Annual Report to Parliament on the Administration of the Privacy Act 2021-2022

Introduction

This report is tabled in Parliament in accordance with section 72 of the Privacy Act under the direction of the Minister of Public Safety. It describes how Public Safety Canada administered and fulfilled its obligations under the Privacy Act between April 1, 2021, and March 31, 2022.

Purpose of the Privacy Act

The Privacy Act came into force on July 1, 1983. It protects the privacy of individuals by imposing obligations on government institutions subject to the act. These obligations limit the collection, retention, use, disclosure and disposal of personal information held by these government institutions. It also gives individuals the right of access to their own personal information, with limited and specific exemptions, and the rights to request the correction of that information. Individuals who are not satisfied with an institution’s handling of their personal information or any matter related to a formal request made under the Privacy Act are entitled to complain to the Privacy Commissioner of Canada.

Mandate of Public Safety Canada

Public Safety Canada was created in 2003 to ensure coordination across all federal departments and agencies responsible for national security and the safety of Canadians. Our mandate is to keep Canadians safe from a range of risks such as natural disasters, crime and terrorism. Our mission is to build a safe and resilient Canada. Our vision is to, through outstanding leadership, achieve a safe and secure Canada and strong and resilient communities.

Legislation governing the Department sets out three essential roles:

1. Support the Minister’s responsibility for all matters related to public safety and emergency management not assigned to another federal organization;
2. Exercise leadership at the national level for national security and emergency preparedness; and
3. Support the Minister’s responsibility for the coordination of entities within the Public Safety Portfolio.

Organizational Structure

Public Safety Canada

During the 2021-22 fiscal year, the department was organized into five branches: Emergency Management and Programs, Community Safety and Countering Crime, Portfolio Affairs and Communications, National and Cyber Security, and Corporate Management. The department also has a Chief Audit and Evaluation Executive and is supported by the Legal Services Unit.

Five Regional Offices represent the Atlantic, Quebec, Ontario, the Prairies and British Columbia and the North. Our regional offices are the primary point of contact for the Department at the provincial level. They deliver a coordinated federal response to emergencies; facilitate the effective delivery of emergency management, Indigenous policing and crime prevention programs; and improve partnerships with other levels of government and key regional stakeholders.

The Public Safety Portfolio: Partner Agencies and Review Bodies

The Canada Border Services Agency (CBSA) manages the nation's borders by enforcing Canadian laws governing trade and travel, as well as international agreements and conventions. CBSA facilitates legitimate cross-border traffic and supports economic development while stopping people and goods that pose a potential threat to Canada.

The Canadian Security Intelligence Service (CSIS) investigates and reports on activities that may pose a threat to the security of Canada. CSIS also provides security assessments, on request, to all federal departments and agencies.

The Correctional Service of Canada (CSC) helps protect society by encouraging offenders to become law-abiding citizens while exercising reasonable, safe, secure and humane control. CSC is responsible for managing offenders sentenced to two years or more in federal correctional institutions and under community supervision.

The Parole Board of Canada (PBC) is an independent body that grants, denies or revokes parole for inmates in federal prisons and provincial inmates in provinces without their own parole board. The PBC helps protect society by facilitating the timely reintegration of offenders into society as law-abiding citizens.

The Royal Canadian Mounted Police (RCMP) enforces Canadian laws, prevents crime and maintains peace, order and security.

The Civilian Review and Complaints Commission for the Royal Canadian Mounted Police (CRCC) investigates complaints from the public about the conduct of members of the RCMP in an open, independent and objective manner. The Commission also holds public hearings and conducts research and policy development to improve the public complaints process.

The Office of the Correctional Investigator (OCI) conducts independent, thorough and timely investigations about issues related to the Correctional Service of Canada. The OCI may initiate an investigation based on a complaint from (or on behalf of) an offender, as the result of a ministerial request, or on its own initiative.

The Access to Information and Privacy (ATIP) Office

The department’s Access to Information and Privacy (ATIP) Office is responsible for the coordination and implementation of policies, guidelines, and procedures to ensure departmental compliance with the Access to Information Act and the Privacy Act. The ATIP Office is also responsible for responding to requests made under the Acts. In keeping with the department’s role to support the Minister in the coordination of entities within the Public Safety Portfolio, the ATIP Office also plays a leadership role with respect to ensuring alignment of approach with the ATIP Offices of other Public Safety Portfolio organizations. 

The ATIP Office is part of Public Safety Canada’s Portfolio Affairs and Communications Branch. It is headed by the Director of ATIP and Executive Services, who is also responsible for Ministerial Correspondence and Secretariat Services. The ATIP Office is divided into two teams, the ATIP Operations Unit and the Privacy Policy and Governance Unit (PPGU). Each team is headed by a Manager who reports to the Director of ATIP and Executive Services. In 2021-22, the ATIP Office consisted of 15 full-time employees.

Public Safety was not a party to any service agreements to provide services to other organizations under section 73.1 of the Privacy Act during the fiscal year.

Delegation Order

Public Safety’s current delegation order for the Privacy Act and related regulations was signed by the Minister of Public Safety and Emergency Preparedness on July 21, 2020. The signed Delegation Order is attached in Annex A.

As of October 26, 2021, the responsibilities of the Minister of Public Safety and Emergency Preparedness were divided among two Ministers: the Minister of Public Safety and the Minister of Emergency Preparedness. Despite this change, the current Delegation Order remains valid for all exercise of delegated authorities by employees of the department under the Privacy Act. 

The following authorities are granted under this delegation order:

• Full authority is granted to the Deputy Minister of Public Safety, the Associate Deputy Minister, the Assistant Deputy Minister of Portfolio Affairs and Communication Branch, the Director General of Cabinet and Parliamentary Affairs and Executive Services, the Director of ATIP and Executive Services, as well as the ATIP Manager.
• ATIP Operations Team Leaders and ATIP Analysts possess authority under Sections 15 of the Privacy Act and Assistant Deputy Ministers as well as Chief Audit Executives possess authority under Section 9(4) and 10 of the Privacy Act.

Performance 2021-2022

The following sections provide an overview of key data on Public Safety’s processing of Privacy Act requests between April 1, 2021 and March 31, 2022. The full statistical report can be found in Annex B.

Response within Legislated Timelines

In 2021-2022, Public Safety Canada received 40 requests under the Privacy Act, a slight decrease compared to the previous year (41 requests). During the year, the department completed 40 requests. Of these, 92.5% of privacy requests were completed on time, a slight decrease compared to the previous year (93.3%).

While the department’s on-time completion rate for Privacy Act requests was not impacted this fiscal year by the circumstances of the COVID-19 pandemic, it is expected there will be an impact in the coming year. During the pandemic, the ATIP Office was unable to process files containing classified or physical records, in cases where these could not be accessed by employees working remotely. As the 2021-2022 fiscal year progressed, measures were taken to restore full capacity to process new incoming requests, and to begin working on backlog files that had been delayed. As the ATIP Office works on completing backlog files, there will be a temporary impact on the department’s on-time completion rate until all backlog files are addressed.

Completion Times

A total of 40 files were completed during the fiscal year. Due to the focus on completing backlog files delayed by the pandemic, there was a slight increase in files with longer completion times (greater than 180 days), as seen in the table below.

Active Requests Outstanding from Previous Reporting Periods

At the end of the fiscal year, Public Safety Canada had a total of 9 active requests that were carried over to the next reporting period. Of these, 2 were within the legislated timeline, while 7 were beyond the legislated timeline. The majority of files that were beyond the legislated timeline were related to the circumstances of the pandemic.

Active Complaints Outstanding from Previous Reporting Periods

At the end of the fiscal year, Public Safety had a total of 4 active complaints that were carried over to the next reporting period. The ATIP Office worked closely with the Office of the Privacy Commissioner during the year to ensure complaints were addressed, and no significant issues were flagged.

Reasons for Extensions

A total of 4 extensions were taken during the fiscal year under section 15 of the Privacy Act, due to interference with operations.

Consultations from Other Institutions

Public Safety Canada completed 1 consultation for another institution, responding in under 15 days.

Disposition of Requests

Of the 40 completed requests, 22.5% of requests had records that were entirely disclosed, and 20% of requests had records that were disclosed in part. The remaining requests were either abandoned, or no records existed corresponding to the request.

Impacts of the COVID-19 Pandemic

Throughout the year, the physical and mental health of employees continued to be a primary focus, while balancing our obligations under the Privacy Act. Between April 1, 2021 and March 31, 2022, Public Safety’s ATIP Office as well as Offices of Primary Interest (OPIs) across the department continued to work remotely in response to the COVID-19 pandemic. This resulted in a number of challenges, chiefly that employees working remotely were unable to retrieve or review classified or physical records. While the impact was felt most strongly in relation to Access to Information Act Requests, there was an impact on Privacy Act Requests as well, particularly in cases where records needed to be retrieved or processed on-site.

To address these challenges, Public Safety Canada continued to make use of mitigation measures established early in the pandemic. Files containing records that could not be accessed by employees working remotely were triaged to ensure they could be completed in a timely matter upon return to the office. Where possible, the ATIP Office made arrangements to provide requesters with interim releases of materials that could be processed remotely.

As the year progressed, the ATIP Office and OPIs began having staff return to the office to work on files containing classified or physical records. Priority was placed on restoring full capacity to process new incoming requests (full capacity was reached in early 2022-23), while addressing backlog files on a targeted basis. Addressing the remaining backlog files will be a priority in the coming fiscal year.

Training and Awareness       

Public Safety Canada remains committed to promoting awareness and providing ongoing training opportunities to all employees. This fiscal year, the ATIP Office provided 16 training and information sessions on the Access to Information Act and Privacy Act. A variety of subject matters were presented, including strategies for retrieving records and applying exemptions, as well as requirements for proactive publication. A total of 397 people attended these sessions.

Additionally, 361 Public Safety employees completed the online course, Access to Information and Privacy Fundamentals (I015), this fiscal year. This course is offered by the Canada School of Public Service and is mandatory for all new employees joining Public Safety Canada.

Policies, Guidelines or Procedures and Initiatives

During the year, the ATIP Office led conversations with portfolio partners to ensure alignment of approach on privacy matters, including updates to the Privacy Act to extend access rights to foreign nationals. An internal working group was organized to begin preparations for the rollout of new government-wide contracts for ATIP software in the 2022-23 fiscal year. The ATIP Office also completed a full update of privacy related resources and procedures for departmental employees on the department’s intranet page, including guidelines on conducting Privacy Impact Assessments.

Summary of Key Issues and Actions Taken on Complaints

During the year, Public Safety’s ATIP Office maintained a constructive relationship with the Office of the Privacy Commissioner (OPC) and worked proactively with the OPC to address complaints in relation to Privacy Act requests. Meetings were held as needed to address areas of concern as they arose and to ensure ongoing alignment of approach. No specific issues were noted during the year.

Monitoring Compliance

The department’s weekly ATIP report includes the list of new Privacy Act requests and deadlines for retrieval of materials. This report was shared with the Deputy Minister, Assistant Deputy Ministers, and other senior officials, and discussed at senior management meetings as required. In addition, ATIP performance is monitored at the ADM level through their Performance Management Agreements to ensure ATIP is a priority within the department.

Material Privacy Breaches

There were no material privacy breaches reported this fiscal year.

Privacy Impact Assessments

No Privacy Impact Assessments were completed during the fiscal year.

Public Interest Disclosures Pursuant to paragraph 8(2)(m) of the Privacy Act

Paragraph 8(2)(m) of the Privacy Act provides the head of the institution with the authority to disclose personal information where the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure, or where the disclosure would clearly benefit the individual to whom the information relates. No disclosures pursuant to paragraph 8(2)(m) of the Privacy Act were made by Public Safety Canada this fiscal year.

Annex A: Delegation Orders

Privacy Act Delegation Order

The Minister of Public Safety and Emergency Preparedness, pursuant to section 73(1) of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Minister as the head of Public Safety and Emergency Preparedness, under the provisions of the Privacy Act and related regulations set out in the schedule opposite each position. This designation replaces all previous delegation orders.

Dated, at the City of Ottawa, this 21st day of July, 2020.

The Honourable William Sterling Blair, P.C., C.O.M., M.P.
Minister of Public Safety and Emergency Preparedness

Appendix B – Statistical Report on the Privacy Act

Reporting period: 2021-04-01 to 2022-03-31

Section 1: Requests Under the Privacy Act

Section 2: Informal Requests

Section 3: Requests Closed During the Reporting Period

3.5 Complexity

3.6 Closed requests

3.7 Deemed refusals

Section 4: Disclosures Under Subsections 8(2) and 8(5)

Section 5: Requests for Correction of Personal Information and Notations

Section 6: Extensions

Section 7: Consultations Received From Other Institutions and Organizations

Section 8: Completion Time of Consultations on Cabinet Confidences

Section 9: Complaints and Investigations Notices Received

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

Section 11: Privacy Breaches

Section 12: Resources Related to the Privacy Act

Annex C: Supplemental Statistical Report

Reporting period: 2021-04-10 to 2022-03-31

Section 1: Capacity to Receive Requests under the Access to Information Act and the Privacy Act

Section 2: Capacity to Process Records under the Access to Information Act and the Privacy Act

Section 3: Open Requests and Complaints Under the Access to Information Act

Section 4: Open Requests and Complaints Under the Privacy Act

Section 5: Social Insurance Number (SIN)

Date modified:

2022-11-07