Government Response to Concerns raised by Information Commissioner

A. I am pleased that Minister Duclos has stressed the importance of maintaining transparency during this crisis to his Cabinet colleagues, I am looking to see what actions the government will implement to ensure the rights of Canadians are respected under the Act.

During a recent conversation with a member of his staff, I raised several points for consideration with regard to legislative review:

The OIC can’t do the work for TBS – but we are happy to respond to what they put forward.

We are eager to speak to them about our experiences gained from the 35 years of experience, as well as our experience with new provisions introduced under C-58

We don’t want to see (unnecessarily long) consultations used as an excuse to further cause delays–TBS officials already have a lot of information and analysis and reports to draw from and there is a lot of input previously provided by stakeholders–we don’t want to revisit all of the same issues, and conduct the same consultations and analysis for a year. Action is needed.

Other points:

• Meaningful consultations with indigenous groups
• Look at exemptions and exclusions
• Timeliness

A. TBS provided my office with statistics earlier this week that state that with the exception of Canadian Heritage, all departments report that they have full or partial capacity to respond to requests at this time. For a full break down, they are probably the best to ask. I can say however, that the pandemic has already been cited as a reason for not instituting recommendations.

If pressed for more details:

• According to information provided by TBS, Canadian Heritage is the only institution that has no capacity to respond to access requests at this time
• According to information provided by TBS, 46 institutions indicate that they are operating at full capacity
• It is concerning that only 4 large departments – DND, Shared Services, Infrastructure Canada and IRCC – are in that category.
• The 46 institutions operating at full capacity represent just 25% of the complaint investigations currently in my office’s inventory of 3800 administrative and refusal complaints (or 9%, if you remove IRCC).
• Most federal departments, and in particular most large departments, continue to operate with limited capacity
  • The institutions in this category have many different challenges: some are “front line” departments in terms of COVID response; some tend to have more classified documents in their record-holdings, which cannot be hosted on their networks; some are still very paper-based and are therefore unable to access documents in closed offices. We have heard from some departments that their ATIP redaction software is housed on their secure network, which means that it may be completely inaccessible remotely, or only accessible during off-peak hours. ATIP professionals cannot process records, regardless of the records’ classification, if they can’t access the software to do so. And, the problem remains of over-classified records and the difficulties of storing, retrieving, and processing these is amplified when working from home.
• A number of departments told us that since March they have tried to move to Canada Post ePost for document transfer and delivery, but have been hampered by government requirements to each perform their own Threat Risk Assessment. TBS informed us that TBS Cyber Security, the Canadian Center for Cyber Security, and Canada Post continue to validate the security posture of the ePost Connect solution, to confirm that e-post can be used for e-delivery of Government of Canada Protected B information.

A. Aside from the self-initiated complaint into Canadian Heritage, I have not yet launched investigations into any other federal institutions directly as a result of their operations during the pandemic. We are monitoring the situation, and I can’t rule out definitively that there won’t be investigations in the future.

There are no provisions under the Access to Information Act (or any other legislation for that matter) that allow institutions to put requests on hold or to delay the processing of requests due to the pandemic. Heads of institutions are responsible to do everything possible to ensure compliance with applicable legislation, including the ATIA. 

A. Heads of institutions are responsible for their operations of their respective institutions, while TBS is responsible for the overall administration of the ATIA and providing direction on information management practices.

All leaders of federal institutions are responsible to do everything possible to ensure that their organizations meet the requirements of the Act, and that information is managed in accordance with best practices.

Employees must be aware of their obligations and ensure that they are documenting decisions.

A. Longstanding issues in the system, including a lack of resources, archaic practices, and a lingering culture of secrecy within the federal administration are already causing long delays. 

Journalists, who file access requests as part of their job, have been saying for some time that the access to information system is broken. 

Historically, a surge in request generally follows a major event or crisis like the one we are currently living through. A Covid-related surge down the road will only make things worse.ATIP teams are working hard, but they can only do so much.   

A. We know that TBS opted to forego a move to ePost because they are developing a document delivery through the online ATIP portal, and that the portal is also evolving to be cloud-based.  This is a multi-year project – if it cannot be sped up, an interim solution is needed that is better than CDs. If not ePost, some similar method for transmitting documents securely.

The Government should anticipate an increased demand for information.  It knows what Canadians want to know. Why wait for an ATI request?  Be proactive in providing this information.

If pressed for more details:

A number of departments told us that since March they have tried to move to Canada Post ePost for document transfer and delivery, but have been hampered by government requirements to each perform their own Threat Risk Assessment. TBS informed us that TBS Cyber Security, the Canadian Center for Cyber Security, and Canada Post continue to validate the security posture of the ePost Connect solution, to confirm that e-post can be used for e-delivery of Government of Canada Protected B information.

A. I do not have an oversight role on proactive disclosure, which is covered under part two of the Act, but I believe that, on principle, the government should make every effort to provide Canadians with the information they want, and not wait to receive access requests.

That being said, proactive disclosure is not a substitute for a properly functioning and responsive Access to Information System

A. Some institutions’ ATIP employees are not equipped to work remotely. They don’t have access to their networks.

Poor information management practices.

Many institutions house their redaction software on the secure side of their network, which is largely inaccessible remotely (e.g., PCO).

We need to revisit how documents are classified—currently the over-classification of records creates a barrier to access. 

Certain institutions need to carefully consider the implications of over-classification and provide clear guidance to program officials when classifying documents.

Implications could include paper documents needing to be sent by internal mail to ATIP shops and scanned to be processed, CDs sent by mail, and other operations requirements that will cause delays.

A.  I always support the goal of increased transparency and I encourage government to disclose as much information as possible.

This is of course subject to the protection of personal information, as appropriate

If pressed on privacy

• The federal and provincial privacy commissioners are currently looking into those issues more closely

If pressed on other elements Covid-19 Ombudsman, Whistleblowing, Education and awareness.

• Those topics fall outside of my mandate