Annual Report to Parliament on the Administration of the Privacy Act 2015-2016

Chapter I – Report on the Privacy Act

About Public Safety Canada

The Department of Public Safety and Emergency Preparedness (PSEP) plays a key role in discharging the Government's fundamental responsibility for the safety and security of its citizens. The Minister of PSEP is responsible for the Department. Legislation governing the Department sets out three essential roles: (i) support the Minister's responsibility for all matters related to public safety and emergency management not assigned to another federal organization; (ii) exercise leadership at the national level for national security and emergency preparedness; and (iii) support the Minister's responsibility for the coordination of Public Safety's Portfolio entities and for setting their strategic priorities.

The Department provides strategic policy advice and support to the Minister of PSEP on a range of issues including: national security, border strategies, countering crime, emergency management and interoperability. The Department also delivers a number of grant and contribution programs related to emergency management, national security and community safety.

Public Safety Canada is organized into five branches: Emergency Management and Programs, Community Safety and Countering Crime, Portfolio Affairs and Communications, National and Cyber Security, Corporate Management; it also has a Chief Audit and Evaluation Executive and are supported by the Legal Services Unit. The Department has regional presence in all provinces, as well as in the North, and are a primary contact in the regions to deliver a coordinated federal response to emergencies; facilitate the effective delivery of emergency management, Aboriginal policing and crime prevention programs; and improve partnerships with other levels of government and key regional stakeholders.

About the Public Safety Portfolio

The Public Safety Portfolio encompasses nine organizations which directly contribute to the safety and security of Canadians. While Portfolio agencies deliver public security operations according to their mandates, Public Safety Canada, in its portfolio coordination role, brings strategic focus to the overall safety and security agenda.  Each organization in the portfolio administers its own access to information and privacy programs, under authorities delegated to them by the Minister.

Public Safety Portfolio

• Public Safety Canada (PS)
• Canada Border Services Agency (CBSA)
• Canadian Security Intelligence Service (CSIS)
• Correctional Service of Canada (CSC)
• Parole Board of Canada (PBC)
• Royal Canadian Mounted Police (RCMP)
• RCMP External Review Committee (ERC)
• Civilian Review and Complaints Commission for the RCMP (CRCC)
• Office of the Correctional Investigator (OCI)

About the Privacy Act

The Privacy Act protects the privacy of all Canadian citizens and permanent residents of Canada regarding personal information held by a government institution against unauthorized use and disclosure. The Privacy Act also gives Canadians, including those in Canada who are not permanent residents or citizens, the right to access personal information held by the government.

Section 72 of the Privacy Act requires that the head of every government institution submit an annual report to Parliament on the administration of the Act during the financial year. This report outlines how Public Safety Canada administered the Privacy Act throughout fiscal year 2015-2016.

The Access to Information and Privacy (ATIP) Office

The Access to Information and Privacy Operations Unit (ATIP Operations Unit) and the Policy, Privacy and Training Unit (PPTU) are part of Public Safety Canada’s ATIP and Executive Services Division within the Department’s Portfolio Affairs and Communications Branch. The Director of ATIP and Executive Services, supported by one Administrative Assistant, is responsible for ATIP as well as Ministerial Correspondence and Secretariat Services. The ATIP Office consists of 12 full-time positions with two streams of ATIP-related work: (1) the ATIP Operations Unit consisting of one ATIP Manager, two Team Leaders, five Analysts, one Junior Analyst, and one Administrative Officer; and, (2) the PPTU consisting of one Team Leader and one Policy Analyst.

The ATIP Office is responsible for the coordination and implementation of policies, guidelines and procedures to ensure departmental compliance with the Access to Information Act and the Privacy Act. The team is also responsible for responding to requests made under the Acts, as well as providing the following services to the Department:

• Processing consultations received from other institutions;
• Providing advice and guidance to employees and senior officials on ATIP related matters;
• Producing the Annual Reports to Parliament;
• Delivering ATIP awareness sessions to departmental employees;
• Coordinating regular updates to Info Source manuals;
• Reviewing departmental documents, such as audits and evaluations, prior to proactively disclosing these on the departmental website;
• Developing departmental procedures for processing ATIP requests;
• Maintaining the Department’s ATIP reading room; and
• Participating in forums for the ATIP community, such as the Treasury Board Secretariat’s ATIP Community meetings and working groups.

Delegation of Authority

During the reporting period, the ATIP Office operated under two delegation orders, both can be found in Appendix A. The previous order was signed by the Minister of Public Safety and Emergency Preparedness on July 15, 2014. The new Minister of Public Safety and Emergency Preparedness signed the current delegation order on January 8, 2016, delegating his powers and responsibilities under the Privacy Act.

New or Revised Policies, Guidelines or Procedures

During the reporting period, there were two new privacy-related guidance documents created. The Personal Information Bank (PIB) Review Process was created to assist program officials in creating or updating PIBs. The Privacy Notice Guidelines were developed to assist program officials in crafting appropriate privacy notices.

The ATIP Office updated two tools. The Privacy Protocol document was updated to better ensure departmental officials are aware of their privacy responsibilities when they are implementing new or modifying programs that involve a non-administrative use of personal information.

The ATIP Office updated the Statement of Completeness form that branch officials submit to ATIP Analysts with records retrieved in response to a request. This form has resulted in improved descriptions of the sensitivity of records, which assists the delegated authority in making decisions about the disclosure of the information.

The Minister of Public Safety and Emergency Preparedness approved protocols for interactions between the Minister’s Office and the ATIP Office, which include an administrative arrangement that applies when it is necessary to retrieve records from the Minister’s Office that are subject to the Act, and, instructions that Minister’s Office’s exempt staff are to limit their contact about Access to Information requests to designated officials. These administrative measures formalize good ATIP practices between the Minister’s Office and the ATIP Office.

Training

During 2015-2016, the ATIP Office provided eight training and/or information sessions on the Guidelines for Retrieving and Reviewing Records in Response to an Access to Information (ATI) Request, Privacy Impact Assessments, and the new Statement of Completeness document. 103 people were trained at these sessions.

Monitoring Performance

The ATIP Office monitors the processing of privacy requests by registering them in AccessPro Case Management, a comprehensive tracking system. The Office uses the system to generate reports on compliance and to present retrieval statistics in the Weekly ATIP Report. Additionally, the number of training sessions, privacy breaches and completed Privacy Impact Assessments are reported to the Executive Committee quarterly.

Challenges/Complexities

Following an internal audit of the personal information holdings of Public Safety Canada, several recommendations were made for improving the management of personal information. During the reporting period, a plan was created to fulfil the recommendations and progress was made. Accomplishing the recommendations has added to the workload of the PPTU. All recommendations must be completed by the end of the 2016-2017 reporting period, and it is anticipated that this project will continue to require a significant amount of involvement by the PPTU.

Volume and Capacity

The number of requests received under the Privacy Act increased five per cent from the last reporting period, and the complexity of the requests received remains challenging due to the interwoven information of multiple individuals.

Key Issues Raised as a Result of Complaints/Investigations/Audits

One complaint was received this year under the Privacy Act, concerning the refusal to disclose information by reason of exemption. This complaint was not resolved before the end of the reporting period. There were no issues or patterns identified to Public Safety Canada as a result of complaints or investigations by the Office of the Privacy Commissioner.

In response to the recommendations of the internal audit of the personal information holdings of Public Safety Canada, working groups were created to discuss improving the management of personal information; the Personal Information Bank (PIB) Review Process document was completed; additional training sessions were provided; and guidance was provided to departmental officials on how to identify the personal information that their branches hold under their control. The commitments in response to the recommendations must be completed by the end of 2016-2017; therefore work in this area continues.

Material Privacy Breaches

There were no material privacy breaches reported this fiscal year.

Appeals to the Court

There were no appeals to the Federal Court this fiscal year.

Privacy Impact Assessments Completed During the Year

There were two Privacy Impact Assessments (PIAs) completed this fiscal year.

The PIA for the Emergency Management Exemplary Service Medal was completed and submitted to the Office of the Privacy Commissioner during the reporting period. The medal is used to recognize individuals (including volunteers) who have distinguished themselves by exemplary conduct, actions and leadership as emergency management professionals.

The PIA for the Mentoring Program was completed and submitted to the Office of the Privacy Commissioner during the reporting period. The program is for participating employees to gain knowledge and develop skills so they can further develop their career.

Chapter II – Privacy Act Statistical Report

Summary

In 2015-2016, Public Safety Canada received 35 requests under the Privacy Act, an increase of approximately five per cent over the previous year. Public Safety Canada completed 100 per cent on time, the seventh consecutive year of over 90 per cent on time completion. The average number of days to process a request was 16 days.

Overall Workload Trends

Annex B provides a summarized statistical report on Privacy Act requests processed by Public Safety Canada between April 1, 2015 and March 31, 2016. The following section provides an overview and interpretation of this information.

The overall workload for ATIP has rebounded from last year’s decreased numbers. The figures below include formal Access and Privacy requests, and consultations received from other institutions.

The following table provides an overall breakdown of workload by category for the past five years.

Requests Received under the Privacy Act

The number of privacy requests remains small compared to the volume of access to information requests. Public Safety Canada collects little information directly from Canadians in comparison to portfolio agencies whose mandates are more operational in nature, such as the Royal Canadian Mounted Police (RCMP) and Correctional Service of Canada (CSC) who receive thousands of privacy requests annually

Public Safety Canada received 35 new Privacy Act requests throughout the 2015-2016 fiscal year, representing an increase of approximately five per cent over the number of requests received during previous year (23). There was one request carried forward from the previous fiscal year, resulting in a total of 36 requests to process during the reporting year. Of these requests, all 36 were completed during 2015-2016 and no requests were carried forward to the 2016-2017 reporting year.

Extensions

Section 15 of the Privacy Act allows institutions to extend the legal deadline for processing a request if a search for responsive records cannot be completed within 30 days of receipt of the request, or if the institution must consult with other institutions. During the 2015-2016 fiscal year, the department invoked five extensions of 16-30 days. The extensions invoked were due to required consultations and because the original time limit would unreasonably interfere with operations of the department.

Performance in Meeting Statutory Response Deadlines

Of the 36 completed requests, 25 were completed within 15 days, six were completed between 16-30 days, and five between 31 to 60 days. All 35 requests were completed within the statutory deadline.

Disposition of Requests for 2015-2016

There were six requests received under the Privacy Act that were disclosed without exemptions applied, 15 requests disclosed in part, no requests that were exempted or excluded in their entirety, four requests were abandoned, nine requests where no records existed and two requests where the existence of records was neither confirmed nor denied.

Consultations from other Institutions

The Department’s role in coordinating with other federal institutions as well as those within Public Safety Canada’s portfolio has normally resulted in the Department having an interest in the records processed by other institutions. During fiscal year 2015-2016, a total of three consultations from other institutions were received.

Disclosures Pursuant to paragraph 8(2)(m) of the Privacy Act

Paragraph 8(2)(m) of the Privacy Act provides the head of the institution with the authority to disclose personal information where the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure, or where the disclosure would clearly benefit the individual to whom the information relates. During 2015-2016, no disclosures pursuant to paragraph 8(2)(m) of the Privacy Act were made by Public Safety Canada.

Appendix A – Delegation of Authority for the Privacy Act and Regulations

The Minister of Public Safety and Emergency Preparedness, pursuant to section 73 of the Privacy Act*, hereby designates the persons holding the positions set out below, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Minister as the head of the Department of Public Safety and Emergency Preparedness, under the section of the Act and related regulations set out opposite each position.  This designation replaces all previous delegation orders.

Appendix B – Statistical Report for 2015-2016 on the Privacy Act

Reporting Period: 2015-04-01 to 2016-03-31

Part 1: Requests Under the Privacy Act

Part 2: Requests Closed During the Reporting Period

2.5 Complexity

2.6 Deemed refusals

Part 3: Disclosures Under Subsections 8(2) and 8(5)

Part 4: Requests for Correction of Personal Information and Notations

Part 5: Extensions

Part 6: Consultations Received From Other Institutions and Organizations

Part 7: Completion Time of Consultations on Cabinet Confidences

Part 8: Complaints and Investigations Notices Received

Part 9: Privacy Impact Assessments (PIAs)

Part 10: Resources Related to the Privacy Act

Date modified:

2018-01-31