Annual Report to Parliament on the Privacy Act 2015-2016

Table of Contents

1. Introduction
2. Governance and accountability
3. Privy Council Office delegation order
4. Access to Information and Privacy (ATIP) Division
5. Education and training activities
6. Privacy-related policies, guidelines, and procedures
7. Other activities
   1. a) General operations
   2. b) Electronic release of records
   3. c) Data matching and sharing
8. Interpretation of the Statistical Report
   1. Part 1: Requests under the Privacy Act
   2. Part 2: Requests closed during the reporting period
      1. 2.1) Disposition and completion time
      2. 2.2) Exemptions
      3. 2.3) Exclusions
      4. 2.4) Format of information released
      5. 2.5) Complexity
         1. 2.5.1) Relevant pages processed and disclosed
         2. 2.5.2) Relevant pages processed and disclosed by size of requests
         3. 2.5.3) Other complexities
      6. 2.6) Deemed refusals
      7. 2.7) Requests for translation
   3. Part 3: Disclosures under s. 8(2)
   4. Part 4: Requests for correction of personal information and notations
   5. Part 5: Extensions
      1. 5.1) Reasons for extensions and disposition of requests
      2. 5.2) Length of extensions
   6. Part 6: Consultations received from other institutions and organizations
   7. Part 7: Completion time of consultations on Cabinet confidences
   8. Part 8: Complaints and investigations
      1. 8.1) Complaints received
      2. 8.2) Types of complaints
      3. 8.3) Investigations
   9. Part 9: Privacy Impact Assessments (PIAs)
   10. Part 10: Resources related to the Privacy Act (PA)
9. Appendix A: Delegation order
10. Appendix B: 2015-2016 Statistical Report on the Privacy Act (PA)

Introduction

The Privy Council Office (PCO) reports directly to the Prime Minister and is headed by the Clerk of the Privy Council and the Secretary to the Cabinet. PCO is both the Cabinet secretariat and the Prime Minister’s source of public service advice across the entire spectrum of policy questions and operational issues facing the Government. As the hub of non-partisan, public service support to the Prime Minister, Cabinet and its decision-making structures, PCO ensures that the Government and Canadians are served by the highest quality public service.

From the beginning of the fiscal year until a new Cabinet was sworn in on November 4, 2015, PCO also provided support to the Minister of Intergovernmental Affairs, the Leader of the Government in the House of Commons, the Minister of State and Chief Government Whip, and the Minister of State (Democratic Reform). A new Ministry was sworn in on November 4, 2015. Through the remainder of the fiscal year, in addition to the new Prime Minister (including in his capacities as Minister of Youth and Minister of Intergovernmental Affairs), PCO provided support to the Leader of the Government in the House of Commons and the Minister of Democratic Institutions.

PCO has three main roles:

• Advice to the Prime Minister - PCO brings together quality, objective policy advice, analysis and information to support the Prime Minister, the ministers within the Prime Minister’s portfolio and Cabinet. This includes:
  • bringing together non-partisan advice, analysis and information from across the Public Service;
  • consulting and collaborating with international and domestic partners inside and outside of government (including provincial and territorial governments);
  • gathering information on the priorities of Canadians;
  • supporting and advising on the development and implementation of the Government’s Parliamentary and legislative programs and democratic reform agenda; and
  • advising on Canada’s Westminster style of government, on government structure and organization, and on Governor in Council appointments.
• Secretariat to Cabinet - PCO facilitates the smooth, efficient and effective functioning of Cabinet and the Government of Canada on a day-to-day basis. This includes:
  • managing the Cabinet's decision-making system;
  • coordinating departments’ policy and legislative proposals to Cabinet, with supporting policy analysis;
  • scheduling and providing support services for meetings of Cabinet and Cabinet committees;
  • advancing the Government's agenda across federal departments and agencies and with external stakeholders;
  • advising on Governor in Council appointments, including directing and coordinating selection and recruitment processes for leadership and full-time Governor in Council positions across the public sector and supporting Cabinet in decision-making related to Governor in Council appointments;
  • preparing Orders in Council and other statutory instruments to give effect to Government decisions; and
  • providing administrative services to the Prime Minister's Office, portfolio ministers and commissions of inquiry.
• Public Service Leadership - PCO supports the development and maintenance of a high quality public service that meets the highest standards of accountability, transparency and efficiency, one that is able to deliver the best advice to government and excellent services to Canadians. This includes:
  • managing the recruitment and appointment process for senior positions in federal departments and agencies;
  • guiding policy on people management issues and public service renewal; and
  building the capacity of the public service to meet emerging challenges and the changing responsibilities of government.

This is the 33rd Annual Report to Parliament on the administration of the Privacy Act (PA) by PCO, submitted as required by s. 72(1) of the PA. This report covers the reporting period of April 1, 2015 to March 31, 2016.

Additional copies of this report may be obtained from:

• Access to Information and Privacy (ATIP) Division
  Privy Council Office
  55 Metcalfe Street, Room 1500
  Ottawa, Ontario K1A 0A3

Governance and accountability

PCO provides support to the Prime Minister and to the ministers within his portfolio, which, in 2015-2016, included: (April 1 to November 4, 2015) the Minister of Intergovernmental Affairs, the Leader of the Government in the House of Commons, the Minister of State and Chief Government Whip, and the Minister of State (Democratic Reform); (November 4, 2015 to March 31, 2016) the Leader of the Government in the House of Commons and the Minister of Democratic Institutions.

Reporting to the Prime Minister, the Clerk of the Privy Council has three main roles: Deputy Minister to the Prime Minister, Secretary to the Cabinet, and Head of the Federal Public Service. PCO’s Corporate Services Branch, which reports directly to the Clerk, has four divisions, including Access to Information and Privacy (ATIP). The ATIP Division has three functional areas of responsibility: ATIP Policy and Processes, Operations, and Client Services.

Privy Council Office delegation order

The Minister heading each government institution is responsible for the implementation of the PA within his/her institution. The Prime Minister, as the Head of the Privy Council Office and pursuant to s. 73 of the PA, is responsible for the implementation of the PA within PCO. Through PCO's delegation order, the Prime Minister designated the Director, Access to Information and Privacy (ATIP), as the individual within PCO to perform the powers, duties, functions, or administrative tasks pertaining to the PA. PCO Secretariats, or Offices of Primary Interest (OPI), holders of the information identified in a privacy request, approve the release of information to requesters and application of exemptions or exclusions and supporting rationales. This shared delegation of authority for the disposition of information is exercised diligently within PCO, and recorded formally at appropriate stages in the process. The PCO delegation orders are shown at Appendix A.

Access to Information and Privacy (ATIP) Division

The PA protects the privacy of personal information held by the Government of Canada. The PA ensures the protection of that information against unauthorized use and disclosure, and provides individuals with the right of access to, and a means to correct, their personal information.

The ATIP Division is the focal point for access to information and privacy within PCO. The Division is responsible for managing requests for departmental or personal information, ensuring corporate understanding and compliance with the Access to Information Act (ATIA)and the PA, and fostering corporate awareness of access and privacy rights and responsibilities. On matters of access and privacy, the ATIP Division also acts as a primary liaison with the Office of the Information Commissioner (OIC), the Office of the Privacy Commissioner (OPC), the Treasury Board of Canada Secretariat (TBS), and partner departments.

The ATIP Division has a personnel complement totalling approximately 20 full-time equivalents that are organized into three categories of responsibility:

1. ATIP Policy and Processes
   • Provides expertise in access to information and privacy policy;
   • Optimizes operations performance; and
   • Researches trends and best practices in access to information and privacy.
2. Operations
   • Processes access to information and privacy requests;
   • Oversees the collection and release of personal and/or business information; and
   • Maintains dialogue with PCO secretariats and other federal or provincial institutions.
3. Client Services
   • Produces training and promotional products;
   • Develops and delivers ATIP training programs;
   • Develops ATIP awareness messaging;
   • Coordinates responses to Parliamentary questions and petitions on behalf of PCO; and
   • Provides database administration.

In compliance with s. 17(1) of the PA, the ATIP Division also provides a Reading Room where the public may examine requested departmental records, manuals, and publications related to privacy. In 2015-2016, no requesters made use of this option.

Education and training activities

PCO promotes ATIP imperatives in face-to-face meetings, presentations, special events, learning products, on the intranet and through its training program. It fosters strong working relationships with clients, and operates under a clearly established timeline and procedures.

In 2015-2016, PCO delivered ATIP training or awareness sessions to over 100 employees through a total of 14 training events during the reporting year. The majority of these training sessions provided an overview of ATIP to internal secretariats, as well as delivering insight on the process and application of exemptions.

To promote understanding of access and privacy responsibilities, the PCO Executive Committee was provided with a summary of access and privacy statistics, performance and compliance. The Director of ATIP maintained regular contact with senior staff in the Department and ATIP senior staff met with senior officials in PCO Secretariats to clarify roles and strengthen working relationships. Throughout 2015-2016, PCO ATIP analysts liaised with clients to explain the five-stage request timeline, train on processes such as the search for records, assist with records review, and explain their working role.

PCO personnel are provided with multiple channels to information on access and privacy, such as instructional ATIP handouts, an e-mailbox for questions, takeaway learning tools, and comprehensive and educational electronic content on PCO’s intranet.

Privacy-related policies, guidelines, and procedures

On a regular basis, PCO ATIP provides advice and guidance to the PCO central tasking authority regarding written questions tabled in the House of Commons and the Senate of Canada. These questions may request personal information that is protected by the principles of the PA. PCO ATIP duly ensures that such protection is included in the tasking directive and/or afforded to the final PCO response, in compliance with the PA. PCO ATIP also routinely advises departmental personnel on the privacy dimensions of information holdings, proactive disclosure content, internal or external communications, and e-mails from the public.

Other activities

a) General operations

PCO ATIP provides support to requesters not captured by statistics. For example, routine inquiries about privacy and personal information matters are received which, whenever possible, are treated informally and to the satisfaction of the requesters. In addition, PCO receives privacy requests from applicants who assume the institution holds all government information of a personal nature, or whose requests should be addressed to provincial governments. In these cases, a letter to the requester is written explaining the nature and role of PCO and the privacy application process. On a case-by-case basis, the requester is referred to the appropriate federal authority for more information.

b) Electronic release of records

In March 2015, ATIP introduced a new practice for the release of records, in which packages over 125 pages are provided in PDF format on a CD. CDs are also provided if the requester asks for an electronic copy. Verification of the PDF by ATIP officers and management takes place at four stages to ensure its accuracy. The PDF format has been deemed tamper-proof and secure by PCO Security Operations. This initiative also benefited the requesters, who, prior to the elimination of such fees, were no longer subject to fees for the cost of reproducing packages that are more than 125 pages. The electronic release packages create no additional expense for PCO. In 2015-2016, half of the PA requests (6 requests) for which records existed and were disclosed, were released in electronic format.

c) Data matching and sharing

For the 2015-2016 reporting period, PCO did not establish any new systems or processes which led to data matching or sharing of personal information, either within the Department or with any external sources. The Department was not involved in any data matching activities.

Interpretation of the Statistical Report

The Statistical Report on the PA is shown at Appendix B.

Part 1: Requests under the Privacy Act

Between April 1, 2015 and March 31, 2016, PCO received 15 requests for personal information under the PA, compared to 10 received the previous year. This represents a volume increase of 50% from 2014-2015. Note that the unusually high volume in 2013-2014 is attributed to one requester who submitted 62 privacy requests.

Text version of Volume of Requests by Year Chart

Part 2: Requests closed during the reporting period

2.1) Disposition and completion time

In 2015-2016, PCO completed 16 requests for personal information under the PA. The disposition of completed privacy requests was as follows:

• 12 disclosed in part;
• 3 requests abandoned; and
• 1 for which no records exist.

No privacy requests closed by PCO were all disclosed, all exempted, all excluded or neither confirmed nor denied.

Only 3 requests remained active and were carried over into 2016-2017 down 1 from 2015-2016.

Text version of Disposition of Requests Completed Chart

In 2015-2016, 6 requests, or 38% of all requests, were completed in 30 days or less. There are certain circumstances in which a privacy request may require more than 30 days to complete, such as the necessity to consult with external organizations or to solicit legal advice. During the reporting year, 3 requests were completed in 1 to 15 days, 3 were completed in 16 to 30 days, and 10 requests were completed in the 31 to 60 day time frame.

2.2) Exemptions

There are instances where information qualifies for necessary protection under the PA. In 2015-2016, exemptions were invoked for the following number of requests:

• 1 under s. 22(1)(b) - pertaining to law enforcement and investigation;
• 11 under s. 26 - information about another individual; and
• 2 under s. 27 - information subject to solicitor-client privilege.

2.3) Exclusions

The PAdoes not apply to certain publicly available information described by s. 69(1) and s. 69(2) of the PA, or to confidences of the Queen’s Privy Council for Canada pursuant to s. 70(1). During this reporting period, s. 69 was not cited, while s. 70(1)(c), and s. 70(1)(f) were each cited once.

2.4) Format of information released

As of March 2015, PCO provides electronic responses on a CD at the requester’s request and for records totalling more than 125 pages. Requesters have the option of receiving their response by mail or picking it up in person. In 2015-2016, PCO gave paper copies of relevant documents to requesters for 6 privacy requests and electronic copies for 6 privacy requests for which records existed. No requesters asked to examine documents on site during the reporting period.

2.5) Complexity

2.5.1) Relevant pages processed and disclosed

In 2015-2016, the disposition of all requests for which records existed was disclosed in part. In total, 2850 pages were processed, of which 2186 pages were disclosed. This equates to a release rate of 77%, compared to 2014-2015, when 2012 pages were processed and 895 pages were disclosed with a 44% release rate.

2.5.2) Relevant pages processed and disclosed by size of requests

Of the 12 requests for which records existed and were disclosed in part, 3 had less than 100 pages to process. A total of 155 pages were disclosed for these 3 requests. The majority of requests (8) fell into the 101-500 page range and totalled 1516 pages disclosed. One request involved the processing of between 500 and 1000 pages, from which 515 pages were disclosed.

It should be noted that the number of pages is not an accurate measure of the complexity of a privacy request, or the resources required to process it. The personal information held by PCO receives thorough, comprehensive review and consultation when appropriate prior to release, efforts that are often disproportionate to the volume of records.

2.5.3) Other complexities

The complex interdepartmental nature of information in many records under the control of PCO often necessitates external consultations and legal advice. This requirement is the principal reason why some requests take an extended length of time to process. During the reporting year, 11 requests involved interwoven information, i.e., personal information about another individual that was blended or intermixed with the personal information of the requester. This year no requests involved external consultations or legal advice. Note that totals correspond to the number of requests and not to the number of complexities relating to a request.

2.6) Deemed refusals

During the 2015-2016 fiscal year, all 16 requests that were closed met the statutory deadline for completion. This number is down from 35 late requests in the previous fiscal year.

2.7) Requests for translation

The PA states at s. 17(2) that “where access to personal information is to be given under this Act and the individual...requests that access be given in a particular one of the official languages of Canada, (a) access shall be given in that language, if the personal information already exists; and (b) where the personal information does not exist in that language, the head of the government institution...shall cause it to be translated or interpreted... if it would enable the individual to understand the information”. During this reporting period, there were no translations requested.

Part 3: Disclosures under s. 8(2)

The PA sets out specific circumstances at s. 8(2) in which government institutions may disclose personal information without the individual’s consent. S. 8(2)(e) of the PA permits the disclosure of personal information “to an investigative body specified in the regulations, on the written request of the body, for the purpose of enforcing any law of Canada or a province or carrying out a lawful investigation, if the request specifies the purpose and describes the information to be disclosed.” No disclosures were made by PCO under sections 8(2)(e) and 8(2)(m) of thePAduring the reporting period.

Part 4: Requests for correction of personal information and notations

The PA specifies at s. 12(1) that any Canadian citizen or permanent resident of Canada has a right to and shall, on request, be given access to any personal information about the individual found in a personal information bank and personal information under the control of a government institution. An individual should be entitled to correction of personal information where there is an error or omission, a request that a notation be attached, and assurance that any party who has requested the information within the last two years be notified of the correction and make changes to their copies. There were no requests for correction of personal information and notations made during the reporting period.

Part 5: Extensions

5.1) Reasons for extensions and disposition of requests

The PA provides for extensions to the legislated 30-day time limit, for consultations or if meeting the original time limit would unreasonably interfere with the operations of the government institution. In the 2015-2016 fiscal year, PCO took three extensions to accommodate operations under s. 15(a)(i). Of the three cases where extensions were taken all were disclosed in part.

5.2) Length of extensions

All 3 extensions taken by PCO were between 16 and 30 days.

Part 6: Consultations received from other institutions and organizations

PCO received 5 privacy consultations from other government institutions in the 2015-2016 fiscal year, totalling 30 pages. No consultations were received from other organizations. This number is up from 2 consultations last fiscal year, as shown in the chart below. The processing of consultation requests requires resources at a level similar to the processing of privacy requests.

Text version of Privacy Consultations Received, by Year Chart

Four consultations were closed in 2015-2016. The records for 2 consultations were processed in 1 to 15 days and 2 consultations were processed in 16 to 30 days. All 4 consultations were disclosed in part.

Part 7: Completion time of consultations on Cabinet confidences

As reported at Part 2.3, 2 exclusions under s. 70 - confidences of the Queen's Privy Council for Canada - were cited, all within the same request. One consultation on Cabinet confidences was undertaken regarding these exclusions. The completion time for the consultation was 1 to 15 days and totaled 281 pages disclosed.

Part 8: Complaints and investigations

8.1) Complaints received

To promote the improved client service that mitigates complaints, PCO continues to optimize its work processes, develop expertise, and staff appropriately. PCO dedicates resources to the resolution of complaints, and works in close cooperation with the Office of the Privacy Commissioner as required.

In 2015-2016, PCO received 1 complaint pursuant to the PA, 1 complaint less than in 2014-2015.

8.2) Types of complaints

In the reporting period, one requester filed a complaint to the OPC regarding delay in response and an extension taken. The complaint has not yet been closed.

8.3) Investigations

In 2015-2016, there were no breaches of privacy under the PA.

Part 9: Privacy Impact Assessments (PIAs)

PCO completed one Privacy Impact Assessment (PIA) during the 2015-2016 reporting period. The PIA was in regard to the collection of personal information for Governor in Council appointments using an on-line process. 

Part 10: Resources related to the Privacy Act (PA)

In the 2015-2016 reporting period, the total salary costs associated with administering thePAwere $37,639 down $45,466 from the previous year. Overtime amounted to $3,051 this year. No specific goods and services costs were attributed to the application of the PA. Total cumulative costs amounted to $40,690, a decrease of $64,738 from 2014-2015.

The associated person-year resource utilization for the 2015-2016 reporting period was 0.45 full-time equivalents (FTE).

Text version of Person-Year Utilization (FTEs) Chart

Note that in 2011-2012, the Statistical Report on thePA did not permit the reporting of person-year utilization in fractions.

Appendix A: Delegation order

Privacy Act

The Prime Minister, as head of the Privy Council Office and pursuant to section 73 of the Privacy Act^a, hereby designates the officers or employees holding the positions set out in the schedule hereto, and any persons acting in those positions, to exercise or perform the powers, duties and functions of the Prime Minister as the head of a government institution under the sections of the Act and the regulations opposite each position in the schedule.

This delegation order supercedes all previous delegation orders.

Prime Minister
Justin Trudeau

December 23, 2015

^a R.S. 1985, c. P-21

Schedule

^a R.S. 1985, c. P-21
^b SOR/83-508

Privacy Act

The Prime Minister, as head of the Privy Council Office and pursuant to section 73 of the Privacy Act^a, hereby designates the officers or employees holding the positions set out in the schedule hereto, and any persons acting in those positions, to exercise or perform the powers, duties and functions of the Prime Minister as the head of a government institution under the sections of the Act and the regulations opposite each position in the schedule.

This delegation order supercedes all previous delegation orders.

Prime Minister
Stephen Harper

June 13, 2008

^a R.S. 1985, c. P-21

Schedule

^a R.S. 1985, c. P-21
^b SOR/83-508

Appendix B: 2015-2016 Statistical Report on the Privacy Act

Reporting period: 2015-04-01 to 2016-03-31

Part 1 – Requests under the Privacy Act

Part 2 – Requests closed during the reporting period

2.1 Disposition and completion time

2.2 Exemptions

2.3 Exclusions

2.4 Format of information released

2.5 Complexity

2.6 Deemed refusals

2.7 Requests for translation

Part 3 – Disclosures under subsection 8(2) and 8(5)

Part 4 – Requests for correction of personal information and notations

Part 5 – Extensions

Part 6 – Consultations received from other institutions and organizations

Part 7 – Completion time of consultations on Cabinet confidences

Part 8 – Complaints and Investigations Notices Received

Part 9 – Privacy Impacts Assesments (PIAs)

Part 10 – Resources related to the Privacy Act

Note: Enter values to two decimal places.