance to employees and senior officials on ATIP related matters such as privacy impact assessments (PIA) and privacy breaches;
• Producing the Annual Reports to Parliament;
• Delivering ATIP awareness sessions to departmental employees;
• Coordinating regular updates to Public Safety’s Info Source publication;
• Reviewing departmental documents, such as audits and evaluations, prior to proactively disclosing these on the departmental website;
• Developing departmental procedures for processing ATIP requests;
• Maintaining the Department’s ATIP reading room; and
• Participating in forums for the ATIP community, such as the Treasury Board Secretariat’s ATIP Community meetings and working groups

Image Description

The figure illustrates the organizational structure of the ATIP and Executive Services Division. The Director of the ATIP and Executive Services Division is supported by one Administrative Assistant. The Director also has the Manager of ATIP Operations, the Manager of the Privacy Policy and Training Unit (PPTU) as well as the Manager of Secretariat Services and the Manager of the Ministerial Correspondence Unit as direct reports. The ATIP Office consists of 13 full-time positions including the Manager of ATIP Operations and the Manager of the PPTU. The Manager of ATIP Operations and the Manager of the PPTU manage two separate streams of the ATIP Office. These streams are:

1. The ATIP Operations Unit which includes the Manager of ATIP Operations, two ATIP Team Leaders, five Seniors ATIP Analysts, one ATIP Analyst, one Junior ATIP Analyst, and one ATIP Administrative Officer. The ATIP Team Leaders and the ATIP Administrative Officer report to the Manager. The Junior ATIP Analyst reports to the Manager for administrative tasks and to the first ATIP Team Leader for operational tasks. Two Senior ATIP Analysts and the ATIP Analyst also report to the first ATIP Team Leader. The other three Senior ATIP Analysts report to the second ATIP Team Leader.
2. The PPTU which includes the Manager of the PPTU and one Senior Advisor who reports to the Manager of the PPTU.

Delegation of Authority

The Minister of Public Safety and Emergency Preparedness is responsible for how the department administers and complies with the Privacy Act, the Privacy Regulations and Treasury Board of Canada Secretariat policy instruments. Section 73 of the Privacy Act gives the minister the authority to designate one or more officers or employees of Public Safety to exercise or perform all, or part, of the minister’s powers, duties, and functions under the Act.

Public Safety’s current delegation order for the Privacy Act was signed by the Minister of Public Safety and Emergency Preparedness on January 8, 2016. The signed Delegation Order is attached in Annex A. This designation replaces all previous delegation orders.

The Public Safety positions that are authorized to perform the powers, duties, and functions given to the Minister of Public Safety and Emergency Preparedness as head of a government institution under the provisions of the Privacy Act and its regulations are the following:

Deputy Minister

• Full Authority

Associate Deputy Minister

• Full Authority

Assistant Deputy Minister, Portfolio Affairs and Communications

• Authority to apply subsection 9(4), section 10, subsection 19(1) to section 31 and section 70 of the Privacy Act

Assistant Deputy Ministers and Chief Audit Executive

• Authority to apply subsection 9(4) and section 10 of the Privacy Act

Director General, Cabinet and Parliamentary Affairs, and Executive Services

• Authority to apply subsection 9(4), section 10, subsection 19(1) to section 31 and section 70 of the Privacy Act

Director, ATIP and Executive Services

• Full Authority with the exception of paragraph 8(2)(m) of the Privacy Act

Manager, ATIP Operations

• Full Authority with the exception of paragraph 8(2)(m) of the Privacy Act

Team Leaders, ATIP Operations

• Authority to apply section 15 of the Privacy Act

Analysts, ATIP Operations

• Authority to apply section 15 of the Privacy Act

Highlights of the Statistical Report and Multi-Year Trends

Annex B provides a statistical report on Privacy Act requests processed by Public Safety Canada between April 1, 2018 and March 31, 2019. The following explains and interprets the statistical information, and identifies multi-year trends.  

Overview of the Statistical Report

In 2018-2019, Public Safety Canada received 62 requests under the Privacy Act, an increase of approximately 195 per cent over the previous year. This year, Public Safety Canada has completed 100 per cent of privacy requests on time. It took the department an average of 27 days to process a request made under the Privacy Act. For the past five consecutive years, Public Safety has completed 100 per cent of privacy request on time.

ATIP Request Volume and Workload

In 2018-2019, the total number of requests received under the Access to Information Act and the Privacy Act increased by 12.3 per cent and the total number of pages processed has increased by 95.7 per cent. Over the past five years, the average growth per year of the number of requests received is 8.2 per cent and the average growth per year of the number of pages processed is 25.3 per cent. The following table and chart demonstrate the ATIP workload over the past five years.

Image Description

The figure is a dual axis column and line chart that illustrates the data found in Table 1. ATIP Volume and Workload. The chart has five stacked columns that demonstrates the volume of requests received per fiscal year from 2014-2015 to 2018-2019. Each column has four stacks that demonstrate the differences in volume between the number of ATIrequests received by Public Safety Canada, the number of ATI consultations received from other institutions, the number of Privacy requests received by Public Safety Canada and the number of Privacy consultations received from other institutions. A linear chart is superposed over the column chart. The linear chart shows the number of pages process during each fiscal year which demonstrates ATIP’s workload. Stack proportions are similar from column to column. Request volumes increased from year to year, except for a small drop 2017-2018. The number of pages processed increased from 2014-2015 to 2015-2016, then dropped approximately by one third in 2016-2017, then starts to increase again in 2017-2018 and rapidly rises to almost double in 2018-2019.

Requests Received under the Privacy Act

The number of privacy requests remains small compared to the volume of access to information requests. Public Safety Canada collects little information directly from Canadians in comparison to portfolio agencies whose mandates are more operational in nature, such as the Royal Canadian Mounted Police (RCMP) and Correctional Service of Canada (CSC) who receive thousands of privacy requests annually.

Public Safety Canada received 62 Privacy Act requests this fiscal year, representing an increase of approximately 195.2 per cent over the number of requests received during the previous year (21). Over the past five years, the average growth of Privacy Act requests received is 67.5 per cent.

Of 62 requests received and one carried over from the previous fiscal year, 58 requests were completed and five requests were carried over into the next fiscal year.

Extensions

During this fiscal year, the department invoked ten extensions under section 15 of the
Privacy Act:

• Two extensions were invoked to conduct required consultations; and,
• Eight extensions were invoked due to interference with operations.

Completion Times

All 58 requests were completed within the statutory deadline.  Of the 58 completed requests:

• Five were completed within 15 days;
• 42 were completed between 16 to 30 days; and
• 11 between 31 to 60 days.

Disposition of Requests

Of the 58 completed requests:

• 13 requests were disclosed without exemptions applied;
• 26 requests disclosed in part;
• Two requests were exempted in their entirety;
• One request was abandoned;
• 16 requests where no records existed; and,
• Zero requests where the existence of records was neither confirmed nor denied.

In total 30 exemptions and no exclusions were applied under the Privacy Act:

• Section 21 was applied three times;
• Subparagraph 22(1)(a)(iii) was applied once;
• Paragraph 22(1)(b) was applied once;
• Section 26 was applied 24 times; and,
• Section 27 was applied once.

Over the past five fiscal years, sections 21, 26 and 27 make up 96 per cent of the exemptions applied to records requested under the Privacy Act.

• Section 26 is used in 74 per cent of instances;
• Section 21 is used in 12 per cent of instances;
• Section 27 is used in ten per cent of instances; and,
• The remaining four per cent make up other sections that have occasionally been used to apply exemptions and exclusions.

Image Description

The figure is a pie chart that illustrates the sections of the Privacy Act that were applied to exempt or exclude information from requests during the last five fiscal years. The percentage of each section applied in the last five years is as follows: 12 per cent under section 21, one per cent under subparagraph 22(1)(a)(i), one per cent under subparagraph 22(1)(a)(iii), one per cent under paragraph 22(1)(b), 74 per cent under section 26, ten per cent under section 27 and one per cent under paragraph 70(1)(a).

Consultations from other Institutions

During this fiscal year, one consultation was received from another institution.

Challenges/Complexities

The ATIP Operations Unit did not experience any significant challenges with regards to Privacy Requests. The complexity of the requests received remains challenging due to the interwoven information of multiple individuals.

Training and Awareness       

Training

This fiscal year, the ATIP Office provided 48 training or information sessions on the Access to Information Act and Privacy Act. A variety of subject matters were presented from retrieving and reviewing records in response to an Access to Information (ATI) request, to privacy Breaches and proactive publication. A grand total of 848 people attended these sessions.

An additional 306 Public Safety employees complete the online course Access to Information and Privacy Fundamentals (I015) this fiscal year. This course is offered by the Canada School of Public Service and is mandatory for all new employees joining Public Safety Canada.

Awareness

This fiscal year, the ATIP Office has also raised ATIP awareness through the department’s internal communications vehicles, publishing three internal InfoBulletin articles, one intranet InfoCentral page and one Frequently Asked Questions intranet page.

Policies, Guidelines or Procedures and Initiatives

During the year, Public Safety’s Privacy Breach guidelines were updated. The guidelines now include a preliminary assessment tool that will help employees to determine if a breach has occurred and how to contain it. The department’s Privacy Breach and Threat Assessment form was also created to replace our previous form. This form allows the department to better assess the breach as well as to better document the incident, its containment and the mitigation strategy.

Work to update Public Safety’s privacy notice statement and consent templates and guidelines started this fiscal year and will be completed in early fiscal year 2019-2020. Public Safety’s statement of completeness form for ATIP requests has also been updated.

Summary of Key Issues and Actions Taken on Complaints, Audits or Investigations

Public Safety Canada responded to 14 complaints this fiscal year which were resolved. There were no audits or key issues during the year.

Monitoring Compliance

Reports on ATIP compliance and retrieval statistics are reported to the Executive Committee in the Weekly ATIP Report. Additionally, on a quarterly basis, the number of Privacy Act requests, training sessions and attendees, privacy breaches and completed Privacy Impact Assessments are included in the Weekly ATIP Report.

Material Privacy Breaches

There was one material privacy breach reported this fiscal year. The breach was the result of a human error. One individual was affected. The individual was notified of the breach. The department has taken necessary steps to protect the individual from potential harm. Training and awareness sessions were provided to employees. Further mitigation strategy includes more tailored training for specific groups which will be developed and rolled out in the next fiscal year. 

Privacy Impact Assessments

The Passenger Protect Program (PPP) PIA

The PPP is an important part of Canada’s national security framework. Transport Canada (TC) launched the PPP in 2007 to protect aviation by denying boarding to any specified person whom the Minister of Transport determined to be an immediate threat to aviation security. Sections of the Aeronautics Act and the Identity Screening Regulations were used in order to allow for the specifying of individuals, to respond to threats through an emergency direction, collecting and sharing information with air carriers, and for monitoring air carrier compliance with information-protection requirements.

In February of 2011, the PPP underwent machinery of government changes. An Order in Council transferred the responsibility for determining the individuals who should be included on the list from the Minister of Transport to the Minister of Public Safety. Communicating the list of names of these individuals to air carriers remained the responsibility of the Minister of Transport, as did the issuance of emergency directions to deny boarding in cases where an air carrier identified a potential match to a listed person, pursuant to paragraph 4.81(1)(b) of the Aeronautics Act.

On August 1, 2015, the Secure Air Travel Act (SATA) came into force to provide a solid legislative framework for the PPP. Among its provisions, the SATA:

1. Sets out authorities of the Minister of Public Safety and the Minister of Transport;
2. Clarifies authorities relating to the collection and disclosure of information;
3. Broadens the mandate of the PPP to include the prevention of travel by air for the purpose of committing certain terrorism offences, as defined in the Criminal Code, such as recruiting, training, or conducting attacks;
4. Transfers the authority for making directions to air carriers to take a specific, reasonable and necessary action against a listed person from the Minister of Transport to the Minister of Public Safety. The Minister of Transport remains responsible for communicating the list and any direction made by the Minister of Public Safety to air carriers, for disclosing information collected from air carriers and operators of aviation reservation systems to the Minister and any other person or entity referred to in section 10, as well as for ensuring compliance with aviation-related laws and regulations.

For more information on the PPP, please visit the program’s website at: https://www.publicsafety.gc.ca/cnt/ntnl-scrt/cntr-trrrsm/pssngr-prtct/index-en.aspx

Information on this PIA can be found at the following link: https://www.publicsafety.gc.ca/cnt/trnsprnc/ccss-nfrmtn-prvc/prvc-mpct-ssssmnt/pssngr-prtct-en.aspx

Memorial Grant Program for First Responders PIA

In recognition of the critical role of first responders in protecting Canadians, the Memorial Grant Program will provide a new federal tax-free grant of $300,000 to families of police officers, firefighters and paramedics including volunteers, reservists or auxiliary members who die as a direct result of their duties on or after April 1, 2018. The objective of the grant is to recognize the service and sacrifice of Canada's first responders who die in the line of duty, including deaths resulting from occupational illness and deaths resulting from a psychological impairment (i.e., suicide).

Information on this PIA can be found at the following link: https://www.publicsafety.gc.ca/cnt/trnsprnc/ccss-nfrmtn-prvc/prvc-mpct-ssssmnt/mmrl-grnt-prgrm-frst-rspndrs-en.aspx

Public Interest Disclosures Pursuant to paragraph 8(2)(m) of the Privacy Act

Paragraph 8(2)(m) of the Privacy Act provides the head of the institution with the authority to disclose personal information where the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure, or where the disclosure would clearly benefit the individual to whom the information relates. No disclosures pursuant to paragraph 8(2)(m) of the Privacy Act were made by Public Safety Canada this fiscal year.

Appendix A – Delegation of Authority for the Privacy Act and Regulations

The Minister of Public Safety and Emergency Preparedness, pursuant to section 73 of the Privacy Act*, hereby designates the persons holding the positions set out below, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Minister as the head of the Department of Public Safety and Emergency Preparedness, under the section of the Act and related regulations set out opposite each position.  This designation replaces all previous delegation orders.

Appendix B – Statistical Report on the Privacy Act

Reporting period: 2018-04-01 to 2019-03-31

Part 1: Requests Under the Privacy Act

Part 2: Requests Closed During the Reporting Period

2.5 Complexity

2.6 Deemed refusals

Part 3: Disclosures Under Subsections 8(2) and 8(5)

Part 4: Requests for Correction of Personal Information and Notations

Part 5: Extensions

Part 6: Consultations Received From Other Institutions and Organizations

Part 7: Completion Time of Consultations on Cabinet Confidences

Part 8: Complaints and Investigations Notices Received

Part 10: Resources Related to the Privacy Act

Part 10: Resources Related to the Privacy Act

Part 11: New Exemptions Tables

Date modified:

2022-07-28