Annual report to Parliament 2022–2023 on the Privacy Act

Introduction

Women and Gender Equality Canada (WAGE) is pleased to present to Parliament its Annual Report on the Administration of the Privacy Act, in accordance with section 72 of the Privacy Act. The report describes how WAGE fulfilled its responsibilities and obligations for the reporting period of April 1, 2022 to March 31, 2023.

ISSN 2817-6421

Purpose of the Privacy Act

The Privacy Act provides individuals with the right of access to, and correction of, personal information about themselves that is under the control of a government institution. It also provides the legal framework for the collection, retention, use, disclosure, disposition, and accuracy of personal information in the administration of programs and activities by government institutions.

Mandate of Women and Gender Equality Canada

The mandate of Women and Gender Equality Canada (WAGE) is to advance equality with respect to sex, sexual orientation, and gender identity or expression through the inclusion of people of all genders, including women, in Canada's economic, social, and political life. This application of a gender and diversity lens will help us to understand better the intersection of sex and gender with other identity factors. These factors include but are not limited to race, national and ethnic origin, Indigenous origin or identity, age, sexual orientation, socio-economic condition, place of residence and disability.

For more information about WAGE, click here to visit our website.

Organizational structure

The Access to Information and Privacy (ATIP) Office is part of the Corporate Secretariat. The ATIP coordinator for WAGE is the manager of the ATIP Office, who reports directly to the Corporate Secretary.

The ATIP coordinator acts on behalf of the Minister for Women and Gender Equality and Youth to ensure that the Department's responsibilities under the Access to Information Act, the Privacy Act, and the Service Fees Act are met.

The ATIP Office is responsible for the administration of the Access to Information Act and the Privacy Act, and they also serve as the centre of ATIP expertise within WAGE. Activities include:

• providing timely and complete responses to requests made under the Access to Information Act and Privacy Act, as well as assisting clients in accordance with the Principles for Assisting Requesters
• processing consultation requests received from other institutions, providing recommendations on the disclosure of information of primary interest to WAGE
• representing the Department in resolving complaints filed with the Information Commissioner and Privacy Commissioner
• providing advice and guidance to senior management and all employees of the Department on ATIP-related matters, including privacy policy advisory services related to the safeguarding of personal information
• delivering training sessions to departmental employees on their obligations under the ATIP legislation and related policies, as well as on departmental procedures
• reviewing proactive publication material and providing recommendations regarding disclosure within the spirit of the Access to Information Act

The ATIP Office consists of five positions: the ATIP coordinator and four ATIP analysts at various levels. In fiscal year 2022–23, the ATIP Office operated with 3.5 full-time employees, and called on the services of a consultant to provide privacy expertise when needed.

WAGE's ATIP Office was not party to any service agreements under section 73.1 of the Privacy Act during the reporting period.

Delegation order

The Minister for Women and Gender Equality and Youth has delegated the responsibilities associated with the administration of the Privacy Act to WAGE officials through a delegation order, which can be found in Appendix A. At WAGE, the ATIP coordinator has full delegated authority.

Performance 2022–2023

This section highlights key information on the Department's performance for fiscal year 2022–23. See Appendix B for the complete Statistical Report and Appendix C for the Supplemental ATIP Statistical Report.

The Access to Information and Privacy (ATIP) Office received four privacy requests during the 2022–2023 fiscal year. No extensions were taken on these requests, and each of the four requests was completed within the original 30-day legislative timeframe. WAGE achieved 100% compliance on requests made under the Privacy Act, and no requests were active as of the last day of that reporting period.

Of the four requests closed during the reporting period, 50% were closed with no records found to exist (2), 25% disclosed in full (1), and 25% disclosed in part (1).

No consultations were completed for other institutions for requests made under the Privacy Act, nor did WAGE consult any other institutions for such. WAGE has no active complaints, and none were received during the reporting period.

WAGE's ATIP operations were not impacted by COVID-19 during the reporting period.

Training and awareness

Within the first three months of employment, all new WAGE employees must take the Access to Information and Privacy Fundamentals course offered by the Canada School of Public Service. Topics include:

• reviewing current legislation and policies
• processing access to information requests effectively
• protecting personal information
• understanding the requirements concerning the collection, use, communication, retention, and disposal of personal information

In addition, employees are invited to participate in departmental ATIP Essentials training sessions. During the past fiscal year, the training material was updated to ensure that it fully met all requirements set out in policies. In piloting the new material, ATIP delivered one training session to 15 people.

Furthermore, the ATIP Office regularly provides informal training on the application of ATIP legislation to departmental employees who retrieve and review relevant records requested under the Act, and to sectors that collect personal information. During the reporting year, the ATIP Office received 36 requests for privacy advice and guidance from internal clients.

Policies, guidelines, procedures, and initiatives

During fiscal year 2022–23, WAGE continued the modernization of ATIP tools, templates, and processes. An ATIP liaison working group was created to assist in these efforts, as well as to foster greater understanding of each other's challenges and to enhance collaboration.

Initiatives and projects to improve privacy

During the 2022–2023 fiscal year, WAGE initiated planning for the implementation of new request processing software to replace the current one.

To ensure compliance and efficiency, the ATIP Office created a two-year work plan to optimize internal guidance documents, internal procedures, and tools.

Summary of key issues and actions taken on complaints

WAGE had no complaints or audits under the Privacy Act during the reporting period.

Material privacy breaches

No material privacy breaches were reported to the Office of the Privacy Commissioner or to the Treasury Board of Canada Secretariat (Privacy and Responsible Data Division) during the reporting period.

Privacy impact assessments

No new privacy impact assessments were initiated during the reporting period.

Public Interest Disclosures

There were no public interest disclosures made during the reporting period.

Monitoring Compliance

The ATIP Office meets daily to ensure that all requests are on track and that deadlines will be met. This also provides an opportunity to discuss issues that have arisen and for analysts to receive guidance on the processing of their requests.

Consistent with the requirement to provide timely access to requested records, WAGE limits inter-institutional consultation to only when required for the proper exercise of discretion or when there is an intention to disclose. For this reporting period, WAGE did not need to consult with other institutions.

As WAGE sees a low volume of requests under the Privacy Act, no frequently requested types of information were identified.

WAGE uses standard clauses to ensure that appropriate privacy protections are included in contracts, agreements, and arrangements.

Appendix A: Delegation order

The responsibilities associated with the administration of the Privacy Act are delegated to departmental officials through a delegation order signed by the Minister for Women and Gender Equality and Youth.

DEPARTMENT FOR WOMEN AND GENDER EQUALITY

Access to Information Act and Privacy Act Delegation

The Minister for Women and Gender Equality and Youth, pursuant to section 95 of the Access to Information Act and section 73 the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers and functions of the Minister as the head of a government institution. This Delegation Order supersedes all previous Delegation Orders.

Dated this 28 day of March 2022

Appendix B: Statistical report on the Privacy Act

April 1, 2022-March 31,2023

Section 1: Requests under the Privacy Act

Section 2: Informal requests

Section 3: Requests Closed During the Reporting Period

3.5 Complexity

3.6 Closed requests

3.7 Deemed refusals

Section 4: Disclosures Under Subsections 8(2) and 8(5)

Section 5: Requests for Correction of Personal Information and Notations

Section 6: Extensions

Section 7: Consultations Received From Other Institutions and Organizations

Section 8: Completion Time of Consultations on Cabinet Confidences

Section 9: Complaints and Investigations Notices Received

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

Section 11: Privacy Breaches

Section 12: Resources Related to the Privacy Act

Note: Enter values to three decimal places

Appendix C: Supplemental statistical report on the Access to Information Act and the Privacy Act

April 1, 2022-March 3,2023

Section 1: Capacity to Receive Requests under the Access to Information Act and the Privacy Act

Section 2: Capacity to Process Records under the Access to Information Act and the Privacy Act

Section 3: Open Requests and Complaints Under the Access to Information Act

Section 4: Open Requests and Complaints Under the Privacy Act

Section 5: Social Insurance Number (SIN)

Section 6: Universal Access under the Privacy Act