Annual Report to Parliament on the Administration of the Privacy Act 2019-2020

Annual Report to Parliament on the Administration of the Privacy Act 2019-2020 PDF Version (1,427 KB)

Table of contents

• Introduction
  • The Privacy Act
• Overview of Public Safety Canada
  • Mandate, Mission and Vision
  • Three Essential Roles of the Department
• Organizational Structure
  • Public Safety Canada
  • The Public Safety Portfolio: Partner Agencies and Review Bodies
  • The Access to Information and Privacy (ATIP) Office
  • Service Agreements Under Section 73.1 of the Privacy Act 5
    
• Delegation of Authority
• Highlights of the Statistical Report and Multi-Year Trends
  • Overview of the Statistical Report
    
  • ATIP Request Volume and Workload
    
  • Requests Received under the Privacy Act
    
  • Extensions
    
  • Completion Times
    
  • Disposition of Requests
    
  • Consultations from other Institutions
    
  • The Impacts of the COVID-19 Pandemic
    
  • Challenges/Complexities
• Training and Awareness
  
  • Training
    
  • Awareness
    
• Policies, Guidelines or Procedures and Initiatives
  
• Summary of Key Issues and Actions Taken on Complaints, Audits or Investigations
  
• Monitoring Compliance
  
• Material Privacy Breaches
  
• Privacy Impact Assessments
• Public Interest Disclosures Pursuant to paragraph 8(2)(m) of the Privacy Act
• Annex A: Delegation Orders
• Annex B: Statistical Report
• Annex C: 2019-2020 Supplemental Statistical Report – Requests affected by COVID-19 measures

Introduction

Each fiscal year, the head of every government institution prepares and submits an annual report to Parliament on the administration of the Privacy Act.

This report is tabled in Parliament in accordance with section 72 of the Privacy Act under the direction of the Minister of Public Safety and Emergency Preparedness. It describes how Public Safety Canada administered and fulfilled its obligations under the Privacy Act between
April 1, 2019, and March 31, 2020.

The Privacy Act

The Privacy Act came into force on July 1, 1983. It protects the privacy of individuals by imposing obligation on government institutions subject to the act. These obligations limit the collection, retention, use, disclosure and disposal of personal information held by these government institutions. It also gives individuals the right of access to their own personal information, with limited and specific exemptions, and the rights to request the correction of that information. Individuals who are not satisfied with an institution’s handling of their personal information or any matter related to a formal request made under the Privacy Act are entitled to complain to the Privacy Commissioner of Canada.

Overview of Public Safety Canada

Public Safety Canada was created in 2003 to ensure coordination across all federal departments and agencies responsible for national security and the safety of Canadians.

Mandate, Mission and Vision

Our mandate is to keep Canadians safe from a range of risks such as natural disasters, crime and terrorism. Our mission is to build a safe and resilient Canada. Our vision is to, through outstanding leadership, achieve a safe and secure Canada and strong and resilient communities.

Three Essential Roles of the Department

1. Support the Minister’s responsibility for all matters related to public safety and emergency management not assigned to another federal organization;
2. Exercise leadership at the national level for national security and emergency preparedness; and
3. Support the Minister’s responsibility for the coordination of entities within the Public Safety Portfolio.

Organizational Structure

Public Safety Canada

The department is organized into five branches: Emergency Management and Programs, Community Safety and Countering Crime, Portfolio Affairs and Communications, National and Cyber Security, and Corporate Management. The department also has a Chief Audit and Evaluation Executive and is supported by the Legal Services Unit.

Five Regional Offices represent the Atlantic, Quebec, Ontario, the Prairies and British Columbia and the North. Our regional offices are the primary point of contact for the Department at the provincial level. They deliver a coordinated federal response to emergencies; facilitate the effective delivery of emergency management, Indigenous policing and crime prevention programs; and improve partnerships with other levels of government and key regional stakeholders.

Our Regional Offices

We have five Regional Offices representing the Atlantic, Quebec, Ontario, the Prairies and British Columbia and the North. Our regional offices are the primary point of contact for the Department at the provincial level. They deliver a coordinated federal response to emergencies; facilitate the effective delivery of emergency management, Indigenous policing and crime prevention programs; and improve partnerships with other levels of government and key regional stakeholders.

The Public Safety Portfolio: Partner Agencies and Review Bodies

The Canada Border Services Agency (CBSA) manages the nation's borders by enforcing Canadian laws governing trade and travel, as well as international agreements and conventions. CBSA facilitates legitimate cross-border traffic and supports economic development while stopping people and goods that pose a potential threat to Canada.

The Canadian Security Intelligence Service (CSIS) investigates and reports on activities that may pose a threat to the security of Canada. CSIS also provides security assessments, on request, to all federal departments and agencies.

The Correctional Service of Canada (CSC) helps protect society by encouraging offenders to become law-abiding citizens while exercising reasonable, safe, secure and humane control. CSC is responsible for managing offenders sentenced to two years or more in federal correctional institutions and under community supervision.

The Parole Board of Canada (PBC) is an independent body that grants, denies or revokes parole for inmates in federal prisons and provincial inmates in province without their own parole board. The PBC helps protect society by facilitating the timely reintegration of offenders into society as law-abiding citizens.

The Royal Canadian Mounted Police (RCMP) enforces Canadian laws, prevents crime and maintains peace, order and security.

The Civilian Review and Complaints Commission for the Royal Canadian Mounted Police (CRCC) investigates complaints from the public about the conduct of members of the RCMP in an open, independent and objective manner. The Commission also holds public hearings and conducts research and policy development to improve the public complaints process.

The Office of the Correctional Investigator (OCI) conducts independent, thorough and timely investigations about issues related to Correctional Service Canada. The OCI may initiate an investigation based on a complaint from (or on behalf of) an offender, as the result of a ministerial request, or on its own initiative.

The RCMP External Review Committee (ERC) is an independent agency that promotes fair and equitable labour relations within the RCMP. The Committee conducts an independent review of appeals in disciplinary, discharge and demotion matters, as well as certain kinds of grievances.

The Access to Information and Privacy (ATIP) Office

Figure 1: ATIP and Executive Services Division Organization Chart

Image Description

The figure illustrates the organizational structure of the ATIP and Executive Services Division. The Director of the ATIP and Executive Services Division is supported by one Administrative Assistant. The Director also has the Manager of ATIP Operations, the Manager of the Privacy Policy and Training Unit (PPTU) as well as the Manager of Secretariat Services and the Manager of the Ministerial Correspondence Unit as direct reports. The ATIP Office consists of 13 full-time positions including the Manager of ATIP Operations and the Manager of the PPTU. The Manager of ATIP Operations and the Manager of the PPTU manage two separate streams of the ATIP Office. These streams are:

1. 1. The ATIP Operations Unit which includes the Manager of ATIP Operations, two ATIP Team Leaders, five Seniors ATIP Analysts, one ATIP Analyst, one Junior ATIP Analyst, and one ATIP Administrative Officer. The ATIP Team Leaders and the ATIP Administrative Officer report to the Manager. The Junior ATIP Analyst reports to the Manager for administrative tasks and to the first ATIP Team Leader for operational tasks. Two Senior ATIP Analysts and the ATIP Analyst also report to the first ATIP Team Leader. The other three Senior ATIP Analysts report to the second ATIP Team Leader.
   
   2. The PPTU which includes the Manager of the PPTU and one Senior Advisor who reports to the Manager of the PPTU.

Service Agreements Under Section 73.1 of the Privacy Act

Public Safety was not a party to any service agreements under section 73.1 of the Privacy Act during the fiscal year.

Delegation of Authority

The Minister of Public Safety and Emergency Preparedness is responsible for how the department administers and complies with the Privacy Act, the Privacy Regulations and Treasury Board of Canada Secretariat policy instruments. Section 73 of the Privacy Act gives the minister the authority to designate one or more officers or employees of Public Safety to exercise or perform all, or part, of the minister’s powers, duties, and functions under the Act.

Public Safety’s current delegation order for the Privacy Act was signed by the Minister of Public Safety and Emergency Preparedness on January 8, 2016. The signed Delegation Order is attached in Annex A. This designation replaces all previous delegation orders.

The Public Safety positions that are authorized to perform the powers, duties, and functions given to the Minister of Public Safety and Emergency Preparedness as head of a government institution under the provisions of the Privacy Act and its regulations are the following:

Deputy Minister

• Full Authority

Associate Deputy Minister

• Full Authority

Assistant Deputy Minister, Portfolio Affairs and Communications

• Authority to apply subsection 9(4), section 10, subsection 19(1) to section 31 and section 70 of the Privacy Act

Assistant Deputy Ministers and Chief Audit Executive

• Authority to apply subsection 9(4) and section 10 of the Privacy Act

Director General, Cabinet and Parliamentary Affairs, and Executive Services

• Authority to apply subsection 9(4), section 10, subsection 19(1) to section 31 and section 70 of the Privacy Act

Director, ATIP and Executive Services

• Full Authority with the exception of paragraph 8(2)(m) of the Privacy Act

Manager, ATIP Operations

• Full Authority with the exception of paragraph 8(2)(m) of the Privacy Act

Team Leaders, ATIP Operations

• Authority to apply section 15 of the Privacy Act

Analysts, ATIP Operations

• Authority to apply section 15 of the Privacy Act

Highlights of the Statistical Report and Multi-Year Trends

Annex B provides a statistical report on Privacy Act requests processed by Public Safety Canada between April 1, 2019 and March 31, 2020. The following explains and interprets the statistical information, and identifies multi-year trends.  

Overview of the Statistical Report

In 2019-2020, Public Safety Canada received 59 requests under the Privacy Act, a decrease of approximately 4.8 per cent over the previous year. Public Safety Canada completed 100 per cent of privacy requests on time. It took the department an average of 22.5 days to process a request made under the Privacy Act. For the past five consecutive years, Public Safety has completed 100 per cent of privacy requests on time.

ATIP Request Volume and Workload

In 2019-2020, the total number of requests received under the Access to Information Act and the Privacy Act decreased by 9.5 per cent and the total number of pages processed  decreased by 19.9 per cent. The following table and chart demonstrate the ATIP workload over the past five years.

Figure 2: ATIP Request Volume

Image Description

The figure shows a line graph illustrating the data found in Table 1: ATIP Volume and Workload, regarding the volume of Access to Information (ATI) and Privacy requests and consultations received by Public Safety Canada. The graph shows four lines. The first line shows the number of ATI requests received by Public Safety Canada over the five fiscal years from 2015-2016 to 2019-2020. The second line shows the number of ATI consultations received from other institutions during the same period. The third line shows the number of Privacy requests received by Public Safety Canada during the same period. The fourth line shows the number of Privacy consultations received from other institutions during the same period.

Figure 3: ATIP Page Volumes

Image Description

The figure shows a line graph illustrating the data found in Table 3: ATIP Page Volumes, regarding the volume of pages processed by Public Safety Canada. The graph shows one line. The line illustrates the volume of pages processed over the five fiscal years from 2015-2016 to 2019-2020.

Requests Received under the Privacy Act

The number of privacy requests remains small compared to the volume of access to information requests. Public Safety Canada collects little information directly from Canadians in comparison to portfolio agencies whose mandates are more operational in nature, such as the Royal Canadian Mounted Police (RCMP) and Correctional Service of Canada (CSC) who receive thousands of privacy requests annually.

Public Safety Canada received 59 Privacy Act requests this fiscal year, representing a decrease of approximately 4.8 per cent over the number of requests received during the previous year (62). Over the past five years, the average growth of Privacy Act requests received is 17.3 per cent.

Of 59 requests received and five carried over from the previous fiscal year, 36 requests were completed and 28 requests were carried over into the next fiscal year.

Extensions

During this fiscal year, the department invoked ten extensions under section 15 of the Privacy Act:

• Three extensions were invoked to conduct required consultations; and,
• Seven extensions were invoked due to interference with operations.

Completion Times

All 36 requests were completed within the statutory deadline.  Of the 36 completed requests:

• 14 were completed within 15 days;
• 16 were completed between 16 to 30 days; and
• Six between 31 to 60 days.

Disposition of Requests

Of the 36 completed requests:

• Seven requests were disclosed without exemptions applied;
• 14 requests disclosed in part;
• Five requests were abandoned;
• Zero requests were exempted in their entirety;
• Ten requests where no records existed; and,
• Zero requests where the existence of records was neither confirmed nor denied.

In total 21 exemptions and no exclusions were applied under the Privacy Act:

• Section 21 was applied four times;
• Subparagraph 22(1)(a)(ii) was applied twice;
• Subparagraph 22(1)(a)(iii) was applied twice;
• Section 26 was applied 11 times; and,
• Section 27 was applied twice.

Over the past five fiscal years, sections 21, 26 and 27 make up 96 per cent of the exemptions applied to records requested under the Privacy Act:

• Section 26 is used in 74 per cent of instances;
• Section 21 is used in 12 per cent of instances;
• Section 27 is used in ten per cent of instances; and,
• The remaining four per cent make up other sections that have occasionally been used to apply exemptions and exclusions.

Figure 4: Privacy Act Sections Applied for Exemptions and Exclusions During the Last Five Fiscal Years

Image Description

The figure is a bar graph that illustrates the sections of the Privacy Act that were applied to exempt or exclude information from requests during the last five fiscal years. The percentage of each section applied in the last five years is as follows: 12 per cent under section 21, one per cent under subparagraph 22(1)(a)(i), one per cent under subparagraph 22(1)(a)(iii), one per cent under paragraph 22(1)(b), 74 per cent under section 26, ten per cent under section 27 and one per cent under paragraph 70(1)(a).

Consultations from other Institutions

During this fiscal year, one consultation was received from another institution.

The Impacts of the COVID-19 Pandemic

On March 16, 2020, Public Safety Canada’s ATIP Office shifted to working remotely in response to the COVID-19 pandemic.  Some of the challenges encountered during the period from March 16, 2020 to March 31, 2020 include:

• Initial challenges in setting up new business processes to accommodate remote working.
• Inability to review records that could not be processed remotely.
• Delays in receiving consultation responses from other federal organizations whose operations were similarly restricted due to the COVID-19 situation.
• In some cases, program areas being tasked to retrieve records were already fully engaged in leading Canada’s response to the COVID-19 situation, and therefore faced challenges responding to requests.
• Some staff faced challenges balancing telework with other responsibilities, including care of children following closure of schools and daycares.

Challenges/Complexities

The ATIP Operations Unit did not experience any significant challenges with regards to Privacy Requests.

Training and Awareness       

Training

This fiscal year, the ATIP Office provided 15 training or information sessions on the Access to Information Act and Privacy Act. A variety of subject matters were presented fromretrieving and reviewing records in response to an Access to Information (ATI) request, to privacy Breaches and proactive publication. A grand total of 397 people attended these sessions.

An additional 148 Public Safety employees complete the online course Access to Information and Privacy Fundamentals (I015) this fiscal year. This course is offered by the Canada School of Public Service and is mandatory for all new employees joining Public Safety Canada.

Awareness

This fiscal year, the ATIP Office provided 15 training or information sessions on the Access to Information Act and Privacy Act. A variety of subject matters were presented fromretrieving and reviewing records in response to an Access to Information (ATI) request, to privacy Breaches and proactive publication. A grand total of 397 people attended these sessions.

An additional 148 Public Safety employees complete the online course Access to Information and Privacy Fundamentals (I015) this fiscal year. This course is offered by the Canada School of Public Service and is mandatory for all new employees joining Public Safety Canada.

Policies, Guidelines or Procedures and Initiatives

During the year, Public Safety’s Privacy Impact Assessment guidelines were updated. The departmental ATIP Statement of Completeness form was also updated.

Summary of Key Issues and Actions Taken on Complaints, Audits or Investigations

Public Safety Canada responded to 2 complaints this fiscal year.  One complaint, a denial complaint,  remains open and ongoing and the second complaint, an exemption complaint, was not well-founded. There were no audits or key issues during the year.

Monitoring Compliance

Reports on ATIP compliance and retrieval statistics are reported to the Executive Committee in the Weekly ATIP Report. Additionally, on a quarterly basis, the number of Privacy Act requests, training sessions and attendees, privacy breaches and completed Privacy Impact Assessments are included in the Weekly ATIP Report.

Material Privacy Breaches

There was one material privacy breach reported this fiscal year. The breach was the result of a human error. One individual was affected. The individual was notified of the breach. The department has taken necessary steps to protect the individual from potential harm.

Privacy Impact Assessments

One Privacy Impact Assessment was completed during the fiscal year.

Public Interest Disclosures Pursuant to paragraph 8(2)(m) of the Privacy Act

Paragraph 8(2)(m) of the Privacy Act provides the head of the institution with the authority to disclose personal information where the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure, or where the disclosure would clearly benefit the individual to whom the information relates. No disclosures pursuant to paragraph 8(2)(m) of the Privacy Act were made by Public Safety Canada this fiscal year.

Annex A: Delegation Orders

The Minister of Public Safety and Emergency Preparedness, pursuant to section 73 of the Privacy Act*, hereby designates the persons holding the positions set out below, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Minister as the head of the Department of Public Safety and Emergency Preparedness, under the section of the Act and related regulations set out opposite each position.  This designation replaces all previous delegation orders.

Appendix B – Statistical Report on the Privacy Act

Reporting period: 2019-04-01 to 2020-03-31

Section 1: Requests Under the Privacy Act

Section 2: Requests Closed During the Reporting Period

2.5 Complexity

2.6 Closed Requests

2.7 Deemed Refusals

2.8 Requests for translation

Section 3: Disclosures Under Subsections 8(2) and 8(5)

Section 4: Requests for Correction of Personal Information and Notations

Section 5: Extensions

Part 6: Consultations received from other Government of Canada institutions and other organizations

Part 7: Completion Time of Consultations on Cabinet Confidences

Section 8: Complaints and Investigations Notices Received

Section 9: Privacy Impact Assessments (PIA) and Personal Information Banks (PIB)

Section 10: Material Privacy Breaches

Section 11: Resources Related to the Privacy Act

Annex C: 2019-2020 Supplemental Statistical Report – Requests affected by COVID-19 measures

The following table reports the total number of formal requests received during two periods; 2019-04-01 to 2020-03-13 and 2020-03-14 to 2020-03-31.

The following table reports the total number of requests closed within the legislated timelines and the number of closed requests that were deemed refusals during two periods 2019-04-01 to 2020-03-13 and 2020-03-14 to 2020-03-31.

The following table reports the total number of requests carried over during two periods; 2019-04-01 to 2020-03-13 and 2020-03-14 to 2020-03-31.

Date modified:

2022-07-28