2024-25 Annual Report on the Administration of the Privacy Act

Table of Contents

• Introduction
• Organizational Structure
• Delegation Order
• 2024–25 Performance
  • Workload
  • Timeliness
  • Disclosure
  • Complaints
• Training and Awareness
• Policies, Guidelines, and Procedures
• Initiatives and Projects to Improve Privacy
• Summary of Key Issues and Actions Taken on Complaints
• Material Privacy Breaches
• Privacy Impact Assessments
• Public Interest Disclosures
• Monitoring Compliance
• Annex A

Introduction

The Privacy Act (Act) safeguards the privacy of individuals by protecting personal information held by government institutions. The Act also gives individuals the right to access their own personal information. The Office of the Information Commissioner (OIC) has been subject to the Privacy Act since 2007. The OIC pursues all measures to protect personal information and provide prompt access to the personal information it holds in response to requests.

This report, prepared and tabled in accordance with section 72 of the Privacy Act, reviews the OIC's privacy-related activities for 2024–25.

The Office of the Information Commissioner (OIC) was created in 1983 under the Access to Information Act to support the work of the Information Commissioner. The mandate of the OIC is to conduct efficient, fair and confidential investigations into complaints about government institutions' handling of access to information requests. Investigators conduct these enquiries in private, giving all parties the opportunity to present their positions on the matters under investigation.

The OIC supports the Commissioner in her advisory role to Parliament and parliamentary committees on all matters pertaining to access to information. The OIC actively supports freedom of information in Canada through targeted initiatives such as Right to Know Week and ongoing dialogue with Canadians, Parliament and government institutions.

Organizational Structure

The OIC supports the Information Commissioner in her advisory role to Parliament and parliamentary committees on all matters pertaining to access to information.

The Commissioner is supported by a staff complement of approximately 124 employees, including a senior management team of three deputy commissioners:

• Deputy Commissioner, Investigations and Governance
• Deputy Commissioner, Legal Services and Public Affairs
• Deputy Commissioner, Corporate Services, Strategic Planning and Transformation Services

The Access to Information and Privacy Secretariat falls under the Corporate Services, Strategic Planning, and Transformation Services Sector. The ATIP Manager and the Deputy Commissioner of Corporate Services, Strategic Planning, and Transformation Services hold full-delegated authority under the Act.

The OIC has a small team of specialists who carry out the organization's Access to Information and Privacy (ATIP) activities. In 2024–25, the ATIP team consisted of the ATIP Manager and 2 ATIP Officers. Secretariat members process requests, proactively publish completed Access requests, provide training on access and privacy matters to new employees, and develop and implement policies and procedures to ensure that the institution meets its obligations under the Acts.

The OIC was not party to any service agreements under section 73.1 of the Privacy Act.

Delegation Order

The following delegation order was in effect May 16, 2024:

2024–25 Performance

Appendix A contains the OIC's statistical report on the Privacy Act for 2024–25. The following sets out some highlights from that report, along with notable trends related to workload, timeliness and disclosure over the last 5 years.

Workload

The OIC saw a decrease in the number of requests received in 2024–25 but not in the total number of pages processed. More specifically, 25 new requests were received, which represents a decrease of 39% from the previous fiscal year. However, a total of 16,808 pages were processed, which represents an increase of 280.19%.

No informal privacy requests were received during this reporting period.

No requests carried over from 2023–24 but two (2) requests were carried forward into 2025–26.

No requests for consultation were received within the reporting period.

Timeliness

The OIC completed 92% of privacy requests within the reporting period and all requests processed in 2024–25 were completed on time. This ongoing commitment to ensuring timely access to information has been a pillar of the OIC's Access to Information and Privacy program for over 10 years. Members of the ATIP team monitor file status on an ongoing basis to ensure that all files are dealt with within statutory deadlines. This is accomplished through regular reports drawn from our case management system.

The average time taken to respond to privacy requests was 12.7 days for 2024–25 compared to 17.4 days in 2023–24.

Two extensions were taken under section 15 of the Privacy Act. Of the 23 requests completed in 2024–25, fifteen (15) were completed within 1-15 days, seven (7) were completed within 16-30 days, and one (1) was completed within 31-60 days.

Disclosure

The OIC disclosed all records for four (4) of the requests (17.4%) in 2024–25. The records were disclosed in part for another five (5) requests (21.7%) whereas twelve (12) requests had no responsive records (52.2%).

No requests were treated informally and none were abandoned. Overall, the OIC disclosed 4,292 pages.

In 2024–25, the OIC claimed exemptions to withhold information in five (5) of the 23 requests processed. The most frequently used exemptions this year was subsection 22(1)(b) (law enforcement and investigations) and section 26 (personal information of someone other than the requester), both of which were applied in response to three (3) requests.

The OIC made no disclosures of personal information in the public interest under paragraph 8(2)(m).

Complaints

The Office of the Privacy Commissioner did not receive any complaints about the OIC's handling of privacy matters in 2024–25.

Training and Awareness

The OIC ATIP team provides ongoing training on access and privacy matters to OIC employees. In 2024–25, the Secretariat held formal training sessions for all new employees. A total of 14 new employees participated in these sessions. Informal training sessions were held on an ad hoc basis with current employees, as required.

Policies, Guidelines, and Procedures

No new policies, guidelines and procedures were implemented during this reporting period.

Initiatives and Projects to Improve Privacy

A couple of initiatives were undertaken in 2024–25 to improve access to information and privacy within the OIC.

Update of PIA Checklist

The OIC developed an internal checklist tool to determine if a new PIA is required when looking to implement or update a new or existing program or service that contains personal information.

Implementation of SharePoint

In order to modernize its file management system, improve efficiency and collaboration, and align with the Government of Canada's implementation of SharePoint as a tool for information management and digital government initiatives, the OIC fully implemented this solution as its central repository in 2024–25. SharePoint is used to support compliance with TBS policies, such as the Policy on Service and Digital, and to enhance collaboration and productivity within the OIC.

Summary of Key Issues and Actions Taken on Complaints

No key issues or actions taken on complaints to report.

Material Privacy Breaches

There were no material breaches reported in 2024–25

Privacy Impact Assessments

There were no Privacy Impact Assessment (PIA) completed in 2024–25.

Public Interest Disclosures

The OIC made no disclosures of personal information in the public interest under paragraph 8(2)(m).

Monitoring Compliance

The OIC monitors compliance with the Privacy Act in a variety of ways. This includes regular meetings with the team as a whole, bilateral meetings, and reporting file status via a weekly report shared with management.

In order to ensure that timelines are respected, the OIC ATIP Secretariat only consults other government institutions when absolutely necessary, and in a manner that ensures timely responses and is in line with the Implementation Notice published by Treasury Board Secretariat.

The right of public access to information is reflected in contracts, information sharing agreements and arrangements via the inclusion of standard clauses to ensure awareness of obligations under the Access to Information Act and the Privacy Act.

Annex A

Statistical Report on the Privacy Act

Name of institution: Office of the Information Commissioner of Canada

Reporting period: 2024-04-01 to 2025-03-31

Section 1: Requests Under the Privacy Act

1.1 Number of requests received

1.2 Channels of requests

Section 2: Informal requests

2.1 Number of informal requests

2.2 Channels of informal requests

2.3 Completion time of informal requests

2.4 Pages released informally

Section 3: Requests Closed During the Reporting Period

3.1 Disposition and completion time

3.2 Exemptions

3.3 Exclusions

3.4 Format of information released

3.5 Complexity

3.5.1 Relevant pages processed and disclosed for paper and e-record formats

3.5.2 Relevant pages processed by request disposition for paper and e-record formats by size of requests

Supplemental Statistical report on the Access to Information Act and the Privacy Act

Name of institution: Office of the Information Commissioner of Canada

Reporting period: 2024-04-01 to 2025-03-31

Section 1: Requests Carried Over and Complaints Under the Access to Information Act

1.1 Requests carried over to next reporting period, broken down by reporting period received

1.2 Active complaints with the Information Commissioner of Canada. broken down by reporting period

Section 2: Requests Carried Over and Active Complaints Under the Privacy Act

2.1 Requests carried over to next reporting period, broken down by reporting period received

2.2 Active complaints with the Privacy Commissioner of Canada, broken down by reporting period

Section 3: Social Insurance Number

Section 4: Universal Access under the Privacy Act