2018–2019 Annual Report on the Administration of the Privacy Act

Table of Contents

Introduction

The Privacy Act (Act) safeguards the privacy of individuals by protecting personal information held by government institutions. The Act also gives individuals the right to access their own personal information. The Office of the Information Commissioner (OIC) has been subject to the Privacy Act since 2007. The OIC pursues all measures to protect personal information and provide prompt access to the personal information it holds in response to requests.

This report, prepared and tabled in accordance with section 72 of the Privacy Act, reviews the OIC’s privacy-related activities for 2018-19.

The OIC received four privacy requests in 2018-19 and had no requests carried over from the previous year. All four requests were completed within the year. The organization also achieved an average completion time for these files of 27.75 days. Please see the “Timeliness” section for more information.

About the Office of the Information Commissioner

The Office of the Information Commissioner (OIC) was established in 1983 under the Access to Information Act to support the work of the Information Commissioner of Canada.

OIC staff carry out confidential investigations into complaints about federal institutions’ handling of access requests, giving both complainants and institutions the opportunity to present their positions.

The OIC strives to maximize compliance with the Act, using the full range of tools, activities and powers at the Commissioner’s disposal. These include negotiating with complainants and institutions without the need for formal investigations, making formal recommendations to resolve matters at the conclusion of investigations, and bringing cases to the Federal Court to ensure the Act is properly applied and interpreted.

The OIC supports the Information Commissioner in her advisory role to Parliament and parliamentary committees on all matters pertaining to access to information.

The OIC also raises awareness regarding freedom of information in Canada through targeted initiatives such as Right to Know Week and ongoing dialogue with Canadians, Parliament and federal institutions.

The Commissioner is supported by a staff complement of approximately 90 employees and three deputy commissioners:

  • Deputy Commissioner, Investigations and Governance
  • Deputy Commissioner, Legal Services and Public Affairs
  • Deputy Commissioner, Corporate Services, Strategic Planning and Transformation Services

The Access to Information and Privacy Secretariat falls under the Legal Services and Public Affairs branch.

Privacy Activities at the OIC

The OIC has a small team of specialists who carry out the organization’s access to information and privacy (ATIP) activities. In 2018–19, the ATIP Secretariat was comprised of the ATIP Manager (full-time) supported by a full-time ATIP Officer and a part-time student.

Secretariat staff process requests, provide training on access and privacy matters to new staff, and develop and implement policies and procedures.

In 2018-19, the ATIP Secretariat held awareness and training sessions for employees on their responsibilities under the Privacy Act. A total of 62 staff attended these sessions. No new policies, guidelines, procedures or initiatives were implemented during the reporting period.

Since March 2016, the Secretariat publishes A-Tips, a regular series of tips and reminders posted on the OIC intranet to remind employees about their access to information and privacy responsibilities. These posts are rotated on a biweekly basis to ensure awareness of obligations imposed by the Access to Information Act and the Privacy Act, as well as to provide best practices and other helpful information. The purpose of this initiative is to keep ATIP issues top of mind for all staff.

A weekly file status report is shared with senior management for information purposes. Privacy request files are included but the subject of the request is not provided. File status is monitored on an ongoing basis by all members of the ATIP team.

The ATIP Manager and the Deputy Commissioner of Legal Services and Public Affairs hold full delegated authority under the Act. Appendix A copy of the delegation order is included in this report.

Privacy Breaches

There were no material breaches in 2018-19 however there was one breach reported to both the Office of the Privacy Commissioner and the Treasury Board Secretariat. The incident in question was in relation to a copy of an old labour relations file that had been left behind in a locked, limited-access file cabinet after an office move.

When the cabinet was unlocked, the file was found by someone uninvolved in the matter, and this was reported to the OIC staff responsible for security. Steps were taken immediately to correct the situation and a plan was put in place to ensure that this did not reoccur. The plan included training and awareness sessions on privacy obligations which was carried out by the ATIP Secretariat. It also recommended that the employee departure checklist be updated in a manner that makes managers accountable for ensuring that departing employees do not leave documents in file cabinets.

There were an additional three minor privacy breaches reported for administrative errors. In each instance, an email was sent to the incorrect recipient. These breaches were incorporated in the training and awareness sessions as examples to illustrate the importance of handling personal information with care.

Privacy Impact Assessments

There were no privacy impact assessments completed in 2018-19.

2018-19 Statistics and Trends

Appendix B contains the OIC’s statistical report on the Privacy Act for 2018-19. The following sets out some highlights from that report, along with some trends related to workload, timeliness and disclosure over the years the OIC has been subject to the Privacy Act.

Workload

The OIC received four new requests in 2018-19 and had no requests carried over from the previous year. This is a 33% decrease from the six files received in 2017-18, and a 60% decrease from the ten requests received in 2016-17. However, the OIC processed 16 255 pages which is a significant increase from previous years, with 5 501 processed in 2016-17, and 4 007 pages processed in 2017-18. There were three requests that required the processing of over 1 000 pages. In the previous three years there was an average of 5 140 pages processed.

Timeliness

The OIC completed all requests within the reporting period. None of the requests the OIC completed in 2018-19 were late. In fact, over the last 10 years that the OIC has been subject to the Privacy Act, it has always completed a request within the statutory deadline.

The average time taken to respond to privacy requests was 27.75 days for 2018-19. One extension was taken for 30 days under paragraph 15(1)(a) as there was a large volume of records and meeting the original deadline would have interfered with the operations of the institution. If this file is not factored in, the average completion time falls to 17 days which is in line with the average over the last five years. For example, the average processing time in 2014-15 was 19 days, in 2015-16 it was 17.3 days, in 2016-17 it was 13.9 days, and it was 26 days in 2017-18.

Disclosure

The OIC disclosed all the processed records for one request in 2018-19. The records were disclosed in part for another three. Overall, the OIC disclosed 6,089 pages, 37% of the number of pages processed.

In 2018-19, the OIC claimed exemptions to withhold information in three of the four requests processed. The most often-used exemption was section 22(1)(b) (law enforcement and investigations; three instances), followed by section 26 (personal information of someone other than the requester; one instance), and section 27 (solicitor-client privilege; one instance). This is consistent with recent trends at the OIC.

The OIC applied no exclusions to records in 2018-19.

The OIC made no disclosures of personal information in the public interest under paragraph 8(2)(m).

Complaints

The Office of the Privacy Commissioner received no complaints about the OIC’s handling of privacy matters in 2018-19.

Appendix A: Delegation Order, Privacy Act

Delegation Order, Access to Information Act-1

Text version

Arrêté de délégation en vertu de la Loi sur l’accès à l’informationet de la Loi sur la protection des renseignements personnels

Delegation orders for the purpose of the Access to Information Act and the Privacy Act

En vertu de l’article 73 de la Loi sur l’accès à l’information et de la Loi sur la protection des renseignements personnels, la Commissaire à l’information du Canada délègue aux titulaires des postes mentionnés à l’annexe ci-après, ainsi qu’aux personnes occupant à titre intérimaire lesdits postes, les attributions dont elle est investie en qualité de responsable d’une institution fédérale, c’est-à-dire le Commissariat à l’information du Canada.  Le présent arrêté de délégation annule et remplace tout arrêté antérieur fait en vertu de l’article 73.

Cet arrêté de délégation prend effet le 14 novembre 2016.

Daté, à la ville de Gatineau, ce 14 jour de novembre 2016

Original signé par

The Information Commissioner of Canada, pursuant to Section 73 of the Access to Information Act and of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers and functions of the Information Commissioner of Canada as the head of a government institution that is, the Office of the Information Commissioner of Canada. This Delegation Order supersedes all previous Delegation Orders pursuant to section 73.

This delegation order is effective on November 14, 2016

Dated, at the City of Gatineau, this 14 day of November 2016

Original signed by

______________________________________________

Suzanne Legault

Commissaire à l’information du Canada

Information Commissioner of Canada

Delegation Order, Access to Information Act-2

Text version
Annexe / Schedule
Position / Poste Loi sur la protection des renseignements personnelset règlement / Privacy Actand Regulations Loi sur l’accès à l’informationet règlement / Access to Information Actand Regulations
Avocat général / General Counsel Autorité Absolue / Full Authority Autorité Absolue / Full Authority
Gestionnaire, Accès à l’information et protection des renseignements personnels / Manager, Access to Information and Privacy Autorité Absolue / Full Authority Autorité Absolue / Full Authority
Agent de l’AIPRP / ATIP Officer Articles de la Loi / Sections of the Act : 15, 17(2)(b) Articles du Règlement / Sections of the Regulations : 9, 11(2), 11(4), 13(1), 14 Articles de la loi / Sections of the Act : 4(2.1), 8(1), 9, 11(2), 11(3), 11(4), 11(5), 11(6), 12(2), 12(3), 27(1), 27(4), 29(1). Articles du Règlement / Sections of the Regulations : 6(1), 7(2), 7(3), 8, 8.1

Delegation Order, Access to Information Act-3

Text version

Arrêté de délégation en vertu de la Loi sur l’accès à l’informationet de la Loi sur la protection des renseignements personnels

Delegation orders for the purpose of the Access to Information Act and the Privacy Act

En vertu de l’article 73 de la Loi sur l’accès à l’information et de la Loi sur la protection des renseignements personnels, la Commissaire à l’information du Canada délègue aux titulaires des postes mentionnés à l’annexe ci-après, ainsi qu’aux personnes occupant à titre intérimaire lesdits postes, les attributions dont elle est investie en qualité de responsable d’une institution fédérale, c’est-à-dire le Commissariat à l’information du Canada.  Le présent arrêté de délégation annule et remplace tout arrêté antérieur fait en vertu de l’article 73.

Cet arrêté de délégation prend effet le 22 mai 2018.

Daté, à la ville de Gatineau, ce 22 jour de mai 2018

Original signé par

The Information Commissioner of Canada, pursuant to Section 73 of the Access to Information Act and of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers and functions of the Information Commissioner of Canada as the head of a government institution that is, the Office of the Information Commissioner of Canada. This Delegation Order supersedes all previous Delegation Orders pursuant to section 73.

This delegation order is effective on May 22, 2018

Dated, at the City of Gatineau, this 22 day of May 2018

Original signed by

______________________________________________

Caroline Maynard

Commissaire à l’information du Canada

Information Commissioner of Canada

Delegation Order, Access to Information Act-4

Text version
Annexe / Schedule
Position / Poste Loi sur la protection des renseignements personnelset règlement / Privacy Actand Regulations Loi sur l’accès à l’informationet règlement.Access to Information Actand Regulations
Deputy Commissioner, Legal Services and Public Affairs/ Sous commissaire, Services juridiques et Affaires publiques Autorité Absolue / Full Authority Autorité Absolue / Full Authority
Gestionnaire, Accès à l’information et protection des renseignements personnels / Manager, Access to Information and Privacy Autorité Absolue / Full Authority Autorité Absolue / Full Authority
Agent de l’AIPRP / ATIP Officer Articles de la Loi / Sections of the Act : aucune délégation  no delegation Articles du Règlement / Sections of the Regulations : 11(2), 11(4) Articles de la loi / Sections of the Act : 4(2.1), 8(1), 11(6), 27(1), 27(4). Articles du Règlement / Sections of the Regulations : 6(1)

Appendix B: 2018–2019 Statistical Report

Statistical Report on the Privacy Act

Name of institution: Office of the Information Commissioner of Canada

Reporting period: 2018-04-01 to 2019-03-31

PART 1: Requests Under the Privacy Act

  Number of Requests
Received during reporting period 4
Outstanding from previous reporting period 0
Total 4
Closed during reporting period 4
Carried over to next reporting period 0

PART 2: Requests Closed During the Reporting Period

2.1  Disposition and completion time

Disposition of
Requests
Completion Time
1 to 15 Days 16 to 30 Days 31 to 60 Days 61 to 120 Days 121 to 180 Days 181 to 365 Days More Than 365 Days Total
All disclosed 1 0 0 0 0 0 0 1
Disclosed in part 0 2 1 0 0 0 0 3
All exempted 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0
No records exist 0 0 0 0 0 0 0 0
Request abandoned 0 1 0 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0 0 0 0
Total 1 2 1 0 0 0 0 4

2.2  Exemptions

Section Number of Requests Section Number of Requests Section Number of Requests
18(2) 0 22(1) a)(i) 0 23 a) 0
19(1) a) 0 22(1) a)(ii) 0 23 b) 0
19(1) b) 0 22(1) a)(iii) 0 24 a) 0
19(1) c) 0 22(1) b) 3 24 b) 0
19(1) d) 0 22(1) c) 0 25 0
19(1) e) 0 22(2) 0 26 1
19(1) f) 0 22.1 0 27 1
20 0 22.2 0 28 0
21 0 22.3 0    

2.3  Exclusions

Section Number of Requests Section Number of Requests Section Number of Requests
69(1)(a) 0 70(1) 0 70(1)(d) 0
69(1)(b) 0 70(1)(a) 0 70(1)(e) 0
69.1 0 70(1)(b) 0 70(1)(f) 0
    70(1)(c) 0 70.1 0

2.4  Format of information released

Disposition Paper Electronic Other formats
All disclosed 0 1 0
Disclosed in part 0 3 0
Total 0 4 0

2.5  Complexity

2.5.1  Relevant pages processed and disclosed

Disposition of Requests Number of Pages Processed Number of Pages Disclosed Number of Requests
All disclosed 14 14 1
Disclosed in part 16241 6075 3
All exempted 0 0 0
All excluded 0 0 0
Request abandoned 0 0 0
Neither confirmed nor denied 0 0 0
Total 16255 6069 4

2.5.2  Relevant pages processed and disclosed by size of requests

Disposition Less Than 100
Pages Processed
101-500
Pages Processed
501-1000
Pages Processed
1001-5000
Pages Processed
More than 5000
Pages Processed
Number of
Requests
Pages Disclosed Number of
Requests
Pages Disclosed Number of
Requests
Pages Disclosed Number of
Requests
Pages Disclosed Number of
Requests
Pages Disclosed
All disclosed 1 14 0 0 0 0 0 0 0 0
Disclosed in part 0 0 2 0 0 0 1 5721 1 354
All exempted 0 0 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0 0 0
Request abandoned 0 0 0 0 0 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0 0 0 0 0 0
Total 1 14 0 0 0 0 1 5721 0 354

2.5.3  Other complexities

Disposition Consultation Required Legal Advice Sought Interwoven Information Other Total
All disclosed 0 0 0 0 0
Disclosed in part 0 0 0 0 0
All exempted 0 0 0 0 0
All excluded 0 0 0 0 0
Request abandoned 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0
Total 0 0 0 0 0

2.6  Deemed refusals

2.6.1  Reasons for not meeting statutory deadline

Number of Requests Closed Past the Statutory Deadline Principal Reason
Workload External Consultation Internal Consultation Other
0 0 0 0 0

2.6.2  Number of days past deadline

Number of Days Past Deadline Number of Requests Past Deadline Where No Extension Was Taken Number of Requests Past Deadline Where An Extension Was Taken Total
1 to 15 days 0 0 0
16 to 30 days 0 0 0
31 to 60 days 0 0 0
61 to 120 days 0 0 0
121 to 180 days 0 0 0
181 to 365 days 0 0 0
More than 365 days 0 0 0
Total 0 0 0

2.7  Requests for translation

Translation Requests Accepted Refused Total
English to French 0 0 0
French to English 0 0 0
Total 0 0 0

PART 3: Disclosures Under Subsection 8(2) and 8(5)

Paragraph 8(2)(e) Paragraph 8(2)(m) Subsection 8(5) Total
0 0 0 0

PART 4: Requests for Correction of Personal Information and Notations

Disposition for Correction Requests Received Number
Notations attached 0
Requests for correction accepted 0
Total 0

PART 5: Extensions

5.1  Reasons for extensions and disposition of requests

Disposition of Requests Where an Extension Was Taken 15(a)(i)
Interference With Operations
15(a)(ii)
Consultation
15(b)
Translation or Conversion
Section 70 Other
All disclosed 0 0 0 0
Disclosed in part 0 0 0 0
All exempted 0 0 0 0
All excluded 0 0 0 0
No records exist 0 0 0 0
Request abandoned 0 0 0 0
Total 1 0 0 0

5.2  Length of extensions

Length of Extensions 15(a)(i)
Interference with operations
15(a)(ii)
Consultation
15(b)
Translation purposes
Section 70 Other
1 to 15 days 0 0 0 0
16 to 30 days 1 0 0 0
Total 1 0 0 0

PART 6: Consultations Received From Other Institutions and Organizations

6.1  Consultations received from other Government of Canada institutions and other organizations

Consultations Other Government of Canada Institutions Number of Pages to Review Other Organizations Number of Pages to Review
Received during the reporting period 0 0 0 0
Outstanding from the previous reporting period 0 0 0 0
Total 0 0 0 0
Closed during the reporting period 0 0 0 0
Pending at the end of the reporting period 0 0 0 0

6.2  Recommendations and completion time for consultations received from other Government of Canada institutions

Recommendation Number of Days Required to Complete Consultation Requests
1 to 15 Days 16 to 30 Days 31 to 60 Days 61 to 120 Days 121 to 180 Days 181 to 365 Days More Than 365 Days Total
All disclosed 1 0 0 0 0 0 0 1
Disclosed in part 0 0 0 0 0 0 0 0
All exempted 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0
Consult other institution 0 0 0 0 0 0 0 0
Other 0 0 0 0 0 0 0 0
Total 1 0 0 0 0 0 0 1

6.3  Recommendations and completion time for consultations received from other organizations

Recommendation Number of days required to complete consultation requests
1 to 15 Days 16 to 30 Days 31 to 60 Days 61 to 120 Days 121 to 180 Days 181 to 365 Days More Than 365 Days Total
All disclosed 0 0 0 0 0 0 0 0
Disclosed in part 0 0 0 0 0 0 0 0
All exempted 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0
Consult other institution 0 0 0 0 0 0 0 0
Other 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0

PART 7: Completion Time of Consultations on Cabinet Confidences

7.1 Requests with Legal Services

Number of Days Fewer Than 100 Pages Processed 101-500 Pages Processed 501-1000 Pages Processed 1001-5000 Pages Processed More Than 5000 Pages Processed
Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed
1 to 15 0 0 0 0 0 0 0 0 0 0
16 to 30 0 0 0 0 0 0 0 0 0 0
31 to 60 0 0 0 0 0 0 0 0 0 0
61 to 120 0 0 0 0 0 0 0 0 0 0
121 to 180 0 0 0 0 0 0 0 0 0 0
181 to 365 0 0 0 0 0 0 0 0 0 0
More than 365 0 0 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0 0 0

7.2 Requests with Privy Council Office

Number of Days Fewer Than 100 Pages Processed 101-500 Pages Processed 501-1000 Pages Processed 1001-5000 Pages Processed More Than 5000 Pages Processed
Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed
1 to 15 0 0 0 0 0 0 0 0 0 0
16 to 30 0 0 0 0 0 0 0 0 0 0
31 to 60 0 0 0 0 0 0 0 0 0 0
61 to 120 0 0 0 0 0 0 0 0 0 0
121 to 180 0 0 0 0 0 0 0 0 0 0
181 to 365 0 0 0 0 0 0 0 0 0 0
More than 365 0 0 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0 0 0

PART 8: Complaints and Investigations Notices Received

Section 31 Section 33 Section 35 Court action Total
0 0 5 0 5

PART 9: Privacy Impact Assessments (PIAs)

Number of PIA(s) completed 1

Part 10: Resources Related to the Privacy Act

10.1 Costs

Expenditures Amount
Salaries  $69,490
Overtime $0
Goods and Services $46
  • Professional services contracts
$0
  • Other
$46
Total $69,536

10.2 Human Resources

Resources Person Years Dedicated to Privacy Activities
Full-time employees 0.74
Part-time and casual employees 0.00
Regional staff 0.00
Consultants and agency personnel 0.00
Students 0.00
Total 0.91

Note: Enter values to two decimal places.

Date modified:
Submit a complaint