Annual Report to Parliament 2021-2022: Privacy Act

PDF Version

Information contained in this publication or product may be reproduced, in part or in whole, and by any means, for personal or public non-commercial purposes, without charge or further permission, unless otherwise specified.

You are asked to:

• exercise due diligence in ensuring the accuracy of the materials reproduced;
• indicate both the complete title of the materials reproduced, as well as the author organization; and
• indicate that the reproduction is a copy of an official work that is published by the Government of Canada and that the reproduction has not been produced in affiliation with, or with the endorsement of the Government of Canada.

Commercial reproduction and distribution is prohibited except with written permission from the Department of Justice Canada. For more information, please contact the Department of Justice Canada at: www.justice.gc.ca.

© Her Majesty the Queen in Right of Canada, represented by the Minister of Justice and Attorney General of Canada, 2022

ISSN 2369-2596
Cat. No. J1-16E-PDF

Table of Contents

• Introduction
  • Purpose of the Privacy Act
  • Mandate of the Department of Justice
• Organizational Structure
• Delegation Order
• Performance and Statistics
  • The ATIP office during the COVID-19 pandemic
  • Number of requests
  • Compliance rate, completion times and extensions
  • Deemed refusal rate
  • Outstanding requests
  • Disposition of completed requests
  • Requests, exemptions and exclusions
  • Informal requests
  • Format of information released
  • Consultations
  • Active complaints
  • Salaries and costs
• Training and Awareness Activities
• Policies, Guidelines, Procedures and Initiatives
  • Advice
• Complaints, Federal Court Cases and Audits
  • Complaints filed
  • Completed investigations
  • Review by the Federal Court of Canada
  • Audits conducted by the Privacy Commissioner
• Monitoring Compliance
  • Requests for the correction of personal information
• Administration of Personal Information
  • Public interest disclosures
  • Material privacy breaches
  • Privacy Impact Assessments
• Annex A – Delegation Order
• Annex B – Annual Statistical Report

Introduction

We are pleased to table the Annual Report to Parliament on the administration of the Privacy Act (the Act) for fiscal year 2021-2022, as required under Section 72 of the Act.

Purpose of the Privacy Act

The Act was proclaimed into force on July 1, 1983.

The Act extends to individuals the right of access to information about themselves held by the Government, subject to specific and limited exceptions. The Act also protects individuals’ privacy by preventing others from having access to their personal information and gives individuals substantial control over the collection, use, and disclosure by the federal government of such information. Section 72 of the Act requires that the head of every government institution prepare for submission to Parliament an annual report on the administration of the Act within the institution during each financial year.

This 39^th Annual Report on the Administration of the Act is intended to describe how the Department of Justice (hereinafter referred to as “the Department”) administered its responsibilities during fiscal year 2021-22 (hereinafter “during the reporting period”).

Mandate of the Department of Justice

The Department has a dual mandate stemming from the Minister’s dual role as the Minister of Justice and the Attorney General of Canada.

In support of the Minister of Justice, the Department is responsible for providing policy and program advice and direction through the development of the legal content of bills, regulations and guidelines. In support to the Attorney General of Canada, the Department is responsible for litigating civil cases by, or on behalf of the federal Crown and for providing legal advice to federal law enforcement agencies and other government departments.

Organizational Structure

The Access to Information and Privacy (ATIP) office is responsible for the administration of the Act including the processing of access to information and privacy requests, consultations with other government departments, complaints and monitoring compliance to meet statutory obligations and timelines.

The Director of the ATIP office reports to the Chief Information Officer of the Information Solutions Branch, under the direction of the Assistant Deputy Minister and Chief Financial Officer of the Management Sector. The Director is accountable for the development,

coordination and implementation of effective policies, guidelines, systems and procedures to efficiently process requests under the Act.

During the reporting period, the Department’s ATIP Office had a total of 27.85 full-time equivalent (FTE) positions working on access to information requests and privacy files, of which 1.34 FTE were professional services.

The ATIP office staffing structure consists of one director, one legal counsel, five managers, two team leaders, four senior advisors, eight analysts, three intake officers, one administrative assistant and one system administrator.

The ATIP office is organized into three units:

• The Operational Unit works with the department to process incoming access to information and privacy requests…
• The Privacy, Policy and Programs Unit develops ATIP policies, provides advice on privacy related matters, updates annual reports and other statutory reports.
• The Complaints Unit processes complaints and works closely with the Office of the Information Commissioner (OIC) and the Office of the Privacy Commissioner (OPC).

In addition, the ATIP office is currently working on modernizing its ATIP management system in order to achieve better performance and is building a team with information technology experts. The team will prepare and better assist the transition to the new platform.

Under section 73.1 of the Act institutions reporting to the same minister can partner to share request-processing services. The Department of Justice has not entered into any such service sharing agreements.

The Department’s ATIP Office is comprised of a dedicated workforce committed to access to information and the protection of privacy. This work includes:

• The timely processing of requests under the Act and assisting clients in accordance with the principles for assisting applicants;
• Processing consultation requests submitted by other federal institutions on Department documents located in their files and on records that may be subject to solicitor-client privilege;
• Providing advice and guidance to senior management and all employees of the Department on ATIP-related matters, as well as training and awareness sessions;
• Responding to complaints and negotiating with the Information Commissioner and Privacy Commissioner;
• Liaison on behalf of the Department with the Treasury Board Secretariat (TBS), the Information and Privacy Commissioners of Canada and other government departments and agencies regarding the application of the Act;
• Coordinating, reviewing, approving and publishing statutory reports such as the Annual Reports to Parliament;
• Developing, coordinating and implementing policies, procedures and guidelines for the orderly implementation of the Act by the Department; and,
• Modernizing the ATIP processes and the ATIP Management technologies by building a small team that evaluates new digital solutions that can reduce business processes, reduce time needed for requests, increase quality and helps all stakeholders more easily engage in the process.

The work of the ATIP Office is supported by 26 offices of primary interest (OPIs) within the Department. These offices are responsible for locating and providing the records responsive to requests and providing recommendations about the disclosure of records in compliance with the provisions of the Act.

Delegation Order

The ATIP Director has full authority delegated by the Minister for the administration of the Act. For the purpose of increased executive oversight, full authority is also conferred to the Deputy Minister, the Associate Deputy Minister, the Assistant Deputy Minister and Chief Financial Officer, Management Sector and the Chief Information Officer. A copy of the Department’s Delegation Order can be found in Annex A of this report.

Performance and Statistics

The Department is committed to transparency and accountability under the Act and continues to work to improve its performance to deliver the highest standards of service for access and protection of personal information. The Department’s performance for this reporting year should be understood within the context of the pandemic and its ongoing impact on ATIP operations.

For additional statistics, a copy of the Department’s annual Statistical Report for fiscal year 2021-22 is included in Annex B of this report.

The ATIP office during the COVID-19 pandemic

• ATIP employees continue to work remotely assisting applicants and processing requests. The Department used a mechanism to facilitate the collection, consultation and processing of sensitive information electronically in order to maintain the COVID-19 health and safety measures.
• Despite the COVID-19 impact, the Department continued to meet its publication requirements. The Department continued publishing briefing material titles submitted to the Minister and Deputy Minister on a monthly basis as well as the summaries of the completed requests on the Open Government Portal, thereby continuing to improve communication with applicants and promoting transparency.
• The Department continued to use the tools of Microsoft Office 365, to communicate internally and engage with key stakeholders. The ATIP office also used these tools for the transfer of information with the OPIs to allow for business continuity during the pandemic.
• To better serve our clients, the Department continued to be part of the Access to Information and Privacy Online Request Service. Our clients can submit requests under the Act through this online channel administered by TBS.
• The pandemic substantially reduced the paper consumption. During this reporting period, the office mostly received electronic requests and records, as well as provided release packages electronically to applicants in almost all cases as the office continued to use the delivery via Epost Connect, which was implemented in February 2020.

Number of requests

Overview of requests received and completed by the Department pursuant to the Act:

The Department received 131 requests during the reporting period, an increase of 2% compared to previous reporting period. In addition, 44 requests were outstanding from previous years, for a total of 175 active requests 2021-2022.

During the same reporting period 120 requests were completed, a small decrease compared to the previous reporting period and 55 requests were carried-forward to be completed in fiscal year 2022-23. Responding to formal privacy requests involved the review of 14,336 pages, of which 6,213 pages were partially disclosed.

Compliance rate, completion times and extensions

Out of 120 requests completed in 2020-21, 86 requests (72%) were completed within the legislated timelines under the Act. During the reporting period, the Department was able to close a total of 60 requests (60%) in 15 days or less (50%), 24 requests within 16 to 30 days (20%), 15 requests within 31-60 days (12%), 7 requests within 61-120 days (6%), 3 requests within 121-180 days (2%), 2 requests within 181-365 days (2%), and 9 requests took over 365 days to complete (8%). The chart below represents the number of requests completed (with percentage) per completion time for all completed requests.

The Department found it necessary to seek extensions to the prescribed time limits in 12 requests, pursuant to section 15(1)(a) for interference with operations and in one instance for consultation purposes.

Deemed refusal rate

The Department’s deemed refusal rate in this reporting period (i.e., the percentage of personal Information requests that received a response beyond the deadline required under the Act) was 28.4%, which means that 34 requests were closed past the legislated timelines. The deemed refusal percentage for the reporting period decreased by 1.6% compared to the 2020-2021 reporting period.

Outstanding requests

This year the TBS is collecting statistical data from specific institutions (the Department is one of these) on the volume of their outstanding access to information requests and requests for personal information. The Department carried-forward 55 requests, out of those requests 49% were received during the reporting period.

Disposition of completed requests

Of the 120 requests closed in the 2021-2022 fiscal year, 60 requests (50%) did not have any responsive records to provide, 41 requests (34%) were abandoned by the applicant, and 19 requests (16%) were disclosed in part.

Requests, exemptions and exclusions

Exemptions invoked

The Department invoked exemptions under the Act for 34 requests. Most of the exemptions were section 26 which was invoked most often (14 requests) and exempts personal information relating to individuals other than the applicant. Followed by section 27 (12 requests), which exempts information relating to solicitor-client privilege. For further details regarding all the exemptions invoked, please refer to the Statistical Report in Annex B of this Report.

Exclusions cited

Information was excluded under section 69 (published material) once during the reporting period.

Informal requests

The Department proactively publishes on the Open Government Portal summaries of completed access to information requests that do not contain personal or third party information. Members of the public can submit informal requests for a copy of the previously released information.

No informal requests were processed during this reporting period.

Format of information released

Most (16) of the applicants chose to receive information in an electronic format at no extra charge as the department continued to use the delivery via Epost Connect, a service offered at no charge to the applicant and is now the office’s primary method of record delivery. It allows for secure delivery of records in an electronic format and avoids the issue of email size restrictions and the need for the recipient to have a compatible device to access the records. Only three applicants chose to receive information in paper copies.

Consultations

During the 2021-2022 reporting period, the Department received eight requests from other government institutions and three from other organizations requesting recommendations regarding records originating from, pertaining to, or of interest to the Department. In addition, three consultations were carried over from previous years, for a total of 11 consultations. In total, the Department was asked to review 2,434 pages for these consultations.

Of the 11 consultations, eight were completed during the reporting period (2,267 pages) and the remaining three were carried forward to be completed in fiscal year 2022-2023. The completion times for the eight consultations completed were the following:

• five were completed between 1 to 60 days; and
• the remaining three were completed between 181 to 365 days.

Active complaints

The chart below represents the number of active complaints with the OPC that are outstanding from previous reporting periods, broken down by fiscal year in which they were received. A total of seven complaints remain active after the current reporting period.

Salaries and costs

The total cost for administering the Act during the 2021-2022 reporting period was $353,966. This cost includes $305,574 in salaries and overtime, as well as operating costs totaling $48,392, which include $47,126 in professional service contracts.

These costs do not capture resources expended by the Department’s other sectors to meet the requirements under the Act.

Training and Awareness Activities

The employees of the ATIP office regularly provide advice and informal training on the application of ATIP legislation to departmental employees who must review relevant records requested under the Act.

Formal awareness information sessions are offered to other sectors within the Department in order to address the specific business and operational needs of the individual groups. Five sessions were provided during the reporting period (a total of 113 participants).

• Minister’s Office – 2 sessions – 8 participants
• ATIP Process overview – 3 sessions – 105 participants

The Centre for Information and Privacy Law (CIPL) ), in the Public Law and Legislative Sector of the Department, is responsible for providing legal advice to all departments on the interpretation and application of the Access to Information and Privacy Act. It also offered training to departmental employees, including through the Department’s Learning Program and to employees from other government departments:

• CIPL training day – 250 participants
• Fundamentals of Solicitor-Client Privilege in the Government Context – 2 sessions – 193 participants

ATIP training is part of the recommended courses under the values and ethics component of the Department’s Roadmap for new Managers. An e-orientation deck is posted on the Department’s Intranet site for employee consultation.

ATIP employees participated in collective awareness sessions with ATIP Counsel to review recent jurisprudence and case law related to the Act. The ATIP Counsel participated in monthly ATIP Practice Group meetings during which information was exchanged and viable solutions proposed. The Practice Group is open to all departmental counsel, including those from Legal Services Units, and its mandate is to discuss questions such as the right of access to information or privacy issues.

In addition to mentorship and partnership relationships, workshops and presentations were regularly provided within the ATIP Office on various topics concerning the application of the PA and related policy and procedures. This allowed ATIP employees to benefit from each other’s respective levels of experience and knowledge.

Finally, ATIP employees participated in training sessions, conferences and seminars organized by the TBS or by various associations on matters relating to both access and privacy. These exchanges provided updates for employees in the development of ATIP and upcoming trends in this area.

Policies, Guidelines, Procedures and Initiatives

• The Department monitored guidelines and service standards for the federal government ATIP community that clarify the ATIP Office’s role in requests that have been received by other federal government institutions pursuant to the Act.
• The Department participated in inter-departmental working groups on ATIP related matters, mostly led by the TBS, in order to remain updated on different changes to its policies, guidelines and directives.
• The Department continued to develop internal guidance documents and tools to ensure consistency and to document best practices and lessons learned. These guidance documents are routinely discussed at regular staff meetings and updated as required.
• The Department continued to update internal procedures and tools to ensure consistency within the office and document best practices and lessons learned. In addition, the Department continued to share best practices with other government institutions.

Advice

The ATIP Office acted as a resource on several occasions for departmental officials as well as those from other government institutions, offering advice and guidance on the provisions of the legislation as well as related policies. The Office was consulted on the collection, the use, the disclosure and disposal or retention of personal information on a wide range of issues.

Complaints, Federal Court Cases and Audits

Complaints filed

The ATIP Division created a dedicated team to manage complaints; this team serves as the primary liaison between the Department and the OPC. The team continues to work to strengthen relationships and improve the Department’s ATIP program performance.

During the 2021-2022 reporting period, the Department received eight Notices of Intention to Investigate from the OPC during the reporting period. The reasons for the complaints were as follows:

• 1 related to delay;
• 5 related to exemption; and
• 2 concerned an incomplete search for documents.

Completed investigations

A total of 10 investigations were completed during the reporting period, some of which had been carried forward from previous years. Of the 10 investigations, five were not well founded, one was well founded, and four were discontinued. No key issues were raised as a result of these complaints.

Complaint findings are defined as follows:

• Well founded: The institution contravened a provision of the Act.
• Well founded and resolved: The institution contravened a provision of the Act but has since taken corrective measures to resolve the issue to the satisfaction of the OPC.
• Not well founded: There was no or insufficient evidence to conclude the institution/organization contravened the privacy legislation.
• Resolved: The investigation revealed that the complaint is essentially a result of a miscommunication, misunderstanding, etc., between parties; and/or the institution agreed to take measures to rectify the problem to the satisfaction of the OPC.
• Settled: The OPC helped negotiate a solution that satisfied all parties during the course of the investigation, and did not issue a finding.
• Discontinued: The investigation was terminated before allegations were fully investigated.
• Early Resolution (ER): Applied to situations in which the issue is resolved to the satisfaction of the complainant early in the investigation process and the OPC did not issue a finding.

Review by the Federal Court of Canada

During the 2021-2022 reporting period there were no applications filed before the Federal Court pursuant to sections 41, 42 and 44 of the Act.

Audits conducted by the Privacy Commissioner

During fiscal year 2021-202, no formal investigations were conducted by the Privacy Commissioner.

Monitoring Compliance

The ATIP office regularly monitors compliance with statutory requirements and timeliness associated with the processing of requests through ongoing communication with senior management and OPIs.

The workload was assessed, through the ATIP Case Management System, on a daily basis in order to ensure that workload was evenly distributed and effectively managed to meet statutory deadlines.

The reading rooms at the Department’s headquarters in Ottawa and those located in the regional offices across Canada make available to the public the most recent published version of Info Source, as well as departmental publications and manuals. Many of these publications can be found on the Department’s website and the Treasury Board Secretariat’s websites.

Requests for the correction of personal information

Paragraph 12(2)(a) of the Act provides that every individual given access to personal information about himself or herself that has been used, is being used, or is available for use for an administrative purpose, is entitled to request correction of such information where the individual believes there is an error or omission therein.

The Department did not receive any requests for correction of personal information during the reporting period.

Administration of Personal Information

Public interest disclosures

Paragraph 8(2)(m) of the Act permits the disclosure of personal information in situations where the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure or when the disclosure would clearly benefit the individual to whom the information relates. The Privacy Commissioner must be informed of disclosures to be made under these provisions.

During fiscal year 2021-2022, the Department did not disclose personal information pursuant to paragraph 8(2)(m).

Material privacy breaches

During the reporting period 2021-2022, the Department did not report any material privacy breaches to the OPC and to TBS (Information and Privacy Policy Division).

Privacy Impact Assessments

The Department did not complete any privacy impact assessments during the 2021-2022 reporting period.

Annex A – Delegation Order

Annex A – Delegation Order – Text version

This image is of the Delegation Order for the Access to Information Act and Privacy Act. The Minister of Justice Canada, pursuant to subsections 95(1) of the Access to Information Act and 73(1) of the Privacy Act, hereby delegates any powers, duties, and functions under the Acts to the persons holding the positions set out in the schedule hereto, as well as to the persons occupying those positions on an acting basis. This delegation order replaces any previous delegation order.

Schedule

Position

1. The Deputy Minister and Associate Deputy Minister (full authority)
2. The Director, Access to Information and Privacy Office (full authority)
3. The Assistant Deputy Minister, Manager Sector and Chief Financial Officer (full authority)
4. The Chief Information Officer (full authority)
5. The Chief of Operations, Chief of Policy and Legal Counsel, Access to Information and Privacy Office (15 and the mandatory provisions of section 26 for all records)
6. The Senior Access to Information and Privacy Advisors (15 for all records)

Signed by the Honourable David Lametti, P.C., M.P.
Ottawa, October 16, 2020

Annex B – Annual Statistical Report

Statistical Report on the Privacy Act

Name of institution: Department of Justice

Reporting period: 2021-04-01 to 2022-03-31

Section 1: Requests Under the Privacy Act

1.1 Number of requests received

1.2 Channels of requests

Section 2: Informal requests

2.1 Number of informal requests

2.2 Channels of informal requests

2.3 Completion time of informal requests

2.4 Pages released informally

Section 3: Requests Closed During the Reporting Period

3.1 Disposition and completion time

3.2 Exemptions

3.3 Exclusions

3.4 Format of information released

3.5 Complexity

3.5.1 Relevant pages processed and disclosed for paper and e-record formats

3.5.2 Relevant pages processed by request disposition for paper and e-record formats by size of requests

3.5.3 Relevant minutes processed and disclosed for audio formats

3.5.4 Relevant minutes processed per request disposition for audio formats by size of requests

3.5.5 Relevant minutes processed and disclosed for video formats

3.5.6 Relevant minutes processed per request disposition for video formats by size of requests

3.5.7 Other complexities

3.6 Closed requests

3.6.1 Number of requests closed within legislated timelines

3.7 Deemed refusals

3.7.1 Reasons for not meeting legislated timelines

3.7.2 Request closed beyond legislated timelines (including any extension taken)

3.8 Requests for translation

Section 4: Disclosures Under Subsections 8(2) and 8(5)

Section 5: Requests for Correction of Personal Information and Notations

Section 6: Extensions

6.1 Reasons for extensions

6.2 Length of extensions

Section 7: Consultations Received From Other Institutions and Organizations

7.1 Consultations received from other Government of Canada institutions and other organizations

7.2 Recommendations and completion time for consultations received from other Government of Canada institutions

7.3 Recommendations and completion time for consultations received from other organizations outside the Government of Canada

Section 8: Completion Time of Consultations on Cabinet Confidences

8.1 Requests with Legal Services

8.2 Requests with Privy Council Office

Section 9: Complaints and Investigations Notices Received

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

10.1 Privacy Impact Assessments

10.2 Institution-specific and Central Personal Information Banks

Section 11: Privacy Breaches

11.1 Material Privacy Breaches reported

11.2 Non-Material Privacy Breaches

Section 12: Resources Related to the Privacy Act

12.1 Allocated Costs

12.2 Human Resources