Annual Report on the Administration of the Privacy Act 2021‑2022

Table of contents

• Introduction
• Organizational structure
• Delegation of authority
• Statistics
• Interpretation of the Statistical Report
  • Section 1. Requests Under the Privacy Act
  • Section 2. Informal Requests
  • Section 3. Applications to the Information Commissioner on Declining to Act on Requests
  • Section 4. Disclosures Under Subsections 8(2) and 8(5)
  • Section 5. Requests for Corrections Received of Personal Information and Notations
  • Section 6. Extensions
  • Section 7. Consultations Received from Other Institutions and Organizations
  • Section 8. Completion Time of Consultations on Cabinet Confidences
  • Section 9. Complaints and Investigations Notices Received
  • Section 10. Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)
  • Section 11. Privacy Breaches
  • Section 12. Resources Related to the Privacy Act
• Highlights
  • Training and Awareness
  • Policies, Guidelines, Procedures, and Directives
  • Complaints
  • Monitoring Compliance
• Appendix A: Delegation Order
• Appendix B: Statistical Report on the Privacy Act for 2021-2022
• Appendix C: Supplementary Statistical Report on the Access to Information Act and Privacy Act for 2021-2022

Introduction

The Privacy Act (Revised Statutes of Canada, Chapter A-1, 1985) was proclaimed on July 1, 1983. The Privacy Act (the Act) extends to individuals the right of access to information about themselves held by the government, subject to specific and limited exceptions. The Act also protects an individual's privacy by preventing others from having access to personal information and gives individuals substantial control over its collection, use and disclosure.

This annual report describes how the Canada School of Public Service (the School) administered its responsibilities under the Act during the 2021-2022 fiscal year. The School is pleased to present its Annual Report to Parliament in accordance with section 72 of the Act.

Established on April 1, 2004, under the Public Service Modernization Act and operating under the authority of the Canada School of Public Service Act (CSPS Act), the School supports deputy head responsibilities in providing leadership and professional development across the public service by identifying organizational needs and designing and delivering high-quality, practical programs that address the key development requirements of public service employees.

The School, a departmental corporation, is mandated under the CSPS Act to:

• encourage pride and excellence in the public service
• foster a common sense of purpose, values, and traditions in the public service
• assist deputy heads in meeting the learning needs of their organizations
• conduct research and encourage greater awareness of public management, administration, and innovation

The School parallels that of a corporate training and development institution for its client organizations. It supports common public service learning at all levels and across more than 90 federal departments and agencies, while federal organizations focus on mandate-specific training and development. It has a legislative mandate to provide a broad range of learning activities to build public sector capacity at all levels, including management excellence, within the public service. It plays a key role in helping public servants serve Canadians with excellence in a digital age, where Canadians expect their government to be effective, transparent, and open by default.

Under its Departmental Plan for 2021-2022, the School intended to add emphasis on internal services that support learning delivery underpinned by a commitment to raise the bar on inclusion, openness, effectiveness, and transparency. The School's aim was to optimize internal planning processes and forecasting strategies to gain efficiencies and transparency for internal services processes and support, which in turn would increase openness and inherently, transparency, and continue building on our client service excellence.

Organizational structure

The School's access to information and privacy (ATIP) management falls under the responsibility of the ATIP, Parliamentary and Cabinet Affairs, and Special Projects Unit. This unit reports to the Director General, Communications and Engagement, and is led by a Manager, also the School's ATIP Coordinator, as well as two ATIP Senior Advisors, one Advisor and two Analysts. These employees form the dedicated resources allocated to the administration of the Privacy Act.

In addition to its activities related to parliamentary affairs and government accountability, the responsibilities of the School's ATIP, Parliamentary and Cabinet Affairs, and Special Projects Unit (the School) include the following:

• processing requests for information submitted under the Access to Information Act and requests for personal information pursuant to the Privacy Act in accordance with legislation, regulations and Treasury Board of Canada Secretariat (TBS) policies and guidelines
• responding to ATIP consultations received from other government institutions and organizations
• providing advice and guidance to requesters on the application of ATIP legislation, as well as promoting awareness and training to School employees
• collaborating with the Office of the Information Commissioner and the Office of the Privacy Commissioner on the resolution of complaints
• reviewing departmental documents prior to their proactive disclosure on public facing websites
• ensuring that the School's information holdings (classes of records and personal information banks) are published and maintained in the Information about Programs and Information Holdings
• preparing the statistical reports and the annual reports on the administration of the Access to Information Act and on the administration of the Privacy Act
• participating in ATIP community activities, such as the Treasury Board Secretariat-led ATIP coordinators' and ATIP practitioners' meetings and working groups
• raising awareness on a variety of access to information and privacy-related matters to ensure compliance with access to information and privacy legislation.

Delegation of autority

In July 2022, the School's President delegated full authority for the purposes of the Act to the Director General, Communications and Engagement, and to the ATIP, Parliamentary and Cabinet Affairs, and Special Projects Unit's Manager, also the ATIP Coordinator. A copy of the signed delegation instrument under the Act took effect on July 12, 2022, and is included as Appendix A.

Statistics

Interpretation of the Statistical Report

The following outlines the information contained in the Statistical Report on the Privacy Act for 2021–2022 reporting period, which is included as Appendix B.

Section 1. Requests Under the Privacy Act

1.1 Number of requests received

During this reporting period (2021-2022), the Canada School of Public Service's ATIP Office (the ATIP Office) received 11 new requests and carried forward six requests from the previous reporting period (2020-2021), for a total of 17 requests – of which 14 were closed.

Of the six requests carried forward from the previous reporting period (2020-2021), five were within their legislative timelines (including extensions).

The ATIP Office carried forward three requests into the 2022-2023 reporting period; all three requests were within their legislative timelines.

1.2 Channels of requests

Of the 11 new requests received, ten were received from the TBS Online Portal and one was received by email.

Section 2. Informal Requests

An informal request is defined as a request for information made to the ATIP Office of a Government of Canada institution that is either not made or not processed under the Act. There are no timelines for responding under the Act for informal requests. The requester also has no statutory right of complaint to the Privacy Commissioner of Canada.

2.1 Number of informal requests

During this reporting period, the ATIP Office received one informal request.

2.2 Channels of informal requests

The one informal request was received by email.

2.3 Completion time of informal requests

The one informal request received required eight days to complete.

2.4 Pages released informally

The one informal request resulted in 20 pages processed and 8 pages released informally.

Pages released informally are requests for documents that were not previously released by the institution in response to a formal request pursuant to the Act.

Section 3. Requests Closed During the Reporting Period

3.1 Disposition and completion time

Of the 14 requests closed in this reporting period: 10 (or 72%) were completed within 30 days; three (or 21%) required 31 to 60 days to complete; and one (or 7%) required more than 365 days to complete.

Of the 14 requests closed: no relevant records existed under the control of the School for one request (or 7%); and five requests (or 36%) were abandoned by the requester. The remaining eight requests were released in the following manner: six (or 43%) were disclosed in part; and two (or 14%) were all disclosed.

3.2 Exemptions

The most commonly invoked exemption cited in six closed requests was section 26 of the Act (protection of personal information)

Section 26 - the head of a government institution may refuse to disclose any personal information requested under subsection 12(1) about an individual other than the individual who made the request, and shall refuse to disclose such information where the disclosure is prohibited under section 8.

Section 27 - the head of a government institution may refuse to disclose any personal information requested under subsection 12(1) that is subject to solicitor-client privilege or the professional secrecy of advocates and notaries or to litigation privilege.

Table 3.2 Number of requests closed where exemption provisions were invoked

3.3 Exclusions

No exclusion provisions were applied to requests that were closed in this reporting period.

3.4 Format of information released

Of the 14 requests closed: eight were released in electronic format; the remaining six requests were either abandoned or generated no responsive records.

Of the eight requests released in electronic format, one also contained audio recordings.

3.5 Complexity

The following sections detail several factors impacting the complexity of requests that were completed during this reporting period.

3.5.1 Relevant pages processed and disclosed for paper and e-records formats

Of the 14 requests closed: 13 requests (includes eight that had responsive records and five that were abandoned) generated 13,097 relevant pages processed; and one had no responsive records. The total amount of relevant pages disclosed was 6,613 (in full or in part). The remaining 6,484 pages were either withheld pursuant to exemptions under the Act or were considered not relevant and/or duplicate documents.

3.5.2 Relevant pages processed by request disposition for paper and e-records formats

Of the eight closed requests that generated responsive records: three required processing of 100 pages or less, resulting in a total of 79 pages processed; one request fell within the 101-500 pages processed criteria, resulting in the processing of a total of 177 pages; three requests fell within the 1001-5000 pages processed criteria, resulting in the processing of a total of 7,040 pages; and one request fell within the more than 5000 pages processed criteria, resulting in the processing of a total of 5,801 pages.

3.5.3 Relevant minutes processed and disclosed for audio formats

The ATIP Office processed one request that produced audio recordings as well as documents. In this one request, the ATIP Office processed 100 minutes of recordings and released 79 minutes.

3.5.4 Relevant minutes processed and disclosed for audio formats by size of requests

The combined audio files included 100 minutes of recordings processed and resulted in 79 minutes of recordings disclosed, which fell within the "60-120 minutes processed" criteria.

3.5.5 Relevant minutes processed and disclosed for video formats

The ATIP Office did not process any relevant minutes in video format.

3.5.6 Relevant minutes processed per request disposition for video formats by size of requests

The ATIP Office did not process nor disclose any relevant minutes in video format for any requests.

3.5.7 Other complexities

There were no complexities to any of the requests closed.

3.6 Closed requests

The following section details the number of requests closed within the legislated timelines.

3.6.1 Number of requests closed within legislated timelines

Of the 14 requests closed, 13 were completed within their legislative timelines – indicating a compliance rate of 92.85%.

Table 3.6.1 Requests closed within legislative timelines - Multi year overview

3.7 Deemed refusals

The following sections provide context on the rationales applied to requests considered deemed refusal during this reporting period.

3.7.1 Reasons for not meeting legislated timelines

One request was closed past the legislative timelines due to heavy workload. However, 92.85% of requests were closed on time. This demonstrates the ATIP Office's ongoing commitment to ensuring timely access to records and compliance with the legislation.

3.7.2 Request closed beyond legislated timelines (including any extension taken)

For the one request closed past the legislated timelines, a 30-day extension was taken and an additional 317 days was required to complete beyond the legislative timelines.

3.8 Requests for translation

There were no instances where a requester requested that the responsive records be translated to another official language.

Section 4. Disclosures Under Subsections 8(2) and 8(5)

Permissible disclosure pursuant to subsection 8(2) of the Actdescribes the circumstances under which personal information under the control of government institutions may be disclosed without the consent of the individual to whom the information pertains.

During this reporting period, the ATIP Office did not treat any requests for information to be disclosed pursuant to subsections 8(2) and 8(5).

Section 5. Requests for Correction of Personal Information and Notations

The ATIP Office did not receive any requests for correction of personal information or notations.

Section 6. Extensions

6.1 Requests for extensions

Subsection 15 of the Privacy Act allows the head of a government institution to extend the initial period under the following circumstances:

1. maximum of thirty days if:
   1. meeting the original time limit would unreasonably interfere with the operations of the government institution, or
   2. consultations are necessary to comply with the request that cannot reasonably be completed within the original time limit

A total of four extensions were taken on requests closed during this reporting period, pursuant to subsection 15(a) of the Privacy Act, due to large volume of records.

6.2 Length of extensions

The ATIP Office applied four extensions during this reporting period, which fell within the criteria of 16 to 30 days.

Section 7. Consultations received from other Government of Canada institutions and other organizations

7.1 Consultations received from other Government of Canada institutions and other organizations

The ATIP Office received one consultation from another Government of Canada institution, consisting of 22 pages processed.

The ATIP Office did not receive any requests for consultation from other organizations.

7.2 Recommendations and completion time for consultations received from other Government of Canada institutions

The one closed consultation was completed within the timeline provided by the other Government of Canada institution, with a recommendation of full disclosure.

7.3 Recommendations and completion time for consultations received from other organizations

The ATIP Office did not receive any requests for consultation from other organizations including any governments of provinces, territories, municipalities and of other countries.

Section 8. Completion Time of Consultations on Cabinet Confidences

8.1 Requests with legal services

The ATIP Office did not send any consultation requests on Cabinet Confidences to the Department of Justice.

8.2 Requests with Privy Council Office

The ATIP Office did not send any consultation requests to the Privy Council Office.

Section 9. Complaints and Investigations Notices Received

At the start of this reporting period, the ATIP Office had six complaints outstanding from previous reporting periods: three from the 2019-2020 reporting period; and three from the 2020-2021 reporting period.

The ATIP Office received four new complaints pursuant to section 31 of the Act, during this reporting period. In addition, the office received eight formal findings which were closed in collaboration with the OPC.

The ATIP Office undertook an additional review of its ongoing complaints and processed a total of 9,936 pages during this reporting period.

There are currently two outstanding complaints: one from the 2019-2020 reporting period; and one from the 2020-2021 reporting period, which is being carried forward to the 2022-2023 reporting period.

During this reporting period, we worked on two Federal Court cases.

The annual statistical report requires institutions to identify sections of the Act under complaint:

• Section 31: captures a new formal complaint from the OPC
• Section 33: requires the institution to make representations against a complaint to the OPC
• Section 35: is the formal finding of the OPC and closure of the complaint

Section 10. Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

A Privacy Impact Assessment (PIA) is a risk evaluation of the flow of personal information held within a program or service. This process enables the Department to determine whether new or substantially modified technologies, information systems, initiatives, and proposed programs or policies meet federal government privacy requirements.

During this reporting period, the ATIP Office developed, approved and implemented actions in relation to seven PIAs, and one PIA was modified. All were submitted to the OPC and TBS for review and suggestions, and all executive summaries were published on the School's website.

Table 10.1 Privacy Impact Assessments - Multi year overview

10.2 Institution-specific and central personal information banks

The ATIP Office currently has five institution-specific Personal Information Banks.

Section 11. Privacy Breaches

11.1 Material privacy breached reported

The ATIP Office supports the Department in investigating potential privacy breaches. The ATIP Office reported no material privacy breaches during this reporting period. 

Material privacy breaches are at the highest risk and impact and are defined as: Involving sensitive personal information and could reasonably cause serious injury or harm to the individual and/or involves a large number of impacted individuals.

11.2 Non-material privacy breached reported

The ATIP Office addressed one non-material privacy breach.

Section 12. Resources Related to the Privacy Act

12.1 Allocated costs

During the reporting period, the ATIP Office incurred an estimated $293,910 in Salary and in Goods and Services costs for the administration of the Privacy Act. These costs do not include the resources incurred by the program areas of the School to meet the requirements of the Act.

12.2 Human resources

A total of 2.989 combined full-time equivalents (FTEs) were dedicated to privacy-related activities.

Highlights

2021-2022 Points of interest

Training and Awareness

The ATIP, Parliamentary and Cabinet Affairs, and Special Projects Unit (ATIP Office) informs and guides employees and requesters regarding the administration and the requirements of the Privacy Act through various forms of communication. During the reporting period, the ATIP Office responded to a significant amount of inquiries for advice and guidance on various subjects pertaining to the Act.

The ATIP Office's intranet site is continuously updated as more resources are developed to provide School employees and liaison officers with key information on access to information and privacy, and to ensure individual and institutional accountabilities in the accordance with the Act.

In addition to the material developed by the ATIP Office, the development and provision of institutional training on the Basics of Access to Information and on the Basics of Privacy have been provided to School employees; a total of 10 sessions have been held, in both official languages:

• two sessions on the Access to Information Act: 34 participants
• eight sessions on the Privacy Act: 190 participants
  • The ATIP Office recorded a session on the Basics of Access to Information, which is available to School employees on the intranet site
  • The ATIP Office recorded a session on the Basics of Privacy, which is available to School employees on the intranet site

The ATIP Office also hosted eight presentations that were provided by the Office of the Privacy Commissioner of Canada:

Artificial Intelligence: 70 participants
Biometrics: 70 participants
Information Sharing Agreements: 65 participants
Transparency: 64 participants
Video Interviews: 48 participants
Social Media: 39 participants

Data Privacy Day Activities (January 28, 2021)

• Necessity and Proportionality: 38 participants
• Digital Government: 38 participants

Privacy Awareness Week 2021 Activities (May 3-7, 2021)

• OPC Presentations for internal School employees: Demystifying Privacy with the Office of the Privacy Commissioner' Event
• Test Your Knowledge Quiz
• OPC Presentation to all federal government employees: Integrating a Privacy-First Mindset into Your Work Event

Policies, Guidelines, Procedures, and Initiatives

The ATIP Office's focus has been on raising awareness and developing and revising all its guidelines and procedures over the last two years. In the last year specifically, it has developed and implemented the following:

• Guideline "When is a Privacy Impact Assessment (PIA) is required" in both official languages;
• Three PIA templates in both official languages;
• PIA Checklist in both official languages;
• The revision of the Privacy Breach Protocol;
• A fact sheet: "Examples of What is Considered Personal Information under the Privacy Act" in both official languages;
• Job aids were developed for School employees to support requirements set out in the administration of the Act.

Complaints

At the start of this reporting period, the ATIP Office had six complaints outstanding from previous reporting periods: three from the 2019-2020 reporting period; and three from the 2020-2021 reporting period.

The ATIP Office received four new complaints pursuant to section 31 of the Act, during this reporting period. In addition, the office received eight formal findings which were closed in collaboration with the OPC.

The ATIP Office undertook an additional review of its ongoing complaints and processed a total of 9,936 pages during this reporting period.

There are currently two outstanding complaints: one from the 2019-2020 reporting period; and one from the 2020-2021 reporting period, which is being carried forward to the 2022-2023 reporting period.

During this reporting period, we worked on two Federal Court cases.

Monitoring Compliance

Since the School is a small institution with a relatively low number of requests in comparison with other institutions, senior management is kept informed of the time to process personal information requests by means of a weekly report and through ongoing verbal briefings. The ATIP Office meets to discuss the weekly report with the Director General, Communications and Engagement, on a weekly basis. This report is also shared with the President, Vice-Presidents, Directors General and liaisons on a weekly basis.

Requests closed within legislative timelines - Multi year overview

COVID Impacts

Due to social distancing measures in place for School employees, we have had partial capacity in regards to processing paper records responsive to ATIP requests. As such, there was only minimal impact to our institution's ability to fulfill its Access to Information Act and Privacy Act responsibilities. The mitigation measures applied included, in part, providing extensions to our Offices of Primary Interest to provide the responsive records for several requests.

Appendix A: Delegation order

Privacy Act

The President of the Canada School of Public Service, pursuant to section 73 of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the President, as the head of the Canada School of Public Service, under the provisions of the Act and related regulations set out in the schedule opposite each position. This designation replaces all previous delegation orders.

Appendix B: Statistical Report on the Privacy Act for 2021-2022

Name of institution: Canada School of Public Service

Reporting period: 2021-04-01 to 2022-03-31

Section 1: Requests Under the Privacy Act

Section 2: Informal Requests

Section 3: Requests Closed During the Reporting Period

3.5 Complexity

3.6 Closed requests

3.7 Deemed refusals

Section 4: Disclosures Under Subsections 8(2) and 8(5)

Section 5: Requests for Correction of Personal Information and Notations

Section 6: Extensions

Section 7: Consultations received from other Government of Canada institutions and other organizations

Section 8: Completion Time of Consultations on Cabinet

Section 9: Complaints and Investigations Notices Received

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

Section 11: Privacy Breaches

Section 12: Resources Related to the Privacy Act

Note: Enter values to three decimal places.

Appendix C: Supplementary Statistical Report on the Access to Information Act and Privacy Act for 2021-2022

Name of institution: Canada School of Public Service

Reporting period: 2021-04-01 to 2022-03-31

Section 1: Capacity to Receive Requests under the Access to Information Act and the Privacy Act

Enter the number of weeks your institution was able to receive ATIP requests through the different channels.

Section 2: Capacity to Process Records under the Access to Information Act and the Privacy Act

Section 3: Open Requests and Complaints Under the Access to Information Act

Section 4: Open Requests and Complaints Under the Privacy Act

Section 5: Social Insurance Number (SIN)

Contact us Subscribe to the GCLearning newsletter

---

Features

Embedding Risk Management into Decision-Making (TRN5-E44)

(November 18, 2024)

2024 Government of Canada Workplace Charitable Campaign: Quiz for a Cause – DM Trivia (WMT2-E16)

(November 28, 2024)

Practical Artificial Intelligence Series: Reimagining Government Communications and Access to Services (DDN1-E11)

(December 5, 2024)

Follow:

• Twitter
• YouTube
• LinkedIn
• GCLearning newsletter
• RSS