Administration of the Privacy Act - Annual Report to Parliament 2016-2017

Administration of the Privacy Act - Annual Report to Parliament 2016-2017

Catalogue no. En104-12/2-2016E-PDF

Canadian Environmental Assessment Agency
Access to Information and Privacy Coordinator

Physical/mailing address:
160 Elgin St.
Ottawa, ON K1A 0H3

Telephone: 613-948-1362
Email: atip-aiprp@ceaa-acee.gc.ca

This document is also available in Adobe's Portable Document Format [PDF - 1.8 MB].

Table of Contents

• Introduction
• About the Canadian Environmental Assessment Agency
• Delegation of authority
• About Access to Information and Privacy
• Statistical report – Interpretation and analysis
• Privacy Act requests received
• Disclosures under paragraphs 8(2)(e), (f), (g), and (m) of the Privacy Act
• Complaints / Investigations / Appeals to the Court
• Privacy impact assessments
• Data matching and sharing activities
• Policies, guidelines and procedures
• Training and awareness
• Monitoring and reporting
• Privacy breaches
• Appendix A: Designation order
• Appendix B: Statistical report on the Privacy Act

Introduction

The Privacy Act (the Act) gives Canadian citizens and people present in Canada the right to have access to information about them that is held by the federal government. It also protects against unauthorized disclosure of that personal information. In addition, it strictly controls how government will collect, use, store, disclose, and dispose of any personal information.

Section 72 of the Act requires that the head of every government institution submit an annual report to Parliament on the administration of the Act during each fiscal year. The Canadian Environmental Assessment Agency (the Agency) is pleased to table in Parliament its 2016-2017 Annual Report on the Administration of the Act.

About the Canadian Environmental Assessment Agency

Led by the President, who reports to the Minister of Environment and Climate Change, the Agency delivers its mandate within the framework of the following instruments:

• The Canadian Environmental Assessment Act, 2012 (CEAA 2012) and its accompanying regulations;
• The Canada-Wide Accord on Environmental Harmonization, including the Sub-Agreement on Environmental Assessment, and bilateral agreements with provincial governments that establish arrangements for cooperative environmental assessments; and
• International agreements containing environmental assessment provisions to which Canada is a party, principally the United Nations Economic Commission for Europe's Convention on Environmental Impact Assessment in a Transboundary Context.

Consistent with the Cabinet Directive on the Environmental Assessment of Policy, Plan and Program Proposals, the Agency also supports the Minister of Environment and Climate Change in promoting the application of environmental assessment processes in strategic-level decision-making, by providing training and guidance to federal authorities.

The Agency is responsible for conducting federal environmental assessments for most major resource projects, as mandated under CEAA 2012. The Agency also integrates the Government of Canada's Aboriginal engagement and consultation activities into the environmental assessment process for these projects, in accordance with the Cabinet Directive on Improving the Performance of the Regulatory System for Major Resource Projects and its Memorandum of Understanding. The Agency is the Crown Consultation Coordinator for Aboriginal Consultation, with the exception of projects under the authority of the National Energy Board and the Canadian Nuclear Safety Commission.

The President of the Agency is designated by an Order in Council as the federal administrator of the environmental and social protection regimes set out in Chapters 22 and 23 of the 1975 James Bay and Northern Quebec Agreement.

Delegation of authority

For the purposes of the Act, the Agency’s “head of the institution” as defined in section 3 of the Act is the President of the Agency.

The responsibilities associated with the administration of the Act are delegated to the senior executive officers reporting directly to the President (Vice-presidents and General Counsel), as well as the Access to Information and Privacy Coordinator as deemed appropriate by the President for the effective administration of the program. The decision-making responsibility for the application of the various provisions of the Act is formally established and outlined in the departmental Delegation of Authority Instrument which can be found under Appendix A.

About Access to Information and Privacy

The administration of the Act at the Agency is delegated to the Access to Information and Privacy (ATIP) Division. Their provision of ATIP services is included under the general responsibility of the Information Services Division, reporting to the Vice-President and Chief Security Officer, Corporate Services.

The Information Services Division is sub-divided into an Information Management (IM) unit, an ATIP unit, and an Information Technology (IT) unit. The ATIP function is the direct responsibility of the ATIP Coordinator and a team of three ATIP Officers.

The ATIP team administers the Act by:

• Receiving requests under the Act, creating Privacy request files and tracking the processing of Privacy requests using AccessPro Case Management software;
• Sending statutory notices to applicants, to third parties, and to the Information and Privacy Commissioners;
• Conducting consultations;
• Processing records for disclosure under the Act, in response to requests;
• Responding to requests for correction of personal information held by the Agency;
• Providing advice and training to Agency officials on interpretation and application of the legislation;
• Negotiating the resolution of formal complaints;
• Advising applicants, third parties and complainants of their rights and obligations under the legislation;
• Managing and reporting on privacy breaches;
• Annually updating and publicly reporting the Personal Information Banks under the Agency’s control;
• Conducting/securing Privacy Impact Assessments in support of the Act and associated Regulations, Policies and Directives of Justice Canada and the Treasury Board Secretariat (TBS);
• Compiling statistics; and
• Preparing the Agency’s annual report on the administration of the Act.

Statistical report – Interpretation and analysis

Appendix B provides a summarized statistical report on Privacy Act requests processed by the Agency from April 1, 2016, to March 31, 2017.

Privacy Act requests received

As indicated in the statistical report, the Agency received no requests under the Act during the 2016-2017 fiscal year. The table below demonstates that the Agency has received a declining number of Privacy requests over the past few fiscal years.

	2013-2014	2014-2015	2015-2016	2016-2017
Number of Requests Received	3	2	0	0

Disclosures under paragraphs 8(2)(e), (f), (g), and (m) of the Privacy Act

There were no disclosures pursuant to paragraphs 8(2)(e), (f), (g), and (m) of the Act during the 2016-2017 reporting period.

Complaints / Investigations / Appeals to the Court

There were no complaints filed with the Office of the Privacy Commissioner of Canada during the reporting period. As well, there were no investigations and no appeals to the Federal Court of Appeal.

Privacy impact assessments

One Privacy Impact Assessment (PIA) for the Environmental Assessment Delivery, Facilitated by the Environmental Assessment Management System (EAMS) was completed on January 25, 2017.

The Risk Analysis for this PIA identified five medium and two high risks related to the management of personal information through EAMS. These risks have been addressed by a mitigation strategy involving the following:

• Augmentation of the Agency’s Privacy Management. This includes updating the following documents: The Privacy Notice, the Privacy Impact Assessment Directive, the Privacy Breach Policy, and the Privacy Protocol. Final approval is ongoing for the implementation of some of these policy instruments.
• Training. The Agency is developing a communication strategy to promote staff awareness of the importance of the above mentioned policy instruments. The Agency is also developing a training strategy for the implementation of EAMS. Both strategies will enhance observance of the privacy protection requirements within the Agency and surrounding the use of EAMS.
• Protected B certification of the EAMS hosted platform. The Agency has secured certification that the platform is cleared for Protected B.
• Establishment of Records Disposition Authorities (RDAs). The Agency is working towards establishing RDAs with Library and Archives Canada.
• Registration of a new Personal Information Bank (PIB) to replace an existing Class of Records. A new PIB has been included in this PIA, and has been submitted to the Treasury Board Secretariat of Canada (TBS) for registration.

It was posted to the Agency’s external website on February 9, 2017 and more information can be found at https://www.canada.ca/en/impact-assessment-agency/corporate/transparency/pia/executive-summary-eams.html

Data matching and sharing activities

There was no data matching or sharing activities undertaken during this reporting period.

Policies, guidelines and procedures

There were no policies, guidelines or procedures implemented during this reporting period.

Training and awareness

Agency employees are provided with training and guidance to assist them in fulfilling their duties under the Privacy Act. The ATIP Coordinator provides advice and support on an as-needed basis.

Employees have been directed to take the Privacy-related training offered by the Canada School of the Public Service. Training and reference materials are also made available to employees on the Agency’s Intranet site.

Monitoring and reporting

The Agency continues to ensure compliance with the Act through effective reporting and monitoring mechanisms. Weekly ATIP reports are tabled by the Vice-President Corporate Services at the President’s Management Committee meetings. These reports include depersonalized status of any individual requests, as well as compliance statistics. Special reports are also submitted to provide justification for any time extensions.

Privacy breaches

The Agency had three (3) privacy incidents during the reporting period. These breaches were not significant and therefore were not reported to the Office of the Privacy Commissioner (OPC).

To mitigate the effects of these breaches and to prevent recurrence, the employees were reminded and referred to of the the Agency’s Privacy Policy as well as the TBS Policy on Government Security.

Appendix A: Designation order

Designation order

(Privacy Act)

As head of the Canadian Environmental Assessment Agency for purposes of the Privacy Act, I hereby designate, under section 73 of that Act, the officers and employees of the Canadian Environmental Assessment Agency, who hold the positions set out in the attached Annex, to exercise or perform all of the powers, duties or functions that are conferred upon me by the provisions of the Privacy Act specified in the aforementioned Annex.

Original signed July 23, 2017 by Ron Hallman, President, Canadian Environmental Assessment Agency.

Annex to Designation Order (Privacy Act) Dated – July 2014

The Access to Information and Privacy Coordinator and the Senior Executive Officers reporting directly to the President of the Canadian Environmental Assessment Agency are designated to exercise or perform all powers, duties or functions of the President as the head of the Canadian Environmental Assessment Agency under the provisions of the Privacy Act listed below. This designation replaces all previous delegation orders.

8(2)(e)	Disclose personal information for law enforcement or investigation
8(2)(m)	Disclose personal information in the public interest or in the interest of the individual
8(4)	Retain copy of 8(2)(e) requests and disclosed records
8(5)	Notify Privacy Commissioner of 8(2)(m) disclosures
9(1)	Retain record of use
9(4)	Notify Privacy Commissioner of consistent use and amend index
10(1)	Include personal information in personal information banks
14(a)	Provide notice when access is requested
14(b)	Provide access to the information or part thereof
15	Extend time limit
17(2)(b)	Cause translation or interpretation to be made
18(2)	Apply exemption - Personal information contained in an exempt bank
19(1)	Apply exemption - Personal information obtained in confidence from other governments
19(2)	Apply exemption - Personal information if the other government, organization or institution consents to the disclosure or makes the information public
20	Apply exemption - Personal information injurious to the conduct of federal-provincial affairs
21	Apply exemption - Personal information injurious to international affairs or defense
22(1)	Apply exemption - Personal information injurious to law enforcement or investigation
22(2)	Apply exemption - Personal information obtained or prepared by the RCMP while performing policing services for a province or municipality
22 (3)	Apply exemption - Personal information requested under subsection 12(1) that was created for the purpose of making a disclosure under the Public Servants Disclosure Protection Act or in the course of an investigation into a disclosure under that Act.
23	Apply exemption - Personal information prepared by an investigative body for security clearances
24	Apply exemption - Personal information collected by the Canadian Penitentiary Service, the National Parole Service or the National Parole Board while individual was under sentence
25	Apply exemption - Personal information which could threaten the safety of individuals
26	Apply exemption - Personal information about another individual
27	Apply exemption - Personal information subject to solicitor-client privilege
28	Apply exemption - Personal information relating to the individual’s physical or mental health
31	Receive notice of intention of investigation by the Privacy Commissioner
33(2)	Make representations to the Privacy Commissioner in the course of an investigation
35	Give notice to the Information Commissioner of action taken/to be taken to implement recommendations and provide access to complainant after 35(1)(b) notice
36(3)	Receive Privacy Commissioner’s report of findings of investigation of exempt bank
37(3)	Receive report of Privacy Commissioner’s findings after compliance investigation
51(2)(b)	Request that hearing be held in the National Capital Region
51(3)	Request and be given opportunity to make representations in section 51 hearings
70(1)	Exclusion - Confidences of the Queen’s Privy Council for Canada
72(1)	Prepare annual report to Parliament
77	Fulfill any responsibilities that are conferred upon the head of the institution by the regulations made under section 77 and are not included above

Appendix B: Statistical Report on the Privacy Act

Name of institution: Canadian Environmental Assessment Agency
Reporting period: 2016-04-01 to 2017-03-31

Part 1: Requests Under the Privacy Act

	Number of Requests
Received during reporting period	0
Outstanding from previous reporting period	0
Total	0
Closed during reporting period	0
Carried over to next reporting period	0

Part 2: Requests Closed During the Reporting Period

2.1 Disposition and completion time

Disposition of Requests	Completion Time
	1 to 15 Days	16 to 30 Days	31 to 60 Days	61 to 120 Days	121 to 180 Days	181 to 365 Days	More Than 365 Days	Total
All disclosed	0	0	0	0	0	0	0	0
Disclosed in part	0	0	0	0	0	0	0	0
All exempted	0	0	0	0	0	0	0	0
All excluded	0	0	0	0	0	0	0	0
No records exist	0	0	0	0	0	0	0	0
Request abandoned	0	0	0	0	0	0	0	0
Neither confirmed nor denied	0	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0	0

2.2 Exemptions

Section	Number of Requests
18(2)	0
19(1)(a)	0
19(1)(b)	0
19(1)(c)	0
19(1)(d)	0
19(1)(e)	0
19(1)(f)	0
20	0
21	0
22(1)(a)(i)	0
22(1)(a)(ii)	0
22(1)(a)(iii)	0
22(1)(b)	0
22(1)(c)	0
22(2)	0
22.1	0
22.2	0
22.3	0
23(a)	0
23(b)	0
24(a)	0
24(b)	0
25	0
26	0
27	0
28	0

2.3 Exclusions

Section	Number of Requests
69(1)(a)	0
69(1)(b)	0
69.1	0
70(1)	0
70(1)(a)	0
70(1)(b)	0
70(1)(c)	0
70(1)(d)	0
70(1)(e)	0
70(1)(f)	0
70.1	0

2.4 Format of information released

Disposition	Paper	Electronic	Other formats
All disclosed	0	0	0
Disclosed in part	0	0	0
Total	0	0	0

2.5 Complexity

2.5.1 Relevant pages processed and disclosed

Disposition of Requests	Number of Pages Processed	Number of Pages Disclosed	Number of Requests
All disclosed	0	0	0
Disclosed in part	0	0	0
All exempted	0	0	0
All excluded	0	0	0
Request abandoned	0	0	0
Neither confirmed nor denied	0	0	0
Total	0	0	0

2.5.2 Relevant pages processed and disclosed by size of requests

Disposition	Less Than 100 Pages Processed		101-500 Pages Processed		501-1000 Pages Processed		1001-5000 Pages Processed		More Than 5000 Pages Processed
	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed
All disclosed	0	0	0	0	0	0	0	0	0	0
Disclosed in part	0	0	0	0	0	0	0	0	0	0
All exempted	0	0	0	0	0	0	0	0	0	0
All excluded	0	0	0	0	0	0	0	0	0	0
Request abandoned	0	0	0	0	0	0	0	0	0	0
Neither confirmed nor denied	0	0	0	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0	0	0	0

2.5.3 Other complexities

Disposition	Consultation Required	Legal Advice Sought	Interwoven Information	Other	Total
All disclosed	0	0	0	0	0
Disclosed in part	0	0	0	0	0
All exempted	0	0	0	0	0
All excluded	0	0	0	0	0
Request abandoned	0	0	0	0	0
Neither confirmed nor denied	0	0	0	0	0
Total	0	0	0	0	0

2.6 Deemed refusals

2.6.1 Reasons for not meeting statutory deadline

Number of Requests Closed Past the Statutory Deadline	Principal Reason
	Workload	External Consultation	Internal Consultation	Other
0	0	0	0	0

2.6.2 Number of days past deadline

Number of Days Past Deadline	Number of Requests Past Deadline Where No Extension Was Taken	Number of Requests Past Deadline Where An Extension Was Taken	Total
1 to 15 days	0	0	0
16 to 30 days	0	0	0
31 to 60 days	0	0	0
61 to 120 days	0	0	0
121 to 180 days	0	0	0
181 to 365 days	0	0	0
More than 365 days	0	0	0
Total	0	0	0

2.7 Requests for translation

Translation Requests	Accepted	Refused	Total
English to French	0	0	0
French to English	0	0	0
Total	0	0	0

Part 3: Disclosures Under Subsections 8(2) and 8(5)

Paragraph 8(2)(e)	Paragraph 8(2)(m)	Subsection 8(5)	Total
0	0	0	0

Part 4: Requests for Correction of Personal Information and Notations

Disposition for Correction Requests Received	Number
Notations attached	0
Requests for correction accepted	0
Total	0

Part 5: Extensions

5.1 Reasons for extensions and disposition of requests

Disposition of Requests Where an Extension Was Taken	15(a)(i) Interference With Operations	15(a)(ii) Consultation		15(b) Translation or Conversion
		Section 70	Other
All disclosed	0	0	0	0
Disclosed in part	0	0	0	0
All exempted	0	0	0	0
All excluded	0	0	0	0
No records exist	0	0	0	0
Request abandoned	0	0	0	0
Total	0	0	0	0

5.2 Length of extensions

Length of Extensions	15(a)(i) Interference with operations	15(a)(ii) Consultation		15(b) Translation purposes
		Section 70	Other
1 to 15 days	0	0	0	0
16 to 30 days	0	0	0	0
Total	0	0	0	0

Part 6: Consultations Received From Other Institutions and Organizations

6.1 Consultations received from other Government of Canada institutions and other organizations

Consultations	Other Government of Canada Institutions	Number of Pages to Review	Other Organizations	Number of Pages to Review
Received during the reporting period	0	0	0	0
Outstanding from the previous reporting period	0	0	0	0
Total	0	0	0	0
Closed during the reporting period	0	0	0	0
Pending at the end of the reporting period	0	0	0	0

6.2 Recommendations and completion time for consultations received from other Government of Canada institutions

Recommendation	Number of Days Required to Complete Consultation Requests
	1 to 15 Days	16 to 30 Days	31 to 60 Days	61 to 120 Days	121 to 180 Days	181 to 365 Days	More Than 365 Days	Total
All disclosed	0	0	0	0	0	0	0	0
Disclosed in part	0	0	0	0	0	0	0	0
All exempted	0	0	0	0	0	0	0	0
All excluded	0	0	0	0	0	0	0	0
Consult other institution	0	0	0	0	0	0	0	0
Other	0	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0	0

6.3 Recommendations and completion time for consultations received from other organizations

Recommendation	Number of days required to complete consultation requests
	1 to 15 Days	16 to 30 Days	31 to 60 Days	61 to 120 Days	121 to 180 Days	181 to 365 Ddays	More Than 365 Days	Total
All disclosed	0	0	0	0	0	0	0	0
Disclosed in part	0	0	0	0	0	0	0	0
All exempted	0	0	0	0	0	0	0	0
All excluded	0	0	0	0	0	0	0	0
Consult other institution	0	0	0	0	0	0	0	0
Other	0	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0	0

Part 7: Completion Time of Consultations on Cabinet Confidences

7.1 Requests with Legal Services

Number of Days	Fewer Than 100 Pages Processed		101-500 Pages Processed		501-1000 Pages Processed		1001-5000 Pages Processed		More than 5000 Pages Processed
	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed
1 to 15	0	0	0	0	0	0	0	0	0	0
16 to 30	0	0	0	0	0	0	0	0	0	0
31 to 60	0	0	0	0	0	0	0	0	0	0
61 to 120	0	0	0	0	0	0	0	0	0	0
121 to 180	0	0	0	0	0	0	0	0	0	0
181 to 365	0	0	0	0	0	0	0	0	0	0
More than 365	0	0	0	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0	0	0	0

7.2 Requests with Privy Council Office

Number of Days	Fewer Than 100 Pages Processed		101-500 Pages Processed		501-1000 Pages Processed		1001-5000 Pages Processed		More than 5000 Pages Processed
	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed
1 to 15	0	0	0	0	0	0	0	0	0	0
16 to 30	0	0	0	0	0	0	0	0	0	0
31 to 60	0	0	0	0	0	0	0	0	0	0
61 to 120	0	0	0	0	0	0	0	0	0	0
121 to 180	0	0	0	0	0	0	0	0	0	0
181 to 365	0	0	0	0	0	0	0	0	0	0
More than 365	0	0	0	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0	0	0	0

Part 8: Complaints and Investigations Notices Received

Section 31	Section 33	Section 35	Court action	Total
0	0	0	0	0

Part 9: Privacy Impact Assessments (PIAs)

Number of PIA(s) completed: 1

Part 10: Resources Related to the Privacy Act

10.1 Costs

Expenditures	Amount
Salaries	$6,935
Overtime	$0
Goods and Services Professional services contracts = $0 Other = $0	$0
Total	$6,935

10.2 Human Resources

Resources	Person Years Dedicated to Privacy Activities
Note: Enter values to two decimal places.
Full-time employees	0.01
Part-time and casual employees	0.00
Regional staff	0.00
Consultants and agency personnel	0.00
Students	0.00
Total	0.01