2019-2020 Annual Report to Parliament on the Privacy Act

[ PDF version ]

Introduction

The Privy Council Office (PCO) reports directly to the Prime Minister and is headed by the Clerk of the Privy Council and Secretary to the Cabinet. PCO is both the Cabinet secretariat and the Prime Minister’s source of public service advice across the entire spectrum of policy questions and operational issues facing the Government. As the hub of non-partisan, public service support to the Prime Minister, Cabinet and its decision making structures, PCO ensures that the Government and Canadians are served by the highest quality public service.

PCO also provides support to the Prime Minister, as well as to the Deputy Prime Minister and Minister of Intergovernmental Affairs, the Leader of the Government in the House of Commons and the President of the Queen’s Privy Council.

PCO has three main roles:

• PM and Ministers of the portfolio - To deliver analysis, advice and support to the Prime Minister and Ministers of the Portfolio in: setting and implementing the Government’s agenda; establishing the institutions, mandates and accountabilities of government; forming and leading the Cabinet; conducting intergovernmental and international relations; safeguarding national security; and communicating with Canadians. This includes:
  • Bringing together non-partisan advice, analysis and information from across the Public Service;
  • Consulting and collaborating with international and domestic partners inside and outside of government (including provincial and territorial governments);
  • Supporting and advising on the development and implementation of the Government’s Parliamentary and legislative programs; and
  • Advising on Canada’s Westminster style of government, on government structure and organization, and on Governor in Council appointments.
• Secretariat to the Cabinet - To act as secretariat to the Cabinet and its committees in: conducting its deliberations; formulating its recommendations; and making and implementing decisions. This includes:
  • Managing the Cabinet’s decision-making system;
  • Coordinating departments’ policy and legislative proposals to Cabinet, with supporting policy analysis; and
  • Preparing Orders in Council and other statutory instruments to give effect to Government decisions.
• Public Service leadership - To lead and renew the Public Service in: advising the government; implementing its agenda; and delivering services and results to Canadians. This includes:
  • Managing the recruitment and appointment process for senior positions in federal departments and agencies;
  • Guiding policy on people management issues and Public Service Renewal; and
  • Building the capacity of the Public Service to meet emerging challenges and changing responsibilities of government.

This is the 37th Annual Report to Parliament on the administration of the Access to Information Act (ATIA) by PCO, submitted as required by section 94 of the ATIA and section 20 of the Service Fees Act. This report covers the reporting period of April 1, 2019 to March 31, 2020.

Additional copies of this report may be obtained from the:

• Access to Information and Privacy Division
  Privy Council Office
  11 Metcalfe Street
  Ottawa, Ontario K1A 0A3

Highlights

1. In the 2019-2020 fiscal year, 21 privacy requests were received, an increase of 12 from 2018-2019.
2. PCO completed two Privacy Impact Assessments (PIAs) in 2019-2020 and worked with the Office of the Privacy Commissioner (OPC) on several files across the department dealing with personal information.

Access to Information and Privacy division – organizational structure

The PA protects the privacy of personal information held by the Government of Canada. It ensures the protection of that information against unauthorized use and disclosure, and provides individuals with the right of access to, and a means to correct, their personal information.

The Access to Information and Privacy (ATIP) division is the focal point for access to information and privacy within PCO. The division is responsible for managing requests for departmental or personal information, ensuring corporate understanding and compliance with the Access to Information Act (ATIA) and the PA, and fostering corporate awareness of access and privacy rights and responsibilities. On matters of access and privacy, the ATIP division also acts as a primary liaison with the Office of the Information Commissioner (OIC), the OPC, the Treasury Board of Canada Secretariat (TBS), and partner departments. 

The ATIP division has a personnel complement of approximately 30.75 full-time equivalents (FTEs) that are organized into two areas of responsibility. The two areas of responsibility are organized as follows:

1. ATIP operations (24.75 FTEs)
   • Processes access to information and privacy requests;
   • Oversees the collection and release of personal and/or business information;
   • Provides expertise in access to information and privacy policy;
   • Researches trends and best practices in access to information and privacy;
   • Develops and delivers ATIP training programs; and
   • Proactively discloses and publishes briefing note titles, transition material and Question Period Cards.
2. Client services (6 FTEs)
   • Organizes training and develops promotional products;
   • Coordinates responses to parliamentary questions and petitions on behalf of PCO; and
   • Provides database administration.

Monitoring compliance

In order to meet the legislative deadlines for privacy requests, the timelines of individual requests are strictly monitored. Regular meetings and various reports are used to ensure all requests are on track to meet the deadlines. Given our delegation orders (described in the next section), PCO ATIP works very closely with our Offices of Primary Interest (OPIs) to ensure tasking and signoff timelines are respected.

Privy Council Office delegation orders

The Minister heading each government institution is responsible for the implementation of the PA within his or her institution. The Prime Minister, as the Head of the Privy Council Office (PCO) and pursuant to section 73 of the PA, is responsible for the implementation of the PA within PCO. By virtue of PCO’s delegation order, the Prime Minister designated the Executive Director, ATIP, as the individual within PCO to perform the powers, duties, functions, or administrative tasks pertaining to the PA. PCO Secretariats, or OPIs, holders of the information identified in a privacy request, approve the release of information to requesters and the application of exemptions or exclusions and supporting rationales. This shared delegation of authority for the disposition of information is exercised diligently within PCO, and recorded formally at appropriate stages in the process. PCO delegation orders, which were in effect in 2019-2020, are attached at Appendix A.

Education and training activities

Within the PCO ATIP division, meetings are held on a weekly basis to ensure all requests meet the legislated due dates, to review legislated extensions and to discuss any new processes. PCO encourages ATIP requirements and the best practices through learning products, special events in either the branch and/or the department, as well as the intranet.

In 2019-2020, PCO provided ATIP training or awareness sessions to 125 employees through 16 training sessions during the reporting year. These sessions consisted of an overview of ATIP, Information Management (IM), process and the application of PA exemptions to Ministers Offices and internal secretariats.

PCO senior officials were provided with a run-down of the access and privacy statistics to demonstrate performance, compliance and understanding of the access and privacy responsibilities. The Executive Director of ATIP has maintained regular contact with senior staff in the department, and the ATIP senior staff with senior officials in PCO Secretariats to clarify the roles and enhance the working relationships. Throughout the 2019-2020 reporting period, PCO ATIP analysts strived to liaise with clients to explain the five-stage request timeline, train on processes such as the search for records, records retrieval, request interpretation, working role and much more.

PCO ATIP has information made available that instructs on key information on access and privacy. This information is readily available as instructional ATIP handouts, an email box for questions, tools as well as comprehensive and educational electronic content on PCO intranet.

Other activities

a) General operations

PCO ATIP provides support to requesters not captured by statistics. For example, routine inquiries about privacy and personal information matters are received which, whenever possible, are treated informally and to the satisfaction of the requesters. Further, PCO ATIP provides advice and guidance on privacy matters and activities across the department. PCO ATIP conducts PIAs and assists officials in various areas of the department to ensure that any activity related to personal information was in compliance with our responsibilities under the PA.

b) Data matching and sharing

For the 2019-2020 reporting period, PCO did not establish any new systems or processes that led to data matching or sharing of personal information, either within the department or with any external sources. The department was not involved in any data matching activities.

Privacy-related policies, guidelines, and procedures

a) Transitioning to an electronic office

As part of the Beyond 2020 plan, which advocates for green government operations and a paperless office, PCO began the process of transforming into a paperless office. In 2016-2017, we introduced electronic tasking and notification of releases. These two processes alone have proven to be very successful and have greatly reduced the number of pages printed on a daily basis. In 2018-2019, PCO was part of the first wave of institutions brought on by TBS to accept requests through the online portal. In addition, PCO ATIP began the electronic approval process and record retrieval process.

Nearing the end of 2019-2020, PCO ATIP with the help of Information Technology (IT), officially became a paperless office by initiating the entire five-stage process electronically. Despite the challenges and the limitations that internal secretariats may have, this new process provided security benefits as it allows electronic signatures. As PCO ATIP became a paperless office, efficiency has increased significantly.

Interpretation of the Statistical report

The 2019-2020 Statistical report on the Privacy Act can be found at Appendix B.

Part 1− Requests under the Privacy Act

Between April 1, 2019 and March 31, 2020 PCO received 21 requests for personal information under the PA, compared to nine received the previous year.

Part 2 − Requests closed during the reporting period

2.1 Disposition and completion time

In 2019-2020, PCO completed 26 requests for personal information under the PA. The disposition of the completed privacy requests was as follows:

• 12 disclosed in part;
• 7 requests abandoned;
• 5 where no records existed; and
• 2 fully disclosed.

Only two requests remained active and were carried over into 2020-2021.

There are certain circumstances in which a privacy request may require more than 30 days to complete, such as the necessity to consult with external organizations or due to volume of pages to review. In 2019-2020, four requests were completed in 15 days or less, 13 between 16 to 30-day timeframe, six requests completed between 31 to 60 days, and two requests took 365 days or more.

2.2 Exemptions

There are instances where information qualifies for necessary protection under the PA. In 2019-2020, exemptions were invoked for the following number of requests:

• 8 under section 26 – information about another individual;
• 2 under section 21 – information related to international affairs and defence of Canada;
• 1 under paragraph19(1)(a) – personal information obtained from the government of a foreign state or an institution thereof;
• 1 under paragraph 22(1)(b) – information related to the enforcement of any law of Canada or a province or the conduct of lawful investigations; and
• 1 under section 27 – information subject to solicitor-client privilege.

2.3 Exclusions

The PA does not apply to certain publicly available information described by subsection 69(1) and subsection 69(2) of the PA, nor to Confidences of the Queen’s Privy Council for Canada pursuant to subsection 70(1). During this reporting period, no exclusions were cited.

2.4 Format of information released

In 2019-2020, PCO provided electronic copies of responsive records to requesters in 11 instances. Three requesters elected to receive information in paper format.

2.5 Complexity

2.5.1 Relevant pages processed and disclosed

In 2019-2020, 15,385 pages were processed in response to the 21 completed requests where records were found, of which 787 pages were disclosed.

2.5.2 Relevant pages processed and disclosed by size of requests

Of the 21 requests for which records existed and were disclosed in part, 15 had less than 100 pages to process, three requests contained between 101-500 pages to process, one request had 501-1000 pages to process and two requests had more than 5,000 pages to process.

2.5.3 Other complexities

The complex interdepartmental nature of information in many records under the control of PCO often necessitates external consultations and legal advice. This requirement is the principal reason why some requests take an extended length of time to process.

During the reporting year, eight completed requests involved personal information about another individual that was blended or interwoven with the personal information of the requester. Two requests required consultations and no legal advice was sought.

2.6 Closed requests

2.6.1 Number of requests closed within legislated timelines

In the 2019-2020 reporting period, 22 requests (84.6%) were closed within legislated timelines.

2.7 Deemed refusals

2.7.1 Reasons for not meeting legislated timelines

During the 2019-2020 fiscal year, four requests were closed past the statutory deadline. Three requests were closed past the deadline due to workload pressures and one was closed past the deadline due to external consultations.

2.7.2 Requests closed beyond legislated timelines (including any extension taken)

Of the four requests closed beyond legislated timelines, one request was closed between 1 to 15 days past the legislated timeline without an extension. One request with an extension was closed 16 to 30 days past the legislated timeline. Two requests, one with an extension and one without were closed 365 days or more after the legislated timeline.

2.8 Requests for translation

The PA states at subsection 17(2) that “where access to personal information is to be given under this Act and the individual to whom access is to be given requests that access be given in one of the official languages of Canada, (a) access shall be given in that language, if the personal information already exists under the control of a government institution in that language; and (b) where the personal information does not exist in that language, the head of the government institution that has control of the personal information shall cause it to be translated or interpreted for the individual if the head of the institution considers a translation or interpretation to be necessary to enable the individual to understand the information.” During this reporting period, there were no translations requested.

Part 3 – Disclosure under subsections 8(2) and 8(5)

The PA sets out specific circumstances at subsection 8(2) in which government institutions may disclose personal information without the individual’s consent. Paragraph 8(2)(e) of the PA permits the disclosure of personal information “to an investigative body specified in the regulations, on the written request of the body, for the purpose of enforcing any law of Canada or a province or carrying out a lawful investigation, if the request specifies the purpose and describes the information to be disclosed.” Paragraph 8(2)(m) of the PA permits the disclosure of personal information when “(i) the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure, or (ii) disclosure would clearly benefit the individual to whom the information relates”. No disclosures were made under subsection 8(2)(e) or subsection 8(2)(m) of the PA during the 2019-2020 reporting period.

In addition, subsection 8(5) of the PA indicates that the government institution “shall notify the Privacy Commissioner in writing of any disclosure of personal information under paragraph (2)(m) prior to the disclosure where reasonably practicable or in any other case forthwith on the disclosure, and the Privacy Commissioner may, if the Commissioner deems it appropriate, notify the individual to whom the information relates of the disclosure”. During the 2019-2020 reporting period, no disclosures were made under subsection 8(5) of the PA.

Part 4 - Requests for correction of personal information and notations

The PA specifies at subsection12(1) that any Canadian citizen or permanent resident of Canada has a right to and shall, on request, be given access to any personal information about the individual found in a personal information bank and personal information under the control of a government institution. An individual should be entitled to correction of personal information where there is an error or omission, a request that a notation be attached, and assurance that any party who has requested the information within the last two years be notified of the correction and make changes to their copies. There were no requests for correction of personal information and notations made during the reporting period.

Part 5 − Extensions

5.1 Reasons for extensions and disposition of requests

The PA provides for extensions to the legislated 30-day time limit, for consultations or if meeting the original time limit would unreasonably interfere with the operations of the government institution. In the 2019-2020 fiscal year, PCO took five extensions to accommodate operations under paragraph 15(a)(i) and two extensions were taken to allow for consultations on Cabinet confidences and external consultations under paragraph 15(a)(ii).

5.2 Length of extensions

All seven extensions taken by PCO were for a period of 16 to 30 days.

Part 6 − Consultations received from other institutions and organizations

6.1 Consultations received from other Government of Canada institutions and other organizations

PCO received two privacy consultations from other government institutions in the 2019-2020 fiscal year, totaling 236 pages. This number is in line with the quantity of consultations received the last six fiscal years, as shown in the chart below. The processing of consultation requests requires resources at a level similar to the processing of privacy requests. No consultations were received from other organizations.

6.2 Recommendations and completion time for consultations received from other Government of Canada institution

Of the two consultations received in 2019-2020, one was completed in 1 to 15 days. PCO recommended full disclosure of the documents under consultation. The other consultation was carried to the next reporting period of 2020-2021.

6.3 Recommendations and completion time for consultations received from other organizations

During the 2019-2020 reporting period, no consultations were received from other organizations.

Part 7 − Completion time of consultations on Cabinet confidences

7.1 Requests with legal services

Note that in regard to ATIP, PCO consults only with the Office of the Counsel to the Clerk of the Privy Council (PCO Cabinet Confidence Legal Unit (CCLU)). Therefore, no data appears in the table entitled “Completion Time of Consultations on Cabinet Confidences - Requests with Legal Services.”

7.2 Requests with Privy Council Office

During this reporting period, no consultations were sent to PCO CCLU.

Part 8 – Complaints and investigations notices received

No complaints were received, and no audits or investigations were concluded for Privacy files in 2019-2020.

Part 9 − Privacy Impact Assessments and Personal information Banks

9.1 Privacy Impact Assessments

PCO completed two PIAs during the 2019-2020 reporting period on the Canada Youth Summit.

9.2 Personal Information Banks

PCO currently has 51 active Personal Information Banks (PIBs).

Part 10 – Material privacy breaches

In the 2019-2020 reporting period, PCO notified TBS and the OPC about one material privacy breach. The breach concerns correspondence that was sent to the wrong recipient. As a result, PCO retrained the individual on the processes pertaining to correspondence.  

Part 11 – Resources related to the Privacy Act

11.1 Costs

In the 2019-2020 reporting period, the total salary costs associated with administering the PA were $86,788, consistent with 2018-2019. There were no overtime or specific goods and services costs were attributed to the application of the PA.

11.2 Human resources

The associated person-year resource utilization for the 2019-2020 reporting period was approximately one full-time equivalent (FTE).

Part 12 - Impact of COVID-19

Since mid-March, COVID-19 has affected PCO ATIP’s ability to task secretariats for relevant information and to respond to privacy requests in a timely manner. Like most other institutions, a large percentage of PCO employees have been working from home since the beginning of the pandemic. While the majority of privacy requests can continue to be processed without access to secure networks, some challenges remain with accessing the network remotely, and obtaining the relevant approvals efficiently. In addition, if consultations with other institutions are required, only a limited number of them have been able to process consultation requests quickly.

In order to mitigate possible delays in processing privacy requests, PCO ATIP has adapted new procedures to transform into a more paperless office so we can function remotely. PCO implemented GCdocs in 2019 and we have used this repository to transfer and submit information electronically. Since PCO does not receive a high volume of privacy requests, these measures have allowed us to continue with approvals as efficiently as possible.

Appendices

Appendix A: Delegation orders

Privacy Act

The Prime Minister, as head of the Privy Council Office and pursuant to section 73 of the Privacy Act^a, hereby designates the officers or employees holding the positions set out in the schedule hereto, and any persons acting in those positions, to exercise or perform the powers, duties and functions of the Prime Minister as the head of a government institution under the sections of the Act and the regulations opposite each position in the schedule.

This delegation order supercedes all previous delegation orders.

Prime Minister
Justin Trudeau

December 23, 2015

^a R.S. 1985, c. P-21

Schedule

Section 9 - Privacy Impact Assesments (PIA) and Personal Information Banks (PIB)

9.1 Privacy Impact Assesments

9.2 Personal Information Banks

Section 10 - Material privacy breaches