Annual Report to Parliament 2022-2023: Privacy Act

PDF Version

Information contained in this publication or product may be reproduced, in part or in whole, and by any means, for personal or public non-commercial purposes, without charge or further permission, unless otherwise specified.

You are asked to:

• exercise due diligence in ensuring the accuracy of the materials reproduced;
• indicate both the complete title of the materials reproduced, as well as the author organization; and
• indicate that the reproduction is a copy of an official work that is published by the Government of Canada and that the reproduction has not been produced in affiliation with, or with the endorsement of the Government of Canada.

Commercial reproduction and distribution is prohibited except with written permission from the Department of Justice Canada. For more information, please contact the Department of Justice Canada at: www.justice.gc.ca.

© His Majesty the King Right of Canada, represented by the Minister of Justice and Attorney General of Canada, 2023

ISSN 2369-2596
Cat. No. J1-16E-PDF

Table of Contents

• Introduction
  • Purpose of the Privacy Act
  • Mandate of the Department of Justice
• Organizational structure
• Delegation order
• Performance and statistics
  • The ATIP office during the COVID-19 pandemic
  • Number of requests
  • Compliance rate, completion times and extensions
  • Deemed refusal rate
  • Outstanding requests
  • Disposition of completed requests
  • Requests, exemptions and exclusions
  • Informal requests
  • Format of information released
  • Consultations
  • Active complaints
  • Salaries and costs
• Training and awareness activities
• Policies, guidelines, procedures and initiatives
  • Advice
• Complaints, federal court cases and audits
  • Complaints filed
  • Completed investigations
  • Review by the Federal Court of Canada
  • Audits conducted by the Privacy Commissioner
• Monitoring compliance
  • Requests for the correction of personal information
• Administration of personal information
  • Public interest disclosures
  • Material privacy breaches
  • Privacy Impact Assessments
• Annex A – Delegation order
• Annex B – Annual statistical report

Introduction

We are pleased to table the Annual Report to Parliament on the administration of the Privacy Act (the Act) for fiscal year 2022-2023, as required under Section 72 of the Act.

Purpose of the Privacy Act

The Act was proclaimed into force on July 1, 1983.

The Act extends to individuals the right of access to information about themselves held by the Government, subject to specific and limited exceptions. The Act also protects individuals’ privacy by preventing others from having access to their personal information and gives individuals substantial control over the collection, use, and disclosure by the federal government of such information. Section 72 of the Act requires that the head of every government institution prepare for submission to Parliament an annual report on the administration of the Act within the institution during each financial year.

This 40^th Annual Report on the Administration of the Act is intended to describe how the Department of Justice (hereinafter referred to as “the Department”) administered its responsibilities during fiscal year 2022-23 (hereinafter “during the reporting period”).

Mandate of the Department of Justice

The Department of Justice has the mandate to support the dual roles of the Minister of Justice and the Attorney General of Canada.

Under Canada’s federal system, the administration of justice is an area of shared jurisdiction between the federal government and the provinces and territories. The Department supports the Minister of Justice in his responsibilities for 49 statutes and areas of federal law by ensuring a bilingual and bijural national legal framework principally within the following domains: criminal justice (including youth criminal justice), family justice, access to justice, Aboriginal justice, public law and private international law.

The Department also supports the Attorney General as the chief law officer of the Crown, both in terms of the ongoing operations of government and of the development of new policies, programs and services for Canadians. The Department provides legal advice to the Government and federal government departments and agencies, represents the Crown in civil litigation and before administrative tribunals, drafts legislation and responds to the legal needs of federal departments and agencies.

Organizational structure

The Access to Information and Privacy (ATIP) Office is responsible for the administration of the Act including the processing of access to information and privacy requests, consultations with other government departments, complaints and monitoring compliance to meet statutory obligations and timelines.

In 2022-23, the Director of the ATIP Office reported to the Chief Information Officer of the Information Solutions Branch under the direction of the Assistant Deputy Minister and Chief Financial Officer of the Management Sector. The Director is accountable for the development, coordination and implementation of effective policies, guidelines, systems and procedures to efficiently process requests under the Act.

During the reporting period, the Department’s ATIP Office had a total of 29.019 full-time equivalent (FTE) positions working on access to information requests and privacy files. Of which 2 FTE is professional services.

The ATIP Office staffing structure consists of one director, one legal counsel, five managers, two team leaders, five senior advisors, eight analysts, three intake officers, one administrative assistant and one system administrator.

The ATIP office is organized into three units:

• The Operational Unit works with the department to process incoming access to information and privacy requests.
• The Privacy, Policy and Programs Unit develops ATIP policies, provides advice on privacy related matters, updates annual reports and other statutory reports.
• The Complaints Unit processes complaints and works closely with the Office of the Information Commissioner (OIC) and the Office of the Privacy Commissioner (OPC).

In addition, the ATIP Office is currently working on modernizing its ATIP management system in order to achieve better performance and is building a team with information technology experts. The team will prepare and better assist the transition to the new platform.

Under section 73.1 of the Act institutions reporting to the same minister can partner to share request-processing services. The Department of Justice has not entered into any such service sharing agreements.

The Department’s ATIP Office is comprised of a dedicated workforce committed to access to information and the protection of privacy. This work includes:

• The timely processing of requests under the Act and assisting clients in accordance with the principles for assisting applicants;
• Processing consultation requests submitted by other federal institutions on Department documents located in their files and on records that may be subject to solicitor-client privilege;
• Providing advice and guidance to senior management and all employees of the Department on ATIP-related matters, as well as training and awareness sessions.
• Responding to complaints and negotiating with the Information Commissioner and Privacy Commissioner.
• Liaison on behalf of the Department with the Treasury Board Secretariat (TBS), the Information and Privacy Commissioners of Canada and other government departments and agencies regarding the application of the Act;
• Coordinating, reviewing, approving and publishing statutory reports such as the Annual Reports to Parliament;
• Developing, coordinating and implementing policies, procedures and guidelines for the orderly implementation of the Act by the Department;
• Modernizing the ATIP processes and the ATIP Management technologies by building a small team that evaluates new digital solutions that can reduce business processes, reduce time needed for requests, increase quality and helps all stakeholders more easily engage in the process.

The work of the ATIP Office is supported by 26 offices of primary interest (OPIs) within the Department. These offices are responsible for locating and providing the records responsive to requests and providing recommendations about the disclosure of records in compliance with the provisions of the Act.

Delegation order

The ATIP Director has full authority delegated by the Minister for the administration of the Act. For the purpose of increased executive oversight, full authority is also conferred to the Deputy Minister, the Associate Deputy Minister, the Assistant Deputy Minister and Chief Financial Officer, Management Sector and the Chief Information Officer. A copy of the Department’s Delegation Order can be found in Annex A of this report.

Performance and statistics

The Department is committed to transparency and accountability under the Act and continues to work to improve its performance to deliver the highest standards of service for access and protection of personal information. The Department’s performance for this reporting year should be understood within the context of the pandemic and its ongoing impact on ATIP operations. For additional statistics, a copy of the Department’s annual Statistical Report for fiscal year 2022-2023 is included in Annex B of this report.

The ATIP Office Post COVID-19 Pandemic

• ATIP employees have returned on-site in a hybrid model in September 2022. The Department continues to use its mechanism to facilitate the collection, consultation and processing of sensitive information electronically even with the return to work.
• The Department has continued to meet its publication requirements. The Department has published briefing material titles submitted to the Minister and Deputy Minister on a monthly basis as well as the summaries of the completed requests on the Open Government Portal, thereby continuing to improve communication with applicants and promoting transparency.
• The Department continued to use the Microsoft Office 365 tools, to communicate internally and engage with key stakeholders. The ATIP office also uses these tools for the transfer of information with the OPIs to allow for business continuity following the pandemic.
• To better serve our clients, the Department is part of the Access to Information and Privacy Online Request Service. Our clients can submit requests under the Act through this online channel administered by TBS.
• The pandemic substantially reduced the paper consumption. During this reporting period, the office mostly receives electronic requests and records, as well as provides release packages electronically to applicants in almost all cases as the office continued to use the delivery via Epost Connect, which was implemented in February 2020.

Number of Requests

Overview of requests received and completed by the Department pursuant to the Act:

The Department received 130 requests during the reporting period, a decrease of 1% compared to previous reporting period. In addition, 55 requests were outstanding from previous years, for a total of 185 active requests 2022-2023.

During the same reporting period 117 requests were completed, a small decrease compared to the previous reporting period and 68 requests were carried-forward to be completed in fiscal year 2023-2024. Responding to formal privacy requests involved the review of 1664 pages, of which 632 pages were disclosed.

Compliance rate, Completion Times and Extensions

Out of 117 requests completed in 2022-2023, 99 requests (85%) were completed within the legislated timelines under the Act. During the reporting period, the Department was able to close a total of 76 requests (65%) in 15 days or less, 21 requests within 16 to 30 days (18%), 10 requests within 31-60 days (9%), 3 requests within 181-365 days (2%), and 7 requests took over 365 days to complete (6%). The chart below represents the number of requests completed (with percentage) per completion time for all completed requests.

The Department found it necessary to seek extensions to the prescribed time limits in 12 requests, pursuant to section 15(1)(a) for interference with operations and in 3 instances for consultation purposes.

Deemed Refusal Rate

The Department’s deemed refusal rate in this reporting period (i.e., the percentage of personal Information requests that received a response beyond the deadline required under the Act) was 15%, which means that 18 requests were closed past the legislated timelines. The deemed refusal percentage for the reporting period decreased by 13.4% compared to the 2021-2022 reporting period.

Outstanding Requests

The TBS is collecting statistical data from specific institutions (the Department is one of these) on the volume of their outstanding access to information requests and requests for personal information. The Department carried-forward 68 requests, out of those requests 49% were received during the reporting period.

Disposition of Completed Requests

Of the 117 requests closed in the 2022-2023 fiscal year, 72 requests (62%) did not have any responsive records to provide, 31 requests (26%) were abandoned by the applicant, 10 requests (9%) were disclosed in part while 4 requests were released in their entirety (3%).

Requests, Exemptions and Exclusions

Exemptions invoked

The Department used exemptions 37 times under the Act for 117 requests. Most of the exemptions were section 26 which was invoked most often (17 requests) and exempts personal information relating to individuals other than the applicant. Followed by section 27 (12 requests), which exempts information relating to solicitor-client privilege. For further details regarding all the exemptions invoked, please refer to the Statistical Report in Annex B of this Report.

Exclusions cited

Information was excluded under section 69 (published material) for 1 request during the reporting period.

Informal Requests

The Department proactively publishes on the Open Government Portal summaries of completed access to information requests that do not contain personal or third party information. Members of the public can submit informal requests for a copy of the previously released information.

No informal request were processed during this reporting period.

Format of Information Released

Most (14) of the applicants chose to receive information in an electronic format at no extra charge as the department continued to use the delivery via Epost Connect, a service offered at no charge to the applicant and is now the office’s primary method of record delivery. It allows for secure delivery of records in an electronic format and circumvents the issue of email size restrictions and the need for the recipient to have a compatible device to access the records. Only 3 applicants chose to receive information in paper copies.

Consultations

During the 2022-2023 reporting period, the Department received 8 requests from other government institutions and no requests from other organizations requesting recommendations regarding records originating from, pertaining to, or of interest to the Department. In addition, 3 consultations were carried over from previous years, for a total of 11 consultations. In total, the Department was asked to review 2,434 pages for these consultations.

Of the 11 consultations, eight were completed during the reporting period (2,267 pages) and the remaining 3 were carried forward to be completed in fiscal year 2022-2023. The completion times for the eight consultations completed were the following:

• 5 consultations were completed between 1 to 60 days; and
• 3 consultations were completed between 181 to 365 days.

Active Complaints

The chart below represents the number of active complaints with the OPC that are outstanding from previous reporting periods, broken down by fiscal year in which they were received. A total of 3 complaints remain active after the current reporting period.

Salaries and Costs

The total cost for administering the Act during the 2022-2023 reporting period was $118,273. This cost includes $110,405 in salaries and overtime, as well as operating costs totaling $7,868, which include $7,427 in professional service contracts.

These costs do not capture resources expended by the Department’s other sectors to meet the requirements under the Act.

Training and awareness activities

The employees of the ATIP office regularly provide advice and informal training on the application of ATIP legislation to departmental employees who must review relevant records requested under the Act.

Formal awareness information sessions are offered to other sectors within the Department in order to address the specific business and operational needs of the individual groups.

The Centre for Information and Privacy Law (CIPL), in the Public Law and Legislative Sector of the Department, is responsible for providing legal advice to all departments on the interpretation and application of the Access to Information and Privacy Act. It also offered training to departmental employees, including through the Department’s Learning Program and to employees from other government departments:

• ATIP Fundamentals for Litigators – 2 sessions – 73 participants
• Introduction to the Privacy Act – 1 session – 18 participants
• Introduction to the Access to Information – 2 sessions – 185 participants

The ATIP Fundamentals Course (COR502) at the Canada School of Public Service was also completed by 124 employees for the 2022-2023 reporting period.

ATIP training is part of the recommended courses under the values and ethics component of the Department’s Roadmap for new Managers. An e-orientation deck is posted on the Department’s Intranet site for employee consultation.

ATIP employees participated in collective awareness sessions with ATIP Counsel to review recent jurisprudence and case law related to the Act. The ATIP Counsel participated in monthly ATIP Practice Group meetings during which information was exchanged and viable solutions proposed. The Practice Group is open to all departmental counsel, including those from Legal Services Units, and its mandate is to discuss questions such as the right of access to information or privacy issues.

In addition to mentorship and partnership relationships, workshops and presentations were regularly provided within the ATIP Office on various topics concerning the application of the PA and related policy and procedures. This allowed ATIP employees to benefit from each other’s respective levels of experience and knowledge.

Finally, ATIP employees participated in training sessions, conferences and seminars organized by the TBS or by various associations on matters relating to both access and privacy. These exchanges provided updates for employees in the development of ATIP and upcoming trends in this area.

Policies, guidelines, procedures and initiatives

• The Department monitored guidelines and service standards for the federal government ATIP community that clarify the ATIP Office’s role in requests that have been received by other federal government institutions pursuant to the Act.
• The Department participated in inter-departmental working groups on ATIP related matters, mostly led by the TBS, in order to remain updated on different changes to its policies, guidelines and directives.
• The Department continued to develop internal guidance documents and tools to ensure consistency and to document best practices and lessons learned. These guidance documents are routinely discussed at regular staff meetings and updated as required.
• The Department continued to update internal procedures and tools to ensure consistency within the office and document best practices and lessons learned. In addition, the Department continued to share best practices with other government institutions.

Advice

The ATIP Office acted as a resource on several occasions for departmental officials as well as those from other government institutions, offering advice and guidance on the provisions of the legislation as well as related policies. The Office was consulted on the collection, the use, the disclosure and disposal or retention of personal information on a wide range of issues.

Complaints, federal court cases and audits

Complaints Filed

The ATIP Office created a dedicated team to manage complaints; this team serves as the primary liaison between the Department and the OPC. The team continues to work to strengthen relationships and improve the Department’s ATIP program performance.

During the 2022-2023 reporting period, the Department received 8 Notices of Intention to Investigate from the OPC during the reporting period. The reasons for the complaints were as follows:

• 1 related to delay;
• 5 related to exemption; and
• 2 concerned an incomplete search for documents.

Completed Investigations

A total of 21 investigations were completed during the reporting period, some of which had been carried forward from previous years. Of the 21 investigations, one was not well founded, four were resolved, one was settled, 14 were well founded, and one was discontinued. No key issues were raised as a result of these complaints.

Complaint findings are defined as follows:

Well founded: The institution contravened a provision of the Act.

Well founded and resolved: The institution contravened a provision of the Act but has since taken corrective measures to resolve the issue to the satisfaction of the OPC.

Not well founded: There was no or insufficient evidence to conclude the institution/organization contravened the privacy legislation.

Resolved: The investigation revealed that the complaint is essentially a result of a miscommunication, misunderstanding, etc., between parties; and/or the institution agreed to take measures to rectify the problem to the satisfaction of the OPC.

Settled: The OPC helped negotiate a solution that satisfied all parties during the course of the investigation, and did not issue a finding.

Discontinued: The investigation was terminated before allegations were fully investigated.

Early Resolution (ER): Applied to situations in which the issue is resolved to the satisfaction of the complainant early in the investigation process and the OPC did not issue a finding.

Review By the Federal Court of Canada

During the 2022-2023 reporting period there were 12 applications filed before the Federal Court pursuant to sections 41, 42 and 44 of the Act.

Audits Conducted by the Privacy Commissioner

During fiscal year 2022-2023, no formal investigations were conducted by the Privacy Commissioner.

Monitoring compliance

The ATIP Office regularly monitors compliance with statutory requirements and timeliness associated with the processing of requests through ongoing communication with senior management and OPIs.

The workload was assessed, through the ATIP Case Management System, on a daily basis in order to ensure that workload was evenly distributed and effectively managed to meet statutory deadlines.

The reading rooms at the Department’s headquarters in Ottawa and those located in the regional offices across Canada make available to the public the most recent published version of Info Source, as well as departmental publications and manuals. Many of these publications can be found on the Department’s website and the Treasury Board Secretariat’s websites.

Requests for the Correction of Personal Information

Paragraph 12(2)(a) of the Act provides that every individual given access to personal information about himself or herself that has been used, is being used, or is available for use for an administrative purpose, is entitled to request correction of such information where the individual believes there is an error or omission therein.

The Department did not receive any requests for correction of personal information during the reporting period.

Administration of personal information

Public Interest Disclosures

Paragraph 8(2)(m) of the Act permits the disclosure of personal information in situations where the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure or when the disclosure would clearly benefit the individual to whom the information relates. The Privacy Commissioner must be informed of disclosures to be made under these provisions. During fiscal year 2022-2023, the Department did not disclose personal information pursuant to paragraph 8(2)(m).

Material Privacy Breaches

During the reporting period 2022-2023, the department did not report any material privacy breaches to the OPC and to TBS (Information and Privacy Policy Division).

Privacy Impact Assessments

The Department has not completed any privacy impact assessments during the 2022-2023 reporting period.

Six PIA’s have been carried over from a previous reporting period and are at various stages of completion. They will be sent to Treasury Board of Canada Secretariat (TBS) as soon as they are finalized and approve in order to be registered. A copy will also be sent to the OPC for their review and comments.

Annex A – Delegation order

Annex B – Annual statistical report

Statistical Report on the Privacy Act

Name of institution: Department of Justice

Reporting period: 4/1/2022 to 3/31/2023

Section 1: Requests Under the Privacy Act

1.1 Number of requests received

1.2 Channels of requests

Section 2: Informal requests

2.1 Number of informal requests

2.2 Channels of informal requests

2.3 Completion time of informal requests

2.4 Pages released informally

Section 3: Requests Closed During the Reporting Period

3.1 Disposition and completion time

3.2 Exemptions

3.3 Exclusions

3.4 Format of information released

3.5 Complexity

3.5.1 Relevant pages processed and disclosed for paper and e-record formats

3.5.2 Relevant pages processed by request disposition for paper and e-record formats by size of requests

3.5.3 Relevant minutes processed and disclosed for audio formats

3.5.4 Relevant minutes processed per request disposition for audio formats by size of requests

3.5.5 Relevant minutes processed and disclosed for video formats

3.5.6 Relevant minutes processed per request disposition for video formats by size of requests

3.5.7 Other complexities

3.6 Closed requests

3.6.1 Number of requests closed within legislated timelines

3.7 Deemed refusals

3.7.1 Reasons for not meeting legislated timelines

3.7.2 Request closed beyond legislated timelines (including any extension taken)

3.8 Requests for translation

Section 4: Disclosures Under Subsections 8(2) and 8(5)

Section 5: Requests for Correction of Personal Information and Notations

Section 6: Extensions

6.1 Reasons for extensions

6.2 Length of extensions

Section 7: Consultations Received From Other Institutions and Organizations

7.1 Consultations received from other Government of Canada institutions and other organizations

7.2 Recommendations and completion time for consultations received from other Government of Canada institutions

7.3 Recommendations and completion time for consultations received from other organizations outside the Government of Canada

Section 8: Completion Time of Consultations on Cabinet Confidences

8.1 Requests with Legal Services

8.2 Requests with Privy Council Office

Section 9: Complaints and Investigations Notices Received

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

10.1 Privacy Impact Assessments

10.2 Institution-specific and Central Personal Information Banks

11.1 Material Privacy Breaches reported

11.2 Non-Material Privacy Breaches

12.1 Allocated Costs

12.2 Human Resources