2014-2015 Annual Report on the Administration of the Privacy Act

Download

1 Introduction

This report to Parliament, prepared and tabled in accordance with section 72 of the Privacy Act, describes the activities of the Office of the Information Commissioner of Canada (OIC) in administering the Act during 2014–2015.

The purpose of the Act is to safeguard the privacy of individuals by protecting personal information held by government institutions. The Act also gives individuals the right to access their own personal information.

The OIC was established under the Access to Information Act in 1983 as an independent oversight body reporting to Parliament. The OIC conducts efficient, fair and confidential investigations into complaints about government institutions’ handling of access to information requests, to maximize compliance with the Act while fostering disclosure of public sector information.

The OIC became subject to the Privacy Act in 2007. Since then, the organization has made every effort to provide exemplary service to requesters. Here are some highlights from 2014–2015:

• responding to 21 formal requests—more than double the number in 2013–2014—in an average of 19 days; and
• reviewing a total of 5,421 pages, compared to 3,790 pages in 2013–2014, a 43-percent increase.

2 Organization

The Information Commissioner is supported by employees working in three branches, as follows:

• The Complaints Resolution and Compliance Branch, under the direction of the Assistant Commissioner, Complaints Resolution and Compliance, carries out investigations and dispute resolution efforts to resolve complaints. It also conducts systemic investigations.
• Legal Services, under the direction of the General Counsel, represents the Commissioner in court cases and provides legal advice on investigations, as well as on legislative and administrative matters.
• Corporate Services, led by the Director General, Corporate Services, provides strategic and corporate leadership for various functions, such as communications, human resources, and information management and technology. It also manages the access to information and privacy function.

The Access to Information and Privacy (ATIP) Secretariat processes all requests made under the Privacy Act for records under the OIC’s control. The ATIP Secretariat had three staff members in 2014–2015:

• The Director, ATIP Secretariat, oversees the handling of requests, policy development and training. As ATIP Coordinator, the Director holds full delegated authority under the Act. The Director reports to the Director General, Corporate Services.
• The Senior ATIP Officer processes requests and holds some delegated authority for tasks such as taking time extensions and arranging for translation or interpretation of personal information. The Senior ATIP Officer reports to the Director, ATIP Secretariat.
• The Junior ATIP Officer processes requests and performs administrative tasks in the ATIP Secretariat. The Junior ATIP Officer reports to the Director, ATIP Secretariat.

3 Delegation order

Under the Privacy Act, the Information Commissioner is the designated head of the institution for the purpose of administering the legislation.

During the reporting period, the delegation order under section 73 of the Act, signed on July 16, 2011, was in effect (Appendix A).

4 Interpretation of the statistical report

The statistical report (Appendix B) details all aspects of the ATIP Secretariat’s processing of privacy requests completed between April 1, 2014, and March 31, 2015. Below are some items of note from that report.

4.1 Requests received under the Privacy Act

The OIC received 22 new requests in 2014–2015, compared to 9 in 2013–2014.

4.2 Disposition of completed requests

The OIC completed 21 requests during the reporting period, carrying 1 over to the subsequent fiscal year. The OIC disclosed all the requested information in 5 cases. In 12 instances, the OIC disclosed the information in part. No records existed in 3 cases and 1 request was abandoned.

The number of pages processed totalled 5,421, compared to 3,790 in the previous year, an increase of 43 percent. Half of the requests completed required the OIC to process fewer than 100 pages.

4.3 Completion times

The OIC completed all requests within the statutory timelines, in an average of 19 days, and did not claim any extensions. (One request was completed in 30 days; however, the due date fell on a weekend or statutory holiday and was, therefore, moved to the next business day. As such, it is noted as having been completed in 31 to 60 days in section 2.1 of Appendix B.)

4.4 Exemptions

The OIC invoked subsection 22(1)(b) (investigations) for 8 requests in order to protect information obtained during the course of investigations. The OIC also invoked section 26 (information about another individual) for 6 requests.

4.5 Costs

Costs incurred during the reporting period are calculated based on the salaries of ATIP Secretariat members and expenses associated with administering the Act.

5 Education and training

The ATIP Secretariat provided one-on-one training on ATIP procedures to OIC employees, as needed. Secretariat staff also provided ongoing guidance to offices of primary interest (subject-matter experts) regarding the search and retrieval of relevant records.

6 Changes to the organization, programs, operations or policies

During the reporting period, the ATIP Director took on a new role within the OIC. The Senior ATIP Officer is filling the position on an acting basis and a competitive process is under way to staff it permanently.

7 Complaints

Three complaints were lodged with the Privacy Commissioner of Canada in 2014–2015 regarding the OIC’s application of the collection, use and disclosure provisions of the Privacy Act. The investigations into these complaints are ongoing.

One complaint carried over from 2013–2014 was concluded during the reporting period. The OIC had identified records that should have been included in a release package after responding to the requester. Although the records were subsequently processed and sent to the requester prior to the complaint being filed, it was closed with a finding of well founded/resolved, since the OIC had initially failed to locate all the relevant records.

8 Monitoring timelines

The ATIP Secretariat monitors the time taken to process requests and generates a report on all open requests through the electronic case management system, including their status and due dates and without reference to the identity of the requesters. This report is circulated to OIC senior management once a week.

9 Privacy breaches

No privacy breaches occurred during the reporting period.

10 Privacy Impact Assessments

The OIC neither initiated nor completed any Privacy Impact Assessments in 2014–2015. These assessments are required when an organization gathers new personal information or when it changes the purposes for which it gathers personal information.

11 Public interest disclosures

The OIC made no disclosures of information under paragraph 8(2)(m) of the Privacy Act during the reporting period. These disclosures are made when the Commissioner decides that releasing information in the public interest clearly outweighs any invasion of the privacy of the person to whom the records relate or when releasing the information would benefit the person in question.

Appendix A: Delegation orders, July 16, 2011

Text Version

Delegation orders for the purpose of the Access to Information Act and the Privacy Act

Arrêté de délégation en vertu de la Loi sur l’accès à l’informationet de la Loi sur la protection des renseignements personnels

The Information Commissioner of Canada, pursuant to Section 73 of the Access to Information Act and of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers and functions of the Information Commissioner of Canada as the head of a government institution that is, the Office of the Information Commissioner of Canada.  This Delegation Order supersedes all previous Delegation Orders pursuant to section 73.

This delegation order is effective on July 18, 2011

Dated, at the City of Ottawa, this 16 day of July 2011

En vertu de l’article 73 de la Loi sur l’accès à l’information et de la Loi sur la protection des renseignements personnels, la Commissaire à l’information du Canada délègue aux titulaires des postes mentionnés à l’annexe ci-après, ainsi qu’aux personnes occupant à titre intérimaire lesdits postes, les attributions dont elle est investie en qualité de responsable d’une institution fédérale, c’est-à-dire le Commissariat à l’information du Canada.  Le présent arrêté de délégation annule et remplace tout arrêté antérieur fait en vertu de l’article 73.

Cet arrêté de délégation prend effet le 18 juillet 2011.

Daté,  à la ville d’Ottawa, ce 16 jour de juillet 2011

Original signed by

______________________________________________

Suzanne Legault
Information Commissioner of Canada
Commissaire à l’information du Canada

Appendix B: Statistical Report on the Privacy Act

 

Statistical Report on the Privacy Act

Name of institution: Office of the Information Commissioner of Canada

Reporting period: 2014-04-01 to 2015-03-31

PART 1: Requests Under the Privacy Act

PART 2: Requests Closed During the Reporting Period

2.1  Disposition and completion time

2.2  Exemptions

2.3  Exclusions

2.4  Format of information released

2.5  Complexity

2.5.1  Relevant pages processed and disclosed

2.5.2  Relevant pages processed and disclosed by size of requests

2.5.3  Other complexities

2.6  Deemed refusals

2.6.1  Reasons for not meeting statutory deadline

2.6.2  Number of days past deadline

2.7  Requests for translation

PART 3: Disclosures Under Subsection 8(2) and 8(5)

PART 4: Requests for Correction of Personal Information and Notations

PART 5: Extensions

5.1  Reasons for extensions and disposition of requests

5.2  Length of extensions

PART 6: Consultations Received From Other Institutions and Organizations

6.1  Consultations received from other Government of Canada institutions and other organizations

6.2  Recommendations and completion time for consultations received from other Government of Canada institutions

6.3  Recommendations and completion time for consultations received from other organizations

PART 7: Completion Time of Consultations on Cabinet Confidences

7.1 Requests with Legal Services

7.2 Requests with Privy Council Office

PART 8: Complaints and Investigations Notices Received

PART 9: Privacy Impact Assessments (PIAs)

Part 10: Resources Related to the Privacy Act

10.1 Costs

10.2 Human Resources

Note: Enter values to two decimal places.