2021-22 Annual Report on the Administration of the Privacy Act

Table of contents

• Introduction
• About the Office of the Information Commissioner
• 2021-22 Statistics and Trends
  • Workload
  • Timeliness
  • Disclosure
  • Complaints
• Privacy Activities at the OIC
  • Privacy Breaches
  • Privacy Impact Assessments
• Appendix A: Delegation Order, Privacy Act
• Appendix B: 2021-22 Statistical Report
• Supplemental Statistical report on the Access to Information Act and the Privacy Act

Introduction

The Privacy Act (Act) safeguards the privacy of individuals by protecting personal information held by government institutions. The Act also gives individuals the right to access their own personal information. The Office of the Information Commissioner (OIC) has been subject to the Privacy Act since 2007. The OIC pursues all measures to protect personal information and provide prompt access to the personal information it holds in response to requests.

This report, prepared and tabled in accordance with section 72 of the Privacy Act, reviews the OIC’s privacy-related activities for 2021-22.

The OIC received twenty-eight privacy requests in 2021-22 and had no requests carried over from the previous year. All requests were completed within the year. The organization also achieved an average completion time for these files of 18.3 days. Please see the “Timeliness” section for more information.

About the Office of the Information Commissioner

The Office of the Information Commissioner (OIC) was established in 1983 under the Access to Information Act to support the work of the Information Commissioner of Canada.

OIC staff carry out confidential investigations into complaints about federal institutions’ handling of access requests, giving both complainants and institutions the opportunity to present their positions.

The OIC strives to maximize compliance with the Act, using the full range of tools, activities and powers at the Commissioner’s disposal. These include negotiating with complainants and institutions without the need for formal investigations, making formal recommendations and/or issuing orders to resolve matters at the conclusion of investigations.

The OIC supports the Information Commissioner in her advisory role to Parliament and parliamentary committees on all matters pertaining to access to information. The OIC also raises awareness regarding the right of access in Canada through targeted initiatives such as Right to Know Week and ongoing dialogue with Canadians, Parliament and federal institutions.

The Commissioner is supported by a staff complement of approximately 135 employees, including a senior management team of three deputy commissioners:

• Deputy Commissioner, Investigations and Governance
• Deputy Commissioner, Legal Services and Public Affairs
• Deputy Commissioner, Corporate Services, Strategic Planning and Transformation Services

The Access to Information and Privacy Secretariat falls under the Legal Services and Public Affairs Sector. The ATIP Manager and the Deputy Commissioner of Legal Services and Public Affairs hold full delegated authority under the Act. A copy of the delegation order is included at Appendix A of this report.

The OIC has a small team of specialists who carry out the organization’s access to information and privacy (ATIP) activities. In 2021-22, the ATIP Secretariat was comprised of the ATIP Manager supported by two full-time ATIP Analysts and a part-time student.

Secretariat members process requests, provide training on access and privacy matters to new employees, and develop and implement policies and procedures to ensure that the institution meets its obligations under the Acts.

2021-22 Statistics and Trends

Appendix B contains the OIC’s statistical report on the Privacy Act for 2021-22. The following sets out some highlights from that report, along with some trends related to workload, timeliness and disclosure over the years the OIC has been subject to the Privacy Act.

Workload

The OIC received twenty-eight new requests in 2021-22 and had no requests carried over from the previous year. This is double the 14 files received in 2020-21. The OIC processed 5103 pages throughout those requests, which is 149% of the 3 416 pages processed in 2020-21. There were two requests that required the processing of over 1 000 pages.

Timeliness

The OIC completed all requests within the reporting period. None of the requests the OIC completed in 2021-22 were late. This ongoing commitment to ensuring timely access to information has been a pillar of the OIC’s Access to Information and Privacy program for over 10 years. Members of the ATIP team monitor file status on an ongoing basis to ensure that all files are answered within statutory deadlines. This is done through regular reports drawn from our case management system.

The average time taken to respond to privacy requests was 18.3 days for 2021-22. In 2020-21 the average was 17.6 days for 2020-21, in 2019-20 the average was 17.5 days, and it was 17.75 in 2018-19. No extensions were taken under section 15 of the Privacy Act.

Disclosure

The OIC disclosed all records for nine of the requests in 2021-22. The records were disclosed in part for another ten files. One request was abandoned and in the remaining eight requests, there were no records found to respond to the request. Overall, the OIC disclosed 2268 pages.

In 2021-22, the OIC claimed exemptions to withhold information in ten of the twenty-eight requests processed. The most often-used exemption this year was subsection 22(1)(b) (law enforcement and investigations),  followed by section 26 (personal information of someone other than the requester; two instances), and section 27 (solicitor-client privilege) with one instance. These three exemptions are consistently the top three exemptions invoked, with 22(1)(b) traditionally the most frequently invoked exemption.

The OIC applied no exclusions to records in 2021-22.

The OIC made no disclosures of personal information in the public interest under paragraph 8(2)(m).

Complaints

The Office of the Privacy Commissioner received no complaints about the OIC’s handling of privacy matters in 2021-22.

Privacy Activities at the OIC

The OIC has a small team of specialists who carry out the organization’s access to information and privacy (ATIP) activities. In 2020-21 the ATIP team consisted of the ATIP Manager, a senior ATIP Officer, an ATIP Officer and a part-time student.

In 2021-22, the ATIP Secretariat held awareness and training sessions for all new employees on their responsibilities under the Privacy Act. Approximately 23 staff attended these sessions.

No new policies, guidelines, procedures or initiatives were implemented during the reporting period.

Privacy Breaches

There were no material breaches in 2021-22.

Privacy Impact Assessments

There were no Privacy Impact Assessments completed in 2021-22.

Appendix A: Delegation Order, Privacy Act

Text version

Arrêté de délégation en vertu de la Loi sur l’accès à l’information et de la Loi sur la protection des renseignements personnels

Delegation orders for the purpose of the Access to Information Act and the Privacy Act

En vertu de l’article 73 de la Loi sur l’accès à l’information et de la Loi sur la protection des renseignements personnels, la Commissaire à l’information du Canada délègue aux titulaires des postes mentionnés à l’annexe ci-après, ainsi qu’aux personnes occupant à titre intérimaire lesdits postes, les attributions dont elle est investie en qualité de responsable d’une institution fédérale, c’est-à-dire le Commissariat à l’information du Canada.  Le présent arrêté de délégation annule et remplace tout arrêté antérieur fait en vertu de l’article 73.

Cet arrêté de délégation prend effet le 22 mai 2018.

Daté, à la ville de Gatineau, ce 22 jour de mai 2018

Original signé par

The Information Commissioner of Canada, pursuant to Section 73 of the Access to Information Act and of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers and functions of the Information Commissioner of Canada as the head of a government institution that is, the Office of the Information Commissioner of Canada. This Delegation Order supersedes all previous Delegation Orders pursuant to section 73.

This delegation order is effective on May 22, 2018

Dated, at the City of Gatineau, this 22 day of May 2018

Original signed by

______________________________________________

Caroline Maynard

Commissaire à l’information du Canada

Information Commissioner of Canada

Text version

Schedule

Schedule / Annexe
Position / Poste	Privacy Actand Regulations/Loi sur la protection des renseignements personnelset règlement.	Access to Information Act and Regulations/Loi sur l’accès à l’informationet règlement.
Deputy Commissioner, Legal Services and Public Affairs/ Sous commissaire, Services juridiques et Affaires publiques	Autorité Absolue / Full Authority	Autorité Absolue / Full Authority
Gestionnaire, Accès à l’information et protection des renseignements personnels / Manager, Access to Information and Privacy	Autorité Absolue / Full Authority	Autorité Absolue / Full Authority
Agent de l’AIPRP / ATIP Officer	Articles de la Loi / Sections of the Act : aucune délégation  no delegation Articles du Règlement / Sections of the Regulations : 11(2), 11(4)	Articles de la loi / Sections of the Act : 4(2.1), 8(1), 11(6), 27(1), 27(4). Articles du Règlement / Sections of the Regulations : 6(1)

Appendix B: 2021-22 Statistical Report

Statistical Report on the Privacy Act

Name of institution: Office of the Information Commissioner of Canada

Reporting period: 2021-04-01 to 2022-03-31

Section 1: Requests Under the Privacy Act

1.1 Number of requests received

1.2 Channels of requests

Section 2: Informal requests

2.1 Number of informal requests

2.2 Channels of informal requests

2.3 Completion time of informal requests

2.4 Pages released informally

Section 3: Requests Closed During the Reporting Period

3.1 Disposition and completion time

3.2 Exemptions

3.3 Exclusions

3.4 Format of information released

3.5 Complexity

3.5.1 Relevant pages processed and disclosed for paper and e-record formats

3.5.2 Relevant pages processed by request disposition for paper and e-record formats by size of requests

Supplemental Statistical report on the Access to Information Act and the Privacy Act

Section 1: Capacity to Receive Requests under the Access to Information Act and the Privacy Act

Enter the number of weeks your institution was able to receive ATIP requests through the different channels.

Section 2: Capacity to Process Records under the Access to Information Act and the Privacy Act

2.1 Enter the number of weeks your institution was able to process paper records in different classification levels.

2.2 Enter the number of weeks your institution was able to process electronic records in different classification levels.

Section 3: Open Requests and Complaints Under the Access to Information Act

3.1 Enter the number of open requests that are outstanding from previous reporting periods.

3.2 Enter the number of open complaints with the Information Commissioner of Canada that are outstanding from previous reporting periods.

Section 4: Open Requests and Complaints Under the Privacy Act

4.1 Enter the number of open requests that are outstanding from previous reporting periods.

4.2 Enter the number of open complaints with the Privacy Commissioner of Canada that are outstanding from previous reporting periods.

Section 5: Social Insurance Number (SIN)

Supplemental Statistical report on the Access to Information Act and the Privacy Act

Section 1: Capacity to Receive Requests under the Access to Information Act and the Privacy Act

Enter the number of weeks your institution was able to receive ATIP requests through the different channels.

Section 2: Capacity to Process Records under the Access to Information Act and the Privacy Act

2.1 Enter the number of weeks your institution was able to process paper records in different classification levels.

2.2 Enter the number of weeks your institution was able to process electronic records in different classification levels.

Section 3: Open Requests and Complaints Under the Access to Information Act

3.1 Enter the number of open requests that are outstanding from previous reporting periods.

3.2 Enter the number of open complaints with the Information Commissioner of Canada that are outstanding from previous reporting periods.

Section 4: Open Requests and Complaints Under the Privacy Act

4.1 Enter the number of open requests that are outstanding from previous reporting periods.

4.2 Enter the number of open complaints with the Privacy Commissioner of Canada that are outstanding from previous reporting periods.

Section 5: Social Insurance Number (SIN)