Annual Report on the Administration of the Privacy Act 2020-2021

Table of contents

• Introduction
• Organizational structure
• Delegation order
• Performance 2020-2021
• Training and awareness
• Policies, guidelines, procedures and initiatives
• Summary of key issues and actions taken on complaints
• Monitoring compliance
• Material privacy breaches
• Privacy impact assessments
• Public interest disclosures
• Annex A: Delegation order
• Annex B: Statistical report on the Privacy Act for 2020-2021

Introduction

The Privacy Act (Revised Statutes of Canada, Chapter A-1, 1985) was proclaimed on July 1, 1983.

The Privacy Act (the Act) extends to individuals the right of access to information about themselves held by the government, subject to specific and limited exceptions. The Act also protects an individual's privacy by preventing others from having access to personal information and gives individuals substantial control over its collection, use and disclosure.

This annual report describes how the Canada School of Public Service (the School) administered its responsibilities under the Privacy Act during the 2020-2021 fiscal year. This report is tabled in Parliament in accordance with section 72 of the Act.

The School acts much like a corporate training and development institution for its client organizations. While federal organizations focus on mandate-specific training and development, the School supports common public service learning at all levels nationwide and across more than 90 federal departments and agencies. It has a legislative mandate to provide a range of learning activities to build individual and organizational capacity and management excellence within the public service.

Under its Departmental Results Framework, the School has the responsibility to provide common learning to all employees of the core public service to help enable them to serve Canadians with excellence.

Established on April 1, 2004, under the Public Service Modernization Act and operating under the authority of the Canada School of Public Service Act (CSPS Act), the School's primary responsibility is to provide a range of learning opportunities and develop a learning culture within the public service.

The School, a departmental corporation, is mandated under the CSPS Act to:

• encourage pride and excellence in the public service
• foster a common sense of purpose, values and traditions in the public service
• support deputy heads in meeting the learning needs of their organizations
• pursue excellence in public management and administration

Furthermore, the School supports deputy head accountabilities with respect to leadership and professional development across the public service by identifying organizational needs and designing and delivering high-quality, practical programs that address the key development requirements of public service employees.

Organizational structure

The School's access to information and privacy (ATIP) activities are primarily carried out by the ATIP, Parliamentary and Cabinet Affairs, and Special Projects Unit. This unit reports to the Director General of Communications and Engagement and is led by a manager, who is the School's designated ATIP Coordinator. The manager's role is supported by one Senior Advisor, one Analyst, one Program Officer and one part-time student. The ATIP Coordinator has full authority delegated by the President of the Canada School of Public Service for the administration of the Act. The ATIP Coordinator is also accountable for ensuring compliance with the Act and its related policy instruments. In addition, the ATIP Coordinator is responsible for the development, coordination, and implementation of effective practices and procedures that will enable efficient processing of requests under the Act.

In addition to its activities related to parliamentary affairs and government accountability, the responsibilities of the School's ATIP, Parliamentary and Cabinet Affairs, and Special Projects Unit include the following:

• processing requests for information submitted under the Privacy Act (Act) and requests for personal information pursuant to the Act in accordance with legislation, regulations and Treasury Board of Canada Secretariat (TBS) policies and guidelines
• responding to Privacy consultations received from other government institutions and organizations regarding the application of the Act on records originating from the School
• providing advice and guidance to requesters on the application of privacy legislation
• providing advice and guidance to School employees on the application of privacy legislation, including providing guidance, best practices and lessons learned in the stewardship pertaining to the Act
• promoting awareness and offering training and overview sessions to School employees
• cooperating with the Office of the Privacy Commissioner on the resolution of complaints
• developing procedures and practices to ensure the proper administration of the Act
• reviewing departmental documents prior to their proactive disclosure on the Open Government website
• ensuring that the School's information holdings (classes of records and personal information banks) are published in Information about Programs and Information Holdings
• ensuring that the School's Information About Programs and Information Holdings is updated as per the Treasury Board Secretariat's requirements
• preparing and tabling the annual reports on the administration of the Privacy Act, which includes the statistical reports

Delegation order

Section 73 of the Privacy Act provides that the head of a government institution may, by Delegation Order, designate one or more officers or employees of that institution to exercise or perform any of the powers, duties or functions of the head regarding the administration of the Act.

In June 2019, the School's President delegated full authority for the purposes of the Act to the Director General of Communications and Engagement and to the Manager, ATIP, Parliamentary and Cabinet Affairs, and Special Projects Unit, as the designated ATIP Coordinator. The ATIP Coordinator maintains full-delegated authority and is the principal administrator of the Act for the School. A copy of the signed delegation instrument for the Act, which took effect on June 17, 2019, is included as Annex A.

Performance 2020-2021

The following outlines the information contained in the Statistical Report on the Privacy Act for 2020-2021, which is included as Annex B.

Percentage of requests responded

Between April 1, 2020 and March 31, 2021, the School received 18 new requests for personal information under the Privacy Act. This represents a decrease of 12 requests when compared with the previous year's total of 30 requests received. In addition, 9 requests have been carried into the next reporting period. No requests were outstanding from the previous year. The School closed 9 or 50% of the requests received during this reporting period.

Number of requests – completion time

Of the 18 requests received during this reporting period, 9 were closed within the legislated provisions under the Act. Of the 9 requests closed, 5 requests (56%) were completed in 30 days or less, and 4 requests (44%) were completed in 60 days or less.

Extensions

Section 15 of the Act provides for the extension of the statutory time limits for a maximum of 30 days if meeting the original time limit would unreasonably interfere with the operations of the government institution, or if consultations are necessary to comply with the request that cannot reasonably be completed within the original time limit. The School found it necessary to seek extensions to time limits on 4 requests due to the large number of records. These extensions were necessary due to their interference with operations and large volume of pages to process.

Consultations completed for other institutions

The School received 1 request for consultation from another government institution in 2020-2021 which was completed within the timeframe provisions provided under the Act.

Disposition of completed requests

Of the 9 total requests closed in 2020-21: no requests (0%) resulted in full disclosure of records; 1 request (12%) was disclosed in part where some information was withheld in accordance with the Act's exemption provisions; 4 requests (44%) resulted in full exemptions; and 4 requests (44%) were abandoned.

Relevant pages disclosed

A total of 14,658 pages were reviewed during the reporting period, resulting in a total of 16 pages disclosed (in full or in part). The remaining 14,642 pages were either withheld pursuant to exemptions under the Act or were not relevant to the request.

Format of information released

The School provided records in electronic format in response to 1 request. The School sent no responses in paper format.

Exemptions and exclusions

Exemptions and exclusions are the only grounds to withhold personal information found in records that are requested under the Privacy Act. Their application is limited and specific, as stipulated in the Act. The School invoked exemptions under Sections 22 (law enforcement and investigation) and 26 (personal information) in 5 closed requests.

The Act stipulates that certain types of materials are excluded from its application; specifically, records that are already available to the public (Section 69) and Cabinet confidences (Section 70). The School did not invoke these exclusions for any requests completed during this reporting period.

COVID-19 impacts

As part of the School's responsibilities towards the administration of the Privacy Act, it has provided data on its institutional capacity to receive, process and provide responses to personal information requests in the COVID-19 operating environment.

During the reporting period, and throughout the early months of the COVID-19 pandemic, the School had a general capacity to receive requests by mail (with some delays), by email and through a digital request service (ATIP Online Request Service); the School had capacity to process unclassified paper records, Protected B paper records, and Secret and Top Secret paper records (with some delays and assistance from portfolio partners), and to process unclassified electronic records, Protected B electronic records, Secret and Top Secret (with some delays and assistance from portfolio partners) electronic records. The School also had capacity to respond to requesters by mail and by electronic mail, with some delays.

Costs of operating the program

During this reporting period, the salary costs related to the administration of the Privacy Act incurred by the School's ATIP, Parliamentary and Cabinet Affairs, and Special Projects Unit for the purposes of the administration of the Privacy legislation are estimated at $172,443. Overhead and maintenance costs are estimated at $66,577, for a total of $239,020.

Training and awareness

The School's ATIP, Parliamentary and Cabinet Affairs, and Special Projects Unit informs and guides employees and requesters regarding the requirements of the Privacy Act through ongoing dialogue and informal discussions. This year, the School added the course "Access to Information and Privacy Fundamentals" (I015) to its list of mandatory courses for all School employees. The course is available through GCcampus, the School's learning platform, which is open to all federal government employees within the core administration. In addition, the ATIP, Parliamentary and Cabinet Affairs, and Special Projects Unit offered an overview session titled "Privacy at the School: The Basics" to School employees, where a total of 9 sessions were delivered in both official languages to over 176 employees.

In addition, employees in the ATIP, Parliamentary and Cabinet Affairs, and Special Projects Unit responded to inquiries from employees and senior management, provided advice and guidance, and participated in numerous working groups to discuss various subjects pertaining to the Privacy Act.

Policies, guidelines, procedures and initiatives

A dedicated section of the School's intranet site has been revamped and more resources have been developed to provide School employees and ATIP liaison officers with key information on ATIP legislation. The ATIP, Parliamentary and Cabinet Affairs, and Special Projects Unit has communicated through several means the importance of employees' accountability in ensuring that information is handled in accordance with the Act.

Summary of key issues and actions taken on complaints

During this reporting period, the School received a total of 2 notices of intent to investigate pursuant to section 31 from the Office of the Privacy Commissioner (OPC). The School made 2 representations to the Commissioner pursuant to section 33 of the Act, and received 2 reports of findings or recommendations from the Commissioner pursuant to section 35^Note*.

The School takes all complaints received very seriously and works diligently with the OPC and the complainant in an expeditious manner to ensure that each complaint is processed efficiently and in accordance with the recommendations received from the Office of Privacy Commissioner.

Monitoring compliance

Since the School is a small institution with a relatively low number of requests in comparison with other government institutions, senior management is kept informed of the time to process privacy requests by means of reports and through ongoing verbal briefings with the President's Office and briefings at the Chiefs of Staff meetings, which is then disseminated to the Vice-Presidents and Directors General on a regular basis.

Material privacy breaches

During the reporting period, there was one material privacy breach that occurred and which was reported to the Office of the Privacy Commissioner and to the Treasury Board of Canada Secretariat (Information and Privacy Policy Division).

• A web application was launched, and access was provided to all School employees via email.
• A summary document for use in briefing School executives was stored on a corporate Google Docs account, and included a password to access the application.
• The access level of the summary document was mistakenly changed from private to public, thus potentially exposing the web application's password to users other than School employees.
• The application contained two sources of personal information. The application and its associated database that stored the compromised data were disabled as soon as the School became aware of the issue.

To minimize any potential risks, the School notified all of the impacted individuals.

Following this breach, the ATIP, Parliamentary and Cabinet Affairs, and Special Projects Unit provided an overview session on privacy fundamentals to the Offices of Primary Interest and, Chiefs of Staff, and also offered sessions to all School employees. A total of 176 participants attended these sessions, which were offered in both official languages.

Privacy impact assessments

The School completed one privacy impact assessment (PIA) in 2020-2021.

The purpose of this PIA was to examine the privacy risks associated with the School's core registration and evaluation activities. Privacy risks arising from the School's core registration and evaluation activities are considered to be moderate to low, as they involve limited collections of non-sensitive data. For the most part, data is collected and used for non‑administrative purposes (i.e., to improve School products and services, not to make decisions about individual learners). New and novel uses of personal information emanating from the work of the Innovation and Policy Services Branch under the School's new Data Strategy could however increase potential privacy impacts on individuals. These new activities could also increase the privacy risk profile of the School.

CSPS Core Privacy Impact Assessment (PIA) Summary

Public interest disclosures

Paragraph 8(2)(m) of the Privacy Act allows for the disclosure of personal information when the public interest clearly outweighs any invasion of privacy or when the disclosure would benefit the individual. The School did not disclose any personal information pursuant to paragraph 8(2)(m) during the 2020-2021 reporting period.

Annex A: Delegation order

Privacy Act

The President of the Canada School of Public Service, pursuant to section 73 of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the President, as the head of the Canada School of Public Service, under the provisions of the Act and related regulations set out in the schedule opposite each position. This designation replaces all previous delegation orders.

Annex B: Statistical report on the Privacy Act for 2020-2021

Name of institution: Canada School of Public Service

Reporting period: 2020-04-01 to 2021-03-31

Section 1: Requests Under the Privacy Act

Section 2: Requests closed during the reporting period

2.5 Complexity

2.6 Closed requests

2.7 Deemed refusals

Section 3: Disclosures under subsections 8(2) and 8(5)

Section 4: Requests for correction of personal information and notations

Section 5: Extensions

Section 6: Consultations received from other institutions and organizations

Section 7: Completion time of consultations on cabinet confidences

Section 8: Complaints and investigations notices received

Section 9: Privacy impact assessments (PIA) and personal information banks (PIB)

Section 10: Material privacy breaches

Section 11: Resources related to the Privacy Act

Note: Enter values to two decimal places.

Contact us Subscribe to the GCLearning newsletter

---

Features

Embedding Risk Management into Decision-Making (TRN5-E44)

(November 18, 2024)

2024 Government of Canada Workplace Charitable Campaign: Quiz for a Cause – DM Trivia (WMT2-E16)

(November 28, 2024)

Practical Artificial Intelligence Series: Reimagining Government Communications and Access to Services (DDN1-E11)

(December 5, 2024)

Follow:

• Twitter
• YouTube
• LinkedIn
• GCLearning newsletter
• RSS