Annual Report to Parliament on the Privacy Act 2023 to 2024

On this page

1. Introduction
2. Organizational structure
   2.1 About the Correctional Service of Canada
   2.2 The Access to Information and Privacy Division
   2.3 Initiatives and priorities
3. Delegation order
4. Performance for fiscal year 2023 to 2024
   4.1 Requests processed under the Privacy Act
   4.2 Disposition of requests
   4.3 Exemptions and exclusions
   4.4 Extensions
   4.5 Completion time
   4.6 Deemed refusals
   4.7 Outstanding requests
   4.8 Outstanding active complaints
   4.9 Consultations from other institutions and organizations
   4.10 Disclosures made pursuant to paragraph 8(2)(e) of the Privacy Act
   4.11 Informal requests
5. Training and awareness
6. Policies, guidelines and procedures
7. Summary of key issues
8. Material privacy breaches
9. Privacy impact assessments
10. Public interest disclosures
11. Monitoring compliance
12. Appendix A – Delegation order
13. Appendix B – Statistical report on the Privacy Act
14. Appendix C – 2023 to 2024 Supplemental Statistical Report on the Access to Information and Privacy Act

1.     Introduction

The Privacy Act (PA) protects the privacy of Canadian citizens and permanent residents against the unauthorized use and disclosure of personal information about them held by a government institution. It also provides individuals with a right of access to that information and the right to correct inaccurate personal information. In addition, the PA legislates how the government collects, stores, disposes of, uses and discloses personal information.

Section 72 of the PA requires that the Head of every federal government institution submits an Annual Report to Parliament on the administration of this Act over the fiscal year. The Minister of Public Safety, Democratic Institutions and Intergovernmental Affairs has delegated the administration of the PA, including the reporting of the Annual Report, to the Commissioner of the Correctional Service of Canada (CSC).

This report describes how CSC fulfilled compliance with the PA during the reporting fiscal year period of April 1, 2023, to March 31, 2024.

Our institution did not have any non-operational (“paper”) subsidiaries during this reporting period.

2.     Organizational structure

2.1 About the Correctional Service of Canada

The purpose of the federal correctional system, as defined in law, is to contribute to the maintenance of a just, peaceful and safe society by carrying out sentences for offenders sentenced to 2 years or more imposed by courts. This is done through the safe and humane custody and supervision of offenders, and by assisting the rehabilitation of offenders and their safe reintegration into the community as law-abiding citizens through the provision of programs in penitentiaries and in the community (Corrections and Conditional Release Act (CCRA), section 3).

CSC works closely with its Public Safety portfolio partners, including the Royal Canadian Mounted Police (RCMP), the Parole Board of Canada (PBC), the Canada Border Services Agency (CBSA), and the Canadian Security Intelligence Service (CSIS), in addition to oversight bodies including the Office of the Correctional Investigator (OCI).

2.2 The Access to Information and Privacy Division

The Access to Information and Privacy (ATIP) Division reports to the Director General of Rights, Redress and Resolution under the Policy Sector and has 8 units:

• Intake, Processing and Retention (ATIP Administrative Team)
• Access to Information Operations
• Privacy Operations
• Policy and Governance
• Disclosure and Law Enforcement
• ATIP Transformation (Backlog)
• Strategic Compliance, Reporting and Client Management
• ATIPXPress Migration

The Intake, Processing and Retention Unit (IPRU), is responsible for processing incoming requests, generating routine correspondence, tasking retrievals of records to Offices of the Primary Interest (OPIs), fostering the quality assurance of the ATIP process, preparing final release packages, responding to inquiries received on ATIP’s Toll Free number (1-844-757-8031), and providing general support to the office.

The Access to Information Operations team is responsible for reviewing records, conducting consultations with internal and external stakeholders, applying exemptions and exclusions, preparing release packages for requesters, and responding to complaints from the Office of the Information Commissioner (OIC).

The Privacy Operations team processes formal and informal requests under the PA, and responds to complaints from the Office of the Privacy Commissioner (OPC). This team has been organized into 3 teams:

1. The Privacy Urgent Team is responsible for responding to urgent formal privacy requests (for example documents requested by offenders/requesters or their representatives for upcoming parole hearings, court purposes or other legal proceedings where time is of the essence, and where the individual consents to release of their personal information)
2. The Strategic Privacy Response Team (SPRT) Team is responsible for reviewing offenders’ records related to health care, employment, admission and discharge, visits and correspondence, and education and training
3. The Privacy Complaint Team is responsible for responding to delay and access complaints received by the OPC and to any judicial review applications related to these complaints

The Policy and Governance Unit (PGU) acts as a single point of contact for privacy within CSC. It develops privacy policies, guidelines, tools and procedures to support ATIP requirements within CSC. In addition, the unit provides advice, guidance and support regarding ATIP legislation and related policies; promotes privacy awareness; and manages privacy breaches, and any improper collection, use and disclosure complaints filed with the OPC. The unit also oversees Privacy Impact Assessments (PIAs); reviews Memoranda of Understanding, Information Sharing Agreements, contracts, forms and Commissioner’s Directives; and delivers privacy training. The PGU is also responsible for the informal review of disciplinary, harassment and workplace violence reports for the department. This also includes complex privacy requests related to investigations as well as other sensitive files such as public interest disclosures.

The Disclosure and Law Enforcement Team (DLET) oversees releases under 8(2) of the PA, including files for litigation; dangerous offender applications and long-term supervision orders; other court purposes; and on-going investigations.

The ATIP Transformation Teams (Backlog Teams) is responsible for processing files from the ATIP Division’s backlog, including assessing areas of ATIP operations that could be streamlined to foster efficiencies in addressing current legacy requests and preventing future backlog of requests.

The Strategic Compliance, Reporting and Client Management Team (SCRCM) is responsible for collecting, analyzing and presenting information using various search engines and data tools to support ATIP in its reporting requirements (including the ATIP Annual Reports) and compliance rates. When fully operational, this team will also be responsible for managing the ATIP Division’s relationships with its clients and build on the existing work to promote and foster a culture of client satisfaction within CSC’s ATIP Division.

The ATIPXPress Migration Team is responsible to find or develop modern software solutions to assist the Rights Redress and Resolution Branch to increase productivity and efficiency through the use of new technological solutions.

In addition, each sector, region, institution, district, parole office and community correctional centre has an ATIP liaison who assists the national ATIP Division in administering its overall responsibilities.

During the 2023 to 2024 fiscal year, there were 92.8 employees dedicated to privacy activities as follows:

• 89 full-time employees
• 3.8 part-time and casual employees

CSC was not party to any service agreements under section 73.1 of the PA during this reporting period.

2.3    Initiatives and priorities

This section will outline CSC’s initiatives and priorities for ATIP, and unless otherwise noted is referring to both the ATIA and the PA, as well as both formal requests and informal requests such as information sharing with our public safety partners.

The highest proportion of ATIP requests are Privacy requests. These account for about 93% of the total workload, while Access requests represent about 7% of all ATIP requests.

CSC has launched many initiatives to address better position ATIP for the future. CSC developed an ambitious Strategic Action Plan with the following objectives:

• Gradually increase ATIA and PA compliance rates to attain the Treasury Board Secretariat (TBS) compliance standards
• Increase customer satisfaction
• Ensure production outpaces requests
• Minimize and eventually eliminate existing backlog requests
• Reduce the number and frequency of complaints submitted by requesters to both the OIC and OPC
• Sustain productivity to prevent future backlog of requests; and
• Take measures to become an employer of choice and a leader in the ATIP Community

CSC continues to implement this action plan, with focus on our resources and people, our infrastructure, our culture and practices and our results.

While our performance continues to improve, CSC continues to manage similar challenges to the previous year, which include:

• A persistent backlog: 6.3 million pages at the end of fiscal year 2023 to 2024. An average of 2 million pages (7,000 requests) received annually, with 1.8 million pages (7,243 requests) received in 2023 to 2024
• A high number of historical backlog files, some dating back to 2014
• An increase in requests for review of high risk and sensitive files (for example litigation files)
• A disproportionally low number of staff to respond to the demands; however significant hiring was completed and further staffing processes are underway
• Requests becoming increasingly more complex, multi-faceted, inter-connected (multiple requests submitted by same requestor – largely from offenders or their legal counsel)
• A limited interest on the part of offenders to use their Case Management Team as an immediate source of request for information on their files, which drives formal ATIP requests for information
• Technology challenges (for example Protected B server not suitable for Protected C or Secret documents and inmates with no access to internet)
• Staff turnover due to heavy workload, high stress and multiple competing priorities; and
• A shortage of ATIP experts broadly in the federal community thereby leading to competition with other employers and ATIP community both in public and private agencies

Despite these challenges, CSC has achieved many successes and has many initiatives underway, which include the following:

1.       Increase in production: Production outpaces incoming workload

In fiscal year 2023 to 2024, ATIP received a total of 1,849,204 pages and processed a total of 3,256,410 pages, including all request types (Access requests, Privacy requests and informal requests including information sharing). The continued productivity is a positive step towards eliminating backlog and improving CSC’s compliance rate.

The following table and graph will show CSC’s overall production, including formal and informal requests under both Acts, and including both pages processed, and pages resolved (abandoned, not relevant, etc.).

Source: ATIP Dashboard, as of April 2, 2024.

The following graph shows that during fiscal years 2021 to 2022, 2022 to 2023, and 2023 to 2024 the ATIP Division was successful in changing the previous trend and making significant progress in addressing the backlog.

CSC aims to increase and maintain efficiency in processing ATIP requests, eliminate the current backlog, avoid accumulating further legacy requests while improving CSC’s compliance rate. To achieve this goal, the ATIP Division production must continue to outpace the number of requests received.

2. Information sharing with partners

CSC’s DLET is responsible for engaging with Provincial and Territorial Crown Attorneys, Law Enforcement agencies and other public safety organizations to exchange information to foster public safety and protection of Canadians. This fiscal year, CSC’s DLET responded to 497 requests, including processing 521,243 pages, to requesting agencies. While these are not formal requests under the ATIA or the PA, they are an important function of ATIP to meet CSC’s disclosure and information sharing requirements with its criminal justice and law enforcement partners.

CSC has also been working with crown prosecutors across Canada to streamline information sharing and to ensure CSC has lawful authority to share personal information regarding dangerous offender and long-term supervision order cases. This includes preventing broad information sharing, especially where an individual has reached warrant expiry. The ultimate goal is to put a memorandum of understanding in place to clarify what information can be shared and when, and when a production order will be required.

3. Informal Sharing Pilot Project

In partnership with the National Headquarters (NHQ) Policy Sector (Rights, Redress and Resolution Branch); the Prairie Region hosted the Informal Sharing Pilot project at Stony Mountain Institution, Bowden Institution and Saskatchewan Penitentiary through a staggered implementation. The purpose of the pilot was to establish a preliminary working model for informal sharing at the site level, which was supported by a dedicated staff at each site who provided support to offenders on the process and tips on how to refine and clearly define their request.

This process was used as a measure to gauge the efficacy of current practices, develop recommendations for key business processes and evaluation tools to support the implementation of a long-term informal sharing solution and to inform the establishment of a digitization business model. The pilot process involved 5 specific file banks and was applied in cases in which the offender chose to engage their Case Management Team to collect the requested information in place of a formal ATIP request. Data analysis indicates 132 requests were submitted via the informal process, with 4,613 pages requested and 4,268 released. The quality of submissions and the overall number of pages relating to PA requests have also been impacted as there was significantly less requests for “full” file banks.

This pilot produced several recommendations and future considerations which CSC is currently exploring, such as the removal of full file bank checkboxes in the Request form, training for ATIP site staff and other correctional staff such as Parole Officers, development of a site intranet page for ATIP and Informal Sharing etc.

4. Pilot Project with the Department of Justice

In 2021 to 2022, the ATIP Division and CSC Legal Services Unit (LSU), in conjunction with the Department of Justice (DOJ) launched a Pilot Project entitled the Disclosure Review Process (DRP) 2.0 for litigation files. The DRP outlines which file banks can be processed by DOJ and which can be reviewed by DLET or PGU. This approach prevents “double-work” for example where files are reviewed more than once or where second reviews are unnecessary. DOJ lawyers are trained to recognize personal information and protect it if it is not relevant for court purposes. As such, there is no value added for them to consult the ATIP Division to confirm and identify personal information included in these files. However, DOJ consults the DLET to obtain expert advice on complex files involving security matters. In 2023 to 2024, nearly 54,000 pages have been reviewed by DOJ. The pilot is anticipated to end in fiscal year 2024 to 2025 and the DRP process will become formalized.

5. Transforming our inventory of backlog files

• This fiscal year, CSC took significant steps to address our inventory of older files (backlog), including:
• Generating 2,927 backlog notification letters to verify with requesters whether they are still interested in the requested files. Of those requests, 2,023 were resolved totaling 632,284 pages
• Resolving all requests where the requester (offender) has reached their Warrant Expiry (no longer under CSC supervision) and did not leave CSC with their updated contact information. This project allowed CSC to close 1,228 requests totaling 277,997 pages
• To reduce the number of Preventive Security (PS) paper files, the Transformation Team started targeting PS files for this project; and
• The Transformation Team reviewed and closed 20 video requests and an additional 22 were resolved. The total number of video minutes received was 2,219, and the team reviewed 2,219 minutes and released 1,864 minutes of video. CSC took 660 hours to review these videos

6.       Managing Protected C documents: “Protected C” pilot project

In collaboration with Security Intelligence Officers (SIO) from various sites, the Transformation

Team began a Preventive Security pilot project to modernize and streamline the process for processing Preventive Security requests. These files are largely Protected C and have been processed on paper in the past due to security limitations on CSC`s regular network. The process was streamlined to allow CSC to address Protected C documents digitally on appropriate equipment thus allowing CSC to share the redacted Protected C pages with the SIO via the secure SINET network. This has allowed CSC to significantly decrease the number of pages shared with the SIO for review to only the Protected C pages, saving them considerable time and allowing them to provide any additional security concerns to ATIP efficiently.

This streamlined process has eliminated the time and cost associated with sending printed copies back and forth between ATIP and the institutions. CSC has also updated the process of separating the Protected B and Protected C pages by creating a triaging process.

The creation of a secure space on the SINET network for ATIP specifically will also allow CSC to implement the document triaging from the onset of the retrieval phase. CSC engaged the SIOs and provided information on this new process as well as creating a database of contact information for each institution to provide requests to SIOs for review. To date, there are 34 files nearing completion for this project and the results have been positive for both ATIP and the SIOs. CSC anticipates implementing this process permanently by 2025.

7.       ATIPXPress migration

Similar to other federal departments, CSC has been using AccessPro Case Management (APCM), an ATIP software for the management of both internal and external ATIP requests since the mid-2000s. APCM will soon become a legacy application, as a result, there is a need to modernize. To this end, CSC is in the process of implementing the ATIPXPress software.

Following the procurement of licenses in November 2022, CSC created a project team to implement the ATIPXPress system at CSC. Given the size of the project, the ATIPXPress Migration Team designed a system architecture, built 2 environments to host the system, configured and tested ATIPXPress to meet the ATIP Division’s business requirements and developed a training program for its employees.

The project team has successfully configured and tested the system to meet the essential requirements of the ATIP Division. CSC will be proceeding with a pilot project launch of the ATIPXPress system at the end of the first quarter of fiscal year 2024 to 2025. The pilot project will include a small processing team that will address low-risk requests that are fast to process to ensure that the configuration and the system meet all of CSC’s business requirements. At the end of the second quarter, the project will onboard the entire ATIP office in a phased approach. It is worth noting that a short list of defects was submitted to the vendor and corrections are scheduled to be delivered in late summer of 2024. We are confident that the implementation of the new ATIPXPress in 2024 to 2025 will increase CSC’s ATIP division’s productivity and effectiveness to respond to all our requesters.

As an early adopter of the new Request Processing Software Solution, CSC has been very supportive in helping other departments migrate toward the new system. CSC has co-chaired a Community of Practice group to share best practices and lessons learned during the implementation with departments who are at the early stages of their project. CSC is also working closely with the vendor to assist them in developing and enhancing the system to better meet the needs of the ATIP community.

8. Other successes

• The ATIP Division has made progress in several other areas that are important to highlight:
• File room clean up: The IPRU team has made significant progress in reducing ATIP’s physical footprint by destroying old physical files that have met their retention date
• Despite limited resources, the Privacy Urgent Team is responding to court and judicial review requests on time. Similarly, the Complaints Team resolved many delay complaints
• Revised 176 template letters in preparation for ATIPXPress
• CSC continues to have a collaborative work relationship with the OPC and the OIC by meeting with their offices on a regular basis to identify priorities and ensure good communication
• Multiple teams (SPRT, Privacy Urgent, IPRU, Privacy Complaints) worked collaboratively to complete a high-profile request for judicial review that was due to court on September 2023. The teams managed to complete the request by July 2023

Goals and vision moving forward

• In the 2024 to 2025 fiscal year, the ATIP Division will turn its focus to:
• Increasing customer satisfaction
• Ensuring production continues to outpace requests
• Minimizing and eventually eliminating the existing backlog
• Sustaining productivity to prevent future backlogs
• Examining options to avoid future workload increases
• Researching and implementing digitization of services
• Providing training and awareness to prevent beaches of personal information and increase employees’ ATIP knowledge
• Complementing its previous work on resolving backlog requests by also focusing on current requests to better meet TBS compliance standards. In addition, we are refocusing our efforts on backlog requests to more recent late files. This is expected to result in fewer complaints, allowing CSC to focus even more resources on current files
• Adding a Director, ATIP Modernization, Disclosure and Law Enforcement position to support the management of the specialized teams in order to adequately increase its compliance with its statutory obligations under both the ATIA and PA
• In collaboration with Legal Services, CSC is drafting procedures for Faint Hope and judicial review applications
• DLET will work with LSU and litigators to create guidelines for the Disclosure Review Process
• Complete the migration of AccessPro platform to ATIPXPress to enhance ATIP’s capacity to respond to information requests by requesters; and
• Increasing capacity by creating a video and audio review team

3.     Delegation order

The Commissioner of CSC is responsible for the administration of the PA. The Minister delegates this authority to members of departmental senior management, including the ATIP Division Departmental Coordinator (ATIP Director), to carry out their powers, duties, and functions under the Act, in relation to ATIP requests. Certain authorities are delegated to positions in the ATIP Division at NHQ as shown in Appendix A of this report.

4.     Performance for fiscal year 2023 to 2024

4.1    Requests processed under the Privacy Act

In 2023 to 2024, CSC received 5,837 requests for personal information, an approximate 9% increase from the previous year. A total of 20,357 requests were carried over from the previous reporting years, totaling 26,194 requests requiring processing in 2023 to 2024. CSC responded to 9,542 requests for personal information, representing 36% of the total number of requests received and outstanding from the previous reporting period. Please refer to Appendix B for the Statistical Report.

This graph shows the total workload of privacy requests as a sum of requests received during the reporting period and requests outstanding from the previous reporting periods. The line illustrates the trend of files closed. As the graph outlines, there was a significant increase in the number of requests closed in 2023 to 2024 (almost triple the number of 2018 to 2019), which can be attributed to the work completed by the Transformation (Backlog) teams. This trend will continue as efficiencies continue to be implemented to address the long-standing backlog and the current workload.

4.2    Disposition of requests

Of the 9,542 requests completed during the 2023 to 2024 reporting period, 848 requests were full disclosures; 3,206 were partial disclosures; 6 were withheld in their entirety; no records existed for 683; 4,796 were abandoned by the requesters; and 3 were neither confirmed nor denied. In summary, 9% of requests were full disclosures and 34% were partial disclosures.

4.3    Exemptions and exclusions

During this reporting period, there were 6,937 exemptions applied and 1 exclusion applied. Most exemptions invoked by CSC were under 3 sections of the PA:

• Section 26 was applied in 3,730 cases (54%) to protect personal information of individuals
• Section 22 was applied in 1,829 cases (26%) to protect information relating to law enforcement and investigations; and
• Section 19 was applied in 1,120 cases (16%) to protect information obtained in confidence

A complete breakdown of the exemptions applied during this reporting period is as follows:

4.4    Extensions

A total of 4,135 extensions were required during this reporting period. Most of the extensions were taken due to a large volume of requests (4,128), and the others were due to a large volume of pages (7).

4.5    Completion time

During the reporting period, CSC completed 1,869 requests in 30 days or less; 739 requests between 31 and 60 days; 369 requests between 61 and 120 days; 254 requests between 121 and 180 days; and 6,311 requests in over 180 days.

4.6    Deemed refusals

Over the years, an increasing number of files have been closed beyond the legislated timeline however this has improved significantly in 2023 to 2024. During this fiscal year, 74% of the requests (7,017) were closed beyond the legislated timeline, representing a 20% decrease from last fiscal year (94%). The decreased proportion of requests closed beyond legislated timelines is largely attributed to the SPRT team processing low complexity files that deal with specific file banks. The ratio of files closed this year after 365 days and files closed before 365 days is 3 to 1; whereas last year, the ratio was 4.8 to 1. 

4.7    Outstanding requests

At the end of this fiscal year, 16,652 requests were outstanding and were carried over to the 2024 to 2025 reporting period. Of those requests, 2,862 were received during this fiscal year, whereas 2,424 were received during the previous fiscal year. Also:

• 126 outstanding requests were received during fiscal year 2015 to 2016 or earlier
• 210 in 2016 to 2017
• 1,094 in 2017 to 2018
• 2,384 in 2018 to 2019
• 2,649 in 2019 to 2020
• 2,298 in 2020 to 2021 and
• 2,605 in 2021 to 2022

Most of these requests, 15,776 in total, were beyond the legislated timelines as of March 31, 2024.

4.8    Outstanding active complaints

During this reporting period, CSC received a total of 178 complaints, a 15% increase in the number of complaints received during the last fiscal year (151 complaints in 2022 to 2023). Of those 178 complaints, 51 remained active and were carried over to the next fiscal year 2024 to 2025. Other complaints carried over to fiscal year 2024 to 2025 include:

• 16 complaints received during fiscal year 2022 to 2023
• 13 complaints received during fiscal year 2021 to 2022
• 7 complaints received in 2020 to 2021
• 4 complaints received in 2019 to 2020
• 3 complaints received in 2018 to 2019
• 2 complaints received in 2017 to 2018; and
• 1 complaint received in 2016 to 2017

A total of 97 complaints were therefore still active as of March 31, 2024. Finally, a total of 182 findings were issued.

Most privacy complaints received during this reporting period are related to delay/time limit complaints, followed by denial of access.

4.9    Consultations from other institutions and organizations

The ATIP Division’s workload involves responding to consultations in response to formal requests received by other institutions and organizations. CSC works closely with its partners in the Public Safety portfolio such as CBSA, RCMP, CSIS and PBC to respond to consultations in a timely fashion. CSC is consulted on such subjects as court cases, offender grievances, OCI matters, offender files, and deported individuals.

During the 2023 to 2024 reporting period, the ATIP Division received a total of 6 consultations from other government institutions and organizations and started the fiscal year 2023 to 2024 with an additional 10 consultations carried over from the previous fiscal year 2022 to 2023.

4.10  Disclosures made pursuant to paragraph 8(2)(e) of the Privacy Act

During the 2023 to 2024 fiscal year, 136 disclosures pursuant to paragraph 8(2)(e) of the PA were made by CSC.

4.11  Informal requests

During the reporting period, CSC received 611 informal requests. A total of 78 requests were carried over from the previous reporting years, totaling 689 informal requests requiring processing in 2023 to 2024. These include:

• releasing information through informal means where possible; and
• processing requests under subsection 8(2) of the PA, excluding paragraphs 8(2)(e) and (m)

A total of 609 informal requests were closed during 2023 to 2024, with a total of 436,935 pages released.

In addition, the PGU reviewed records informally for CSC, applying the Privacy Act as required, including disciplinary, harassment and workplace violence reports. The PGU processed 284 of these requests, totaling 21,082 pages reviewed and 15,605 pages released. The PGU also reviewed information sharing agreements/Memoranda of Understanding; contracts; Commissioner’s Directives; and forms. The PGU processed 181 of these requests, totaling 4,386 countable pages reviewed.

5.     Training and awareness

CSC offered several training and awareness sessions in this period. In general, the sessions covered both Access to Information and Privacy topics, with some variance based on the training participants.

The ATIP Division plays a fundamental role in developing and delivering training to employees at NHQ, Regional Headquarters and at the institutional level across Canada, as well as the ATIP staff, on ATIP related matters. The PGU also continues to provide advice, and address questions and concerns regarding training, policy and guidelines, and interpretations of the Acts through its generic email account. Through the use of these email accounts, CSC staff is provided with a single point of contact to increase their knowledge of the ATIP legislation and related policies.

During this fiscal year, the ATIP Division has focused on updating internal training materials for its staff and are preparing to increase its capacity to provide training and awareness on ATIP matters in the 2024 to 2025 fiscal year. During this reporting period, the ATIP Division was involved in informal information sessions, informal trainings, conferences, and awareness sessions. More specifically, the DLET team and LSU led an informal information session with the Correctional Operations and Programs Sector, regional ATIP staff, Regional Administrators, Communications and Executive Services and CSC’s Preventive Security Intelligence to explain DLET’s mandate and key activities in sharing information with provincial partners such as Crowns, police and with LSU in case of litigation. There were 60 participants that attended this session.

In addition, there were 6 presentations delivered by staff at the Prairie Region Regional Headquarters about ATIP awareness.

• 1 was provided to the Chiefs of Mental Health
• 1 to the Regional Psychology Department
• 1 to the Regional Psychiatric Centre
• 1 to Social Workers
• 1 to Grade 9 students, and
• 1 to Bowden Institution’s Mental Health Team

Staff in the Pacific Region also delivered 5 training sessions about general ATIP topics to management teams. On average, there were 10 to 15 people that attended the sessions.

6.     Policies, guidelines and procedures

Over the past year, the ATIP Division has continued to update internal guidelines and procedures as required, including:

• Ensuring the ATIP’s information on CSC’s intranet and internet sites are kept up-to-date
• Conducting statistical reporting in response to PA requests to ensure accuracy and improved coordination
• Continued work on the creation of an IT Server Search Process and Procedure to Respond to Privacy Act Requests for emails
• Participated in the Interdepartmental Meetings in relation to the modernization of the Privacy Act and provided feedback to The Privacy Act Modernization team

7.     Summary of key issues

Privacy complaints that CSC received during the reporting period included:

• Delays in the processing of formal Privacy Act requests or complaints for missing records
• The application of redactions to documents responsive to formal Privacy Act requests; and
• Privacy breaches caused by human error

Some complaints received by CSC during the reporting period that are still being analyzed are on the following subjects:

• Whether a disclosure that occurred in the 1990s was in line with the provisions of the Privacy Act; and
• Whether, in specific scenarios, paper documents are being properly handled

Other issues that were raised by privacy complaints were either deemed unfounded or were discontinued by the OPC.

As a result of the OPC’s investigations, recommendations, and the number of privacy complaints received (and carried over), CSC’s ATIP Division undertook several strategic measures to respond to complaints during this 2022 to 2023 period. For example:

• The ATIP Division continues to prioritize providing timely responses. The Division remains focused on building its human resource component and dedicating staff to reducing the backlog
• The ATIP Division worked closely with OPIs to resolve complaints and implement necessary corrective measures.
• The ATIP Division worked closely with the OPC on outstanding complaints and will continue to make this a priority in the new fiscal year
• The ATIP Division has continued to make use of a divisional complaints coordinator to work closely with the OPC to respond to formal complaints and inquiries using a single point of contact
• To resolve privacy complaints for missing records, the ATIP Division re-tasks the OPI to conduct new searches for missing records. Should new records be provided, the ATIP Division conducts a review of the records and discloses them accordingly
• During the reporting period, CSC published an article titled “Prevent privacy breaches at CSC” in its internal newsletter “This Week at CSC”. The article contained:
  • Information about the responsibilities of employees and managers related to the handling of personal information
  • Links to updated privacy awareness documents; and
  • Information about privacy breaches

There were no audits undertaken during this fiscal year.

CSC received 13 new complaints related to the improper collection, use and disclosure of personal information, 9 complaints were carried over from previous fiscal years. During this fiscal year, 6 complaints were closed and 15 were carried over to fiscal year 2023 to 2024, 11 of which were pending a finding from the OPC.

8.     Material privacy breaches

During the 2023 to2024 reporting period, the ATIP Division reported 20 material privacy breaches to the OPC and TBS. These breaches consisted of disclosures of personal information (1) due to theft or loss of hard copy records, (2) due to human error and (3) due to information being sent to outside parties.

Actions taken as a result of these breaches included:

• Meeting with and providing reminders to staff of their obligations regarding the protection of personal information
• Ensuring measures are taken to keep physical documents secure
• Applying caution when sending emails containing attachments and a list of recipients in the carbon copy field
• Updates to processes related to the transfer of documents to parole offices; and
• Consultations with IT on technical issues

CSC takes breaches of personal information seriously and continues to educate staff on the protection of personal information as follows:

• A continued and ongoing component of CSC training includes a comprehensive section on privacy breaches
• Staff are continuously reminded of their obligations to safeguard and protect personal information and adopt privacy-sensitive approaches in the workplace
• The ATIP Division continues to work with all liaisons and management regarding reporting requirements, implementing corrective measures and prevention
• The ATIP Division continues to monitor Situation Reports on a daily basis to ensure breaches are reported in accordance with TBS’s Guidelines for Privacy Breaches and CSC’s Breach Guidelines

9.     Privacy impact assessments

In accordance with TBS policy, CSC undertakes Privacy Impact Assessments (PIA) to ensure new and re-designed programs, initiatives and projects involving the collection, use, disclosure and retention of personal information are complying with the PA. CSC’s PIA website is located at the following hyperlink: Privacy impact assessments - Canada.ca.

No PIAs were completed during the 2023 to 2024 fiscal year.

CSC reported no PIAs during the 2022 to 2023 PA Annual Report, however there was 1 PIA was completed in 2022 to 2023 on the Electronic Statement of Observation Reports (eSOR). This application was implemented as a modern way for CSC staff within institutions and throughout the community offices to record Statement Observation Reports (SORs) in a web-based portal, but their use does not involve any new collection of personal information. Privacy-protective measures implemented for the eSOR application included auditing functions and the creation of multiple access levels that would allow the restriction of access to information on a need-to-know basis. One Personal Information Bank (Preventive Security, CSC PPU 065) was updated to reflect the implementation of this new application. CSC’s list of Personal Information Banks. are located at the following hyperlink: List of Personal Information Banks - Canada.ca

10.   Public interest disclosures

Paragraph 8(2)(m) of the PA permits the disclosure of personal information where the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure, or where the disclosure would clearly benefit the individual to whom the information relates.

During the 2023 to 2024 fiscal year, 19 disclosures pursuant to paragraph 8(2)(m) of the PA were made by CSC. Of the 19, 15 of the public interest disclosures were made to family members/next of kin or the executor of the estate following a death while in the care and custody of CSC. One disclosure was made to an inmate about an investigation that had occurred. One other disclosure was made to the College of Physicians. Two disclosures were made to the media related to CSC’s management of high-profile cases. The OPC was notified before any of these disclosures occurred, with the exception of 1 disclosure which the OPC was mistakenly not notified until the 2024 to 2025 reporting period.

11.   Monitoring compliance

The SCRCM produces weekly reports for senior management that outlines various outputs, including the number of requests received, closed and outstanding. The SCRCM also generates ad hoc reports to monitor and report on strategic areas or “quick wins” with the objective of identifying trends and measuring performance to increase compliance with legislated timeframes.

In addition, the IPRU actively monitors, triages, and clarifies incoming requests, regularly reporting to senior management any requirement to reassess priorities and redistribute workload to improve performance.

To monitor compliance with portions of the Privacy Act that are not related to formal requests, CSC shares draft copies of forms, contracts, agreements and arrangements with the PGU. A Senior Policy Advisor from the PGU reviews these documents to ensure the appropriate privacy protections have been included. Statistics related to the ATIP’s tasks are shared with ATIP’s Director and with the ATIP Director and the Rights, Redress and Resolutions’ Director General on a weekly basis.

CSC is limiting its inter-institutional consultation to only when required for the proper exercise of discretion, a process in which OPIs actively participate. The ATIP Division monitors statistics regarding extensions letters and no records responses on a weekly basis to ensure timely processing.

12.   Appendix A – Delegation order 

13.   Appendix B – Statistical report on the Privacy Act

Statistical Report on the Privacy Act

Name of institution: Correctional Service of Canada

Reporting period: 2023-04-01 to 2024-03-31

Section 1: Requests Under the Privacy Act

1.1          Number of requests received 

1.2          Channels of requests

Section 2: Informal Requests

2.1 Number of informal requests

2.2 Channels of informal requests

2.3 Completion time of informal requests

2.4 Pages released informally

Section 3: Requests closed during the reporting period

3.1 Disposition and completion time

3.2 Exemptions

3.3 Exclusions

3.4 Format of information released

3.5 Complexity

3.5.1 Relevant pages processed and disclosed for paper and e-record formats

3.5.2 Relevant pages processed by request disposition for paper and e-record formats by size of requests

3.5.3 Relevant minutes processed and disclosed for audio formats

3.5.4 Relevant minutes processed per request disposition for audio formats by size of requests

3.5.5 Relevant minutes processed and disclosed for video formats

3.5.6 Relevant minutes processed per request disposition for video formats by size of requests

3.5.7 Other complexities

3.6 Closed requests

3.61 Number of requests closed within legislated timelines 7,018

3.7 Deemed refusals

3.7.1 Reasons for not meeting legislated timelines

3.7.2 Request closed beyond legislated timelines (including any extension taken)

3.8 Requests for translation 

Section 4: Disclosures under Subsections 8(2) and 8(5)

Section 5: Requests for correction of personal information and notations

Section 6: Extensions

6.1 Reasons for extensions

6.2 Length of extensions

Section 7: Consultations Received from Other Institutions and Organizations

7.1 Consultations received from other Government of Canada institutions and other organizations

7.2 Recommendations and completion time for consultations received from other Government of Canada institutions

7.3 Recommendations and completion time for consultations received from other organizations outside the Government of Canada

Section 8: Completion time of consultations on Cabinet Confidences

8.1 Requests with Legal Services

8.2 Requests with Privy Council Office

Section 9: Complaints and investigations notices received

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

10.1 Privacy Impact Assessments

10.2 Institution-specific and Central Personal Information Banks

Section 11: Privacy breaches

11.1 Material privacy breaches reported

11.2 Non-material privacy breaches

Section 12: Resources Related to the Privacy Act

12.1 Allocated costs

12.2 Human resources

14.   Appendix C – 2023 to 2024 Supplemental Statistical Report on the Access to Information and Privacy Act

Supplemental Statistical Report on the Access to Information Act and the Privacy Act

Name of institution: Correctional Service of Canada

Reporting period: 2023-04-01 to 2024-03-31

Section 1: Open Requests and Complaints Under the Access to Information Act

1.1  Enter the number of open requests that are outstanding from previous reporting periods

1.1  Enter the number of open complaints with the Information Commissioner of Canada that are outstanding from previous reporting periods

Section 2: Open requests and complaints under the Privacy Act

2.1 Enter the number of open requests that are outstanding from previous reporting periods

2.2 Enter the number of open complaints with the Privacy Commissioner of Canada that are outstanding from previous reporting periods

Section 3: Social Insurance Number (SIN)

Section 4: Universal Access under the Privacy Act