Annual Report to Parliament on the Administration of the Privacy Act 2018-2019

Table of Contents

Introduction

We are pleased to table the Annual Report to Parliament on the administration of the Privacy Act for fiscal year 2018-2019, as required under section 72 of the Act.

NOTA: The Department is referred to in this report as Global Affairs Canada. Its legal name, however, remains the Department of Foreign Affairs, Trade and Development, as set out in the Department of Foreign Affairs, Trade and Development Act.

Purpose of the Privacy Act

The Privacy Act provides Canadian citizens and individuals present in Canada with the right to seek access to their personal information that is held by the federal government. It also governs the collection, use, disclosure, retention, and disposal of personal information.

Mandate of the Institution

Global Affairs Canada is Canada’s face to the world, working to advance Canada’s political and economic interests in the international community as well as to apply Canadian experience to help address global issues.

The Department's legal mandate, as set out in the Department of Foreign Affairs, Trade and Development Act, SC 2013, c. 33, s. 174, is to:

The Minister of Foreign Affairs is also responsible for the Export and Import Permits Act, RSC 1985, c. E-19, which authorizes the government to control and monitor the trans-border flow of specified goods, and for the Special Economic Measures Act, SC 1992, c. 17, which authorizes the government to apply economic sanctions in response to a serious threat to international peace and security.

The Department also provides administrative support to other federal government institutions with personnel abroad.

Organizational Structure

The Access to Information and Privacy Protection (ATIP) Division is responsible for the administration of the Privacy Act, including the processing of requests and consultations. The Director of the ATIP Division reports to the Corporate Secretary, who in turn reports to the Deputy Minister of Foreign Affairs.

In 2018-2019, the ATIP Division employed 57 Full-Time Equivalents to fulfill the Department’s obligations under both the Access to Information Act and the Privacy Act. During most of the fiscal year, the Division’s staff included up to five consultants and one student.

The Division’s structure consists of a Director, five Deputy Directors, eight Team Leaders, one Senior Advisor, one Manager, one Administrative Assistant, forty-five Analysts, two System Administrators, and seven Clerks. This list includes the Privacy Policy and Governance Team which is comprised of a Team Leader and three Analysts who work exclusively on the application of the Privacy Act. It also includes one Team Leader and five Analysts dedicated to the Intake Team pilot project, which was launched in November 2018. Not all positions in the Division were staffed during the reporting period.

Delegated Authorities

Consistent with Section 73 of the Privacy Act, the Minister’s authority is delegated to the Deputy Ministers, to the Corporate Secretary, to the Director of the ATIP Division, and to the Deputy Directors of the ATIP Division. It is also delegated to Heads of Mission for the purpose of public interest disclosures under section 8(2)(m) of the Act.

Highlights of the Report

Number of requests:

In fiscal year 2018-2019, the number of requests addressed to the Department under the Privacy Act increased by 65% compared to the previous reporting period and by 14% compared with the average of the previous three reporting periods. The number of requests completed by the Department increased by 58% compared to the previous reporting period.

Text version
Privacy Requests
 2015-162016-172017-182018-19
Received13515386142
Completed12716869109

Deemed refusal rate:

The Department’s deemed refusal rate in 2018-19 (i.e., the percentage of requests under the Privacy Act that received a response beyond the deadline required under the Act) was 39%. This represented a 6% increase over the deemed refusal rate for the previous reporting period and a 9% increase over the average of the previous three reporting periods.

Text version
Deemed Refusal Rate
 2015-162016-172017-182018-19
Percentage31.50%23.81%33.33%39.45%

Staffing:

In 2018-19, the Division had approximately 7 Full-Time Equivalents (FTE) working on Privacy Protection requests and Privacy Policies. This represented a 13% decrease over the previous reporting period. The Department took measures to improve its performance by staffing the ATIP Division with additional resources.

Text version
Staffing
 2015-162016-172017-182018-19
Percentage31.50%23.81%33.33%7.26

Innovation to improve operational efficiency:

During the reporting period, the ATIP Division continued the process of reviewing and streamlining its operations. A very significant result of this process has been the Intake Team pilot project. The purpose of this team is to triage incoming requests and consultations, re-scope the requests and retrieve the relevant documents in order to alleviate the overall administrative burden for analysts. Early statistics indicate that analyst productivity will be increased by over 30%. The project was launched in November 2018 and is ongoing.

Administration of Requests

The following section explains key elements of the Statistical Report to the Treasury Board Secretariat provided in annex B.

Privacy Requests

In 2018-2019, the Department received 142 requests for personal information under the Privacy Act. In addition, 35 requests were carried over from the previous fiscal year, for a total of 177 active requests.

During the reporting period, 109 requests were completed. As a result, 68 active files were carried over to the next reporting period.

Disposition of Completed Requests

The disposition of requests for personal information received during the reporting period was as follows:

DispositionNumber of Requests
All disclosed23
Disclosed in part43
All exempted2
All excluded2
No records exist16
Request abandoned23
Neither confirmed nor denied0
Total109

Exemptions and Exclusions

The exemptions under the Act most commonly applied by the Department during the reporting period were section 26 [information about another individual] (applied to 40 requests) and 27 [solicitor-client privilege] (applied to 9 requests).

Relevant pages processed and disclosed

During the reporting period, the Department disclosed 11,319 pages of the 14,106 relevant pages processed.

Extensions

During the reporting period, the Department claimed 29 extensions pursuant to subsection 15(a)(i) and 7 extensions pursuant to subsection 15(a)(ii).

Consultations received from other institutions

When a request addressed to a Department contains records that are of interest to another government institution, the Department consults the ATIP Coordinator of that institution accordingly.

Given its mandate and various responsibilities at the international level, the Department played a key role under the Privacy Act on behalf of other institutions of the Government of Canada. Specifically, the Department consulted foreign governments and organizations on behalf of other federal government institutions when the latter needed to determine whether they could release records that originated abroad. During the reporting period, the Department received 14 new consultations under the Act, all but one from other federal government institutions. In total, the Department completed 14 consultations.

Internal Operations

Training and Development

During fiscal year 2018-2019, the ATIP Division continued to provide its analysts with the necessary training and tools to perform their jobs effectively, notably by ensuring that all staff members had learning plans in their performance evaluation agreements.

The ATIP Division benefited from its Professional Development Program, which allows the Department to train and promote its analysts from junior to senior levels. This program has been very successful in addressing recruitment, retention and succession planning issues. At the end of the fiscal year, 14 employees were in the program and further recruitment was underway.

The ATIP Division continues to develop tools and guidance material to assist and inform the Department. In an effort to foster meaningful dialogue with internal clients, a Departmental outreach event was held for Right to Know Week. In addition, during this reporting period, 685 employees completed an online interactive ATIP awareness tutorial, developed in collaboration with the Canadian Foreign Service Institute. Internal training initiatives for the ATIP Division also include the ATIP mentorship program, a legal workshop on jurisprudence, and guest speakers from the ATIP community.

To assist Consular officials in understanding their roles and responsibilities vis-à-vis the Access to Information Act and the Privacy Act in the context of providing consular services to Canadians, a specific training program was delivered to 66 employees on Confidentiality and Personal Information.

In order to decentralize the responsibility of training among teams, the ATIP Division introduced guidelines for delivering ATIP training. This yielded benefits such as relationship-building between analysts and subject matter experts, skill-building opportunities for analysts in the Professional Development Program, and ensured continuous training offerings throughout the Department. During the reporting period, at least 25 formal ATIP training sessions were delivered to approximately 199 employees.

New or Revised Policies, Guidelines and Procedures

As a result of the Lean initiatives of 2017-18, efforts have been made to foster more effective dialogue between the ATIP Division and subject matter experts. A yearlong rationale campaign has included outreach initiatives, and the provision of helpful statistics in order to identify areas for improvement. For example, the monthly Bureau Performance Report is now circulated by the Corporate Secretary and encompasses all bureaus whose internal deadlines have been missed. This has yielded a significant response from bureaus, and a renewed awareness of tasking deadlines.

With the assistance of the Senior Policy and Governance Advisor, the Intake Team pilot project has centralized administrative functions, and allows analysts to focus their efforts on the review of records. The Intake Team also serves as a training unit and assists in the onboarding of new employees. Once new employees have completed their term with the Intake Team, they are transitioned to regular portfolios. Upon this transition, they are further supported by the ATIP Division’s Mentorship Program, another Lean initiative.

During the Reporting Period, the Privacy Policy Group has undertaken significant efforts to improve its Information Management practices. The Case Management configuration was adapted and documented to improve oversight and operations. It initiated a study to adopt new software to better track correspondence and tasks. Practices have been streamlined to reduce administrative burden.

The Department continued to place a heavy emphasis on educating departmental officials on their ATIP roles and responsibilities to ensure compliance and efficiencies.

Complaints, Audits, and Investigations

During the reporting period, the Department received 17 new complaints. In addition, 7 complaints were carried over from the previous fiscal year. The Department closed 4 complaints, of which two had been opened in a previous fiscal year. Consequently, 13 complaints were carried over to the next fiscal year.

Of the 17 complaints received in the reporting period:

Of the 4 complaints closed during the reporting period:

The Department took the issue of complaints seriously and addressed any problems that were identified, notably through training. The Division had a dedicated officer dealing with the resolution of complaints.

Monitoring Processing Times

The Department monitored the processing time for requests and tracked their status. The tools in place for this purpose included:

Administration of Personal Information

Privacy Breaches

During the reporting period, the Department reported one material privacy breach:

PBR-2017-01189: Information relating to the Prime Minister’s visit to the National Governors’ Conference in Rhode Island and a staff member’s work-related/personal items were stolen from the trunk of the staff member’s rental car. The breach was reported to the Privacy Commissioner and to the Information and Privacy Policy Division of the Treasury Board Secretariat. In consultation with RCMP/departmental security, they are in agreement that the incident does not constitute a security breach. Various measures were taken to contain the material breach including informing the department’s Access to Information and Privacy Policy section, advising Washington’s IT section, remotely wiping and disabling electronics, and advising the GAC HQ security and Washington Mission Security. As part of a larger security initiative, all mission staff will be re-briefed on security protocols at the mission, including a discussion on security protocols for events outside of the mission to limit any further potential for a breach.

Privacy Impact Assessments (PIA)

The Department completed three (3) privacy impact assessments in fiscal year 2018-2019:

• The Diplomatic Registration System examined the privacy risks of the system for the accreditation/registration of foreign representatives and their family members when coming to Canada. The assessment identified potential risks and corresponding strategies to mitigate these risks.

• The Case, Contact, and Emergency Management (CCEM) Solution project PIA examined the privacy risks associated with the modernization of the COSMOS system with the introduction of CCEM and GAC’s broader “Going Digital” strategy. The assessment identified potential risks and corresponding strategies to mitigate these risks.

• The Ministerial Appointment activity PIA examined the privacy risks associated with the appointment process of ministers at Global Affairs Canada. The assessment identified potential risks and corresponding strategies to mitigate these risks.

Disclosure of Personal Information

Subsection 8(2) of the Privacy Act provides that “personal information under the control of a government institution may be disclosed” without consent under certain specific circumstances.

During fiscal year 2018-2019, the Department made a total of 32 disclosures pursuant to subsection 8(2)(m) of the Privacy Act. In 6 cases, the Department determined that the public interest in disclosing personal information clearly outweighed any invasion of privacy that could result. All other disclosures were determined to clearly benefit the individual to whom the information related.

Disclosures pursuant to subparagraph 8(2)(m)(i):

32 disclosures pursuant to paragraph 8(2)(m) were made during fiscal year 2018-2019 and a total of 21 notifications were sent out to the Privacy Commissioner of Canada. The Division is currently in the process of sending out the remainder of notifications to the Privacy Commissioner of Canada for the disclosures made during the fiscal year 2018-2019.

Annex A: designation order

Privacy Act Designation Order

The Minister of Foreign Affairs, pursuant to section 73 of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons acting in those positions, to exercise the powers and perform the duties and functions of the Minister of Foreign Affairs as the head of a Government institution under the sections of the Act set out after each position in the schedule. This designation replaces the designation dated October 2, 2009.

Schedule

Position

  1. Deputy Minister of Foreign Affairs (all sections)
  2. Deputy Minister of International Trade (all sections)
  3. Deputy Minister of International Development (all sections)
  4. Associate Deputy Minister of Foreign Affairs (all sections)
  5. Assistant Deputy Minister, Consular Services (pursuant only to paragraph 8(2)(m) as it relates to public interest disclosure)
  6. Heads of Mission (pursuant only to paragraph 8(2)(m) as it relates to public interest disclosure)
  7. Director General, Corporate Secretariat (all sections)
  8. Director, Access to Information and Privacy Protection Division (all sections)
  9. Deputy Directors, Access to Information and Privacy Protection Division (all sections)

The Honourable Chrystia Freeland, P.C., M.P.
Ottawa, July 04, 2017

Annex B: Global Affairs Canada 2018-2019 Statistical Report

Statistical Report on the Privacy Act

Name of institution: Global Affairs Canada

Reporting period: 2018-04-01 to 2019-03-31

Part 1: Requests Under the Privacy Act
Number of Requests
Received during reporting period142
Outstanding from previous reporting period35
Total177
Closed during reporting period109
Carried over to next reporting period68

Part 2: Requests Closed During the Reporting Period

2.1 Disposition and completion time
Disposition of RequestsCompletion Time
1 to 15 Days16 to 30 Days31 to 60 Days61 to 120 Days121 to 180 Days181 to 365 DaysMore Than 365 DaysTotal
All disclosed568112023
Disclosed in part12109811243
All exempted01100002
All excluded00110002
No records exist490201016
Request abandoned2111000023
Neither confirmed nor denied00000000
Total311921139142109
2.2 Exemptions
SectionNumber of Requests
18(2)0
19(1)(a)1
19(1)(b)0
19(1)(c)0
19(1)(d)0
19(1)(e)0
19(1)(f)0
200
215
22(1)(a)(i)0
22(1)(a)(ii)0
22(1)(a)(iii)0
22(1)(b)1
22(1)(c)0
22(2)0
22.10
22.20
22.32
23(a)0
23(b)0
24(a)0
24(b)0
252
2640
279
280
2.3 Exclusions
SectionNumber of Requests
69(1)(a)0
69(1)(b)0
69.10
70(1)0
70(1)(a)0
70(1)(b)0
70(1)(c)1
70(1)(d)0
70(1)(e)0
70(1)(f)0
70.10
2.4 Format of information released
DispositionPaperElectronicOther formats
All disclosed1940
Disclosed in part14290
Total33330
2.5 Complexity
2.5.1 Relevant pages processed and disclosed
Disposition of RequestsNumber of Pages ProcessedNumber of Pages DisclosedNumber of Requests
All disclosed57857823
Disclosed in part135211074143
All exempted602
All excluded102
Request abandoned0023
Neither confirmed nor denied000
Total141061131993
2.5.2 Relevant pages processed and disclosed by size of requests
DispositionLess Than 100 Pages Processed101-500 Pages Processed501-1000 Pages Processed1001-5000 Pages ProcessedMore Than 5000 Pages Processed
Number of RequestsPages DisclosedNumber of RequestsPages DisclosedNumber of RequestsPages DisclosedNumber of RequestsPages DisclosedNumber of RequestsPages Disclosed
All disclosed2357800000000
Disclosed in part143611630441153222201400
All exempted2000000000
All excluded2000000000
Request abandoned23000000000
Neither confirmed nor denied0000000000
Total649391630441153222201400
2.5.3 Other complexities
DispositionConsultation RequiredLegal Advice SoughtInterwoven InformationOtherTotal
All disclosed10001
Disclosed in part51006
All exempted00000
All excluded00000
Request abandoned00000
Neither confirmed nor denied00000
Total61007
2.6 Deemed refusals
2.6.1 Reasons for not meeting statutory deadline
Number of Requests Closed Past the Statutory DeadlinePrincipal Reason
WorkloadExternal ConsultationInternal ConsultationOther
431211020
2.6.2 Number of days past deadline
Number of Days Past DeadlineNumber of Requests Past Deadline Where No Extension Was TakenNumber of Requests Past Deadline Where An Extension Was TakenTotal
1 to 15 days404
16 to 30 days213
31 to 60 days5510
61 to 120 days2810
121  to 180 days2911
181 to 365 days123
More than 365 days202
Total182543
2.7 Requests for translation
Translation RequestsAcceptedRefusedTotal
English to French000
French to English000
Total000

Part 3: Disclosures Under Subsections 8(2) and 8(5)

Paragraph 8(2)(e)Paragraph 8(2)(m)Subsection 8(5)Total
10322163

Part 4: Requests for Correction of Personal Information and Notations

Disposition for Correction Requests ReceivedNumber
Notations attached0
Requests for correction accepted0
Total0

Part 5: Extensions

5.1 Reasons for extensions and disposition of requests
Disposition of Requests Where an Extension Was Taken15(a)(i) Interference With Operations15(a)(ii) Consultation15(b) Translation or Conversion
Section 70Other
All disclosed5000
Disclosed in part21060
All exempted1000
All excluded1010
No records exist1000
Request abandoned0000
Total29070
5.2 Length of extensions
Length of Extensions15(a)(i) Interference with operations15(a)(ii) Consultation15(b) Translation purposes
Section 70Other
1 to 15 days0000
16 to 30 days29070
Total29070

Part 6: Consultations Received From Other Institutions and Organizations

6.1 Consultations received from other Government of Canada institutions and other organizations
ConsultationsOther Government of Canada InstitutionsNumber of Pages to ReviewOther OrganizationsNumber of Pages to Review
Received during the reporting period1338110
Outstanding from the previous reporting period4129800
Total17167910
Closed during the reporting period1338110
Pending at the end of the reporting period4129800
6.2 Recommendations and completion time for consultations received from other Government of Canada institutions
RecommendationNumber of days required to complete consultation requests
1 to 15 Days16 to 30 Days31 to 60 Days61 to 120 Days121  to 180 Days181 to 365 DaysMore Than 365 DaysTotal
All disclosed63000009
Disclosed in part10000001
All exempted00000000
All excluded00000000
Consult other institution30000003
Other00000000
Total1030000013
6.3 Recommendations and completion time for consultations received from other organizations
RecommendationNumber of days required to complete consultation requests
1 to 15 Days16 to 30 Days31 to 60 Days61 to 120 Days121  to 180 Days181 to 365 DaysMore Than 365 DaysTotal
All disclosed00000000
Disclosed in part00000000
All exempted00000000
All excluded00000000
Consult other institution00000000
Other10000001
Total10000001

Part 7: Completion Time of Consultations on Cabinet Confidences

7.1 Requests with Legal Services
Number of DaysFewer Than 100 Pages Processed101‒500 Pages Processed501-1000 Pages Processed1001-5000 Pages ProcessedMore than 5000 Pages Processed
Number of RequestsPages DisclosedNumber of RequestsPages DisclosedNumber of RequestsPages DisclosedNumber of RequestsPages DisclosedNumber of RequestsPages Disclosed
1 to 151200000000
16 to 300000000000
31 to 600000000000
61 to 1200000000000
121 to 1800000000000
181 to 3650000000000
More than 3650000000000
Total1200000000
7.2 Requests with Privy Council Office
Number of DaysFewer Than 100 Pages Processed101‒500 Pages Processed501-1000 Pages Processed1001-5000 Pages ProcessedMore than 5000 Pages Processed
Number of RequestsPages DisclosedNumber of RequestsPages DisclosedNumber of RequestsPages DisclosedNumber of RequestsPages DisclosedNumber of RequestsPages Disclosed
1 to 150000000000
16 to 300000000000
31 to 600000000000
61 to 1200000000000
121 to 1800000000000
181 to 3650000000000
More than 3650000000000
Total0000000000

Part 8: Complaints and Investigations Notices Received

Section 31Section 33Section 35Court actionTotal
1704021

Part 9: Privacy Impact Assessments (PIAs)

Number of PIA(s) completed3

Part 10: Resources Related to the Privacy Act

10.1 Costs
ExpendituresAmount
Salaries$383,795
Overtime$5,562
Goods and Services$201,340
• Professional services contracts$170,513 
• Other$30,827
Total$590,697
10.2 Human Resources
ResourcesPerson Years Dedicated to Privacy Activities
Full-time employees5.11
Part-time and casual employees0.70
Regional staff0.00
Consultants and agency personnel1.39
Students0.06
Total7.26
Date Modified: