2015-2016 Annual Report on the Administration of the Privacy Act
Contents
Introduction
The Privacy Act (Act) safeguards the privacy of individuals by protecting personal information held by government institutions. The Act also gives individuals the right to access their own personal information. The Office of the Information Commissioner (OIC) has been subject to the Privacy Act since 2007. The OIC pursues all measures to protect personal information and provide prompt access to the personal information it holds in response to requests.
This report, prepared and tabled in accordance with section 72 of the Privacy Act, reviews the OIC's privacy-related activities for 2015–2016.
The OIC received eight new privacy requests in 2015–2016 and carried two over from the previous year. Nine of the ten requests were completed within the year. The organization also achieved the notable average completion time for these files of 17.3 days.
About the OIC
The OIC is an independent public body created in 1983 under the Access to Information Act. The OIC's primary responsibility is to conduct efficient, fair and confidential investigations into complaints about federal institutions’ handling of access to information requests. The OIC primarily uses mediation and persuasion to resolve complaints. The OIC brings cases to the Federal Court to ensure the Access to Information Act is properly applied and interpreted.
The OIC also supports the Information Commissioner in her advisory role to Parliament and parliamentary committees on all matters pertaining to access to information. The OIC actively makes the case for greater freedom of information in Canada through targeted initiatives such as Right to Know Week and ongoing dialogue with Canadians, Parliament and federal institutions.
Organizational Structure
Text Version
This organizational chart shows the titles of the two senior officials at the Office of the Information Commissioner who report to the Information Commissioner: Assistant Commissioner, Complaints Resolution and Compliance, and General Counsel and Director, Legal Services. In addition, the chart shows that Corporate Services falls under the responsibility of the Assistant Commissioner and Public Affairs under the responsibility of the General Counsel.
Complaints Resolution and Compliance mediates and investigates complaints about the processing of access to information requests and any issues related to requesting or obtaining access to records under the Access to Information Act, and makes formal recommendations to institutions and heads of institutions, as required.
Legal Services represents the Commissioner in court as she seeks to clarify points of access law and uphold information rights. Lawyers provide legal advice on investigations, and on administrative and legislative matters, as well as customized reference tools and training on recent case law. Legal Services also monitors legislative developments to determine their possible effect on the Commissioner’s work and access to information in general.
Public Affairs conducts communications and external relations with a wide range of stakeholders, notably Parliament, governments and the media. Public Affairs also provides input to the Treasury Board of Canada Secretariat on improving the administration of the Access to Information Act. Public Affairs is responsible for the OIC's access to information and privacy function.
Corporate Services provides strategic and corporate leadership for planning and reporting, human resources and financial management, security and administrative services, internal audit and evaluation, and information management and technology.
Privacy Activities at the OIC
Secretariat
The OIC has a small team of specialists who carry out the organization’s access to information and privacy (ATIP) activities. In 2015–2016, the ATIP Secretariat comprised the Acting Director (full time) and the Junior ATIP Officer (part time), both supported by a consultant (part time).
Secretariat staff process requests, provide training on privacy matters to new staff, and develop and implement policies and procedures.
In October 2015, the OIC approved a protocol to govern when it collects, uses or discloses personal information for non-administrative purposes. The protocol ensures that all personal information is protected and handled in a manner consistent with the Privacy Act and relevant policies.
In 2015–2016, the Secretariat held two training sessions for employees on their responsibilities under the Access to Information Act and Privacy Act, with a total of 23 staff in attendance.
In March 2016, the Secretariat introduced A-Tips, a regular series of tips and reminders posted on the OIC intranet to remind employees about their access to information and privacy responsibilities.
ATIP staff monitor the progress of requests to ensure they are processed efficiently, and generate reports on all open requests through the electronic case management system, for review by senior management.
The Acting Director and other OIC officials hold full delegated authority under the Privacy Act. Appendix A contains a copy of the delegation order. The OIC expects to fill the Director’s position on a permanent basis in 2016–2017.
Privacy breaches
No material privacy breaches occurred in 2015-2016.
Privacy Impact Assessments
In September 2015, the various federal tenants at 30 Victoria Street in Gatineau (where the OIC is located), led by the Office of the Privacy Commissioner, completed a multi-institutional Privacy Impact Assessment of their joint surveillance and access control and identity management security system. The computer-based system integrates several technologies, such as panic alarms, intrusion detectors, cameras, access controls, and smart identity and access cards.
The assessment notes that security officials may use or disclose the personal information collected to help security officials monitor activities and issue temporary access passes. In the event of security-related incidents in the building, security officials may share personal information with law enforcement agencies and emergency workers. Warning signs inform all personnel and visitors that surveillance cameras are recording activities.
2015–2016 statistics and trends
Appendix B contains the OIC’s statistical report on the Privacy Act for 2015–2016. The following sets out some highlights from that report, along with some trends related to workload, timeliness and disclosure over the years the OIC has been subject to the Privacy Act.
Workload
The OIC received eight new requests in 2015–2016 and carried two over from the previous year. It is typical for the OIC to receive fewer than 10 requests in a year. Only once did the OIC receive more than that (22 in 2014–2015).
In responding to these requests, the OIC processed 5,912 pages, which is the second largest amount since the OIC began to track page volume in 2011–2012. The majority of the pages processed in 2015–2016 were for one request (4,369 pages).
The OIC also responded to one consultation request from another institution.
Timeliness
The OIC completed 9 of the 10 incoming requests within the reporting period. All were completed within 30 days (so no extensions were required), and the average completion time was 17.3 days. With the exception of 2012–2013, the OIC has achieved an average completion time of less than 20 days each year.
None of the requests the OIC completed in 2015–2016 were late. In fact, over the nine years the OIC has been subject to the Privacy Act, it has never completed a request late (known as a “deemed refusal”).
Disclosure
The OIC disclosed all the processed records for two requests in 2015–2016. The records were disclosed in part for the remaining seven. Overall, the OIC disclosed 5,751 pages, 97 percent of the number of pages processed.
In 2015–2016, the OIC claimed exemptions nine times to withhold information. The most often used was section 26 (personal information of someone other than the requester; five instances), followed by paragraph 22(1)(b) (law enforcement and investigations; three instances) and section 27 (solicitor-client privilege; one instance). These have traditionally been the most common exemptions the OIC has used to withhold information.
The OIC applied no exclusions to records in 2015–2016.
The OIC made no disclosures of personal information in the public interest under paragraph 8(2)(m).
Complaints
The Office of the Privacy Commissioner received three complaints about the OIC’s handling of privacy matters in 2015–2016. One of these complaints pertains to missing records and the other two to exemptions the OIC applied to withhold information. Investigations into these complaints are ongoing.
One complaint from 2014–2015 about the disclosure of personal information was closed during 2015–2016 as not well founded. Investigations into three complaints from three previous years are ongoing.
Appendix A: Delegation order, Privacy Act
the Access to Information Act and the Privacy Act/ Arrêté de délégation en vertu de la <em>Loi sur l’accès à l’information et de la Loi sur la protection des renseignements personnels" class="width-90" height="808" src="/sites/default/files/userfiles/images/oic-eng/annual_report/appendix-a.png" width="624" />
Text Version
Delegation orders for the purpose of the Access to Information Act and the Privacy Act
Arrêté de délégation en vertu de la Loi sur l’accès à l’informationet de la Loi sur la protection des renseignements personnels
The Information Commissioner of Canada, pursuant to Section 73 of the Access to Information Act and of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers and functions of the Information Commissioner of Canada as the head of a government institution that is, the Office of the Information Commissioner of Canada. This Delegation Order supersedes all previous Delegation Orders pursuant to section 73.
This delegation order is effective on September 8, 2015
Dated, at the City of Gatineau, this 8 day of September 2015
Original signed by
En vertu de l’article 73 de la Loi sur l’accès à l’information et de la Loi sur la protection des renseignements personnels, la Commissaire à l’information du Canada délègue aux titulaires des postes mentionnés à l’annexe ci-après, ainsi qu’aux personnes occupant à titre intérimaire lesdits postes, les attributions dont elle est investie en qualité de responsable d’une institution fédérale, c’est-à-dire le Commissariat à l’information du Canada. Le présent arrêté de délégation annule et remplace tout arrêté antérieur fait en vertu de l’article 73.
Cet arrêté de délégation prend effet le 8 septembre 2015.
Daté, à la ville d’Gatineau, ce 8 jour de septembre 2015
Original signé par
______________________________________________
Suzanne Legault
Information Commissioner of Canada
Commissaire à l’information du Canada
Text Version
Schedule / Annexe
Position / Poste
General Counsel (Director of Legal Services)/
Avocate générale (Directrice des services juridiques)
Director, ATIP Secretariat/
Directeur, Secrétariat de l’AIPRP
ATIP Officer/
Agent de l’AIPRP
Privacy Act and Regulations/
Loi sur la protection des renseignements personnels et règlement.
Full Authority/
Autorité Absolue
Full Authority/
Autorité Absolue
Sections of the Act / articles de la Loi : 15, 17(2)(b)
Sections of the Regulations / articles du Règlement : 9, 11(2), 11(4), 13(1), 14
Access to Information Act and Regulations/
Loi sur l’accès à l’information et règlement.
Full Authority/
Autorité Absolue
Full Authority/
Autorité Absolue
Full Authority/
Autorité Absolue
Sections of the Act / articles de la Loi : 4(2.1), 8(1), 9, 11(2), 11(3), 11(4), 11(5), 11(6), 12(2), 12(3), 27(1), 27(4), 29(1).
Sections of the Regulations / articles du Règlement : 6(1), 7(2), 7(3), 8, 8.1
Appendix B: 2015–2016 statistical report
Statistical Report on the Privacy Act
Name of institution: Office of the Information Commissioner of Canada
Reporting period: 2015-04-01 to 2016-03-31
PART 1: Requests Under the Privacy Act
| Number of Requests | |
|---|---|
| Received during reporting period | 8 |
| Outstanding from previous reporting period | 2 |
| Total | 10 |
| Closed during reporting period | 9 |
| Carried over to next reporting period | 1 |
PART 2: Requests Closed During the Reporting Period
2.1 Disposition and completion time
| Disposition of Requests |
Completion Time | |||||||
|---|---|---|---|---|---|---|---|---|
| 1 to 15 Days | 16 to 30 Days | 31 to 60 Days | 61 to 120 Days | 121 to 180 Days | 181 to 365 Days | More Than 365 Days | Total | |
| All disclosed | 2 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| Disclosed in part | 1 | 6 | 0 | 0 | 0 | 0 | 0 | 7 |
| All exempted | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| All excluded | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| No records exist | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Request abandoned | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Neither confirmed nor denied | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Total | 3 | 6 | 0 | 0 | 0 | 0 | 0 | 9 |
2.2 Exemptions
| Section | Number of Requests | Section | Number of Requests | Section | Number of Requests |
|---|---|---|---|---|---|
| 18(2) | 0 | 22(1)(a)(i) | 0 | 23(a) | 0 |
| 19(1)(a) | 0 | 22(1)(a)(ii) | 0 | 23(b) | 0 |
| 19(1)(b) | 0 | 22(1)(a)(iii) | 0 | 24(a) | 0 |
| 19(1)(c) | 0 | 22(1)(b) | 3 | 24(b) | 0 |
| 19(1)(d) | 0 | 22(1)(c) | 0 | 25 | 0 |
| 19(1)(e) | 0 | 22(2) | 0 | 26 | 5 |
| 19(1)(f) | 0 | 22.1 | 0 | 27 | 1 |
| 20 | 0 | 22.2 | 0 | 28 | 0 |
| 21 | 0 | 22.3 | 0 |
2.3 Exclusions
| Section | Number of Requests | Section | Number of Requests | Section | Number of Requests |
|---|---|---|---|---|---|
| 69(1)(a) | 0 | 70(1) | 0 | 70(1)(d) | 0 |
| 69(1)(b) | 0 | 70(1)(a) | 0 | 70(1)(e) | 0 |
| 69.1 | 0 | 70(1)(b) | 0 | 70(1)(f) | 0 |
| 70(1)(c) | 0 | 70.1 | 0 |
2.4 Format of Information Released
| Disposition | Paper | Electronic | Other formats |
|---|---|---|---|
| All disclosed | 2 | 0 | 0 |
| Disclosed in part | 0 | 7 | 0 |
| Total | 2 | 7 | 0 |
2.5 Complexity
2.5.1 Relevant pages processed and disclosed
| Disposition of Requests | Number of Pages Processed | Number of Pages Disclosed | Number of Requests |
|---|---|---|---|
| All disclosed | 2 | 2 | 2 |
| Disclosed in part | 5910 | 5749 | 7 |
| All exempted | 0 | 0 | 0 |
| All excluded | 0 | 0 | 0 |
| Request abandoned | 0 | 0 | 0 |
| Neither confirmed nor denied | 0 | 0 | 0 |
| Total | 5912 | 5751 | 9 |
2.5.2 Relevant pages processed and disclosed by size of requests
| Disposition | Less Than 100 Pages Processed |
101-500 Pages Processed |
501-1000 Pages Processed |
1001-5000 Pages Processed |
More than 5000 Pages Processed |
|||||
|---|---|---|---|---|---|---|---|---|---|---|
| Number of Requests |
Pages Disclosed | Number of Requests |
Pages Disclosed | Number of Requests |
Pages Disclosed | Number of Requests |
Pages Disclosed | Number of Requests |
Pages Disclosed | |
| All disclosed | 2 | 2 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Disclosed in part | 2 | 101 | 3 | 553 | 1 | 726 | 1 | 4369 | 0 | 0 |
| All exempted | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| All excluded | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Request abandoned | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Neither confirmed nor denied | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Total | 4 | 103 | 3 | 553 | 1 | 726 | 1 | 4369 | 0 | 0 |
2.5.3 Other complexities
| Disposition | Consultation Required | Legal Advice Sought | Interwoven Information | Other | Total |
|---|---|---|---|---|---|
| All disclosed | 0 | 0 | 0 | 0 | 0 |
| Disclosed in part | 0 | 0 | 0 | 1 | 1 |
| All exempted | 0 | 0 | 0 | 0 | 0 |
| All excluded | 0 | 0 | 0 | 0 | 0 |
| Request abandoned | 0 | 0 | 0 | 0 | 0 |
| Neither confirmed nor denied | 0 | 0 | 0 | 0 | 0 |
| Total | 0 | 0 | 0 | 1 | 1 |
2.6 Deemed refusals
2.6.1 Reasons for not meeting statutory deadline
| Number of Requests Closed Past the Statutory Deadline | Principal Reason | |||
|---|---|---|---|---|
| Workload | External Consultation | Internal Consultation | Other | |
| 0 | 0 | 0 | 0 | 0 |
2.6.2 Number of days past deadline
| Number of Days Past Deadline | Number of Requests Past Deadline Where No Extension Was Taken | Number of Requests Past Deadline Where An Extension Was Taken | Total |
|---|---|---|---|
| 1 to 15 days | 0 | 0 | 0 |
| 16 to 30 days | 0 | 0 | 0 |
| 31 to 60 days | 0 | 0 | 0 |
| 61 to 120 days | 0 | 0 | 0 |
| 121 to 180 days | 0 | 0 | 0 |
| 181 to 365 days | 0 | 0 | 0 |
| More than 365 days | 0 | 0 | 0 |
| Total | 0 | 0 | 0 |
2.7 Requests for translation
| Translation Requests | Accepted | Refused | Total |
|---|---|---|---|
| English to French | 0 | 0 | 0 |
| French to English | 0 | 0 | 0 |
| Total | 0 | 0 | 0 |
PART 3: Disclosures Under Subsections 8(2) and 8(5)
| Paragraph 8(2)(e) | Paragraph 8(2)(m) | Subsection 8(5) | Total |
|---|---|---|---|
| 0 | 0 | 0 | 0 |
PART 4: Requests for Correction of Personal Information and Notations
| Disposition for Correction Requests Received | Number |
|---|---|
| Notations attached | 0 |
| Requests for correction accepted | 0 |
| Total | 0 |
PART 5: Extensions
5.1 Reasons for extensions and disposition of requests
| Disposition of Requests Where an Extension Was Taken | 15(a)(i) Interference With Operations |
15(a)(ii) Consultation |
15(b) Translation or Conversion |
|
|---|---|---|---|---|
| Section 70 | Other | |||
| All disclosed | 0 | 0 | 0 | 0 |
| Disclosed in part | 0 | 0 | 0 | 0 |
| All exempted | 0 | 0 | 0 | 0 |
| All excluded | 0 | 0 | 0 | 0 |
| No records exist | 0 | 0 | 0 | 0 |
| Request abandoned | 0 | 0 | 0 | 0 |
| Total | 0 | 0 | 0 | 0 |
5.2 Length of extensions
| Length of Extensions | 15(a)(i) Interference with operations |
15(a)(ii) Consultation |
15(b) Translation purposes |
|
|---|---|---|---|---|
| Section 70 | Other | |||
| 1 to 15 days | 0 | 0 | 0 | 0 |
| 16 to 30 days | 0 | 0 | 0 | 0 |
| Total | 0 | 0 | 0 | 0 |
PART 6: Consultations Received From Other Institutions and Organizations
6.1 Consultations received from other Government of Canada institutions and other organizations
| Consultations | Other Government of Canada Institutions | Number of Pages to Review | Other Organizations | Number of Pages to Review |
|---|---|---|---|---|
| Received during the reporting period | 1 | 9 | 0 | 0 |
| Outstanding from the previous reporting period | 0 | 0 | 0 | 0 |
| Total | 1 | 9 | 0 | 0 |
| Closed during the reporting period | 1 | 9 | 0 | 0 |
| Pending at the end of the reporting period | 0 | 0 | 0 | 0 |
6.2 Recommendations and completion time for consultations received from other Government of Canada institutions
| Recommendation | Number of Days Required to Complete Consultation Requests | |||||||
|---|---|---|---|---|---|---|---|---|
| 1 to 15 Days | 16 to 30 Days | 31 to 60 Days | 61 to 120 Days | 121 to 180 Days | 181 to 365 Days | More Than 365 Days | Total | |
| All disclosed | 1 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| Disclosed in part | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| All exempted | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| All excluded | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Consult other institution | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Other | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Total | 1 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
6.3 Recommendations and completion time for consultations received from other organizations
| Recommendation | Number of days required to complete consultation requests | |||||||
|---|---|---|---|---|---|---|---|---|
| 1 to 15 Days | 16 to 30 Days | 31 to 60 Days | 61 to 120 Days | 121 to 180 Days | 181 to 365 Days | More Than 365 Days | Total | |
| All disclosed | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Disclosed in part | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| All exempted | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| All excluded | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Consult other institution | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Other | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Total | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
PART 7: Completion Time of Consultations on Cabinet Confidences
7.1 Requests with Legal Services
| Number of Days | Fewer Than 100 Pages Processed | 101-500 Pages Processed | 501-1000 Pages Processed | 1001-5000 Pages Processed | More Than 5000 Pages Processed | |||||
|---|---|---|---|---|---|---|---|---|---|---|
| Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | |
| 1 to 15 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 16 to 30 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 31 to 60 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 61 to 120 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 121 to 180 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 181 to 365 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| More than 365 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Total | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
7.2 Requests with Privy Council Office
| Number of Days | Fewer Than 100 Pages Processed | 101-500 Pages Processed | 501-1000 Pages Processed | 1001-5000 Pages Processed | More Than 5000 Pages Processed | |||||
|---|---|---|---|---|---|---|---|---|---|---|
| Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | |
| 1 to 15 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 16 to 30 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 31 to 60 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 61 to 120 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 121 to 180 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 181 to 365 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| More than 365 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Total | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
PART 8: Complaints and Investigations Notices Received
| Section 31 | Section 33 | Section 35 | Court action | Total |
|---|---|---|---|---|
| 3 | 1 | 0 | 0 | 4 |
PART 9: Privacy Impact Assessments (PIAs)
| Number of PIA(s) completed | 1 |
Part 10: Resources Related to the Privacy Act
10.1 Costs
| Expenditures | Amount | |
|---|---|---|
| Salaries | $33,135 | |
| Overtime | $0 | |
| Goods and Services | $23,612 | |
|
$23,333 | |
|
$279 | |
| Total | $56,747 |
10.2 Human Resources
| Resources | Person Years Dedicated to Privacy Activities |
|---|---|
| Full-time employees | 0.25 |
| Part-time and casual employees | 0.22 |
| Regional staff | 0.00 |
| Consultants and agency personnel | 0.17 |
| Students | 0.00 |
| Total | 0.64 |
Note: Enter values to two decimal places.