2021 to 2022 Annual Report on the Privacy Act

Information contained in this publication or product may be reproduced, in part or in whole and by any means, for personal or public non-commercial purposes, without charge or further permission, unless otherwise specified. Commercial reproduction and distribution are prohibited except with written permission from the Financial Consumer Agency of Canada.

For more information, contact:

Financial Consumer Agency of Canada
427 Laurier Ave. West
Ottawa, ON K1R 1B9

www.canada.ca/en/financial-consumer-agency

ISSN 2816-9832

©His Majesty the King in Right of Canada, as represented by the Minister of Finance Canada, October 2022.

Aussi disponible en français sous le titre : 2021 à 2022 Rapport annuel sur la Loi sur la protection des renseignements personnels

Introduction

The Financial Consumer Agency of Canada (FCAC or the Agency) is pleased to submit to Parliament its annual report on the administration of the Privacy Act (the Act) for the reporting period commencing on April 1, 2021 and ending on March 31, 2022. This report was prepared and tabled in accordance with section 72 of the Act.

The Act which took effect on July 1, 1983, gives Canadian citizens, permanent residents, or any person and corporation present in Canada, a right to access information contained in government records, subject to certain specific and limited exceptions. This is an Act to extend the present laws of Canada that protect the privacy of individuals and that provide individuals with a right of access to personal information about themselves.

FCAC is a federal government agency that derives its mandate from the Financial Consumer Agency of Canada Act (FCAC Act). The FCAC Act outlines the Agency’s powers, duties and functions, and lists the federal laws and regulations under its supervision.

The FCAC Act identifies the objects of the Agency, which are listed in Sections 3(2) and 3(3) at the following link: https://laws-lois.justice.gc.ca/eng/acts/F-11.1/page-1.html#h-222474

FCAC’s mandate is to protect financial consumers. It achieves this in two primary ways: by supervising federally regulated financial entities and strengthening the financial literacy of Canadians.

In 2021–2022, the Agency renewed its vision and mission statements. The new vision statement, “To be a leader and innovator in financial consumer protection”, expresses how the Agency’s role as regulator and educator helps it protect financial consumers. The new mission statement, “Protect, Supervise, Educate”, embodies the Agency’s commitment to protect consumers of financial products and services, supervise federally regulated financial entities, and educate financial consumers to help them make informed decisions and improve their financial literacy. Together, these statements define FCAC’s purpose and identity, and affirm its focus on finding ways to improve outcomes for all Canadian financial consumers.

Organizational structure

The Agency’s Commissioner is the designated head of FCAC for the purpose of the Act. The Commissioner has delegated certain authorities under the Act to the positions of Assistant Commissioner, Corporate Services; Access to Information and Privacy (ATIP) Coordinator; and Senior ATIP Advisor. This serves to oversee the administration of the Act within the Agency and ensures compliance with the legislation. FCAC has one Senior ATIP Advisor and uses consultants as necessary to fulfill its obligations.

The ATIP Coordinator, is accountable for the development, coordination and implementation of effective Agency policies, guidelines, systems, and procedures relevant to the Act. This ensures that the Agency’s responsibilities and obligations are met and that there is appropriate processing and proper protection and that the disclosure of information are made in accordance with the Act.

The main activities of the ATIP Coordinator (Director, Finance and Administration, Corporate Services) include:

• processing requests received pursuant to the Act;
• developing and maintaining policies, procedures, and guidelines to ensure the FCAC comply with its responsibilities and obligations under the Act;
• promoting awareness of the Act to ensure FCAC’s responsiveness to the obligations imposed on the government;
• monitoring FCAC’s compliance with the Act, regulations and relevant procedures and policies;
• preparing annual reports to Parliament and other statutory reports, as well as other material that may be required by central agencies;
• representing FCAC in dealings with the Treasury Board of Canada Secretariat (TBS), the Office of the Privacy Commissioner of Canada (OPC) and other government departments and agencies regarding the application of the Act as it relates to the Agency; and
• supporting FCAC in meeting its commitments in relation to greater openness and transparency through proactive disclosure of information and the disclosure of information through informal avenues.

Reading room

The Agency has provided space for a reading room where the public may consult documents, at the following address:

• Enterprise Building - 427 Laurier Avenue West, 6th Floor Ottawa, Ontario

Delegation Order

The Delegation Order sets out the powers, duties, and functions for the administration of the Act that have been delegated by the Agency’s Commissioner as the head of the institution. The Delegation Order is attached as Appendix A.

Performance - Overview

The Statistical Report for 2021-2022 is attached as Appendix B.

Requests

During this reporting period, the Agency responded to 100% of the requests received by FCAC within the legislative timeline.

The Agency did not carry over any requests from the previous reporting period and received seven new requests, of which five were abandoned by the requester. Within this reporting period, all seven requests were completed within 1-15 days. The Agency did not require any extensions. Of the seven completed requests, 29% of the records were “all disclosed” and 71% were abandoned. There were no active complaints.

Consultations

During this reporting period, the Agency did not receive any consultation requests from other government institutions or organizations.

COVID-19

The Agency’s ability to fulfill its Privacy Act obligations and responsibilities during this reporting period were not affected by COVID-19. Therefore, no specific measures were implemented relating to COVID-19.

Training and awareness

During this reporting period, ATIP training was included as part of the FCAC new employee training session, and a coaching approach was applied with employees involved with the access to information and privacy procedures. As such, an individual’s responsibilities were explained, and the retrieval obligations and workflow were described, and their application monitored.

Policies and procedures

During this reporting period, the Agency applied the Act and TBS’ policies, procedures and guidelines for the processing of requests.

Complaints

During this reporting period, the Agency did not have any active complaints.

Monitoring compliance

FCAC monitors processing times by entering all actions and activities in an electronic database. A timeline for processing is established according to permissible legislated timeframes. This timeline and accompanying workflow were reviewed and adjusted in cases where extensions were required.

Material privacy breaches

No material privacy breaches occurred during this reporting period.

Privacy impact assessments

During the reporting period, the Agency completed one privacy impact assessment (PIA) and had no new data-sharing activities that took place.

The PIA which was completed related to the COVID-19 Vaccination Attestation for FCAC employees. Please refer to the following link for access to the PIA - Privacy impact assessments: Financial Consumer Agency of Canada - Canada.ca

Public interest disclosures

During this reporting period, the Agency did not make any disclosures of personal information pursuant to paragraph 8(2)(m) of the Act.

Costs

During this reporting period, the costs incurred relating to the application of the Privacy Act totaled $57,243.

Appendix A: Delegation Order

Privacy Act Delegation Order

The Commissioner of the Financial Consumer Agency of Canada, pursuant to section 73 of the Privacy Act, hereby designates the following persons to exercise or perform the powers, duties or functions of the head of the institution set out in the sections of the act indicated beside each position.

Original signed by

Judith Robertson

Commissioner, Financial Consumer Agency of Canada

Date: June 16, 2020

Appendix B: Statistical Report on the Privacy Act

Name of institution: Financial Consumer Agency of Canada

Reporting period: 2021-04-01 to 2022-03-31

Section 1: Requests Under the Privacy Act

Section 2: Informal requests 

Section 3: Requests closed during the reporting period 

3.5 Complexity

3.6 Closed requests

3.7 Deemed refusals

Section 4: Disclosures under subsections 8(2) and 8(5)

Section 5: Requests for correction of personal information and notations

Section 6: Extensions

Section 7: Consultations received from other institutions and organizations

Section 8: Completion time of consultations on cabinet confidences

Section 9: Complaints and investigations notices received

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

Section 11: Privacy Breaches

Section 12: Resources related to the Privacy Act

Note: Enter values to three decimal places.