Annual Report - 2022-2023 - Administration of the Privacy Act

1. 2022-2023 Highlights

• During the 2022-2023 fiscal year, the on-time compliance rates for Privacy Act requests stood at 96%
• 1,490 Privacy Act requests were received during the 2022-2023 fiscal year (26% increase from the 2021-­2022 fiscal year)
• 222 Privacy Act requests from confirmed foreign nationals outside of Canada were received since the coming into force of Universal Access in July 2022
• 60% of the Privacy Act requests received were from individuals seeking the status of their (or someone else’s) security screening application

2.  Introduction

The Privacy Act (hereafter the “Act”) provides Canadian citizens, permanent residents, and individuals present in Canada, the right to access personal information under the control of the Government of Canada. This right was extended to include foreign nationals in July 2022.  The right of access to personal information is balanced against the legitimate need to protect sensitive information and to maintain the effective functioning of government, while promoting transparency and accountability in government institutions. The Act protects an individual’s privacy by preventing others from accessing his or her personal information, and manages the collection, retention, use and disclosure of personal information.

In June 2019, Bill C-58, An Act to Amend the Access to Information Act and Privacy Act and to make consequential amendments to other Acts, received Royal Assent. The Bill brought forth the most significant advances to the Access to Information Act as well as minor amendments to the Privacy Act since they came into force in 1983.

This report is prepared and tabled in Parliament in accordance with section 72 of the Privacy Act. It covers the way in which the Canadian Security Intelligence Service (CSIS) administered the Act from April 1, 2022 to March 31, 2023.

The Service is not reporting on behalf of wholly owned subsidiaries or non-operational institutions.

3.  CSIS Mandate

CSIS has, since 1984, continued to demonstrate its value to Canadians by providing the Government of Canada with crucial information and advice linked to threats to the security of Canada and to Canadian interests. The CSIS Act gives CSIS the mandate to investigate activities suspected of constituting threats to the security of Canada including terrorism and violent extremism, espionage and sabotage, foreign influenced activities, and subversion of government. In addition to providing advice to Government on these threats, CSIS may also take lawful measures to reduce them. The Service also provides security assessments on individuals who require access to classified information or sensitive files within the Government of Canada as well as security advice relevant to the exercise of the Citizenship Act and the Immigration and Refugee Protection Act. Foreign intelligence collection within Canada is also conducted by CSIS at the request of the Minister of Foreign Affairs or the Minister of National Defence.

In June 2019, the National Security Act, 2017 modernized the original CSIS Act by addressing outdated legal authorities, introducing new safeguards and accountability measures as well as clarifying CSIS’ responsibilities. The legislation addressed specific challenges and provided new modern authorities needed to keep pace with continuous changes in the threat, as well as the technological and legal landscapes.

The new, ever-evolving and persistent threat environment requires a nimble and dynamic operational approach. Canadians can be confident that when CSIS carries out its duties and functions, it acts in a manner consistent with fundamental Canadian rights and freedoms and in line with its democratic values.

4. Organizational Structure

During the 2022-2023 fiscal year, the Access to Information and Privacy (ATIP) Section remained under the Deputy Director, Policy and Strategic Partnerships (DDP) Directorate. Within the Directorate, the ATIP Section is part to the Litigation and Disclosure Branch headed by the Director General. The employees of the ATIP Section are fully dedicated to the administration of both the Privacy Act and the Access to Information Act programs within CSIS, providing high quality and timely responses to internal and external clients including other government departments as well as providing advice to CSIS employees as they fulfill their obligations under both Acts. CSIS Legal Services Branch, staffed by Department of Justice lawyers, provides legal advice as required.

The CSIS ATIP Section had twenty full-time positions to fulfill CSIS’ obligations under the Act and the Access to Information Act. Throughout this reporting period, two of the thirteen Analyst positions remained vacant. As such, the team comprised of one Chief (Coordinator), one Deputy Chief, three unit Heads, nine full-time Analysts, and two Administrative Officers. The ATIP Section also included two full-time and one part-time Analysts dedicated to the processing of historical records under the Access to Information Act.

During the 2022-2023 fiscal year, the ATIP Section experienced the same resourcing challenges as the other ATIP Sections across government. In order to relieve some of those challenges, the ATIP Section’s management team presented a modernization initiative to the Human Resources (HR) Section, including the reclassification of certain position to create an opportunity for career progression and the requirement for additional resources. While HR did not initially approve the initiative, the ATIP Section continues to push for its modernization.

Aside from the processing of Privacy Act requests, the Service has a Privacy Unit (PU) responsible for Privacy Impact Assessments (PIA), Privacy Breaches and other privacy related matters. The Privacy Unit is comprised of three full-time positions (one Head and two Advisors). While the PU is also under the DDP Directorate, the Director General of the External Review and Compliance Branch (ERC) heads the unit.

The ATIP Section’s responsibilities vis-à-vis the Act are divided in two categories:

Operations

• receiving and processing all requests in accordance with the Act;
• assisting requesters in formulating their requests when required;
• gathering all pertinent records and ensuring that the search for information is rigorous and complete;
• conducting the initial review of the records and providing recommendations to the program areas;
• applying all discretionary and mandatory exemptions under the Act;
• conducting and responding to all internal and external consultations;
• consolidating the recommendations;
• assisting the Office of the Privacy Commissioner (OPC) in all privacy related matters including complaints and audits against CSIS; and
• representing CSIS in privacy litigation cases.

Policies and Procedures

• coordinating the annual Info Source update and submission to TBS;
• preparing the annual report on the administration of the Act;
• providing ongoing advice and guidance to senior management and departmental staff on all matters related to privacy;
• promoting privacy awareness and training sessions and ensuring all employees are aware of the obligations imposed by the legislation;
• monitoring departmental compliance with the Act, regulations and relevant procedures and policies;
• developing and maintaining privacy policies and guidelines, when required; and
• participating in ATIP community activities, such as TBS ATIP community meetings and various working groups.

As defined in section 73.1 of the Privacy Act, CSIS did not provide or receive services related to any power, duty or function to or from another government institution, during this reporting period.

5. Delegation Order

In accordance with section 73(1) of the Act, a delegation order signed by the Minister of Public Safety and Emergency Preparedness designates the persons holding certain positions to exercise and perform the duties of the Minister as Head of the institution. In the case of CSIS, these positions consist of the Director of CSIS, the Deputy Director of the Policy and Strategic Partnerships Directorate, the Director General of the Litigation and Disclosure Branch, as well as the Chief, Deputy Chief and unit Heads of the ATIP Section.

The Honourable Marco E. L. Mendicino, P.C., M.P. issued the delegation order (Annex A) on April 24, 2022.

6. Interpretation of the 2022-2023 statistical report for requests under the Privacy Act

Every year, TBS requires institutions to submit a statistical report on their administration of the Privacy Act, which contains cumulative data on the application of the legislation during the fiscal year. The CSIS Statistical Report and Supplemental Report for 2022-2023 are included in Annex B and Annex C of this report. The statistics included in this report have been rounded to the nearest decimal point.

As indicated in table 1, the Service received 1,490 requests between April 1, 2022 and March 31, 2023. This represents a 26% increase from the requests received during the previous reporting period. The Service had 65 outstanding requests at the end of the 2021-2022 reporting period. Of those 65 requests, all were received during that fiscal year and none remained outstanding for more than one reporting period.

As of the end of the 2022-2023 fiscal year, 132 requests were carried over to the next fiscal year (see section 4.1 of Annex C). Ninety-two percent of those active requests were within their legislated timelines as of March 31, 2023 and eight percent were beyond their legislated timelines as of that same date.

6.1 - Sources of requests

The 1,490 requests received during this reporting period came from various sources. Seventy-five percent came from members of the public who, largely, were seeking the status of their citizenship and immigration application or seeking to discover whether the Service had investigative information on them. Eight percent of requests came from businesses such as law offices looking for the personal information of their clients in relation to the status of their immigration and citizenship application. Of the 1,490 requests received, 222 were from confirmed foreign nationals outside of Canada who were in most part looking for the status of their security screening applications. Ninety-three percent of requests were submitted through the ATIP Online Request Service (AORS). The remaining seven percent was received by email or by mail.

6.2 - Disposition of completed requests

The ATIP Section successfully closed 1,423 requests during the 2022-2023 reporting period: 69% were closed within 1 to 15 days, 24% were closed within 16 to 30 days and 8% took over 31 days to close. Concerning these requests, there were none where the records were all disclosed, 16% were disclosed in part, 28% were all exempt, 17% did not exist, 16% were abandoned and for 23%, the existence could be neither confirmed nor denied.

6.3 - Deemed refusals

Out of the 1,423 requests closed during this reporting period, the ATIP Section successfully closed 1,369 requests (96%) within the legislated timelines; however, the remaining 54 requests (4%) were closed past the legislated timelines. It is important to note that out of those 54 requests, extensions were taken on 76%. The three main reasons for requests being closed past their legislated timelines were the interference with operations, the need to consult other government departments on classified records and an increase in workload without additional resources.

6.4 - Extensions

The legislation allows for extensions when the response requires internal or external consultations, additional review time due to large amount of records, or when the review could interfere with Service operations. During the reporting period, extensions were taken on 80 requests. Of the extensions taken, 14% were due to consultations various internal branches, 58% due to consultations with other government departments, and 28% due to the interference with operations/workload.

6.5 – Exemptions and exclusions invoked

The Privacy Act allows institutions to exempt information from being released for a variety of reasons.

The ATIP Section invoked 1,158 exemptions under the Act during the reporting period.

The Act excludes from disclosure information already publically available and Cabinet Confidences. No exclusions were applicable to information reviewed by the ATIP Section during the reporting period.

6.6 - Consultations received from other Government of Canada institutions

During the 2022-2023 fiscal year, the Service received five consultation requests under the Privacy Act involving Service records or matters. There were no consultation requests outstanding from the 2021-­2022 fiscal year.

For this reporting period, the ATIP Section closed three Privacy Act consultation requests totaling 12 pages reviewed and processed in less than 15 days. Two Privacy Act consultation requests were carried over to the next fiscal year.

6.7 – Informal requests

The ATIP Section also acted as a resource for CSIS executives by offering advice and guidance further to provisions in the legislation. The ATIP Section provided assistance, over 12 times, on a variety of matters including, but not limited to, releases of information made by CSIS outside the parameters of the Act.

Throughout 2022-2023, the ATIP Section continued to receive telephone calls and emails from employees of the Service as well as from the public seeking direction on how to obtain their personal information and/or how to submit a request under the Privacy Act. The ATIP Section administration team provided guidance in a professional manner and often directed these individuals to the AORS website for additional information.

6.8 – Impact of Covid-19 measures

The CSIS ATIP Section operated at full capacity for the entire fiscal year, with little to no impact on its operations. In the beginning of the fiscal year, a few institutions remained unable to access their offices to review classified materials. This resulted in a small number of requests being in deemed refusal, partial responses and/or lengthy extensions. However, as federal employees returned to the offices more frequently, the impact of the pandemic on the ATIP Section’s operations became more or less inexistent.

7.  Training and Awareness

During this fiscal year, the CSIS ATIP Section joined Treasury Board of Canada Secretariat’s (TBS) ATIP Professionals Community Development Office (APCDO). The ATIP employees participated in a variety of deep dive sessions and in the APCDO onboarding session for new ATIP professionals. The ATIP Section continued to encourage its employees to explore other training including courses offered by the Canada School of Public Service.

Through the 2022-2023 reporting period, the ATIP Section was able to resume in-person training sessions, previously cancelled due to the Pandemic. At the request of several Service branches, senior ATIP Analysts delivered valuable ATIP training sessions to employees on a variety of ATIP related topics.

The ATIP Section continued to offer its awareness sessions through ATIP e-learning narrated slides. The narrated slides form part of the employee orientation program, which is required for all new employees. All other Service employees have the ability to reference the narrative slides at any given time through an e-learning application. The narrated slides provided participants with an overview of the Act and the Access to Information Act, promoted a better comprehension of individual responsibilities and obligations relating to the Acts, and offered a greater understanding of the internal ATIP process. During the 2022-2023 fiscal year, 370 Service employees viewed the ATIP online module.

In addition to the above, the Privacy Unit published one article per day during Privacy Awareness Week on CSIS’ Intranet. The articles explained CSIS’ organizational responsibilities under the Act. A CSIS news bulletin was also published the week before the Canadian School of Public Service (CSPS) government-wide information session on privacy, encouraging employees to participate. The Privacy Advisors completed CSPS training on ATIP and Privacy in the Government of Canada, on PIAs and on the Act. Finally, a CSIS representative attended the Global Privacy Symposium.

8.  Policies, Guidelines, Procedures and Initiatives

The CSIS ATIP Section revised its procedures to deal with the coming into effect of Universal Access under the Privacy Act. This included the development of a robust process to verify identity in order to comply with the requirements of the Directive on Personal Information Requests and Correction of Personal Information.

In October 2022, the Privacy Unit developed a Privacy Needs Assessments template to assist the Unit in determining when a Privacy Impact Assessment is required. The PU conducted interdepartmental consultation to understand Privacy best practices and develop internal tools and knowledge. Finally, the PU developed a Privacy Breach template, which facilitates collection of information required to determine if a breach was material or non-material in nature and identified the need to incorporate GBA+ into its templates to capture TBS’ Policy Direction to Modernize Sex and Gender Information Practices in the Government of Canada. The PU will advance this initiative during the next reporting period.

9.  Initiatives and Projects to Improve Privacy

The CSIS ATIP Section was on boarded to the TBS’ ATIP Online Request Service (AORS) and the ATIP Online Management Tool (AOMT) during the end of the fiscal year. The ATIP Administrative team attended training at TBS to ensure a better understanding of the portals. While the team is still learning how to best use the portal, the timely delivery of Privacy Act responses to Canadians has definitely improved.

The CSIS ATIP Section continued to evaluate its current and future needs for selecting the best option for the new Request Processing Software Solution (RPSS). A decision had not been taken by the end of the fiscal period. The ATIP Section will turn its attention to the procurement of a new RPSS during the next reporting period.

The transformation of the ATIP Section continued to be underway. ATIP management worked diligently over the past few fiscal years to modernize its organizational structure and grow its team. It was determined that creating career progression was essential to retain ATIP expertise at CSIS and to maintain CSIS’ high delivery of ATIP standards and requirements to Canadians. While some roadblocks occurred during the reporting period, ATIP management is committed to its modernization.

10 . Issues and Actions Taken on Complaints or Audits

Section 29 (1) of the Act provides requesters with the right to file a complaint with the OPC if they are not satisfied with the response to their personal information request. Reasons for complaints include the refusal of an institution to disclose personal information, personal information used and disclosed for other purposes, delays in receiving a response, etc. Fourteen complaints were registered with the OPC during the 2022-2023 fiscal year. This represents 1% of the total number of Privacy Act requests received throughout the fiscal year.

OPC investigators closed and issued their findings on 11 complaints. They determined that three complaints were not well founded. The remaining eight complaints were resolved during the early stages of the investigation and did not require any further action from CSIS. No complaints were deemed well founded.

The Service had nine open complaints at the end of the 2022-2023 reporting period. The following table shows the number of open complaints that were outstanding from previous reporting periods (see Annex C - section 4.2 of the Supplemental Statistical Report on the Access to Information and Privacy Acts).

CSIS continues to work closely with the OPC in order to resolve complaints in an efficient and timely manner. The Service reviews the outcome of all investigations by the OPC and where appropriate, integrates lessons learned into corporate processes.

There were three Court action filed against CSIS regarding the Act during this reporting period. The Court proceedings on this action remain ongoing.

11.    Monitoring Compliance

The unit Heads are responsible for monitoring compliance under the Privacy Act and reporting issues to the Chief, ATIP. The monitoring is conducted via reports produced by the ATIP Case Management Software. The ATIP Coordinator conveys compliance issues to the Director General, Litigation and Disclosure Branch when required.

The PU monitors compliance relating to PIAs, Privacy Breaches and other privacy related matters. Issues are reported to the Head of the PU and to the Director General of the External Review and Compliance Branch if necessary.

12. Material Breaches

CSIS did not report any material privacy breaches to the OPC (or TBS) during this reporting period.

13. Privacy Impact Assessments (PIA)

There were no PIAs completed during this reporting period.

14. Public Interest Disclosures

There was no disclosure made under paragraph 8(2) (m) of the Privacy Act during the reporting period.

15. Other

Throughout the 2022-2023 fiscal year, CSIS incurred $1,041,498 in salary costs and $6,754 in other costs associated with the administration of the Privacy Act.

Statistical Report on the Privacy Act

Name of institution: Canadian Security Intelligence Service (CSIS)

Reporting period: 2022-04-01 to 2023-03-31

Requests Under the Privacy Act

1.1 Number of requests

	Number of Requests
Received during reporting period	1,490
Outstanding from the previous period	65
Outstanding from previous reporting period	65
Outstanding from more than one reporting period	0
Total	1,555
Closed during reporting period	1,423
Carried over to the next period	132
Carried over within legislated timeline	121
Carried over beyond legislated timeline	11

1.2 Channels of requests

Source	Number of Requests
Online	1,387
E-mail	102
Mail	1
In person	0
Phone	0
Fax	0
Total	1,490

Section 2: Informal Requests

2.1 Number of informal requests

		Number of Requests
Received during the reporting period		12
Outstanding from previous reporting periods		0
Outstanding from previous reporting period	0
Outstanding from more than one reporting period	0
Total		12
Closed during the reporting period		12
Carried over to next reporting period		0

2.2 Channels of informal requests

Source	Number of Requests
Online	0
E-mail	12
Mail	0
In person	0
Phone	0
Fax	0
Total	12

2.3 Completion time of informal requests

Completion Time
1 to 15 Days	16 to 30 Days	31 to 60 Days	61 to 120 Days	121 to 180 Days	181 to 365 Days	More Than 365 Days	Total
6	5	1	0	0	0	0	12

2.4 Pages released informally

Less than 100 pages released		100-500 Pages released		501-1,000 Pages released		1,001 - 5,000 Pages released		More Than 5000 Pages released
Number of requests	Pages released	Number of requests	Pages released	Number of requests	Pages released	Number of requests	Pages released	Number of requests	Pages released
10	103	1	128	0	0	1	1,473	0	0

Section 3: Requests Closed During the Reporting Period

3.1 Disposition and completion time

Disposition of Requests	Completion Time
	1 to 15 Days	16 to 30 Days	31 to 60 Days	61 to 120 Days	121 to 180 Days	181 to 365 Days	More than 365 Days	Total
All disclosed	0	0	0	0	0	0	0	0
Disclosed in part	81	70	38	19	5	10	4	227
All exempted	331	57	4	0	0	0	1	393
All excluded	0	0	0	0	0	0	0	0
No records exist	177	62	1	3	0	0	0	243
Request abandoned	210	18	3	1	0	0	0	232
Neither confirm nor denied	185	139	4	0	0	0	0	328
Total	984	346	50	23	5	10	5	1,423

3.2 Exemptions

Section	Number of Requests	Section	Number of Requests	Section	Number of Requests
18(2)	321	22(1)(a)(i)	220	23(a)	0
19(1)(a)	1	22(1)(a)(ii)	0	23(b)	1
19(1)(b)	0	22(1)(a)(iii)	2	24(a)	0
19(1)(c)	0	22(1)(b)	260	24(b)	0
19(1)(d)	1	22(1)(c)	0	25	1
19(1)(e)	0	22(2)	0	26	77
19(1)(f)	0	22.1	0	27	3
20	0	22.2	0	27.1	0
21	269	22.3	0	28	0
		22.4	0

3.2 Exclusions

Section	Number of Requests	Section	Number of Requests	Section	Number of Requests
69(1)(a)	0	70(1)	0	70(1)(d)	0
69(1)(a)	0	70(1)(a)	0	70(1)(e)	0
69.1	0	70(1)(b)	0	70(1)(f)	0
		70(1)(c)	0	70.1	0

3.4 Format of information released

Paper	Electronic				Other
	E-record	Dataset	Video	Audio
95	132	0	0	0	0

3.5 Complexity

3.5.1 Relevant pages processed and disclosed for paper and e-record formats

Number of Pages Processed	Number of Page Disclosed	Number of Requests
16,729	10,204	1,180

3.5.2 Relevant pages processed per request disposition for paper and e-record formats by size of requests

Disposition	Less than 100 Pages Processed		100-500 Pages Processed		501-1,000 Pages Processed		1,001-5,000 Pages Processed		More than 5,000 Pages Processed
	Number of Requests	Pages Processed	Number of Requests	Pages Processed	Number of Requests	Pages Processed	Number of Requests	Pages Processed	Number of Requests	Pages Processed
All disclosed	0	0	0	0	0	0	0	0	0	0
Disclosed in part	201	5,003	20	4,518	4	3,075	2	3,063	0	0
All exempted	393	743	0	0	0	0	0	0	0	0
All excluded	0	0	0	0	0	0	0	0	0	0
Request abandoned	231	218	1	109	0	0	0	0	0	0
Neither confirm nor denied	328	0	0	0	0	0	0	0	0	0
Total	1,153	5,964	21	4,627	4	3,075	2	3,063	0	0

3.5.3 Relevant minutes processed and disclosed for audio formats

Number of Minutes Processed	Number of Minutes Disclosed	Number of Requests
0	0	0

3.5.4 Relevant minutes processed per request disposition for audio formats by size of requests

Disposition	Less than 60 Minutes Processed		60 - 120 Minutes Processed		More than 120 Minutes Minutes Processed
	Number of Requests	Minutes Processed	Number of Requests	Minutes Processed	Number of Requests	Minutes Processed
All disclosed	0	0	0	0	0	0
Disclosed in part	0	0	0	0	0	0
All exempted	0	0	0	0	0	0
All excluded	0	0	0	0	0	0
Request abandoned	0	0	0	0	0	0
Neither confirm nor denied	0	0	0	0	0	0
Declined to act with the approval of the Information Commissioner	0	0	0	0	0	0
Total	0	0	0	0	0	0

3.5.5 Relevant minutes processed and disclosed for video formats

Number of Minutes Processed	Number of Minutes Disclosed	Number of Requests
0	0	0

3.5.6 Relevant minutes processed per request disposition for video formats by size of requests

Disposition	Less than 60 Minutes Processed		60 - 120 Minutes Processed		More than 120 Minutes Minutes Processed
	Number of Requests	Minutes Processed	Number of Requests	Minutes Processed	Number of Requests	Minutes Processed
All disclosed	0	0	0	0	0	0
Disclosed in part	0	0	0	0	0	0
All exempted	0	0	0	0	0	0
All excluded	0	0	0	0	0	0
Request abandoned	0	0	0	0	0	0
Neither confirm nor denied	0	0	0	0	0	0
Declined to act with the approval of the Information Commissioner	0	0	0	0	0	0
Total	0	0	0	0	0	0

3.5.7 Other complexities

Disposition	Consultation Required	Legal Advice Sought	Other	Total
All disclosed	0	0	0	0
Disclosed in part	136	0	0	136
All exempted	2	0	0	2
All excluded	0	0	0	0
Request abandoned	2	0	0	2
Neither confirm nor denied	0	0	0	0
Total	140	0	0	140

3.6 Closed requests

3.6.1 Requests closed within legislated timelines

Number of requests closed within legislated timelines	1,369
Percentage of requests closed within legislated timelines (%)	96.20520028

3.7 Deemed refusals

3.7.1 Reasons for not meeting legislated timelines

Number of requests closed past the legislated timelines	Principal Reason
	Interference with operations/workload	External Consultation	Internal Consultation	Other
54	11	25	12	6

3.7.2 Requests closed beyond legislated timelines (including any extension taken)

Number of days past legislated timelines	Number of requests past legislated timeline where no extension was taken	Number of requests past legislated timeline where an extension was taken	Total
1 to 15 days	10	12	22
16 to 30 days	1	8	9
31 to 60 days	0	3	3
61 to 120 days	0	5	5
121 to 180 days	1	3	4
181 to 365 days	0	6	6
More than 365 days	1	4	5
Total	13	41	54

3.8 Requests for translation

Translation Requests	Accepted	Refused	Total
English to French	0	0	0
French to English	0	0	0
Total	0	0	0

Section 4: Disclosures Under Subsection 8(2) and 8(5)

Paragraph 8(2)(e)	Paragraph 8(2)(m)	Subsection 8(5)	Total
0	0	0	0

Section 5: Requests for Correction of Personal Information and Notations

Disposition for Correction Requests Received	Number
Notations attached	0
Requests for correction accepted	1
Total	1

Section 6: Extensions

6.1 Reasons for extensions and disposition of requests

Number of requests where an extension was taken	15(a)(i) Interference with operations				15(a)(ii)Consultation			15(b) Translation purposed or conversion
	Further review required to determine exemptions	Large volume of pages	Large volume of requests	Documents are difficult to obtain	Cabinet Confidence Section (s.70)	External	Internal
80	22	0	0	0	0	47	11	0

6.2 Length of extensions

Length of Extension	15(a)(i) Interference with operations				15(a)(ii)Consultation			15(b) Translation purposed or conversion
	Further review required to determine exemptions	Large volume of pages	Large volume of requests	Documents are difficult to obtain	Cabinet Confidence Section (s.70)	External	Internal
1 to 15 days	0	0	0	0	0	0	0	0
16 to 30 days	22	0	0	0	0	47	11	0
31 days or greater	0	0	0	0	0	0	0	0
total	22	0	0	0	0	47	11	0

Section 7: Consultations Received from Other Institutions and Organizations

 

7.1 Consultations received from other Government of Canada institutions and other organizations

Consultations	Other Government of Canada Institutions	Number of Page to Review	Other Organizations	Number of Page to Review
Received during the reporting period	5	21	0	0
Outstanding from the previous reporting period	0	0	0	0
Total	5	21	0	0
Closed during the reporting period	3	12	0	0
Carried over within legislated timeline	2	9	0	0
Carried over beyond negotiated timelines	0	0	0	0

7.2 Recommendations and completion time for consultations received from other Government of Canada institutions

Recommendation	Number of Days Required to Complete Consultation Requests
	1 to 15 Days	16 to 30 Days	31 to 60 Days	61 to 120 Days	121 to 180 Days	181 to 365 Days	More Than 365 Days	Total
Disclosed entirely	0	0	0	0	0	0	0	0
Disclosed in part	3	0	0	0	0	0	0	3
Exempt entirely	0	0	0	0	0	0	0	0
Exclude entirely	0	0	0	0	0	0	0	0
Consult other institution	0	0	0	0	0	0	0	0
Other	0	0	0	0	0	0	0	0
Total	3	0	0	0	0	0	0	3

7.3 Recommendations and completion time for consultations received from other organizations outside the Government of Canada

Recommendation	Number of Days Required to Complete Consultation Requests
	1 to 15 Days	16 to 30 Days	31 to 60 Days	61 to 120 Days	121 to 180 Days	181 to 365 Days	More Than 365 Days	Total
Disclosed entirely	0	0	0	0	0	0	0	0
Disclosed in part	0	0	0	0	0	0	0	0
Exempt entirely	0	0	0	0	0	0	0	0
Exclude entirely	0	0	0	0	0	0	0	0
Consult other institution	0	0	0	0	0	0	0	0
Other	0	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0	0

Section 8: Completion Time of Consultations on Cabinet Confidences

8.1 Requests with Legal Services

Number of days	Fewer than 100 Pages Processed		100-500 Pages Processed		501-1,000 Pages Processed		1,001-5000 Pages Processed		More than 5000 Pages Processed
	Number of Requests	Pages Processed	Number of Requests	Pages Processed	Number of Requests	Pages Processed	Number of Requests	Pages Processed	Number of Requests	Pages Processed
1 to 15	0	0	0	0	0	0	0	0	0	0
16 to 30	0	0	0	0	0	0	0	0	0	0
31 to 60	0	0	0	0	0	0	0	0	0	0
61 to 120	0	0	0	0	0	0	0	0	0	0
121 to 180	0	0	0	0	0	0	0	0	0	0
181 to 365	0	0	0	0	0	0	0	0	0	0
More than 365	0	0	0	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0	0	0	0

8.2 Requests with Privy Council Office

Number of days	Fewer than 100 Pages Processed		100-500 Pages Processed		501-1,000 Pages Processed		1,001-5000 Pages Processed		More than 5000 Pages Processed
	Number of Requests	Pages Processed	Number of Requests	Pages Processed	Number of Requests	Pages Processed	Number of Requests	Pages Processed	Number of Requests	Pages Processed
1 to 15	0	0	0	0	0	0	0	0	0	0
16 to 30	0	0	0	0	0	0	0	0	0	0
31 to 60	0	0	0	0	0	0	0	0	0	0
61 to 120	0	0	0	0	0	0	0	0	0	0
121 to 180	0	0	0	0	0	0	0	0	0	0
181 to 365	0	0	0	0	0	0	0	0	0	0
More than 365	0	0	0	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0	0	0	0

Section 9: Complaints and Investigation Notices Received

9.1 Investigations

Section 31	Section 33	Section 35	Court Action	Total
14	6	11	3	34

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

10.1 Privacy Impact Assessments

Number of PIAs completed	0
Number of PIAs modified	0

10.2 Institution-specific and Central Personal Information Banks

Personal Information Banks	Active	Created	Terminated	Modified
Institution-specific	16	0	0	0
Central	0	0	0	0
Total	16	0	0	0

Section 11: Privacy Breaches

11.1 Material Privacy Breaches Reported

Number of material privacy breaches reported to TBS	0
Number of material privacy breaches reported to OPC	0

11.2 Non-Material Privacy Breaches

Number of non-material privacy breaches

0

Section 12: Resources Related to the Privacy Act

12.1 Allocated Costs

Expenditures		Amount
Salaries		$1,041,498
Overtime		$0
Goods and Services		$6,754
Professional services contracts	$0
Other	$6,754
Total		$1,048,252

12.2 Human Resources

Resources	Person Years Dedicated to Privacy Activities
Full-time employees	11,000
Part-time and casual employees	0,000
Regional staff	0,000
Consultants and agency personnel	0,000
Students	0,000
Total	11,000

Supplemental Statistical Report on the Access to Information Act and the Privacy Act

Name of institution: Canadian Security Intelligence Service (CSIS)
Reporting period: 2022-04-01 to 2023-03-31

Section 1: Capacity to Receive Requests under the Access to Information Act and the Privacy Act

1.1 Enter the number of weeks your institution was able to receive ATIP requests through different channels.

	Number of Weeks
Able to receive requests by mail	52
Able to receive requests by email	52
Able to receive requests through the digital request service	52

Section 2: Capacity to Process Records under the Access to Information Act and the Privacy Act

2.1 Enter the number of weeks your institution was able to process paper records in different classification levels.

	No capacity	Partial Capacity	Full Capacity	Total
Unclassified Paper Records	0	0	52	52
Protected B Paper Records	0	0	52	52
Secret and Top Secret Paper Records	0	0	52	52

2.2 Enter the number of weeks your institution was able to process electronic records in different classification levels.

	No capacity	Partial Capacity	Full Capacity	Total
Unclassified Electronic Records	0	0	52	52
Protected B Electronic Records	0	0	52	52
Secret and Top Secret Electronic Records	0	0	52	52

Section 3: Open Requests and Complaints under the Access to Information Act

3.1 Enter the number of open requests that are outstanding from previous reporting periods

Fiscal Year Open Requests Were Received	Open Requests that are Within Legislated Timelines as of March 31, 2022	Open Requests that are Beyond Legislated Timelines as of March 31, 2022	Total
Received in 2022-2023	100	16	116
Received in 2021-2022	0	14	14
Received in 2020-2021	0	1	1
Received in 2019-2020	0	1	1
Received in 2018-2019	0	0	0
Received in 2017-2018	0	0	0
Received in 2016-2017	0	0	0
Received in 2015-2016 or earlier	0	0	0
Total	100	32	132

3.2 Enter the number of open complaints with the Information Commissioner of Canada that are outstanding from previous reporting periods.

Fiscal Year Open Complaints Were Received by Institution	Number of Open Complaints
Received in 2022-2023	9
Received in 2021-2022	2
Received in 2020-2021	2
Received in 2019-2020	7
Received in 2018-2019	2
Received in 2017-2018	1
Received in 2016-2017	0
Received in 2015-2016	0
Received in 2014-2015	1
Received in 2013-2014 or earlier	1
Total	25

Section 4: Open Requests and Complaints under the Privacy Act

4.1 Enter the number of open requests that are outstanding from previous reporting periods.

Fiscal Year Open Requests Were Received	Open Requests that are Within Legislated Timelines as of March 31, 2022	Open Requests that are Beyond Legislated Timelines as of March 31, 2022	Total
Received in 2022-2023	121	11	132
Received in 2021-2022	0	0	0
Received in 2020-2021	0	0	0
Received in 2019-2020	0	0	0
Received in 2018-2019	0	0	0
Received in 2017-2018	0	0	0
Received in 2016-2017	0	0	0
Received in 2015-2016 or earlier	0	0	0
Total	121	11	132

4.2 Enter the number of open complaints with the Privacy Commissioner of Canada that are outstanding from previous reporting periods.

Fiscal Year Open Complaints Were Received by Institution	Number of Open Complaints
Received in 2022-2023	3
Received in 2021-2022	6
Received in 2020-2021	0
Received in 2019-2020	0
Received in 2018-2019	0
Received in 2017-2018	0
Received in 2016-2017	0
Received in 2015-2016	0
Received in 2014-2015	0
Received in 2013-2014 or earlier	0
Total	9

Section 5: Social Insurance Number (SIN)

Did your institution receive authority for a new collection or consistent use of the SIN in 2021-2022

No

Section 6: Universal Access under the Privacy Act

How many requests were received from confirmed foreign nationals outside of Canada in 2022-2023?

222