Annual Report to Parliament on the Administration of the Privacy Act 2020-2021

Annual Report to Parliament on the Administration of the Privacy Act 2020-2021 PDF Version (3,127 KB)

Table of contents

• Introduction
  • The Privacy Act
• Overview of Public Safety Canada
  • Mandate, Mission and Vision
  • Three Essential Roles of the Department
• Organizational Structure
  • Public Safety Canada
  • The Public Safety Portfolio: Partner Agencies and Review Bodies
  • The Access to Information and Privacy (ATIP) Office
  • Service Agreements Under Section 73.1 of the Privacy Act
    
• Delegation of Authority
• Highlights of the Statistical Report and Multi-Year Trends
  • Overview of the Statistical Report
    
  • ATIP Request Volume and Workload
    
  • Requests Received under the Privacy Act
    
  • Extensions
    
  • Completion Times
    
  • Disposition of Requests
    
  • Consultations from other Institutions
    
  • The Impacts of the COVID-19 Pandemic
    
  • Challenges/Complexities
• Training and Awareness
  
  • Training
    
  • Awareness
    
• Policies, Guidelines or Procedures and Initiatives
  
• Summary of Key Issues and Actions Taken on Complaints, Audits or Investigations
  
• Monitoring Compliance
  
• Material Privacy Breaches
  
• Privacy Impact Assessments
• Public Interest Disclosures Pursuant to paragraph 8(2)(m) of the Privacy Act
• Annex A: Delegation Orders
• Annex B: Statistical Report
• Annex C: Supplemental Statistical Report

Introduction

Each fiscal year, the head of every government institution prepares and submits an annual report to Parliament on the administration of the Privacy Act.

This report is tabled in Parliament in accordance with section 72 of the Privacy Act under the direction of the Minister of Public Safety and Emergency Preparedness. It describes how Public Safety Canada administered and fulfilled its obligations under the Privacy Act between April 1, 2020, and March 31, 2021.

The Privacy Act

The Privacy Act came into force on July 1, 1983. It protects the privacy of individuals by imposing obligations on government institutions subject to the act. These obligations limit the collection, retention, use, disclosure and disposal of personal information held by these government institutions. It also gives individuals the right of access to their own personal information, with limited and specific exemptions, and the rights to request the correction of that information. Individuals who are not satisfied with an institution’s handling of their personal information or any matter related to a formal request made under the Privacy Act are entitled to complain to the Privacy Commissioner of Canada.

Overview of Public Safety Canada

Public Safety Canada was created in 2003 to ensure coordination across all federal departments and agencies responsible for national security and the safety of Canadians.

Mandate, Mission and Vision

Our mandate is to keep Canadians safe from a range of risks such as natural disasters, crime and terrorism. Our mission is to build a safe and resilient Canada. Our vision is to, through outstanding leadership, achieve a safe and secure Canada and strong and resilient communities.

Three Essential Roles of the Department

1. Support the Minister’s responsibility for all matters related to public safety and emergency management not assigned to another federal organization;
2. Exercise leadership at the national level for national security and emergency preparedness; and
3. Support the Minister’s responsibility for the coordination of entities within the Public Safety Portfolio.

Organizational Structure

Public Safety Canada

The department is organized into five branches: Emergency Management and Programs, Community Safety and Countering Crime, Portfolio Affairs and Communications, National and Cyber Security, and Corporate Management. The department also has a Chief Audit and Evaluation Executive and is supported by the Legal Services Unit.

Five Regional Offices represent the Atlantic, Quebec, Ontario, the Prairies and British Columbia and the North. Our regional offices are the primary point of contact for the Department at the provincial level. They deliver a coordinated federal response to emergencies; facilitate the effective delivery of emergency management, Indigenous policing and crime prevention programs; and improve partnerships with other levels of government and key regional stakeholders.

The Public Safety Portfolio: Partner Agencies and Review Bodies

The Canada Border Services Agency (CBSA) manages the nation's borders by enforcing Canadian laws governing trade and travel, as well as international agreements and conventions. CBSA facilitates legitimate cross-border traffic and supports economic development while stopping people and goods that pose a potential threat to Canada.

The Canadian Security Intelligence Service (CSIS) investigates and reports on activities that may pose a threat to the security of Canada. CSIS also provides security assessments, on request, to all federal departments and agencies.

The Correctional Service of Canada (CSC) helps protect society by encouraging offenders to become law-abiding citizens while exercising reasonable, safe, secure and humane control. CSC is responsible for managing offenders sentenced to two years or more in federal correctional institutions and under community supervision.

The Parole Board of Canada (PBC) is an independent body that grants, denies or revokes parole for inmates in federal prisons and provincial inmates in province without their own parole board. The PBC helps protect society by facilitating the timely reintegration of offenders into society as law-abiding citizens.

The Royal Canadian Mounted Police (RCMP) enforces Canadian laws, prevents crime and maintains peace, order and security.

The Civilian Review and Complaints Commission for the Royal Canadian Mounted Police (CRCC) investigates complaints from the public about the conduct of members of the RCMP in an open, independent and objective manner. The Commission also holds public hearings and conducts research and policy development to improve the public complaints process.

The Office of the Correctional Investigator (OCI) conducts independent, thorough and timely investigations about issues related to the Correctional Service of Canada. The OCI may initiate an investigation based on a complaint from (or on behalf of) an offender, as the result of a ministerial request, or on its own initiative.

The RCMP External Review Committee (ERC) is an independent agency that promotes fair and equitable labour relations within the RCMP. The Committee conducts an independent review of appeals in disciplinary, discharge and demotion matters, as well as certain kinds of grievances.

The Access to Information and Privacy (ATIP) Office

The ATIP Office is part of Public Safety Canada’s ATIP and Executive Services Division within the Department’s Portfolio Affairs and Communications Branch. The Director of ATIP and Executive Services, supported by one Administrative Assistant, is responsible for ATIP as well as Ministerial Correspondence and Secretariat Services. The ATIP Office consists of 13 full-time employees and of two streams of ATIP-related work: the ATIP Operations Unit and the Privacy Policy and Training Unit (PPTU).

The ATIP Office is responsible for the coordination and implementation of policies, guidelines and procedures to ensure departmental compliance with the Access to Information Act and the Privacy Act. The team is also responsible for responding to requests made under the Acts, as well as providing the following services to the Department:

• Processing consultations received from other institutions;
• Providing advice and guidance to employees and senior officials on ATIP related matters such as privacy impact assessments (PIA) and privacy breaches;
• Producing the Annual Reports to Parliament;
• Delivering ATIP awareness sessions to departmental employees;
• Coordinating regular updates to Public Safety’s Info Source publication;
• Reviewing departmental documents, such as audits and evaluations, prior to proactively disclosing these on the departmental website;
• Developing departmental procedures for processing ATIP requests; and
• Participating in forums for the ATIP community, such as the Treasury Board Secretariat’s ATIP Community meetings and working groups.

Figure 1: ATIP and Executive Services Division Organization Chart

Image Description

The figure illustrates the organizational structure of the ATIP and Executive Services Division. The Director of the ATIP and Executive Services Division is supported by one Administrative Assistant. The Director also has the Manager of ATIP Operations, the Manager of the Privacy Policy and Training Unit (PPTU) as well as the Manager of Secretariat Services and the Manager of the Ministerial Correspondence Unit as direct reports. The ATIP Office consists of 13 full-time positions including the Manager of ATIP Operations and the Manager of the PPTU. The Manager of ATIP Operations and the Manager of the PPTU manage two separate streams of the ATIP Office. These streams are:

1. The ATIP Operations Unit which includes the Manager of ATIP Operations, two ATIP Team Leaders, four Senior ATIP Analysts, two ATIP Analysts, one Junior ATIP Analyst, and one ATIP Administrative Officer. The ATIP Team Leaders and the ATIP Administrative Officer report to the Manager. The Junior ATIP Analyst reports to the Manager for administrative tasks and to the first ATIP Team Leader for operational tasks. Two Senior ATIP Analysts and the ATIP Analyst also report to the first ATIP Team Leader. The other two Senior ATIP Analysts and ATIP Analyst report to the second ATIP Team Leader.
2. The PPTU which includes the Manager of the PPTU and one Senior Advisor who reports to the Manager of the PPTU.

Service Agreements Under Section 73.1 of the Privacy Act

Public Safety was not a party to any service agreements under section 73.1 of the Privacy Act during the fiscal year.

Delegation of Authority

The Minister of Public Safety and Emergency Preparedness is responsible for how the department administers and complies with the Privacy Act, the Privacy Regulations and Treasury Board of Canada Secretariat policy instruments. Section 73 of the Privacy Act gives the minister the authority to designate one or more officers or employees of Public Safety to exercise or perform all, or part, of the minister’s powers, duties, and functions under the Act.

Public Safety’s current delegation order for the Privacy Act was signed by the Minister of Public Safety and Emergency Preparedness on July 21, 2020. The signed Delegation Order is attached in Annex A. This designation replaces all previous delegation orders.

The Minister of Public Safety and Emergency Preparedness as head of a government institution under the provisions of the Privacy Act and its regulations, has granted full authority to the Deputy Minister of Public Safety, the Associate Deputy Minister, the Assistant Deputy Minister of Portfolio Affairs and Communication Branch, the Director General of Cabinet and Parliamentary and Executive Services, the Director of ATIP and Executive Services, as well as the ATIP Manager. ATIP Operations Team Leaders and ATIP Analysts possess authority under Sections 15 of the Privacy Act and Assistant Deputy Ministers as well as Chief Audit Executives possess authority under Section 9(4) and 10 of the Privacy Act. 

Highlights of the Statistical Report and Multi-Year Trends

Annex B provides a statistical report on Privacy Act requests processed by Public Safety Canada between April 1, 2020 and March 31, 2021. The following explains and interprets the statistical information, and identifies multi-year trends.  

Overview of the Statistical Report

In 2020-2021, Public Safety Canada received 41 requests under the Privacy Act, a decrease of approximately 30.5 per cent over the previous year. Public Safety Canada completed 93.3 per cent of privacy requests on time. It took the department an average of 34.9 days to process a request made under the Privacy Act. For the past five consecutive years, including 2020-2021, Public Safety has completed an average of 98.7 per cent of privacy requests on time.

ATIP Request Volume and Workload

In 2020-2021, the total number of requests received under the Access to Information Act and the Privacy Act decreased by 17.6 per cent and the total number of pages processed decreased by 71.5 per cent. The decrease in pages processed is related to the circumstances of the pandemic, which are described later in this report. The following table and chart demonstrate the ATIP workload over the past five years.

Figure 2: ATIP Request Volume

Image Description

Figure 2: ATIP Request Volumes, presents a bar graph representing the data found in Table 1: ATIP Volume and Workload, which illustrates the volume of Access to Information (ATI) and Privacy requests and consultations received by Public Safety Canada. The graph shows four groups of five columns each. The first group of columns shows the number of ATI requests received by Public Safety Canada over the five fiscal years from 2016-2017 to 2020-2021. The second group shows the number of ATI consultations received from other institutions during the same period. The third group shows the number of Privacy requests received by Public Safety Canada during the same period. The fourth group shows the number of Privacy consultations received from other institutions during the same period.

Figure 3: ATIP Page Volumes

Image Description

The figure shows a bar graph illustrating the data found in Table 3: ATIP Page Volumes, regarding the volume of pages processed by Public Safety Canada. The graph shows five bars. The bars illustrate the volume of pages processed over the five fiscal years from 2016-2017 to 2020-2021.

Requests Received under the Privacy Act

The number of privacy requests remains small compared to the volume of access to information requests. Public Safety Canada collects little personal information directly from Canadians in comparison to portfolio agencies whose mandates are more operational in nature, such as the Royal Canadian Mounted Police (RCMP) and Correctional Service of Canada (CSC) who receive thousands of privacy requests annually.

Public Safety Canada received 41 Privacy Act requests this fiscal year, representing a decrease of approximately 30.5 per cent over the number of requests received during the previous year (59). Of 41 requests received and 28 carried over from the previous fiscal year, 60 requests were completed and nine requests were carried over into the next fiscal year.

Extensions

During this fiscal year, the department invoked two extensions under section 15 of the Privacy Act due to interference with operations.

Completion Times

Of the total 69 requests (41 received and 28 carried over from last fiscal year), 60 requests were completed within the statutory deadline.  Of the 60 completed requests:

• 14 were completed within 15 days;
• 16 were completed between 16 to 30 days;
• 29 were completed between 31 to 60 days; and,
• One was completed between 61 to 120 days.

Disposition of Requests

Of the 60 completed requests:

• Six requests were disclosed without exemptions applied;
• 35 requests disclosed in part;
• Six requests were abandoned;
• Zero requests were exempted in their entirety;
• 13 requests where no records existed; and,
• Zero requests where the existence of records was neither confirmed nor denied.

In total 37 exemptions and no exclusions were applied under the Privacy Act:

• Section 21 was applied one time;
• Subparagraph 22(1)(b) was applied once;
• Section 26 was applied 34 times; and,
• Section 27 was applied once.

Consultations from other Institutions

Public Safety Canada received one new consultation request under the Privacy Act. There was one request carried forward from the previous fiscal year, resulting in a total of five requests to process. Of these requests, four were completed during the reporting year, while the remaining one request was carried forward to the next reporting year.

The Impacts of the COVID-19 Pandemic

Between April 1, 2020 and March 31, 2021 Public Safety Canada’s ATIP Office has continued to  work remotely in response to the COVID-19 pandemic.  This has resulted in a number of challenges, including:

• Inability to review certain records that could not be processed by employees working remotely;
• Continued delays in receiving consultation responses from other federal organizations whose operations were similarly restricted due to the COVID-19 situation;
• Some staff continued to face challenges balancing telework with other responsibilities, including care of children following closure of schools and daycares;
• Higher proactive publication volumes than seen in previous years, as a result of a substantial increase in Parliamentary Committee appearances related to COVID-19; and
• A significant increase in work by the Public Safety ATIP Office as a result of five Parliamentary Committee motions for the production of papers that were received and processed by the ATIP Office during the year.

To meet these challenges, the following mitigation measures were put in place:

• Establishment of electronic solutions to allow employees to work remotely on files classified Protected B and below;
• New electronic processes for retrieving documents from Offices of Primary Interest (OPIs);
• Adaptation to new online training for Public Safety employees;
• Implementation of digital networking software, allowing for better communication between ATIP and OPIs;
• Ongoing collaboration between the ATIP Office and OPIs to adjust processes throughout the year, in response to emerging challenges; and
• Ongoing collaboration between Public Safety’s ATIP Office and other federal organizations to ensure a coordinated response to files of mutual interest, such as proactive publication and Parliamentary Committee motions for the production of papers.

As a result of these measures, and despite the significant challenges posed by the pandemic, the ATIP Office was able to successfully close 60 requests and 4 consultations during the fiscal year, and to maintain a compliance rate of 93.3% on files that were closed during the year. 

Files containing records that cannot be accessed by employees working remotely are being triaged until such time as it is safe for employees to return to the office. Of the 69 total Privacy Act requests the ATIP Office was required to process, 9 (or 13%) are being carried into the 2021-2022 fiscal year.

In addition, meetings were held during the year with the Office of the Privacy Commissioner to ensure ongoing awareness of Public Safety’s approach and mitigation measures, and to identify and address any areas of concern that arose during the year.

Throughout, the physical and mental health of employees continues to be a primary focus, while balancing our obligations under the Privacy Act.

Challenges/Complexities

Aside from issues related to the pandemic, the ATIP Office did not experience any significant additional challenges with regards to Privacy Requests.

Training and Awareness       

Training

Public Safety Canada remains committed to promoting awareness and providing ongoing training opportunities to all employees.  Training is based on the needs and knowledge base of each employee.  Training has been conducted in both group and one-on-one sessions,  depending on demand. This fiscal year, the ATIP Office provided nine training or information sessions on the Access to Information Act and Privacy Act. A total of 203 people attended these sessions. Due to the pandemic, training numbers were reduced as a result of the time required to shift to an online training model using digital platforms such as MS Teams. The Public Safety ATIP Office and employees are now fully equipped to deliver and receive training via online methods, which will result in higher numbers going forward.

Additionally, 230 Public Safety employees completed the online course, Access to Information and Privacy Fundamentals (I015), this fiscal year. This course is offered by the Canada School of Public Service and is mandatory for all new employees joining Public Safety Canada.

Awareness

This fiscal year, the ATIP Office has raised ATIP awareness through the department’s internal communications vehicles, publishing three articles in the department’s internal newsletter, securing a monthly spot in the Administrative Professional’s Network newsletter, and by  updating various sections of the department’s intranet site.

Policies, Guidelines or Procedures and Initiatives

This past fiscal year, Public Safety’s ATIP Office implemented new electronic processes for handling ATIP requests classified Protected B and below in order to maintain processing of files by employees working remotely. In addition, the departmental Privacy Impact Assessment tool, Proactive Publication guidelines and procedures were updated and enhanced. 

Summary of Key Issues and Actions Taken on Complaints, Audits or Investigations

Public Safety Canada received 12 finding to complaints during the fiscal year.  All 12 complaints were exemption based.  Of the 12 complaints, seven were well founded, while the other five were deemed to be not well-founded.

Monitoring Compliance

Reports on ATIP compliance and retrieval statistics are reported to the Executive Committee in the Weekly ATIP Report. Additionally, on a quarterly basis, the number of Privacy Act requests, training sessions and attendees, privacy breaches and completed Privacy Impact Assessments are included in the Weekly ATIP Report.

Material Privacy Breaches

There were no material privacy breaches reported this fiscal year.

Privacy Impact Assessments

Two Privacy Impact Assessments were completed during the fiscal year.

Public Interest Disclosures Pursuant to paragraph 8(2)(m) of the Privacy Act

Paragraph 8(2)(m) of the Privacy Act provides the head of the institution with the authority to disclose personal information where the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure, or where the disclosure would clearly benefit the individual to whom the information relates. No disclosures pursuant to paragraph 8(2)(m) of the Privacy Act were made by Public Safety Canada this fiscal year.

Annex A: Delegation Orders

Privacy Act Delegation Order

The Minister of Public Safety and Emergency Preparedness, pursuant to section 73(1) of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Minister as the head of Public Safety and Emergency Preparedness, under the provisions of the Privacy Act and related regulations set out in the schedule opposite each position. This designation replaces all previous delegation orders.

Dated, at the City of Ottawa, this 21st day of July, 2020.

The Honourable William Sterling Blair, P.C., C.O.M., M.P.
Minister of Public Safety and Emergency Preparedness

Appendix B – Statistical Report on the Privacy Act

Reporting period: 2020-04-01 to 2021-03-31

Section 1: Requests Under the Privacy Act

Section 2: Requests Closed During the Reporting Period

2.5 Complexity

2.6 Closed Requests

2.7 Deemed Refusals

2.8 Requests for translation

Section 3: Disclosures Under Subsections 8(2) and 8(5)

Section 4: Requests for Correction of Personal Information and Notations

Section 5: Extensions

Part 6: Consultations received from other Government of Canada institutions and other organizations

Part 7: Completion Time of Consultations on Cabinet Confidences

Section 8: Complaints and Investigations Notices Received

Section 9: Privacy Impact Assessments (PIA) and Personal Information Banks (PIB)

Section 10: Material Privacy Breaches

Section 11: Resources Related to the Privacy Act

Annex C: Supplemental Statistical Report – Requests affected by COVID-19 measures

Reporting period: 2020-04-10 to 2021-03-31

Section 1: Capacity to Receive Requests

Section 2: Capacity to Process Records

Date modified:

2022-07-28