2019-2020 Annual Report to Parliament on the Administration of the Access to Information Act and the Privacy Act 

Table of Contents

• Executive summary
  • IRCC ATIP requests at a glance
  • IRCC ATIP growth
  • Access to information and privacy pages reviewed
  • ATIP Complaint Volumes: 2014-2015 to 2019-2020
  • Format of the report
• Section 1: General Information
  • About Immigration Refugees and Citizenship Canada
  • Delegation order
  • Organizational structure
  • Training and awareness
• Section 2: Report on the Administration of the Access to Information Act
  • Introduction
  • Purpose of the Act
  • Service Agreements
• Highlights of the statistical report for 2019-2020
  • Requests received and completed
  • Pages processed
  • Sources of requests under the Access to Information Act
  • Informal access requests under the Access to Information Act
  • Exemptions
  • Exclusions
  • Consultations
  • Extensions
  • Completion times
  • Complaints
  • Audits
  • Appeal to the Federal Court
  • Reporting on the impact of COVID-19
• Reporting on access to information fees for the purposes of the Service Fees Act
• Monitoring compliance
• Policies, guidelines, procedures and initiatives
• Section 3: Report on the Administration of the Privacy Act
  • Introduction
  • Purpose of the Act
  • Service Agreements
• Highlights of the statistical report for 2019-2020
  • Requests received and completed
  • Pages processed
  • Exemptions
  • Exclusions
  • Consultations
  • Extensions
  • Completion times
  • Complaints
  • Audits
  • Appeal to the Federal Court
  • Reporting on the impact of COVID-19
  • Privacy Impact Assessments
  • Disclosure of personal information under paragraphs 8(2)(e) and 8(2)(m)
  • Material privacy breaches
  • Monitoring compliance
• Policies, guidelines, procedures and initiatives
• Annex A: Signed Delegation
• Annex B: Delegation Order under the Access to Information Act
• Annex C: Delegation Order under the Privacy Act
• Annex D: Statistical Report on the Access to Information Act
• Annex E: Statistical Report on the Privacy Act
• Annex F: Supplemental Statistical Report on the Access to Information Act
• Annex G: Supplemental Statistical Report on the Privacy Act

Executive summary

Through its key lines of business, Immigration Refugees and Citizenship Canada (IRCC) interacts with millions of individuals every year, including those seeking temporary or permanent residence into Canada and subsequently settling into Canadian society, and those pursuing Canadian citizenship. The Department is also responsible for passport services in support of individuals seeking to obtain or renew a Canadian passport or other travel document such as a certificate of identity or a refugee travel document.

IRCC manages a considerable volume of personal information as part of delivering these programs and services, and remains committed to ensuring that the personal information held by IRCC is safeguarded, used and disclosed responsibly. During the reporting period, commencing April 1, 2019, and ending March 31, 2020, IRCC completed 5 Privacy Impact Assessments (PIAs) exploring privacy risks in new departmental initiatives. In addition, the Access to Information and Privacy (ATIP) Division provided privacy policy advice on over 639 requests (37% more than the year previous) concerning information sharing, consent, surveys, contracts, privacy notices, and other matters.

In recent years, the Department has experienced significant increases in some of its most important lines of business as many around the world seek to enter Canada temporarily or permanently, and as increasing numbers of eligible permanent residents seek to become Canadian citizens. IRCC’s challenge is to effectively manage these requests to enter and remain in Canada, while working with stakeholders to ensure that newcomers have the best opportunities to succeed and that the Canadian economy and society reap the benefits of newcomer success.

Increases in volume in other IRCC business lines are correlated with significant increases in ATIP request volumes. In 2019-2020, IRCC received 50% of all ATIP requests submitted to federal government institutions, and has experienced unprecedented growth in the number of ATIP requests over the past several years.

IRCC is unique in that most of the requests it receives under the Access to Information Act are for the personal information of its clients. This is because the majority of its requests concern IRCC clients who are foreign nationals that rely on representatives to submit an Access to Information Act request on their behalf and with their consent to seek information about their IRCC immigration file.

To manage these volumes effectively, the ATIP Division within IRCC has two teams that process ATIP requests:

• One team manages Access to Information Act requests for corporate records, and personal information requests concerning IRCC employees. This team’s ATIP request process involves branch ATIP Liaison Officers to coordinate the retrieval of records and identification of release sensitivities responsive to ATIP requests.
• The other team manages all ATIP requests that relate to IRCC client files.

The Department is committed to ensuring that its requesters receive timely access to the records they request, and has undertaken a number of initiatives to improve its performance and address a backlog of requests. Despite a 36 per cent increase over the previous fiscal year, IRCC managed to close 26 per cent more requests than the previous fiscal year.

IRCC ATIP requests at a glance

Text version: IRCC ATIP requests at a glance

• 50% of all ATIP requests in federal government institutions were submitted to IRCC in 2019/20
• 36% increase in requests (+34K) in 2019/2020 from 2018/2019
• 178% growth in requests (+85K) since 2014/2015

IRCC ATIP growth

Text version: IRCC ATIP growth

Year	Percent annual growth	ATIP request volumes	Percent growth since 2014-2015
2014-2015	N/A	47,800	N/A
2015-2016	+19%	57,000	+45%
2016-2017	+11%	63,300	+61%
2017-2018	+23%	77,600	+98%
2018-2019	+26%	98,000	+150%
2019-2020	+36%	132,891	+178%

Access to information and privacy pages reviewed

Text version: Access to information and privacy pages reviewed

Year	Pages reviewed
2019-2020	8,772,174
2018-2019	7,255,790
2017-2018	4,548,653
2016-2017	3,579,498
2015-2016	2,923,225

As the number of requests continues to increase, the volume of pages continues to rise also. In 2019-2020, IRCC processed 8,772,174 pages.

This is a 21 per cent increase from last fiscal year which equates to over 1.5 million more pages that the ATIP Division reviewed.

ATIP Complaint Volumes: 2014-2015 to 2019-2020

Text version: Complaint Volumes: 2013-2014 to 2019-2020

Year	Complaints received	Complaints closed
2014-2015	265	333
2015-2016	199	127
2016-2017	140	204
2017-2018	227	201
2018-2019	555	594
2019-2020	4,269	3,494

As evidenced in this report, numerous efforts have been made by IRCC to strengthen its ATIP program, including stabilizing its workforce, refining procedures and tools, improved stakeholder engagement, and community outreach. Transformation of the ATIP program will be a continued theme in 2020-2021, and IRCC will continue to support the broader ATIP community through participation in discussions concerning reforms of the Acts, ATIP community software needs, and other related Government of Canada initiatives.

Format of the report

As described in the executive summary, IRCC is unique in that most of its ATIP requests relate to requests for personal information, which creates a stronger relationship between the two Acts at IRCC than at other departments. The ATIP Division within the Corporate Management Sector, responsible for administering the ATIP program at IRCC, is organized such that each team supports or administers both Acts. The Department has prepared a single, integrated report that outlines IRCC’s accomplishments in carrying out its ATIP responsibilities during the 2019-2020 reporting period.

The document has been divided into 3 sections:

• The first section describes the mandate of the department, the organizational structure, and training and awareness efforts supporting the administration of both Acts
• The second section reports on the administration of the Access to Information Act
• The third section reports on the administration of the Privacy Act

Section 1: General Information

About Immigration, Refugees and Citizenship Canada

IRCC selects and welcomes, as permanent and temporary residents, foreign nationals whose skills contribute to Canadian prosperity and cultural fabric. It also reunites family members.

The Department maintains Canada's humanitarian tradition by welcoming refugees and other people in need of protection, thereby upholding its international obligations and reputation.

IRCC, in collaboration with its partners, conducts the screening of potential permanent and temporary residents to protect the health, safety and security of Canadians.

The Department builds a stronger Canada by helping all newcomers settle and integrate into Canadian society and the economy, and by encouraging, granting and providing proof of Canadian citizenship.

Lastly, IRCC is also responsible for the issuance and control of Canadian passports and other documents that facilitate the travel of Canadian citizens, Permanent residents and Temporary residents.

IRCC’s mandate comes from the Department of Citizenship and Immigration Act. The Minister of IRCC is responsible for the Citizenship Act of 1977 and shares responsibility with the Minister of Public Safety for the Immigration and Refugee Protection Act (IRPA). Jurisdiction over immigration is shared between the federal and the provincial and territorial governments under section 95 of the Constitution Act of 1867.

Effective July 2, 2013, primary responsibility for Passport Canada and the administration of the Canadian Passport Order and the Order Respecting the Issuance of Diplomatic and Special Passports moved from the Department of Foreign Affairs and International Trade to Immigration, Refugees, and Citizenship Canada.

Delegation order

The Minister of Immigration, Refugees and Citizenship is responsible for dealing with requests under the Access to Information Act and the Privacy Act. The Minister delegates his authority to members of departmental senior management, including the ATIP Departmental Coordinator (ATIP Director), to carry out his powers, duties, or functions under the Acts, in relation to ATIP requests. Certain authorities are delegated to particular positions in the ATIP Division at National Headquarters as shown in Annex B and Annex C of this report.

Organizational structure

The ATIP Division is part of the ATIP & Accountability Branch, which is overseen by a Director General, and is situated in the Corporate Management Sector at IRCC. The Division administers the Access to Information Act and the Privacy Act for IRCC and is led by an Executive Director, who acts as the ATIP Coordinator for the Department. Four units carry out the Division’s work in addition to 35 Liaison Officers who are responsible for coordinating the ATIP activities of IRCC branches. Each unit has shared responsibilities for the administration of both the Access to Information Act and the Privacy Act.

Structure of the ATIP Division at IRCC

Text version: Structure of the ATIP Division at IRCC

ATIP Operations
Carries out administrative functions and processes the bulk of ATIP requests for client records
(85 Employees)

ATIP Corporate Records, Complaints and Informals
Processes complex and sensitive ATIP requests, manages ATIP request-related complaints, and prepares packages of previously access to information requests
(21 Employees)

ATIP Privacy, Policy and Governance
Develops ATIP policies, provides ATIP advice, guidance and support, delivers ATIP training and promotes awareness
(10 Employees)

Technology, Transformation, and Analytics
Conducts statistical analysis and trend monitoring, and leads ATIP technology and transformation efforts
(3 Employees)

ATIP Executive Director’s Office
(3 Employees)

Training and awareness

Through its training delivery and awareness activities, IRCC continues to work towards developing an institution-wide culture of respect for access to information alongside a strong commitment to increased privacy vigilance.

During the reporting period, 2,858 employees participated in ATIP Division training sessions, representing a 12 per cent decrease from the previous fiscal year.

Access to information and privacy training

The ATIP Division offers three core training courses that address both access to information and privacy requirements:

1. Understanding and Managing ATIP Requests is designed to provide a greater understanding of the roles and responsibilities of the ATIP Division, the Liaison Officers and other departmental officials in the processing of an ATIP request. A total of 103 employees attended 11 sessions.
2. ATIP Training for Middle Managers and Executives provides an overview of key ATIP principles and practices, and a greater understanding of the roles and responsibilities of managers and employees. A total of 24 managers and executives attended 3 sessions.
3. Protecting and Giving Access to Information at IRCC is a mandatory online course for all employees. It provides a brief overview of key ATIP principles and practices and fosters a greater understanding of the roles and responsibilities of all employees. During the year, 1,168 employees took the online training session.

The ATIP Division also provides ad hoc and tailored training sessions and workshop presentations to reinforce and increase knowledge and understanding of access to information, privacy and personal information. These sessions are independent of mandatory courses and are given by request in response to a group’s specific needs. A total of 413 employees were provided tailored ATIP training over 50 sessions last fiscal year.

Protect, Secure, and Manage Information

IRCC formalized mandatory training for new employees that includes security, information management and ATIP considerations. A total of 597 employees attended 40 sessions.

Privacy-only training

Privacy breach training

Privacy breach training sessions are designed to provide a greater understanding of what a privacy breach is, the roles and responsibilities of employees and awareness of emerging trends in privacy breaches.

These sessions are focused not only on how to contain a breach, but also how to evaluate it, notify internal and external stakeholders, mitigate the impact and reduce the probability of a recurrence. They provide an opportunity for program areas to ask questions pertaining to real scenarios and receive practical advice from the ATIP staff.

A total of 467 employees received privacy breach training in 2019-2020 over 38 sessions.

Tailored privacy training

Tailored privacy training sessions are designed to provide a more in-depth look at specific privacy policy issues, such as information sharing or privacy impact assessments.

A total of 86 employees received tailored privacy training over 7 sessions.

IRCC ATIP Event

For the past three years, IRCC has observed Data Privacy Day in January, as well as its own IRCC Privacy Day in the fall.

This year, the two celebrations were combined into a single event that spanned January 27, 2020 to January 31, 2020 to bolster privacy awareness and to champion both the protection of personal information and the right of access to information at IRCC.

The week was opened by the Information Commissioner of Canada, who spoke about the importance of access to information and privacy to Canadian democracy. This was followed by key presenters from the Office of the Privacy Commissioner (OPC) who spoke about the importance of privacy in a rapidly changing digital world.

In addition, numerous training sessions and workshops were offered during the week, including two hackathons related to ATIP requests and privacy management policy, a presentation on youth and privacy (developed by the OPC), and a paranormal privacy detective game.

The event was promoted on Today@IRCC, the Department’s internal electronic newsletter.

Section 2: Report on the Administration of the Access to Information Act

Introduction

Section 94 of the Access to Information Act, and section 20 of the Service Fees Act require that the head of every federal government institution submit an annual report to Parliament on the administration of the Act during the fiscal year.

IRCC is pleased to present to Parliament its annual report on the administration of the Access to Information Act. The report describes the activities that support compliance with the Act for the fiscal year commencing April 1, 2019, and ending March 31, 2020.

Purpose of the Act

The purpose of the Access to Information Act is to enhance the accountability and transparency of federal institutions by providing a right of access to records under the control of a government institution. The Act maintains that government information should be available to the public that necessary exceptions to the right of access should be limited and specific, and that decisions on the disclosure of government information should be reviewed independently of the government.

It also sets out requirements for the proactive publication of records.

Service Agreements

IRCC had no service agreements under section 96 of the Access to Information Act.

Highlights of the statistical report for 2019-2020

Requests received and completed

Text version: Access to information requests received and completed

Year	Requests received	Requests completed
2013-2014	29,281	27,407
2014-2015	34,066	33,524
2015-2016	41,660	40,107
2016-2017	50,728	48,733
2017-2018	64,234	59,021
2018-2019	82,387	83,895
2019-2020	116,928	111,593

IRCC continues to receive more Access to Information Act requests than any other federal government institution. Specifically, the Department received a total of 116,928 requests in the 2019-2020 reporting period, which represents an increase of 42 per cent from the previous year. Due to the growth of requests, the compliance rate was 64.39 per cent for the reporting period.

The majority of Access to Information Act requests received were for information relating to client records.

Pages processed

IRCC processed 7,787,738 pages during the 2019-2020 reporting period, an increase of 29 per cent over the previous fiscal year.

Sources of requests under the Access to Information Act

The business sector (mainly immigration lawyers and consultants) remains the largest source of requests, accounting for 59.7 per cent of all requests. The general public accounts for 26.2 per cent, and media, organizations and academia comprise close to 8 per cent of requests. The remaining 6.1 per cent represents requesters who decline to identify themselves.

Sources of access to information requests

Sources of requests under the Access to Information Act

Text version: Sources of access to information requests

Sources	Requests
Business	69,839
Public	30,675
Media, academia and organizations	9,230
Decline to identify	7,184

Informal access requests under the Access to Information Act

IRCC posts summaries of completed access to information requests pertaining to corporate records on the Open Government portal. In 2019-2020, IRCC closed 1,077 informal requests (copies of previously released requests).

Exemptions

The Department invoked some exemptions on 76,564 requests (68.6 per cent), and all information was provided in 29,619 of its requests (26.6 per cent). The remaining 5,382 requests (1.2 per cent) were transferred, abandoned, no record existed, or the Department could neither confirm nor deny the existence of these records, as doing so could reveal information that is protected under the Act.

The majority of exemptions invoked by IRCC fell under three sections of the Act:

• Subsection 19(1), which protects personal information, was used in 49,212 cases (64 per cent);
• Section 17, which covers information the disclosure of which could reasonably be expected to threaten the safety of individuals, was used in 32,935 cases (43 per cent).
• Subsection 16(1), which addresses law enforcement and criminal investigations, was used in 21,658 cases (28 per cent); and

More than one section can be applied to a specific request.

Exclusions

The Access to Information Act does not apply to records that are already available to the public (section 68) and confidences of the Queen’s Privy Council (section 69). IRCC excluded records based on section 68 in 34 instances, and on section 69 in 29 instances.

Consultations

Other federal government institutions consulted IRCC for records related to IRCC in 318 cases under the Access to Information Act, and IRCC was able to respond to 77 per cent of those consultations within 30 days.

Extensions

Section 9 of the Access to Information Act permits the statutory time limits to be extended if consultations are necessary or if the request is for a large volume of records, and processing it within the original time limit would unreasonably interfere with the operations of the Department.

IRCC invoked a total of 7,587 extensions during the 2019-2020 reporting period. Extensions were required in 3,381 instances when IRCC consulted with other federal institutions prior to responding. Extensions were required in 4,191 instances to search through a large volume of records or to respond to the influx of requests, or both, which interfered with operations. The Department also invoked 9 extensions to conduct third-party notifications.

Completion times

Requests under the Access to Information Act

Text version: Completion times

Completion Time	Percentage of requests
30 days or less	51%
31 to 60 days	32%
61 to 120 days	11%
121 days or more	6%

Complaints

Complaint volumes: 2014-2015 to 2019-2020

Text version: Complaint Volumes: 2013-2014 to 2019-2020

Year	Complaints received	Complaints closed
2014-2015	265	333
2015-2016	199	127
2016-2017	140	204
2017-2018	227	201
2018-2019	555	594
2019-2020	4,220	3,450

During the 2019-2020 reporting period, the Department was notified of 4,220 access complaints received by the Office of the Information Commissioner (OIC). This represents 3.8 per cent of all requests completed during this period. The majority of complaints were related to extensions and delays.

During the reporting period, ATIP processed and closed 3,450 complaint investigations. Of these, 68 complaints were abandoned, discontinued, unsubstantiated, and 30 were not well founded. The remaining 3,332 complaints were resolved to the satisfaction of the requester and 20 were well founded. Please note, that these numbers include files closed without a Report of Findings from the OIC and therefore may not match the numbers in the statistical report.

Key complaint issues

In fiscal year 2019-2020, IRCC received more than 700% increase in ATIP complaints, and more complaints than all of the federal government combined ATIA complaints in 2018-2019.

The majority of the complaints (98%) were related to ATIP requests for immigration client files. And 65% of the complaints were delay or extension complaints submitted by a single requester—none of which were well founded.

Actions taken

The increase in complaints forced IRCC ATIP and the OIC to find new ways to work together to ensure that both offices managed complaints efficiently and effectively. The format of the complaints team communications were changed to allow for emails that address multiple complaints at one time rather than individual email for each complaint.

The increase in complaints led to an expansion of the complaints team and forced the complaints team to adopt a more siloed work strategy between team members.

Audits

No audits were concluded during the fiscal year.

Appeal to the Federal Court

There were no appeals to the Federal Court filed against IRCC regarding the Access to Information Act during the 2019-2020 reporting period.

Reporting on the impact of COVID-19

From April 1, 2019 to March 13, 2020, IRCC received 113,381 Access to Information Act requests. From March 14, 2020 to March 31, 2020 (during the lockdown), IRCC received 3,547 access to information requests, which is almost 40% fewer requests than anticipated.

It should be noted that despite the lockdown, IRCC still received more access to information requests in 2 weeks than 85% of federal institutions received in all of 2018-2019, and more than any single institution received in all of 2018-2019 except for the Royal Mounted Canadian Police and the Canada Border Services Agency. See ANNEX F: Supplemental Statistical Report on the Access to Information Act for reference.

As a result of the lockdown the ATIP Division had to adjust processes and procedures to facilitate employees working from home, as well as work closely with our information technology services to equip employees with sufficient remote capacity. IRCC continues to function well, and has been successful at maintaining similar response rates on access to information requests and consultations.

Senior management has been very supportive and continues to highlight the importance of employee well-being while we strive to continue to deliver the quality and timely services to our clients.

Reporting on access to information fees for the purposes of the Service Fees Act

The Service Fees Act requires a responsible authority to report annually to Parliament on the fees collected by the institution.

With respect to fees collected under the Access to Information Act, the information below is reported in accordance with the requirements of section 20 of the Service Fees Act.

• Enabling authority: Access to Information Act
• Fee amount: $5.00 application fee for access to information requests
• Total revenue: IRCC collected $582,080 on 116,416 requests
• Fees waived: In accordance with the Interim Directive on the Administration of the Access to Information Act, issued on May 5, 2016, IRCC waives all fees prescribed by the Act and Regulations, other than the $5.00 application fee set out in paragraph 7(1)(a) of the Regulations. For 2019-2020, IRCC waived $1,845.00
• Cost of operating the program: $5,804,708

Monitoring compliance

The ATIP Division has established internal procedures to help facilitate the timely and efficient processing and monitoring of ATIP requests.

• As necessary, the complaints team advises ATIP management on systemic issues identified as a result of complaint resolution.
• On a daily basis, statistical reports are distributed to ATIP management to help manage the workflow.
• On a weekly basis, different statistical reports are distributed to Senior Management:
  • A snapshot report that looks at ATIP request volumes received and closed, on time compliance rates, etc.
  • A summary of upcoming access to information requests soon to be disclosed.
  • A progress report on late ATIP requests organized by priority.
  • A summary of requests related to COVID-19.
• On a monthly basis, different statistical reports are distributed to Senior Management:
  • A report on each sector’s compliance with internal standards for providing responsive records to the ATIP Division is shared with Senior Management.
  • A report on ATIP requests that have been completed over the past month.
• On a quarterly basis, the Intake Watch Placemat is distributed to IRCC programs, the Client Experience Branch and Senior Management to demonstrate correlations between immigration program initiatives and corresponding changes in ATIP request volumes.

It is important to note that no personal information is disclosed in these reports.

Policies, guidelines, procedures and initiatives

IRCC undertook several projects related to the improvement of its ATIA requests processes which affect the administration of requests under the Access to Information Act:

• Some ATIP Division employees were cross-trained on various functions and temporarily reassigned to a special project focused on substantially reducing the older ATIP request backlog. This also allowed management to temporarily reassign employees to the areas where the processing need was greatest.
• The management of ATIA request complaints was updated based on recommendations from the 2018-2019 audit of ATIP management, as well as consultation with the OIC to facilitate the review of large volumes of complaints in a timely manner.
• Presented “Building Bridges: Creating an effective relationship with an Ombudsmen office” at the Canadian Association of Access and Privacy conference in November 2019 on best practices for complaint management based on our evolution since 2017-2018.
• Ongoing collaboration with key IRCC stakeholders to assess and potentially mitigate the impacts of changes to IRCC programs on ATIP request volumes.
• Further to the LEAN review completed in 2017-2018, a new ATIP request retrieval process was successfully implemented in one sector in 2018-2019 and rolled out to more of the Department in 2019-2020. The new process reduced turnaround time for providing records responsive to an ATIP request, and will be rolled out to the remainder of the Department in 2020-2021.
• Participated in ATIP community discussions concerning Bill C-58, and ATIP software needs.
• Engaged internal stakeholders on implementing Bill C-58 open government requirements.

Section 3: Report on the Administration of the Privacy Act

Introduction

Section 72 of the Privacy Act require that the head of every federal government institution submit an annual report to Parliament on the administration of the Act during the fiscal year.

IRCC is pleased to present to Parliament its annual report on the administration of the Privacy Act. The report describes the activities that support compliance with the Act for the fiscal year commencing April 1, 2019, and ending March 31, 2020.

Purpose of the Act

The purpose of the Privacy Act is to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution and to provide individuals with a right of access to that information. The Act protects an individual’s privacy by preventing others from having unlawful access to personal information. It also permits an individual specific rights regarding the collection, use and disclosure of this information.

Service Agreements

IRCC had no service agreements under section 73.1 of the Privacy Act.

IRCC remains one of the most accessed federal institutions, receiving a total of 15,963 requests submitted under the Privacy Act in the 2019-2020 reporting period. This represents an increase of 1.9 per cent from the previous year. Given the volume of Privacy requests to process, the Department’s compliance rate was 54.79 per cent.

The majority of Privacy Act requests received were for information relating to client records.

Highlights of the statistical report for 2019-2020

Privacy requests received and completed

Text version: Access to information requests received and completed

Year	Requests received	Requests completed
2013-2014	9,961	9,225
2014-2015	13,778	13,082
2015-2016	15,292	15,077
2016-2017	12,605	11,808
2017-2018	13,368	12,698
2018-2019	15,655	16,846
2019-2020	15,963	15,349

Pages processed

IRCC processed 984,436 pages during the 2019-2020 reporting period, a decrease of 18 per cent over the previous fiscal year.

Exemptions

The Department invoked some exemptions on 8,635 requests (56.3 per cent), and all information was provided in 3,142 requests (20.5 per cent). The remaining 3,572 requests (23.3 per cent) were either transferred, abandoned or no record existed.

The majority of exemptions invoked by IRCC fell under three sections of the Act:

• Section 26, which protects personal information, was used in 5,784 cases (67 per cent);
• Section 21, which covers international relations, defense and subversive activities, was used in 4,530 cases (52 per cent); and
• Subparagraph 22(1)(b), which addresses law enforcement and criminal investigations, was used in 2,213 cases (27 per cent).

More than one section can be applied to a specific request.

Exclusions

The Privacy Act does not apply to records that are already available to the public (section 69) and confidences of the Queen’s Privy Council (section 70). IRCC did not apply any exclusions under the Privacy Act during the reporting period.

Consultations

Other federal government institutions consulted IRCC for records related to IRCC in 47 cases under the Privacy Act, and was able to respond to 87 per cent of those consultations within 30 days.

Extensions

Section 15 of the Privacy Act permits the statutory time limits to be extended if consultations are necessary, if translation is required or if the request is for a large volume of records and processing it within the original time limit would unreasonably interfere with the operations of the Department.

IRCC invoked a total of 664 extensions during the 2019-2020 reporting period. Of these, 30 were deemed necessary as IRCC needed to consult with other federal institutions prior to responding. Extensions were required in a further 634 instances to search for or through a large volume of records or to respond to the influx of requests, or both, which interfered with operations. The Department did not invoke any extensions for translation purposes.

Completion times

Requests under the Privacy Act

Text version: Completion times

Completion Time	Percentage of requests
30 days or less	47%
31 to 60 days	38%
61 to 120 days	7.5%
121 days or more	7.5%

Complaints

Privacy Act

During the 2019-2020 fiscal year, the Department was notified of 30 formal privacy complaints and 19 informal complaints received by the Office of the Privacy Commissioner (OPC). This represents 0.35 per cent of all requests completed during this period. The majority of the OPC complaints were related to delays.

During the reporting period, ATIP processed and closed 30 formal complaint investigations and 14 informal complaint investigations. Of these, 1 was abandoned, 2 were well-founded, 2 were not well founded and the remainder were resolved to the satisfaction of the requester.

Key complaint issues

Due to the small sample of Privacy request complaints it is impossible to pinpoint a single issue.

Audits

No audits were concluded during the fiscal year.

Appeal to the Federal Court

There were no appeals to the Federal Court filed against IRCC regarding the Privacy Act during the 2019-2020 reporting period.

Reporting on the impact of COVID-19

From April 1, 2019 to March 13, 2020, IRCC received 15,528 privacy requests. From March 14, 2020 to March 31, 2020 (during the lockdown), IRCC received 435 privacy requests, which is almost 50% fewer requests than anticipated.

It should be noted that despite the lockdown, IRCC still received more privacy requests in 2 weeks than 80% of federal institutions received in all of 2018-2019, and more than any single institution received in all of 2018-2019 except for the top 13 most requested institutions. See ANNEX G: Supplemental Statistical Report on the Privacy Act for reference.

As a result of the lockdown, the ATIP Division had to adjust processes and procedures to facilitate employees working from home, as well as work closely with our information technology services to equip employees with sufficient remote capacity. IRCC continues to function well, and has been successful at maintaining similar response rates on access to information requests and consultations.

Senior management has been very supportive and continues to highlight the importance of employee well-being while we strive to continue to deliver the quality and timely services to our clients.

Privacy Impact Assessments

To fulfil its mandate and effectively deliver its programs and services, IRCC collects, uses and discloses personal information. In accordance with Treasury Board of Canada Secretariat (TBS) policy, the Department undertakes PIAs to ensure compliance with the Privacy Act and identify privacy risks present in new or existing departmental programs, initiatives or projects that collect and use personal information.

Descriptions of PIAs completed during the 2019-2020 fiscal year are found below. The full PIA summaries can be found here: https://www.canada.ca/en/immigration-refugees-citizenship/corporate/transparency/access-information-privacy/privacy-impact-assessment.html

Integrated Payment and Revenue Management System

This PIA concerns a new fee management system called the “Integrated Payment and Revenue Management System” (IPRMS) designed to replace three legacy systems involved in the handling of cost recovery fees, namely the Handling Public Money (HPM) system, the Point of Sale + (POS +) system and the customized Point of Sale Canada functionality (POS Canada) residing in CIC’s SAP system. IPRMS will collect information relevant to ensuring adequate financial control over CIC’s Revenues, such as the type of fee purchased and the amount and form of payment received from the payer. It will maintain similar payer contact information to what currently exists in HPM, POS + and POS +.

IPRMS will interface with the departmental case management system, GCMS, and the departmental financial system, IFMS-SAP.

Use of Computer Analytics in IRCC Programs – India Temporary Resident Visa (Visitor) Annexes

A PIA was previously completed on the Use of Computer Analytics in IRCC Programs, specifically in processing Temporary Resident Visa (TRV) e-applications from China. After the implementation of computer analytics in China, a second implementation in India necessitated a review of privacy risks.

IRCC Notification System (ERMS Advantage)

IRCC is introducing a fully hosted, web-based emergency mass notification system that allows rapid communication with IRCC employees during various security-related events (e.g., security incidents, emergencies, crises) through pre-defined distribution lists to registered employees by various methods (e.g. email, text message, telephone, teletypewriter), and therefore can be received and read by employees while in and away from the office.

Human Resources (HR)-to-Pay Data Warehouse

The HR-to-Pay Data Warehouse (HPDW) provides IRCC employees with a consolidated view of their Human Resources (HR) data (e.g. Personal Record Identifier #, annual salary and pensionable start date), compensation and pay case information through a personalized “Employee Statement”. The HPDW will also enable a Manager Dashboard providing an aggregated view of their team’s information and a Metrics Dashboard containing insightful performance metrics.

Social Media Monitoring

Social media monitoring includes the collection, analysis and reporting of online public communications, including forum discussions and social media activity. Such communications are collected through the use of keyword searches run within a third-party social media monitoring software; searches are designed to collect data on communications relevant to IRCC's mandate and issues of interest under that mandate, rather than data on individuals/clients.

Disclosure of personal information under paragraphs 8(2)(e) and 8(2)(m)

In accordance with subsection 8(2) of the Privacy Act, under certain circumstances, a government institution may disclose personal information under its control without the consent of the individual to whom the information relates.

Paragraph 8(2)(e) provides that personal information may be disclosed to an investigative body specified in the regulations on the written request of the body for the purpose of enforcing any law of Canada or any province or carrying out a lawful investigation. The request must specify the purpose and describe the information to be disclosed.

During this reporting period, IRCC disclosed personal information under subsection 8(2) in responding to 3,403 requests from investigative bodies under paragraph 8(2)(e).

Paragraph 8(2)(m) provides that personal information may be disclosed for any purpose where, in the opinion of the head of an institution, (i) the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure, or (ii) disclosure would clearly benefit the individual to whom the information relates.

During this reporting period, IRCC disclosed personal information in 87 instances under paragraph 8(2)(m) of the Privacy Act:

Material privacy breaches

A privacy breach refers to the improper or unauthorized creation, collection, use, disclosure, retention or disposition of personal information. A material privacy breach is a privacy breach that involves sensitive personal information and could reasonably be expected to cause injury or harm to the individual.

The ATIP Division provided advice and guidance to departmental staff on containment and mitigation strategies to improve the protection of personal information. In addition, senior officials were notified of all material breaches to facilitate communication within the Department and raise awareness of issues that could hinder the public’s right to privacy.

The ATIP Division monitors all privacy breaches reported at IRCC. The Division also reviews how and where they are occurring within the Department. ATIP addresses trends and provides tailored privacy breach training sessions to raise awareness and increase privacy breach prevention.

In 2019-2020, IRCC notified the OPC and TBS of nine material privacy breaches. IRCC monitors all privacy breaches closely and has established notifications and remedial measures to address each situation. The majority of material breaches were of small scale and affected a limited number of individuals.

• Five material breaches involved client files that were lost, or went missing during shipment from a Case Processing Centre to one of the regional offices or to the intended recipient. The affected individuals were notified.
• Three material breaches involved inadvertent disclosures of information to the wrong individual. The affected individuals were notified.
• One material privacy breach involved a planned disclosure of information, which inadvertently included personal information of other individuals. Affected individuals have been notified.

Monitoring compliance

The ATIP Division has established internal procedures to help facilitate the timely and efficient processing and monitoring of ATIP requests.

• As necessary, the complaints team advises ATIP management on systemic issues identified as a result of complaint resolution
• On a daily basis, statistical reports are distributed to ATIP management to help manage the workflow.
• On a weekly basis, different statistical reports are distributed to Senior Management:
  • A snapshot report that looks at ATIP request volumes received and closed, on time compliance rates, etc.
  • A summary of upcoming access to information requests soon to be disclosed.
  • A progress report on late ATIP requests organized by priority.
  • A summary of requests related to COVID-19
• On a monthly basis, different statistical reports are distributed to Senior Management:
  • A report on each sector’s compliance with internal standards for providing responsive records to the ATIP Division is shared with Senior Management.
  • A report on ATIP requests that have been completed over the past month
• On a quarterly basis, the Intake Watch Placemat is distributed to IRCC programs, the Client Experience Branch and Senior Management to demonstrate correlations between immigration program initiatives and corresponding changes in ATIP request volumes

In addition, senior management is provided with a status update on material breaches twice per year.

It is important to note that no personal information is disclosed in these reports.

Policies, guidelines, procedures and initiatives

IRCC undertook several projects related to the improvement of its ATIP requests processes which affect the administration of requests under the Privacy Act:

• Some ATIP Division employees were cross-trained on various functions and temporarily reassigned to a special project focused on substantially reducing the older ATIP request backlog.
• The management of ATIP request complaints was updated based on recommendations from the 2018-2019 audit of ATIP management.
• Presented “Building Bridges: Creating an effective relationship with an Ombudsmen office” at the Canadian Association of Access and Privacy conference in November 2019 on best practices for complaint management based on our evolution since 2017-2018.
• Ongoing collaboration with key IRCC stakeholders to assess and potentially mitigate the impacts of changes to IRCC programs on ATIP request volumes.
• Further to the LEAN review completed in 2017-2018, a new ATIP request retrieval process was successfully implemented in one sector in 2018-2019 and rolled out to more of the Department in 2019-2020. The new process reduced turnaround time for providing records responsive to an ATIP request, and will be rolled out to the remainder of the Department in 2019-2020.
• Participated in ATIP community discussions concerning Privacy Act reform, the European Union General Data Protection Regulations, and ATIP software needs.
• Updated its PIA template to better capture necessary information and improve the assessment of privacy issues and risks.
• Developed a video for privacy awareness. The implementation and distribution of the video is planned for fiscal year 2020-2021.
• Developed a new web form to facilitate the reporting of privacy breaches by IRCC employees.
• Dedicated a full time resource to supporting the assessment of privacy impacts of advanced analytics projects.
• Developed a procedure to ensure timely processing of 8(2)(m) PHAC requests for contact information of individuals who may have come in close proximity of an individual diagnosed with COVID-19.

Annex A: Signed Delegation

Text version: Signed Delegation

Official Document

Department of Immigration, Refugees and Citizenship of Canada

Delegation of Authority

Access to Information Act and Privacy Act

I, Minister of Immigration, Refugees and Citizenship, pursuant to section 95 of the Access to Information Act and section 73 of the Privacy Act, hereby authorize the officer and employee of Immigration, Refugees and Citizenship whose position or classification is set out in the attached Schedule to carry out those of my power, duties or functions under the Acts that are set in the Schedule in relation to that officer and employee.

Dated at Ottawa

This 30 day of August 2019

Ahmed Hussen, P.C., M.P.
Minister of Immigration, Refugees and Citizenship

Annex B: Delegation Order under the Access to Information Act

Official Document

Delegation of Authority under the Access to Information Act and the Access to Information Regulations

The delegation includes acting appointments and assignments to these positions made pursuant to the Public Service Employment Act and regulations.

Full delegation

Partial delegation

Access to Information Act – Part 2 only

Legend

ATIP / PM-05 OPS:

Senior ATIP Administrators, ATIP Operations (OPS)

ATIP / PM-05 CRCI:

Senior ATIP Administrators, Corporate Records, Complaints and Informals (CRCI)

ATIP / PM-04 OPS:

ATIP Administrators, ATIP Operations (OPS)

ATIP / PM-04 CRCI:

ATIP Administrators, Corporate Records, Complaints and Informals (CRCI)

ATIP / PM-03 OPS:

ATIP Officers, ATIP Operations (OPS)

ATIP / PM–03 CRCI:

ATIP Officers, Corporate Records, Complaints and Informals (CRCI)

Annex C: Delegation Order under the Privacy Act

Official Document

The delegation includes acting appointments and assignments to these positions made pursuant to the Public Service Employment Act and regulations.

Full delegation

Partial delegation

Legend

ATIP / PM-05 OPS:

Senior ATIP Administrators, ATIP Operations (OPS)

ATIP / PM-05 CRCI:

Senior ATIP Administrators, Corporate Records, Complaints and Informals (CRCI)

ATIP / PM-04 OPS:

ATIP Administrators, ATIP Operations (OPS)

ATIP / PM-04 CRCI:

ATIP Administrators, Corporate Records, Complaints and Informals (CRCI)

ATIP / PM-03 OPS:

ATIP Officers, ATIP Operations (OPS)

ATIP / PM-03 CRCI:

ATIP Officers, Corporate Records, Complaints and Informals (CRCI)

Annex D: Statistical Report on the Access to Information Act

Name of institution: Immigration, Refugees and Citizenship Canada

Reporting period: 2019-04-01 to 2020-03-31

Section 1: Requests under the Access to Information Act

1.1 Number of requests

1.2 Sources of requests

1.3 Informal requests

Note: All requests previously recorded as “treated informally” will now be accounted for in this section only.

Section 2: Decline to act vexatious, made in bad faith or abuse of right

Section 3: Requests Closed During the Reporting Period

3.1 Disposition and completion time

3.2 Exemptions

3.3 Exclusions

3.4 Format of information released

3.5 Complexity

3.5.1 Relevant pages processed and disclosed

3.5.2 Relevant pages processed and disclosed by size of requests

3.5.3 Other complexities

3.6 Closed requests

3.6.1 Number of requests closed within legislated timelines

3.7 Deemed refusals

3.7.1 Reasons for not meeting legislated timelines

3.7.2 Requests closed beyond legislated timelines (including any extension taken)

3.8 Requests for translation

Section 4: Extensions

4.1 Reasons for extensions and disposition of requests

4.2 Length of extensions

Section 5: Fees

Section 6: Consultations Received From Other Institutions and Organizations

6.1 Consultations received from other Government of Canada institutions and organizations

6.2 Recommendations and completion time for consultations received from other Government of Canada institutions

6.3 Recommendations and completion time for consultations received from other organizations

Section 7: Completion Time of Consultations on Cabinet Confidences

7.1 Requests with Legal Services

7.2 Requests with Privy Council Office

Section 8: Complaints and investigations

Section 9: Court action

9.1 Court actions on complaints received before the coming into force of Bill C-58 and on-going

9.2 Court actions on complaints received after the coming into force of Bill C-58

Section 10: Resources Related to the Access to Information Act

10.1 Cost

10.2 Human Resources

Note: Enter values to two decimal places.

Annex E: Statistical Report on the Privacy Act

Name of institution: Immigration, Refugees and Citizenship Canada

Reporting period: 2018-04-01 to 2019-03-31

Section 1: Requests under the Privacy Act

Section 2: Requests closed during the reporting period

2.1 Disposition and completion time

2.2 Exceptions

2.3 Exclusions

2.4 Format of Information Released

2.5 Complexity

2.5.1 Relevant pages processed and disclosed

2.5.2 Relevant pages processed and disclosed by size of requests

2.5.3 Other complexities

2.6 Closed requests

2.6.1 Number of requests closed within legislated timelines

2.7 Deemed refusals

2.7.1 Reasons for not meeting legislated timelines

2.7.2 Requests closed beyond any legislated timelines (including any extension taken)

2.8 Requests for translation

Section 3: Disclosures under subsections 8(2) and 8(5)

Section 4: Requests for Correction of Personal Information and Notations

Section 5: Extensions

5.1 Reasons for extensions and disposition of requests

5.2 Length of extensions

Section 6: Consultations Received From Other Institutions and Organizations

6.1 Consultations received from other Government of Canada institutions and other organizations

6.2 Recommendations and completion time for consultations received from other Government of Canada Institutions

6.3 Recommendations and completion time for consultations received from other institutions

Section 7: Completion time of Consultations on Cabinet Confidences

7.1 Requests for Legal Services

7.2 Request with Privy Council Office

Section 8: Complaints and Investigations Notices Received

Section 9: Privacy Impact Assessments (PIAs)

9.2 Personal Information Banks

Section 10: Material Privacy Breaches

Section 11: Resources related to the Privacy Act

11.1 Costs

11.2 Human Resources

Annex F: Supplemental Statistical Report on the Access to Information Act

Table 1 – Requests Received

Table 2 – Requests Closed

Table 3 – Requests Carried Over

Annex G: Supplemental Statistical Report on the Privacy Act

Table 4 – Requests Received

Table 5 – Requests Closed

Table 6– Requests Carried Over