2025-26 Annual Report on the Administration of the Privacy Act

Table of Contents

• Introduction
• Organizational Structure
• Delegation Order
• Performance 2025-26
  • Workload
  • Timeliness
  • Disclosure
  • Complaints
• Training and Awareness
• Policies, Guidelines, and Procedures
• Initiatives and Projects to Improve Privacy
• Summary of Key Issues and Actions Taken on Complaints
• Material Privacy Breaches
• Privacy Impact Assessments
• Public Interest Disclosures
• Monitoring Compliance
• Appendix A

Introduction

The Privacy Act (Act) safeguards the privacy of individuals by protecting personal information held by government institutions. The Act also gives individuals the right to access their own personal information. The Office of the Information Commissioner (OIC) has been subject to the Privacy Act since 2007. The OIC pursues all measures to protect personal information and provide prompt access to the personal information it holds in response to requests.

This report, prepared and tabled in accordance with section 72 of the Privacy Act, reviews the OIC’s privacy-related activities for 2025-26.

The Office of the Information Commissioner (OIC) was created in 1983 under the Access to Information Act to support the work of the Information Commissioner. The mandate of the OIC is to conduct efficient, fair and confidential investigations into complaints about government institutions’ handling of access to information requests. Investigators conduct these enquiries in private, giving all parties the opportunity to present their positions on the matters under investigation.

The OIC supports the Commissioner in her advisory role to Parliament and parliamentary committees on all matters pertaining to access to information. The OIC actively supports freedom of information in Canada through targeted initiatives such as Right to Know Week and ongoing dialogue with Canadians, Parliament and government institutions.

Organizational Structure

The OIC supports the Information Commissioner in her advisory role to Parliament and parliamentary committees on all matters pertaining to access to information.

The Commissioner is supported by a staff complement of approximately 119 employees, including a senior management team:

• Deputy Commissioner, Investigations and Governance
• Deputy Commissioner, Corporate Services, Strategic Planning, and Transformation Services
• Executive Director and General Counsel, Legal Services
• Senior Director, Public Affairs and Communications

The Access to Information and Privacy Secretariat falls under the Corporate Services, Strategic Planning, and Transformation Services. The ATIP Manager, Senior Director of HR, ATIP, and Corporate Governance, and the Deputy Commissioner of Corporate Services, Strategic Planning, and Transformation Services hold full-delegated authority under the Act.

The OIC has a small team of specialists who carry out the organization’s Access to Information and Privacy (ATIP) activities. In 2025-26, the ATIP team consisted of the ATIP Manager and 2 ATIP Officers. ATIP Secretariat members process requests, proactively publish completed Access requests, provide training on access and privacy matters to new employees, and develop and implement policies and procedures to ensure that the institution meets its obligations under the Acts.

The OIC was not party to any service agreements under section 73.1 of the Privacy Act.

Delegation Order

The following delegation order was in effect May 16, 2024:

Performance 2025-26

Appendix A contains the OIC’s statistical report on the Privacy Act for 2025-26. The following sets out some highlights from that report, along with notable trends related to workload, timeliness and disclosure over the last 5 years.

Workload

The OIC saw an increase in the number of requests received in 2025-26 but not in the total number of pages processed. More specifically, 42 new requests were received, which represents an increase of 68% from the previous fiscal year. However, a total of 11,219 pages were processed, which represents a decrease of 33.3%.

No informal privacy requests were received during this reporting period.

Two (2) requests were carried over from 2024-25 and five (5) requests were carried forward into 2026-27.

No requests for consultation were received within the reporting period.

Timeliness

The OIC completed 88.6% of privacy requests within the reporting period and all requests processed in 2025-26 were completed on time. This ongoing commitment to ensuring timely access to information has been a pillar of the OIC’s Access to Information and Privacy program for over 10 years. The ATIP team monitors file status on an ongoing basis to ensure compliance with statutory deadlines. This is accomplished through regular reports drawn from our case management system.

The average time taken to respond to privacy requests was 20.8 days for 2025-26 compared to 12.7 days in 2024-25.

Figure 2: Average completion time for requests, 2021-22 to 2025-26

Four extensions were taken under section 15 of the Privacy Act were for 30 days or less. In determining the need for an extension, OIC ATIP Secretariat assessed a variety of factors and circumstances including, but not limited to, volume of responsive records, level of efforts required to undertake a search for records, level of efforts required to process responsive records, and complexity of requests and records sought.

Of the 39 requests completed in 2025-26, seventeen (17) were completed within 1-15 days, sixteen (16) were completed within 16-30 days, four (4) were completed within 31-60 days, and two (2) were completed in 61-120 days. It’s important to note that the two (2) requests completed in 61-120 days would have been closed within 31-60 days were it not for statutory holidays.

Disclosure

The OIC disclosed all records for eleven (11) of the requests (28.2%) in 2025-26. The records were disclosed in part for another nine (9) requests (23.1%) whereas nineteen (19) requests had no responsive records (48.7%).

No requests were treated informally, and none were abandoned. Overall, the OIC disclosed 6,047 pages.

In 2025-26, the OIC claimed exemptions to withhold information in nine (9) of the 39 requests it responded to. The most frequently used exemptions this year section 26 (personal information of someone other than the requester) and section 27 (information protected by the client-solicitor privilege or litigation privilege).

The OIC made no disclosures of personal information in the public interest under paragraph 8(2)(m).

Complaints

The Office of the Privacy Commissioner received three (3) complaints about the OIC’s response to personal information requests in 2025-26, two of which were resolved and one was carried over into 2026-27.

Training and Awareness

The OIC ATIP team provides ongoing training on access and privacy matters to OIC employees. In 2025-26, the Secretariat held formal training sessions for all new employees. Informal training sessions were held on an ad hoc basis with current employees, as required.

Policies, Guidelines, and Procedures

No new policies, guidelines and procedures were implemented during this reporting period.

Initiatives and Projects to Improve Privacy

No initiative was undertaken in 2025-26 to explicitly improve privacy within the OIC. However, the OIC continues to improve and invest in its IT infrastructure to maintain a secure environment, helping to ensure the protection of personal information.

Summary of Key Issues and Actions Taken on Complaints

No key issues or actions taken on complaints to report.

Material Privacy Breaches

There were no material breaches reported in 2025-26.

Privacy Impact Assessments

There were no necessity to complete any Privacy Impact Assessment (PIA) in 2025-26.

Public Interest Disclosures

The OIC made no disclosures of personal information in the public interest under paragraph 8(2)(m).

Monitoring Compliance

The OIC monitors compliance with the Privacy Act in a variety of ways. This includes regular meetings with the team as a whole, bilateral meetings, and reporting file status via a weekly report shared with management.

In order to ensure that timelines are respected, the OIC ATIP Secretariat only consults other government institutions when absolutely necessary, and in a manner that ensures timely responses and is in line with the Implementation Notice published by Treasury Board Secretariat.

The right of public access to information is reflected in contracts, information sharing agreements and arrangements via the inclusion of standard clauses to ensure awareness of obligations under the Access to Information Act and the Privacy Act.

Annex A

Statistical Report on the Privacy Act

Name of institution: Office of the Information Commissioner

Reporting period: 2025-04-01 to 2026-03-31

Section 1: Requests Under the Privacy Act

1.1 Number of requests received

1.2 Channels of requests

Section 2: Informal requests

2.1 Number of informal requests

2.2 Completion time of informal requests

2.3 Pages released informally

Section 3: Requests Closed During the Reporting Period

3.1 Disposition and completion time

3.2 Exemptions

3.3 Exclusions

3.4 Format of information released

3.5 Complexity

3.5.1 Relevant pages processed and disclosed for paper, e-record and dataset formats

3.5.2 Relevant pages processed per request disposition for paper, e-record and dataset formats by size of requests

3.5.3 Relevant minutes processed and disclosed for audio and video formats

3.5.4 Relevant minutes processed per request disposition for audio and video formats by size of requests

3.5.5 Other complexities

3.6 Closed requests

3.6.1 Number of requests closed within legislated timelines

3.7 Deemed refusals

3.7.1 Reasons for not meeting legislated timelines

3.7.2 Request closed beyond legislated timelines (including any extension taken)

Section 4: Disclosures Under Subsections 8(2) and 8(5)

Section 5: Requests for Correction of Personal Information and Notations

Section 6: Extensions

6.1  Reasons for extensions

6.2 Length of extensions

Section 7: Consultations Received From Other Institutions and Organizations

7.1 Consultations received from other Government of Canada institutions and other organizations

7.2 Recommendations and completion time for consultations received from other Government of Canada institutions

7.3 Recommendations and completion time for consultations received from other organizations outside the Government of Canada

Section 8: Completion Time of Consultations on Cabinet Confidences

8.1 Requests with Legal Services

8.2 Requests with Privy Council Office

Section 9: Complaints and Investigations Notices Received

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

10.1 Programs and activities

10.2 Privacy Impact Assessments

10.3 Privacy Protocols

10.4 Institution-specific and Central Personal Information Banks

10.5 Info Source page

Section 11: Social Insurance Number

Section 12: Privacy Breaches

12.1 Material Privacy Breaches reported

12.2 Non-Material Privacy Breaches

Section 13: Privacy Training

Section 14: Resources Related to the Privacy Act

14.1  Allocated Costs

14.2  Human Resources

Supplemental Statistical Report on the Privacy Act

Name of institution:

Reporting period: 2025-04-01 to 2026-03-31

Section 2: Requests Carried Over and Active Complaints Under the Privacy Act

2.1 Requests carried over to next reporting period, broken down by reporting period received

2.2 Active complaints with the Privacy Commissioner of Canada, broken down by reporting period received

Section 3: Universal Access under the Privacy Act