2016-2017 Annual Report on the Administration of the Privacy Act

Download

Introduction

The Privacy Act (Act) safeguards the privacy of individuals by protecting personal information held by government institutions. The Act also gives individuals the right to access their own personal information. The Office of the Information Commissioner (OIC) has been subject to the Privacy Act since 2007. The OIC pursues all measures to protect personal information and provide prompt access to the personal information it holds in response to requests.

This report, prepared and tabled in accordance with section 72 of the Privacy Act, reviews the OIC's privacy-related activities for 2016–2017.

The OIC received ten new privacy requests in 2016-2017 and carried one over from the previous year. All eleven requests were completed within the year. The organization also achieved the notable average completion time for these files of 13.9 days.

About the OIC

The OIC is an independent public body created in 1983 under the Access to Information Act. The OIC's primary responsibility is to conduct efficient, fair and confidential investigations into complaints about federal institutions’ handling of access to information requests. The OIC primarily uses mediation and persuasion to resolve complaints. The OIC brings cases to the Federal Court to ensure the Access to Information Act is properly applied and interpreted.

The OIC also supports the Information Commissioner in her advisory role to Parliament and parliamentary committees on all matters pertaining to access to information. The OIC actively makes the case for greater freedom of information in Canada through targeted initiatives such as Right to Know Week and ongoing dialogue with Canadians, Parliament and federal institutions.

Organization Structure

Text Version

This organizational chart shows the titles of the two senior officials at the Office of the Information Commissioner who report to the Information Commissioner: Assistant Commissioner, Complaints Resolution and Compliance, and General Counsel and Director, Legal Services. In addition, the chart shows that Corporate Services falls under the responsibility of the Assistant Commissioner and Public Affairs under the responsibility of the General Counsel.

Complaints Resolution and Compliance mediates and investigates complaints about the processing of access to information requests and any issues related to requesting or obtaining access to records under the Access to Information Act, and makes formal recommendations to institutions and heads of institutions, as required.

Legal Services represents the Commissioner in court as she seeks to clarify points of access law and uphold information rights. Lawyers provide legal advice on investigations, and on administrative and legislative matters, as well as customized reference tools and training on recent case law. Legal Services also monitors legislative developments to determine their possible effect on the Commissioner’s work and access to information in general.

Public Affairs conducts communications and external relations with a wide range of stakeholders, notably Parliament, governments and the media. Public Affairs also provides input to the Treasury Board of Canada Secretariat on improving the administration of the Access to Information Act. Public Affairs is responsible for the OIC's access to information and privacy function.

Corporate Services provides strategic and corporate leadership for planning and reporting, human resources and financial management, security and administrative services, internal audit and evaluation, and information management and technology.

Privacy Activities at the OIC

The OIC has a small team of specialists who carry out the organization’s access to information and privacy (ATIP) activities. In 2016–2017, the ATIP Secretariat comprised the ATIP Manager (full time) supported by a consultant (part time). The end of the year saw the addition of a full time ATIP Officer as well.

Secretariat staff process requests, provide training on privacy matters to new staff, and develop and implement policies and procedures.

In 2016-2017, the Secretariat held four training sessions for employees on their responsibilities under the Access to Information Act and Privacy Act, with a total of 14 staff in attendance. There was also an initiative undertaken to train new investigators on how to process requests under the Access to Information Act. This is intended to assist them when they are interacting with analysts at institutions under investigation.

In March 2016, the Secretariat introduced A-Tips, a regular series of tips and reminders posted on the OIC intranet to remind employees about their access to information and privacy responsibilities. These posts were rotated on a biweekly basis to ensure awareness of obligations imposed by the Access to Information Act and the Privacy Act, as well as to provide best practices and other helpful information. The feedback from this initiative has been very positive.

The ATIP Manager and other OIC officials hold full delegated authority under the Act. Appendix A contains a copy of the delegation order.

Privacy Breaches

No material privacy breaches occurred in 2016-2017.

Privacy Impact Assessments

There were no privacy impact assessments completed in 2016-2017.

2016–2017 Statistics and Trends

Appendix B contains the OIC’s statistical report on the Privacy Act for 2016–2017. The following sets out some highlights from that report, along with some trends related to workload, timeliness and disclosure over the years the OIC has been subject to the Privacy Act.

Workload

The OIC received ten new requests in 2016-2017 and carried one over from the previous year. This is in line with normal volumes.

In responding to these requests, the OIC processed 5501 pages. There were three requests that required the processing of over 1000 pages.

Timeliness

The OIC completed all requests within the reporting period. All were completed within 30 days (so no extensions were required), and the average completion time was 13.9 days. With the exception of 2012–2013, the OIC has achieved an average completion time of less than 20 days each year.

None of the requests the OIC completed in 2016-2017 were late. In fact, over the ten years the OIC has been subject to the Privacy Act, it has never completed a request late (known as a “deemed refusal”).

Disclosure

The OIC disclosed all the processed records for five requests in 2016-2017. The records were disclosed in part for another five. In one case no records were found that were responsive to the request. Overall, the OIC disclosed 5303 pages, 96 percent of the number of pages processed.

In 2016-2017, the OIC claimed exemptions to withhold information in five of the ten requests where responsive records were found. The most often used was paragraph 22(1)(b) (law enforcement and investigations; three instances), followed by section 26 (personal information of someone other than the requester; two instances). This is consistent with recent trends.

The OIC applied no exclusions to records in 2016–2017.

The OIC made no disclosures of personal information in the public interest under paragraph 8(2)(m).

Complaints

The Office of the Privacy Commissioner received no complaints about the OIC’s handling of privacy matters in 2016-2017.

Investigations into six complaints from previous years are ongoing.

Appendix A: Delegation Order, Privacy Act

 

the Access to Information Act and the Privacy Act/ Arrêté de délégation en vertu de la <em>Loi sur l’accès à l’information et de la Loi sur la protection des renseignements personnels" height="808" src="/sites/default/files/userfiles/images/oic-eng/reports_and_publications/annual_reports/Privacy/appendix-a.png" width="624" />

Text Version

Delegation orders for the purpose of the Access to Information Act and the Privacy Act

Arrêté de délégation en vertu de la Loi sur l’accès à l’informationet de la Loi sur la protection des renseignements personnels

The Information Commissioner of Canada, pursuant to Section 73 of the Access to Information Act and of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers and functions of the Information Commissioner of Canada as the head of a government institution that is, the Office of the Information Commissioner of Canada. This Delegation Order supersedes all previous Delegation Orders pursuant to section 73.

This delegation order is effective on November 14, 2016

Dated, at the City of Gatineau, this 14th day of November 2016

En vertu de l’article 73 de la Loi sur l’accès à l’information et de la Loi sur la protection des renseignements personnels, la Commissaire à l’information du Canada délègue aux titulaires des postes mentionnés à l’annexe ci-après, ainsi qu’aux personnes occupant à titre intérimaire lesdits postes, les attributions dont elle est investie en qualité de responsable d’une institution fédérale, c’est-à-dire le Commissariat à l’information du Canada. Le présent arrêté de délégation annule et remplace tout arrêté antérieur fait en vertu de l’article 73.

Cet arrêté de délégation prend effet le 14 novembre 2016.

Daté,  à la ville d’Gatineau, ce 14eme jour de novembre 2016

Original signed by

______________________________________________

Suzanne Legault
Information Commissioner of Canada
Commissaire à l’information du Canada

Text Version

Schedule / Annexe

Position/ Poste

 

Director General (Corporate Services) /
Directeur général (Services organisationnels)

Director, ATIP Secretariat/
Directeur, Secrétariat de l’AIPRP

ATIP Officer/
Agent de l’AIPRP

Privacy Act and Regulations/
Loi sur la protection des renseignements personnels et règlement.

Full Authority/
Autorité Absolue

Full Authority/
Autorité Absolue

Sections of the Act / articles de la Loi: 15, 17(2)(b)

Sections of the Regulations / articles du Règlement: 9, 11(2), 11(4), 13(1), 14

Access to Information Act and Regulations/
Loi sur l’accès à l’information et règlement.

Full Authority/
Autorité Absolue

Full Authority/
Autorité Absolue

Sections of the Act / articles de la Loi: 4(2.1), 8(1), 9, 11(2), 11(3), 11(4), 11(5), 11(6), 12(2), 12(3), 27(1), 27(4), 29(1).

Sections of the Regulations / articles du Règlement: 6(1), 7(2), 7(3), 8, 8.1

Appendix B: 2016–2017 Statistical Report

Statistical Report on the Privacy Act

Name of institution: Office of the Information Commissioner of Canada

Reporting period: 2016-04-01 to 2017-03-31

PART 1: Requests Under the Privacy Act

PART 2: Requests Closed During the Reporting Period

2.1  Disposition and completion time

2.2  Exemptions

2.3  Exclusions

2.4  Format of information released

2.5  Complexity

2.5.1  Relevant pages processed and disclosed

2.5.2  Relevant pages processed and disclosed by size of requests

2.5.3  Other complexities

2.6  Deemed refusals

2.6.1  Reasons for not meeting statutory deadline

2.6.2  Number of days past deadline

2.7  Requests for translation

PART 3: Disclosures Under Subsection 8(2) and 8(5)

PART 4: Requests for Correction of Personal Information and Notations

PART 5: Extensions

5.1  Reasons for extensions and disposition of requests

5.2  Length of extensions

PART 6: Consultations Received From Other Institutions and Organizations

6.1  Consultations received from other Government of Canada institutions and other organizations

6.2  Recommendations and completion time for consultations received from other Government of Canada institutions

6.3  Recommendations and completion time for consultations received from other organizations

PART 7: Completion Time of Consultations on Cabinet Confidences

7.1 Requests with Legal Services

7.2 Requests with Privy Council Office

PART 8: Complaints and Investigations Notices Received

PART 9: Privacy Impact Assessments (PIAs)

Part 10: Resources Related to the Privacy Act

10.1 Costs

10.2 Human Resources

Note: Enter values to two decimal places.