Introduction

The Administrative Tribunals Support Service of Canada (ATSSC) is pleased to present to Parliament its annual report on the administration of the Privacy Act (the Act) for fiscal year April 1, 2018 to March 31, 2019.

Section 72 of the Act requires the head of every federal government institution to prepare and table an annual report to Parliament on the administration of the Act during the fiscal year. This report provides an overview of the activities of the ATSSC in implementing the Act during the organization’s fiscal cycle.

The purpose of the Privacy Act is to protect the privacy of individuals with respect to personal information about themselves held by a government institution and to provide individuals with a right of access to their information. It also protects the privacy of individuals by exercising strict control over the collection, disclosure and use of such information.

The ATSSC is fully committed to both the spirit and the intent of the Act to foster a culture of openness and transparency while ensuring the privacy of individuals with respect to their personal information held by the organization.

About the ATSSC

The Administrative Tribunals Support Service of Canada (ATSSC) was established with the coming into force on November 1, 2014, of the Administrative Tribunals Support Service of Canada Act. The ATSSC is responsible for providing support services and facilities to 11 federal administrative tribunals by way of a single, integrated organization.

These services include the specialized services required to support the mandate of each tribunal (e.g., registry, research and analysis, legal and other mandate or case activities), as well as internal services (e.g., human resources, financial services, information management and technology, accommodation, security, planning and communications). Through these specialized services, the ATSSC supports improving access to justice for Canadians.

The administrative tribunals supported by the ATSSC include:

• the Canada Agricultural Review Tribunal;
• the Canada Industrial Relations Board;
• the Canadian Cultural Property Export Review Board;
• the Canadian Human Rights Tribunal;
• the Canadian International Trade Tribunal;
• the Competition Tribunal;
• the Federal Public Sector Labour Relations and Employment Board;
• the Public Servants Disclosure Protection Tribunal;
• the Social Security Tribunal of Canada;
• the Specific Claims Tribunal Canada; and
• the Transportation Appeal Tribunal of Canada.

The ATSSC also supports the National Joint Council, the forum for co-development, consultation and information sharing between the government as employer and public service bargaining agents.

The Minister of Justice and Attorney General of Canada is responsible for the ATSSC.

The Access to Information and Privacy Office

The Access to Information and Privacy (ATIP) Office is responsible for administering the Privacy Act (the Act) on behalf of the ATSSC. Its mandate is to ensure compliance with the legislation, regulations and government policy and to create organizational standards and directives relating to the Act. Responsibility for the powers, duties and functions for the administration of the Act has been formally established and is outlined in the Delegation Order signed by the Chief Administrator. The Director, Planning and Communications and the ATIP Manager have been delegated authorities as described in the Delegation Order included in Appendix A.

Within the ATSSC’s organizational structure, the ATIP Office reports to the Planning and Communications Unit which is under the direction of the Chief Administrator. Oversight of the ATIP Office is administered by the Director, Planning and Communications. The ATIP Office consists of the manager and one analyst dedicated to access to information and privacy activities.

The ATIP Office receives, coordinates and processes requests in accordance with the Act, promotes awareness of the Act within the organization, fulfills reporting responsibilities relating to the Act. The ATIP office also provides expert advice and guidance to senior management and ATSSC staff on matters relating to the Act.

ATSSC Statistical Overview

The ATSSC received a total of 54 formal requests under the Act. With one request carried over from last fiscal year, 44 of the 55 active requests were completed. Eleven requests were carried forward into the new fiscal year.

In addition to the formal requests, the ATSSC received two consultation requests from other government institutions. A copy of the Statistical Report is included in Appendix B.

In the last three reporting periods, the statistics indicate an increase of 500% for formal requests. Consultation requests received from other government institutions remain consistent from 2016-17 to this reporting period, varying between two and three requests per fiscal year. The overall volume of combined requests has increased by 410% from 11 requests in 2016-17 to 56 requests in this reporting period.

Disposition of Completed Requests

During this reporting period, the ATSSC completed 44 requests under the Act, 16 of which resulted in a partial release and five resulted in a full disclosure. No records existed in response to 15 requests and eight requests were abandoned.

Exemptions Invoked

The Privacy Act sets out specific exceptions to the right of access known as exemptions. Each exemption is intended to protect information relating to a particular public or private interest and form the only basis for refusing access to personal information under the Privacy Act. In the processing of requests, the exemptions invoked were sections 22(1)(b) (Law Enforcement and Investigations) which was applied in three cases, section 26 (personal information about another individual) was applied in 13 cases and section 27 (Solicitor-Client Privilege) was applied in nine cases. This is incompatible with the previous reporting year where the only exemption applied was section 26.

Additional statistics relating to the application of three new exemptions added to the Access to Information Act follow:

Extensions and Completion Time

Requests can be extended beyond the 30-day statutory time frame in three circumstances:

• the request is for a large number of records or necessitates a search through a large number of records (paragraph 15(a)(i) of the Act);
• consultations are necessary (paragraph 15(a)(ii) of the Act); or
• additional time is necessary for translation or conversion into another format.

During this reporting period, nine extensions were required. Five extensions were taken under 15(a)(i) (interference with operations) and four extensions were taken under 15(a)(ii) (consultation).

The ATSSC responded to 18 requests within one to 15 days, 15 requests within 16 to 30 days and seven requests within 31 to 60 days. A response was provided within 61 to 120 days for one request, within 121 to 180 days for one other request and the remaining two requests within 181 to 365 days. Forty of the 44 requests were completed within the statutory time frame. The remaining four requests did not meet the statutory deadline due to workload (three) and internal consultations (one).

Consultations

Along with processing requests received under the Act, the ATIP Office provides recommendations to other institutions regarding the release of records that concern the ATSSC. During this reporting period, the ATSSC received two consultation requests from other federal institutions.

Training Activities

To increase the knowledge and understanding of the Act across the ATSSC, training and awareness sessions were delivered by the ATIP Office. These sessions provided general information on the purpose and provisions of the Act, as well as the roles and responsibilities of employees and the ATIP Office. These awareness sessions were tailored to meet the specific needs of the units concerned.

Ongoing briefings occurred on an ad-hoc basis with our liaison officers. The liaison officers assist the ATIP Office in producing the requested records and providing insight into the subject matter of the requests.

During the reporting period, the ATIP Office delivered one awareness session and one open-house event to ATSSC employees. Approximately 50 individuals participated in these information activities which represents approximately ten percent of ATSSC employees.

Policies, Guidelines and Procedures

The ATSSC is guided by the Treasury Board of Canada Secretariat (TBS) suite of privacy policy and guidance instruments. During this reporting period, the ATSSC did not implement any new or revised institution-specific policies, guidelines or procedures.

Complaints

This reporting period, two complaints were filed with the Office of the Privacy Commissioner (OPC) against the ATSSC. The reasons for both complaints are the application of exemptions and the ATSSC’s failure to provide all responsive records. Both complaints are ongoing.

Monitoring

The monitoring of privacy requests was conducted through the case management system containing all relevant and necessary information to ensure compliance with the legislated requirements and reporting obligations. The system was updated as new requests were received or the status of a file was changed. Weekly meetings between the ATIP Manager and the ATIP Analyst as well as meetings between the ATIP Manager and the Director, Planning and Communications to discuss workload and priorities also assisted the ATSSC in meeting its statutory obligations.

Material Privacy Breaches

A privacy breach is deemed material if the breach involves sensitive personal information that could reasonably be expected to cause serious injury or harm to the individual, or involves a large number of affected individuals. During this reporting period, the ATSSC did not experience any material privacy breaches.

Privacy Impact Assessments

Privacy Impact Assessments (PIAs) are used to identify the potential privacy risks of new or redesigned federal government activities or services. They also help eliminate or reduce those risks to an acceptable level.

The ATIP Office provided advice to internal stakeholders in response to four cases concerning privacy practices associated with the redesign of activities or services. In all cases, it was recommended to conduct a full PIA.

During this reporting period, no PIAs were completed.

Disclosure of Personal Information pursuant to Paragraph 8(2)(m) of the Act

Subsection 8(2) of the Act stipulates under which circumstances personal information under the control of a government institution may be disclosed. Paragraph 8(2)(m) states that disclosure of personal information is permitted for any purpose where, in the opinion of the head of the institution, the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure, or the disclosure would clearly benefit the individual to whom the information relates. During this reporting period, no disclosures were made pursuant to paragraph 8(2)(m) of the Privacy Act.

Appendix A

SCHEDULE

Powers, duties and functions delegated pursuant to Section 73 of the Privacy Act and Privacy Regulations

Legend:

Appendix B

Statistical Report on the Privacy Act