2023-24 Annual Report on the Administration of the Privacy Act

Table of Contents

• Introduction
• Organizational Structure
• Delegation Order
• 2023‑24 Performance
  • Workload
  • Timeliness
  • Disclosure
  • Complaints
• Training and Awareness
• Policies, Guidelines, and Procedures
• Initiatives and Projects to Improve Privacy
• Summary of Key Issues and Actions Taken on Complaints
• Material Privacy Breaches
• Privacy Impact Assessments
• Public Interest Disclosures
• Monitoring Compliance
• Annex A

Introduction

The Privacy Act (Act) safeguards the privacy of individuals by protecting personal information held by government institutions. The Act also gives individuals the right to access their own personal information. The Office of the Information Commissioner (OIC) has been subject to the Privacy Act since 2007. The OIC pursues all measures to protect personal information and provide prompt access to the personal information it holds in response to requests.

This report, prepared and tabled in accordance with section 72 of the Privacy Act, reviews the OIC’s privacy-related activities for 2023‑24.

The Office of the Information Commissioner (OIC) was created in 1983 under the Access to Information Act to support the work of the Information Commissioner. The mandate of the OIC is to conduct efficient, fair and confidential investigations into complaints about government institutions’ handling of access to information requests. Investigators conduct these enquiries in private, giving all parties the opportunity to present their positions on the matters under investigation.

The OIC supports the Commissioner in her advisory role to Parliament and parliamentary committees on all matters pertaining to access to information. The OIC actively supports freedom of information in Canada through targeted initiatives such as Right to Know Week and ongoing dialogue with Canadians, Parliament and government institutions.

Organizational Structure

The OIC supports the Information Commissioner in her advisory role to Parliament and parliamentary committees on all matters pertaining to access to information.

The Commissioner is supported by a staff complement of approximately 128 employees, including a senior management team of three deputy commissioners:

• Deputy Commissioner, Investigations and Governance
• Deputy Commissioner, Legal Services and Public Affairs
• Deputy Commissioner, Corporate Services, Strategic Planning and Transformation Services

The Access to Information and Privacy Secretariat falls under the Legal Services and Public Affairs Sector. The ATIP Manager, the Deputy Commissioner of Legal Services and Public Affairs, and the Senior Director, Communications and Public Affairs hold full-delegated authority under the Act.

The OIC has a small team of specialists who carry out the organization’s access to information and privacy (ATIP) activities. In 2023‑24, the ATIP team consisted of the ATIP Manager and 3 ATIP Officers. Secretariat members process requests, proactively publish completed access requests, provide training on access and privacy matters to new employees, and develop and implement policies and procedures to ensure that the institution meets its obligations under the Acts.

The OIC was not party to any service agreements under section 73.1 of the Privacy Act.

Delegation Order

The following delegation order was in effect March 31, 2024:

2023‑24 Performance

Appendix A contains the OIC’s statistical report on the Privacy Act for 2023‑24. The following sets out some highlights from that report, along with notable trends related to workload, timeliness and disclosure over the last 5 years.

Workload

The OIC saw a decrease in most areas in 2023‑24. 41 new requests were received, a slight decrease of 4.65% from the previous fiscal year. A total of 4 442 pages were processed, representing a decrease of 86.71%.

There was 1 informal privacy request received during this reporting period.

There were no requests carried over from 2022‑23 and no requests were carried forward into 2024‑25.

No request for consultation were received within the reporting period.

Timeliness

The OIC completed all requests within the reporting period and all requests received in 2023‑24 were completed on time. This ongoing commitment to ensuring timely access to information has been a pillar of the OIC’s Access to Information and Privacy program for over 10 years. Members of the ATIP team monitor file status on an ongoing basis to ensure that all files are dealt with within statutory deadlines. This is accomplished through regular reports drawn from our case management system.

The average time taken to respond to privacy requests was 17.4 days for 2023‑24. In 2022‑23, the average was 15.8 days; in 2021‑22, the average was 18.3 days; and finally, 17.6 days in 2020‑21. No extensions were taken under section 15 of the Privacy Act. Of the 41 requests completed in 2023‑24, 11 were completed within 1-15 days. The remaining 29 files were completed within 16 and 30 days and one fell within its statutory deadline due to a holiday.

Disclosure

The OIC disclosed all records for 10 of the requests (24.39%) in 2023‑24. The records were disclosed in part for another 7 files (17.07%). 3 requests were abandoned (7.31%), 21 requests had no records found to respond to the request (51.23%) and 1 request was treated informally. Overall, the OIC disclosed 4 302 pages.

In 2023‑24, the OIC claimed exemptions to withhold information in 7 of the 41 requests processed. The most frequently used exemption this year was subsection 22(1)(b) (law enforcement and investigations), followed by section 26 (personal information of someone other than the requester), and section 27 (solicitor-client privilege). These three exemptions are consistently the top 3 exemptions invoked, with 22(1)(b) traditionally the most frequently invoked exemption.

The OIC made no disclosures of personal information in the public interest under paragraph 8(2)(m).

Complaints

The Office of the Privacy Commissioner received 2 complaints about the OIC’s handling of privacy matters in 2023‑24. Both complaints were discontinued.

Training and Awareness

The OIC ATIP team provides ongoing training on access and privacy matters to OIC employees. In 2023‑24, the Secretariat held formal training sessions for all new employees. A total of 15 employees participated in these sessions. Informal training sessions were held on an ad hoc basis with current employees as required.

Policies, Guidelines, and Procedures

No new policies, guidelines and procedures were implemented during this reporting period.

Initiatives and Projects to Improve Privacy

Several initiatives were undertaken in 2023‑24 to improve access to information and privacy within the OIC.

Updated Case Management System

ATIPXpress, version 11.1, launched on April 1, 2023, resulted in greater efficiency in processing requests with fewer technical difficulties.

Electronic Document Retrieval

Recognizing the need for a document retrieval system that reflected the advent of remote work and the increasing digitization of records, with the support of senior management ATIP worked in collaboration with partners in Information Technology / Information Management to develop a new digital-first process. This process included a more comprehensive retrieval checklist, a designated retrieval file framework, as well as changes to the roles and responsibilities of the Office of Primary Interest. Thus far, this initiative has helped prepare our transition to Mikan (SharePoint), our new document content management system.

Summary of Key Issues and Actions Taken on Complaints

While there were 2 complaints received during this reporting period, both were discontinued, and as a result there were no recommendations provided.

Material Privacy Breaches

There were no material breaches reported in 2023‑24

Privacy Impact Assessments

There were 3 Privacy Impact Assessments (PIA) completed in 2023‑24, and one was modified.

PIA Regarding the Operationalization of s. 6.1 of the Access to Information Act (Reasons for Declining to Act on Request)

A PIA was commissioned in order to analyse the operationalization of section 6.1 of the Act. This section allows institutions to seek approval from the Information Commissioner to decline to act upon requests that are vexatious, made in bad faith or are otherwise an abuse of the right of access. In order to be able to review these applications, the OIC developed and fully implemented a process in 2023‑24 to collect and disclose information that is transparent and respects obligations under the Privacy Act. The PIA covers the process of operationalizing the responsibility conferred on the OIC, the process, the risks and mitigation strategies.

PIA regarding the Electronic Hybrid Work Agreement

The OIC is looking to modernize operations and maximize technological efficiencies. To that end, the Hybrid Work Agreement form was converted to a digital format in order to be submitted electronically via existing network technology.

PIA Regarding the Document Content Management System (Mikan/SharePoint)

Mikan is the name of the Microsoft SharePoint based-application that is being developed to replace RDIMS and will provide superior lifecycle management to the wide array of electronic information resources at the OIC. Mikan will act as the single repository for all electronic business records and information resources.

Update on the PIA Regarding the Online Complaint Registration Form

The Online Complaint Form system allows for the submission via a portal on the OIC website of complaints about access to information requests made under the ATIA and other matters related to requesting and accessing records under Part 1 of the Act. The online tool will ultimately lead to a faster and more efficient complaint submission process, which will improve the OIC’s service to the public and government institutions.

A summary of these PIA will be posted to the OIC website in the near future.

Public Interest Disclosures

The OIC made no disclosures of personal information in the public interest under paragraph 8(2)(m).

Monitoring Compliance

The OIC monitors compliance with the Privacy Act in a variety of ways. This includes regular meetings with the team as a whole, bilateral meetings, and reporting file status via a weekly report shared with management.

In order to ensure that timelines are respected, the OIC ATIP Secretariat only consults other government institutions when absolutely necessary, and in a manner that ensures timely responses and is in line with the Implementation Notice published by Treasury Board Secretariat.

The right of public access to information is reflected in contracts, information sharing agreements and arrangements via the inclusion of standard clauses to ensure awareness of obligations under the Access to Information Act and the Privacy Act.

Annex A

Statistical Report on the Privacy Act

Name of institution: Office of the Information Commissioner of Canada

Reporting period: 2023-04-01 to 2024-03-31

Section 1: Requests Under the Privacy Act

1.1 Number of requests received

1.2 Channels of requests

Section 2: Informal requests

2.1 Number of informal requests

2.2 Channels of informal requests

2.3 Completion time of informal requests

2.4 Pages released informally

Section 3: Requests Closed During the Reporting Period

3.1 Disposition and completion time

3.2 Exemptions

3.3 Exclusions

3.4 Format of information released

3.5 Complexity

3.5.1 Relevant pages processed and disclosed for paper and e-record formats

3.5.2 Relevant pages processed by request disposition for paper and e-record formats by size of requests

Supplemental Statistical report on the Access to Information Act and the Privacy Act

Name of institution: Office of the Information Commissioner of Canada

Reporting period: 2023-04-01 to 2024-03-31

Section 3: Open Requests and Complaints Under the Access to Information Act

1.1 Enter the number of open requests that are outstanding from previous reporting periods.

1.2 Enter the number of open complaints with the Information Commissioner of Canada that are outstanding from previous reporting periods.

Section 2: Open Requests and Complaints Under the Privacy Act

2.1 Enter the number of open requests that are outstanding from previous reporting periods.

2.2 Enter the number of open complaints with the Privacy Commissioner of Canada that are outstanding from previous reporting periods.

Section 3: Social Insurance Number

Section 4: Universal Access under the Privacy Act