Annual Report to Parliament 2022 to 2023: Administration of the Privacy Act

PDF version - 1,104 kB

October 2023

Catalogue Number: En104-21/2E-PDF
ISSN 2562-7686
GCdocs# 21138591

Impact Assessment Agency of Canada
Access to Information and Privacy Coordinator
Physical/mailing address:
160 Elgin St. 22^nd Floor
Ottawa, ON K1A 0H3
Telephone: 613.297.2320
Email: atip-aiprp@iaac-aeic.gc.ca

On this page

• List of tables
• List of abbreviations and acronyms
• Introduction
• Organizational Structure
• Delegation Order
• Performance 2022-2023
  • Percentage of requests responded to within legislated timelines
  • Number of completed requests
  • Number of active requests
  • Number of active complaints
  • Extensions
  • Consultations completed for other institutions
  • Completed requests
  • Impact of COVID-19
  • The Agency’s 2022-2023 Statistical Report on the Privacy Act for 2022-2023
    • Channels of privacy requests received
    • Informal requests
    • Correction of personal information and notations
    • Disclosures under paragraphs 8(2)(m) of the Privacy Act
    • Format of information released
    • Exemptions and exclusions
    • Translation
  • The Agency’s Supplemental ATIP Statistical Report for 2022-2023
    • Capacity to receive requests
    • Capacity to process paper and electronic requests
    • Social Insurance Number
    • Universal access under the Privacy Act
• Training and Awareness
• Policies, Guidelines and Procedures
• Initiatives and Projects to Improve Privacy
• Summary of Key Issues and Actions Taken on Complaints
• Material Privacy Breaches
• Privacy Impact Assessments
• Monitoring Compliance
  • Privacy requests
  • Inter-institutional consultations
  • Frequently requested information
  • Procurement
• Data Matching and Sharing Activities
• Annexes
  • Annex A: Designation Order
  • Annex B: Statistical Report on the Privacy Act
    • Section 1: Requests under the Privacy Act
      • 1.1a Number of requests received
      • 1.1b Number of requests carried into next reporting period
      • 1.2 Channels of requests
    • Section 2: Informal requests
      • 2.1a Number of informal requests received
      • 2.1b Number of informal requests carried into next reporting period
      • 2.2 Channels of informal requests
      • 2.3 Completion time of informal requests
      • 2.4 Pages released informally
    • Section 3: Requests closed during the reporting period
      • 3.1 Disposition and completion time
      • 3.2 Number of exemptions per section of the Act
      • 3.3 Number of exclusions per section of the Act
      • 3.4 Format of information released
      • 3.5 Complexity
        • 3.5.1 Relevant pages processed and disclosed for paper and e-record formats
        • 3.5.2 Relevant pages processed per request disposition for paper and e-record formats by size
        • 3.5.3 Relevant minutes processed and disclosed for audio formats
        • 3.5.4 Relevant minutes processed per request disposition for audio formats for all sizes of requests
        • 3.5.5 Relevant minutes processed and disclosed for video formats
        • 3.5.6 Relevant minutes processed per request disposition for video formats for all sizes of requests
        • 3.5.7 Other complexities
      • 3.6 Closed requests
        • 3.6.1 Requests closed within legislated timelines
      • 3.7 Deemed refusals
        • 3.7.1 Reasons for not meeting legislated timelines
        • 3.7.2 Requests closed beyond legislated timelines (including any extension taken)
      • 3.8 Requests for translation
    • Section 4: Disclosure under Subsection 8(2) and 8(5)
      • 4.1 Disclosure
    • Section 5: Requests for correction of personal information and notations
      • 5.1 Disposition for correction requests received
    • Section 6: Extensions
      • 6.1a Reasons for extensions under 15(a)(i) interference with operations
      • 6.1b Reasons for extensions under 15(a)(ii) consultations
      • 6.1c Reasons for extensions under 15(b) translation purposes or conversion
      • 6.2a Length of extensions under 15(a)(i) interference with operations
      • 6.2b Length of extensions under 15(a)(ii) consultations
      • 6.2c Length of extensions under 15(b) translation purposes or conversion
    • Section 7: Consultations received from other institutions and organizations
      • 7.1a Consultations received from other Government of Canada institutions
      • 7.1b Number of consultation requests from other Government of Canada institutions carried into next reporting period
      • 7.1c Consultations received from other organizations
      • 7.1b Number of consultation requests from from other organizations carried into next reporting period
      • 7.2 Recommendations and completion time for consultations received from other Government of Canada institutions
      • 7.3 Recommendations and completion time for consultations received from other organizations outside Government of Canada
    • Section 8: Completion time of consultations on Cabinet confidences
      • 8.1 Requests with Legal Services for all sizes
      • 8.2 Requests with Privy Council Office
    • Section 9: Complaints and investigation notices received
      • 9.1 Investigations
    • Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIB)
      • 10.1 Privacy Impact Assessments
      • 10.2 Institution-specific and Central Personal Information Banks
    • Section 11: Privacy breaches
      • 11.1 Material privacy breaches reported
      • 11.2 Non-material privacy breaches
    • Section 12: Resources related to the Privacy Act
      • 12.1 Allocated costs
      • 12.2 Human resources

List of tables

• Table 1 – Requests responded to within legislated timelines
• Table 2 – Completion time for privacy requests
• Table 3 – Number of active requests
• Table 4 – Active complaints by year
• Table 5 – Disposition of requests
• Table 6 – Percentage breakdown of channel of requests
• Table 7 – Format of release packages

List of abbreviations and acronyms

ATIP

Access to Information and Privacy

Act, the

Privacy Act

IAA

Impact Assessment Act

IAAC

Impact Assessment Agency of Canada

OPI

Office of Primary Interest

PIA

Privacy Impact Assessment

PIB

Personal Information Bank

Registry, the

Canadian Impact Assessment Agency Registry

RFP

Request for Proposal

SACC

Standard Acquisition Clauses and Conditions

SIN

Social Insurance Number

TBS

Treasury Board of Canada Secretariat

Introduction

The Privacy Act (the Act) provides Canadian citizens and people present in Canada the right to have access to information about them that is held by the federal government. It also protects against unauthorized disclosure of that personal information. In addition, it strictly controls how government will collect, use, store, disclose, and dispose of any personal information.

This report is submitted in accordance with Section 72(1) of the Act, which requires every head of a federal government institution to submit a report to Parliament on the administration of the Act within their institution during the reporting period. It presents an overview of the Privacy Act activities carried out within the Impact Assessment Agency of Canada (formerly known as the Canadian Environmental Assessment Agency and further referred to in this report as “the Agency”) during the reporting period of April 1, 2022 to March 31, 2023.

The Agency is a federal body that reports to the Minister of Environment and Climate Change Canada. Under the Impact Assessment Act (IAA), the Agency is the lead federal organization responsible for conducting and administering environmental and impact assessments. The Agency is also the Crown coordinator for Indigenous consultation on designated projects. In leading these assessments, the Agency is responsible for assessing the positive and negative environmental, economic, social, health, and gender effects of designated projects.

Organizational Structure

The provision of Access to Information and Privacy (ATIP) services in the Agency is under the Chief Information Officer organization and is directly managed by the Program Manager who reports to the President through the Vice President, Corporate Services, to fulfill the Agency’s Privacy Act responsibilities. The Impact Assessment Agency of Canada was not party to any service agreement pursuant to section 96 of the Act during the reporting period of April 1, 2022 to March 31, 2023.

During 2022-2023 reporting period, there were 0.1 FTEs working on Access to Information related files.

The ATIP Team has administered the Act by:

• Receiving privacy requests under the Act, creating request files and tracking the processing of requests using AccessPro Case Management software;
• Sending statutory notices to applicants, third parties, and the Privacy Commissioner;
• Conducting necessary consultations;
• Processing Privacy records for disclosure under the Act, in response to requests;
• Responding to privacy requests for correction of personal information held by the Agency;
• Providing training and advice to Agency officials on interpretation and application of the legislation;
• Negotiating the resolution of formal complaints;
• Advising applicants, third parties and complainants of their rights and obligations under the legislation;
• Managing and reporting on privacy breaches;
• Annually updating and publicly reporting the Personal Information Banks under the Agency’s control;
• Conducting/securing Privacy Impact Assessments in support of the Act and associated Regulations, Policies and Directives of Justice Canada and the Treasury Board of Canada Secretariat (TBS);
• Responding to Parliamentary Questions related to the administration of the Act;
• Compiling statistics; and
• Preparing, submitting and posting the Agency’s annual report to Parliament on the administration of the Act.

Delegation Order

For the purposes of the Act, the Agency’s “head of the institution” as defined in Section 3 of the Act is the President of the Agency.

The responsibilities associated with the administration of the Act are delegated to the senior executive officers reporting directly to the President (Vice-presidents and General Counsel), as well as the Access to Information and Privacy Coordinator by the President for the effective administration of the program. The decision-making responsibility for the application of the various provisions of the Act is formally established and outlined in the departmental Delegation of Authority Instrument, which can be found under Appendix A.

Performance 2022-2023

The Statistical Report on Access to Information requests processed by the Agency from April 1, 2022 to March 31, 2023 is included in Appendix B of this report. The following sections provide an overview of key data on the Agency’s performance for the year with some explanations, interpretations and analysis of the Statistical Report for 2022-2023.

Percentage of requests responded to within legislated timelines

Of the 6 requests closed during the 2022-2023 period, 5 were closed within the legislated timeline. This represents a percentage of 83.33%.

Number of completed requests

Of the five requests closed within the legislated timeline, two requests were completed in the first 15 days, and three requests were completed between 16 and 30 days, as identified in table 2. The final request was completed on on day 60, where an extension of 30 days was obtained.Over 500 pages of records were processed as part of these requests.

Number of active requests

A total of five requests were received during the 2022-2023 reporting period and two requests were carried over from 2021-2022. Of the seven active requests, one request (14.28%), as identified in table 3, was carried over to the 2023-2024 reporting year. All active requests were received during the 2022-2023 reporting period and were within legislated timelines as of March 31, 2023.

Number of active complaints

As of the last day of the reporting period, there were no active complaints with the Privacy Commissioner of Canada, as identified in table 4.

Extensions

Section 15 of the Act allows institutions to extend the legislated timeframe for an additional 30 days if a search for responsive records cannot be completed within 30 days of receipt of the request, if the institution must consult with other institutions or third parties, or if translation is required.

In 2022-2023, the Agency invoked one extension (beyond the initial 30 days) in the reporting period under 15(a)(i) interference with operations. No extensions were taken under 15(a)(ii) consultations, or 15(b) translation purposes or conversion.

Consultations completed for other institutions

No consultations were received from other Government of Canada institutions or other organizations in the 2022-2023 reporting year.

Completed requests

Of the six requests completed, 16.67% (1) were disclosed in full and 66.67% (4) were disclosed in part. Table 5 outlines the resulting dispositions of the remaining completed request.

Table 3.1, ‘Disposition and completion time’, and Table 3.5.2, ‘Relevant pages processed per request disposition for paper and e-record formats by size of requests’, located in Annex B, provide a further breakdown of the Table 5 above.

Impact of COVID-19

During the 2022-2023 reporting period, our operations remained unaffected by the Covid-19 pandemic. Despite the challenges faced globally, our organization successfully maintained its regular business operations, ensuring minimal disruption to our employees, clients, and stakeholders.

The Agency’s 2022-2023 Statistical Report on the Privacy Act for 2022-2023

Channels of privacy requests received

Table 6 shows a percentage breakdown of the channels for which requests made under the Privacy Act were received during the 2022-2023 reporting period. Of the five requests received, one (20%) was received through online channels, and four (80%) by email.

Informal requests

There were no informal requests made in the 2022-2023 reporting year.

Correction of personal information and notations

There were no requests for the correction of personal information or notations made in the 2022-2023 reporting year.

Disclosures under paragraphs 8(2)(m) of the Privacy Act

There were no disclosures pursuant to paragraphs 8(2)(m) of the Privacy Act made during the 2022-2023 reporting period.

Format of information released

Of the five requests containing records for release, four were provided electronically and one on paper. Electronic release is down 20 % from the previous reporting period as seen in table 7.

Exemptions and exclusions

The Privacy Act provides individuals with an enforceable right of access to their personal information, however, there are instances where certain limited and specific exemptions can be applied. The Privacy Act exemption that was applied most frequently was Section 26, which protects personal information of another individual, as defined by Section 3 of the Act. This exemption occurred in two instances of completed requests during the 2022 to 2023 fiscal year. Additionally, information that does not fall under the Act was redacted under section 12(1) in two instances of completed requests.

The Privacy Act also allows for the exclusion of certain types of information, such as records that are already available to the public (Section 69) and confidences of the King’s Privy Council for Canada (Section 70). During the 2022 to 2023 reporting period, no exclusions under section 69 or section 70 were applied.

Translation

Consistent with previous fiscal years, the Agency did not receive, nor did it process any requests in 2022–23 that required translation of responsive records.

The Agency’s Supplemental ATIP Statistical Report for 2022-2023

Capacity to receive requests

The Agency had an uninterrupted service delivery and was able to receive requests by mail, email and through digital request service for the full 52 weeks of the reporting period.

Capacity to process paper and electronic requests

The Agency had an uninterrupted service delivery and was able to process paper and electronic records in all classification levels (i.e., classified, protected B, secret and top secret) for the full 52 weeks of the reporting period.

Social Insurance Number

The Agency has not collected nor used Social Insurance Numbers (SIN) for any new purposes in the 2022-2023 reporting period. This has no implications for the Agency, as the collection, use, and disclosure of SIN is restricted, and TBS monitors their collection closely.

Universal access under the Privacy Act

The Agency received nil requests from confirmed foreign nationals outside of Canada in 2022-2023.

Training and Awareness

Agency employees are provided with training and guidance to assist them in fulfilling their duties under the Act. The ATIP Team provides advice and support on an as-needed basis.

Employees have been informed of the ATIP-related training offered by the Canada School of Public Service. Training and reference materials are made available to employees on the Agency’s Intranet site.

Policies, Guidelines and Procedures

There were no new policies, guidelines or procedures implemented during this reporting period.

Initiatives and Projects to Improve Privacy

In the Fall of 2022, the Agency transitioned to the Treasury Board Secretariat’s new ATIP online management system to manage the intake of requests.

Further, the ATIP Team revised the templates used for correspondence with Offices of Primary Interest (OPI) on an as-needed basis and has continued to streamline the approval process for requests and consultations. The records retrieval procedure and the tasking process were also revised. Liaison roles and responsibilities under the Act have been further clarified, and guidance was provided on the obligation to provide recommendations and strong rationale to the ATIP team.

Summary of Key Issues and Actions Taken on Complaints

There were no complaints filed with the Office of the Privacy Commissioner of Canada during the reporting period. As well, there were no investigations and no appeals filed with the Federal Court of Appeal.

Material Privacy Breaches

No material privacy breaches occurred during the 2022-2023 reporting period.

Privacy Impact Assessments

No Privacy Impact Assessments (PIA) were completed during the 2022-2023 reporting period.

Monitoring Compliance

Privacy requests

The Agency continues to ensure compliance with the Privacy Act through effective monitoring mechanisms. Biweekly ATIP meetings ensure that privacy requests are managed effectively and responded to on time. Due to their sensitive nature, requests made under the Privacy Act are not included on the Agency’s weekly ATIP reports to the Vice-President, Corporate Services, and the Agency’s senior leadership, however, the ATIP Coordinator monitors the timeline of these requests closely.

Inter-institutional consultations

To ensure the Agency limits inter-institutional consultations to only when required for the proper exercise of discretion or for an intention to disclose, ATIP Analysts are instructed to review records page by page when marking records requiring consultation. This ensures not only that the appropriate institutions are being consulted, but also to limit the number of pages an institution will receive. ATIP Analysts are also instructed to effectively communicate with the receiving institution prior to sharing records. Discussing with an analyst from the receiving institution prior to providing the request confirms whether the institution is indeed the correct receiving party, and also allows us to connect with an appropriate member of staff so that the request is not sent to a generic inbox (unless instructed otherwise). Further, all consultations containing personal information are marked as Protected B and sent via secured method (e.g., encrypted email, via Connect, or registered mail).

Frequently requested information

As required under the Impact Assessment Act, the Agency facilitates public access to information and records related to environmental assessments, through the Canadian Impact Assessment Agency Registry (the Registry). Due to the nature of the Agency’s work, the frequency in which personal information is requested, and the manner in which it is held prevents the Agency from posting anonymized data that would reduce the already small number of privacy requests received per year.

Procurement

Whilst the Agency has not issued a Request for Proposal (RFP) that contained personal information, the Agency does have a protocol in place to ensure appropriate protections are included in contracts, agreements and arrangements. All RFP’s requesting personal information are to be referred to the ATIP team for review.

Supplemental general conditions are used only when the contractor must collect and/or use personal information about individuals to perform the work. Prior to their inclusion in a contract, contracting officers are instructed to consult with Legal Services to ensure they are necessary.

These conditions do not specifically address the numerous policies that apply to Canada’s use and handling of personal information, such as the Directive on Privacy Impact Assessment, the various Treasury Board policies concerning privacy and data protection, or the Policy on Service and Digital, for example. Any additional requirements necessitated by these policies are reflected elsewhere in the contract.

Data Matching and Sharing Activities

There were no data matching or sharing activities undertaken during this reporting period.

Annexes

Annex A: Designation Order

Designation order

(Privacy Act)

As head of the Canadian Environmental Assessment Agency for purposes of the Privacy Act, I hereby designate, under section 73 of that Act, the officers and employees of the Canadian Environmental Assessment Agency, who hold the positions set out in the attached Annex, to exercise or perform all of the powers, duties or functions that are conferred upon me by the provisions of the Privacy Act specified in the aforementioned Annex.

Original signed July 23, 2017 by Ron Hallman, President, Canadian Environmental Assessment Agency.

Annex to Designation Order (Privacy Act) Dated – July 2014

The Access to Information and Privacy Coordinator and the Senior Executive Officers reporting directly to the President of the Canadian Environmental Assessment Agency are designated to exercise or perform all powers, duties or functions of the President as the head of the Canadian Environmental Assessment Agency under the provisions of the Privacy Act listed below. This designation replaces all previous delegation orders.

Annex B: Statistical Report on the Privacy Act

Name of institution: Impact Assessment Agency of Canada

Reporting period: 2022-04-01 to 2023-03-31

Section 1: Requests under the Privacy Act

1.1a Number of requests received

1.1b Number of requests carried into next reporting period

1.2 Channels of requests

Section 2: Informal requests

2.1a Number of informal requests received

2.1b Number of informal requests carried into next reporting period

2.2 Channels of informal requests

2.3 Completion time of informal requests

2.4 Pages released informally

Section 3: Requests closed during the reporting period

3.1 Disposition and completion time

3.2 Number of exemptions per section of the Act

3.3 Number of exclusions per section of the Act

3.4 Format of information released

3.5 Complexity

3.5.1 Relevant pages processed and disclosed for paper and e-record formats

3.5.2 Relevant pages processed per request disposition for paper and e-record formats by size

3.5.3 Relevant minutes processed and disclosed for audio formats

3.5.4 Relevant minutes processed per request disposition for audio formats for all sizes of requests

3.5.5 Relevant minutes processed and disclosed for video formats

3.5.6 Relevant minutes processed per request disposition for video formats for all sizes of requests

3.5.7 Other complexities

3.6 Closed requests

3.6.1 Requests closed within legislated timelines

3.7 Deemed refusals

3.7.1 Reasons for not meeting legislated timelines

3.7.2 Requests closed beyond legislated timelines (including any extension taken)

3.8 Requests for translation

Section 4: Disclosure under Subsection 8(2) and 8(5)

4.1 Disclosure

Section 5: Requests for correction of personal information and notations

5.1 Disposition for correction requests received

Section 6: Extensions

6.1a Reasons for extensions under 15(a)(i) interference with operations

6.1b Reasons for extensions under 15(a)(ii) consultations

6.1c Reasons for extensions under 15(b) translation purposes or conversion

6.2a Length of extensions under 15(a)(i) interference with operations

6.2b Length of extensions under 15(a)(ii) consultations

6.2c Length of extensions under 15(b) translation purposes or conversion

Section 7: Consultations received from other institutions and organizations

7.1a Consultations received from other Government of Canada institutions

7.1b Number of consultation requests from other Government of Canada institutions carried into next reporting period

7.1c Consultations received from other organizations

7.1b Number of consultation requests from from other organizations carried into next reporting period

7.2 Recommendations and completion time for consultations received from other Government of Canada institutions

7.3 Recommendations and completion time for consultations received from other organizations outside Government of Canada

Section 8: Completion time of consultations on Cabinet confidences

8.1 Requests with Legal Services for all sizes

8.2 Requests with Privy Council Office

Section 9: Complaints and investigation notices received

9.1 Investigations

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIB)

10.1 Privacy Impact Assessments

10.2 Institution-specific and Central Personal Information Banks

Section 11: Privacy breaches

11.1 Material privacy breaches reported

11.2 Non-material privacy breaches

Section 12: Resources related to the Privacy Act

12.1 Allocated costs

12.2 Human resources