2017–2018 Annual Report on the Administration of the Privacy Act

Introduction

The Privacy Act safeguards the privacy of individuals by protecting personal information held by government institutions. The Act also gives individuals the right to access their own personal information. The Office of the Information Commissioner (OIC) has been subject to the Privacy Act since 2007. The OIC pursues all measures to protect personal information and provide prompt access to the personal information it holds in response to requests.

This report, prepared and tabled in accordance with section 72 of the Privacy Act, reviews the OIC’s privacy-related activities for 2017–2018.

The OIC received and completed six new privacy requests in 2017–2018. The average completion time for these files was 26 days.

About the OIC

The OIC is an independent public institution created in 1983 under the Access to Information Act. The OIC’s primary responsibility is to support the Information Commissioner of Canada’s mandate to conduct efficient, fair and confidential investigations into complaints about federal institutions’ handling of access to information requests. The OIC primarily uses mediation and persuasion to resolve complaints, but may bring cases to the Federal Court to ensure the Act is properly interpreted and applied.

The OIC also supports the Information Commissioner in her advisory role to Parliament and parliamentary committees on all matters pertaining to access to information. The OIC actively makes the case for greater freedom of information in Canada through targeted initiatives such as Right to Know Week and ongoing dialogue with Canadians, Parliament and federal institutions.

Organizational structure in 2017–2018

Text Version

This organizational chart shows the titles of the two senior officials at the Office of the Information Commissioner who report to the Information Commissioner: Deputy Commissioner, Investigations and Governance; and Deputy Commissioner, Legal Services and Public Affairs.

Under the Deputy Commissioner, Investigations and Governance, the OIC’s investigations group (Complaints Resolution and Compliance) mediates and investigates complaints about the processing of access to information requests and any issues related to requesting or obtaining access to records under the Act. Governance responsibilities are led by Corporate Services. This team provides strategic and corporate leadership for planning and reporting, human resources and financial management, security and administrative services, internal audit and evaluation, and information management and technology.

Under the Deputy Commissioner, Legal Services and Public Affairs, the OIC’s Legal Services group provides legal advice on investigations and administrative and legislative matters, as well as training on recent case law. Legal Services also monitors legislative developments to determine their possible effect on the Commissioner’s work and access to information in general. Legal Services represents the Commissioner in court as she seeks to clarify points of access law and uphold information rights. The Public Affairs team conducts communications and external relations with a wide range of stakeholders, notably Parliament, governments and the media. Public Affairs also provides input to the Treasury Board of Canada Secretariat on improving the administration of the Act. Public Affairs is responsible for the OIC’s access to information and privacy function.

Privacy activities at the OIC

The OIC has a small team of specialists who carry out the organization’s access to information and privacy (ATIP) activities. In 2017–2018, the ATIP Secretariat comprised the ATIP Manager (full time) supported by a full-time ATIP Officer.

Secretariat staff process requests, provide training on access and privacy matters to new staff, and develop and implement policies and procedures.

In 2017–2018, the ATIP Manager trained the ATIP Officer, and Secretariat staff provided advice to individual OIC employees and managers on privacy matters, upon request.

The ATIP Manager and the Deputy Commissioner, Legal Services and Public Affairs, hold full delegated authority under the Act. Appendix A contains a copy of the delegation order, from both former Information Commissioner Suzanne Legault, whose term ended on February 28, 2018, and current Information Commissioner Caroline Maynard, whose term began on March 1, 2018.

Privacy breaches

The OIC had two privacy breaches resulting from administrative errors made during a staffing process in 2017–2018. While being of the view that the two incidents did not amount to a material breach, the OIC nonetheless informed the Privacy Commissioner and the Treasury Board of Canada Secretariat of the matter and cancelled the staffing process. ATIP Secretariat staff worked with Human Resources staff at the OIC to raise awareness of their privacy obligations to try to prevent such incidents from reoccurring.

Privacy impact assessments

The OIC prepared a privacy impact assessment in 2017–2018 for the online complaint form pilot project. The form allows Canadians to file their complaints through the OIC website. In carrying out the assessment, the ATIP Secretariat worked with the OIC’s information technology and security groups to ensure that the personal information complainants submit in the online form is appropriately protected. The pilot project is ongoing. If and when it is made official and/or any new functionality is added to the form, the OIC will review and update the assessment.

2017–2018 statistics and trends

Appendix B contains the OIC’s statistical report on the Privacy Act for 2017–2018. The following sets out some highlights from that report.

Workload

The OIC received six new requests in 2017–2018, slightly less than the normal volume of new requests.

In responding to these requests, the OIC processed 4,007 pages. One request required the processing of the vast majority of these pages (with more than 3,000 released).

Timeliness

The OIC completed all requests within the reporting period. Four out of six were completed within 30 days, with one completed in 31 to 60 days, with a time extension taken of 16 to 30 days. One request was abandoned. With one request involving the processing of more than 3,000 pages, the average completion time for these files of 26 days was up from that of previous years, but still within the 30-day legislated timeframe.

None of the requests the OIC completed in 2017–2018 were late. In fact, over the 11 years the OIC has been subject to the Privacy Act, it has never completed a request late (known as a “deemed refusal”).

Disclosure

The OIC disclosed the records in part for five of the six requests it closed in 2017–2018. The remaining request was abandoned. Overall, the OIC disclosed 3,895 pages, 97 percent of the number of pages processed, and a slight increase over 2016–2017.

The OIC claimed the section 22(1)(b) exemption (law enforcement and investigations) five times and section 26 (personal information of someone other than the requester) twice. This is consistent with recent trends.

The OIC applied no exclusions to records in 2017–2018.

The OIC made no disclosures of personal information in the public interest under paragraph 8(2)(m).

Complaints

The Office of the Privacy Commissioner received no new complaints about the OIC’s handling of privacy matters in 2017–2018 and completed investigations into six complaints dating from 2013 to 2015. Four of the six complaints closed were not well founded.

The remaining two complaints were found to be well founded. In the first one, the Privacy Commissioner disagreed with the OIC’s practice of informally releasing to individuals seeking information about investigations into their own complaints a copy of any record they themselves provided as part of the investigation (subject to any exemptions under the Access to Information Act), and that otherwise would have to have been formally withhold. The OIC took the Privacy Commissioner’s recommendations into consideration and adjusted its processes accordingly.

The second related to an administrative investigation into an internal security matter, and the use of personal information legitimately collected but not used in accordance with the terms of the Personal Information Bank in which it was held. The OIC has committed to following those terms more closely should any similar circumstances arise.

Appendix A: Delegation orders in effect in 2017–2018

Appendix B: 2017–2018 statistical report

Statistical Report on the Privacy Act

Name of institution: Office of the Information Commissioner of Canada

Reporting period: 2017-04-01 to 2018-03-31

PART 1: Requests Under the Privacy Act

	Number of Requests
Received during reporting period	6
Outstanding from previous reporting period	0
Total	6
Closed during reporting period	6
Carried over to next reporting period	0

PART 2: Requests Closed During the Reporting Period

2.1  Disposition and completion time

Disposition of Requests	Completion Time
1 to 15 Days	16 to 30 Days	31 to 60 Days	61 to 120 Days	121 to 180 Days	181 to 365 Days	More Than 365 Days	Total
All disclosed	0	0	0	0	0	0	0	0
Disclosed in part	1	3	1	0	0	0	0	5
All exempted	0	0	0	0	0	0	0	0
All excluded	0	0	0	0	0	0	0	0
No records exist	0	0	0	0	0	0	0	0
Request abandoned	0	1	0	0	0	0	0	1
Neither confirmed nor denied	0	0	0	0	0	0	0	0
Total	1	4	1	0	0	0	0	6

2.2  Exemptions

Section	Number of Requests	Section	Number of Requests	Section	Number of Requests
18(2)	0	22(1) a)(i)	0	23 a)	0
19(1) a)	0	22(1) a)(ii)	0	23 b)	0
19(1) b)	0	22(1) a)(iii)	0	24 a)	0
19(1) c)	0	22(1) b)	5	24 b)	0
19(1) d)	0	22(1) c)	0	25	0
19(1) e)	0	22(2)	0	26	2
19(1) f)	0	22.1	0	27	0
20	0	22.2	0	28	0
21	0	22.3	0

2.3  Exclusions

Section	Number of Requests	Section	Number of Requests	Section	Number of Requests
69(1)(a)	0	70(1)	0	70(1)(d)	0
69(1)(b)	0	70(1)(a)	0	70(1)(e)	0
69.1	0	70(1)(b)	0	70(1)(f)	0
		70(1)(c)	0	70.1	0

2.4  Format of information released

Disposition	Paper	Electronic	Other formats
All disclosed	0	0	0
Disclosed in part	0	5	0
Total	0	5	0

2.5  Complexity

2.5.1  Relevant pages processed and disclosed

Disposition of Requests	Number of Pages Processed	Number of Pages Disclosed	Number of Requests
All disclosed	0	0	0
Disclosed in part	4007	3895	5
All exempted	0	0	0
All excluded	0	0	0
Request abandoned	0	0	1
Neither confirmed nor denied	0	0	0
Total	4007	3895	6

2.5.2  Relevant pages processed and disclosed by size of requests

Disposition	Less Than 100 Pages Processed	101-500 Pages Processed	501-1000 Pages Processed	1001-5000 Pages Processed	More than 5000 Pages Processed
Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed
All disclosed	0	0	0	0	0	0	0	0	0	0
Disclosed in part	2	154	2	700	0	0	1	3041	0	0
All exempted	0	0	0	0	0	0	0	0	0	0
All excluded	0	0	0	0	0	0	0	0	0	0
Request abandoned	0	0	0	0	0	0	0	0	0	0
Neither confirmed nor denied	0	0	0	0	0	0	0	0	0	0
Total	3	154	2	700	0	0	1	3041	0	0

2.5.3  Other complexities

Disposition	Consultation Required	Legal Advice Sought	Interwoven Information	Other	Total
All disclosed	0	0	0	0	0
Disclosed in part	0	0	0	0	0
All exempted	0	0	0	0	0
All excluded	0	0	0	0	0
Request abandoned	0	0	0	0	0
Neither confirmed nor denied	0	0	0	0	0
Total	0	0	0	0	0

2.6  Deemed refusals

2.6.1  Reasons for not meeting statutory deadline

Number of Requests Closed Past the Statutory Deadline	Principal Reason
Workload	External Consultation	Internal Consultation	Other
0	0	0	0	0

2.6.2  Number of days past deadline

Number of Days Past Deadline	Number of Requests Past Deadline Where No Extension Was Taken	Number of Requests Past Deadline Where An Extension Was Taken	Total
1 to 15 days	0	0	0
16 to 30 days	0	0	0
31 to 60 days	0	0	0
61 to 120 days	0	0	0
121 to 180 days	0	0	0
181 to 365 days	0	0	0
More than 365 days	0	0	0
Total	0	0	0

2.7  Requests for translation

Translation Requests	Accepted	Refused	Total
English to French	0	0	0
French to English	0	0	0
Total	0	0	0

PART 3: Disclosures Under Subsection 8(2) and 8(5)

Paragraph 8(2)(e)	Paragraph 8(2)(m)	Subsection 8(5)	Total
0	0	0	0

PART 4: Requests for Correction of Personal Information and Notations

Disposition for Correction Requests Received	Number
Notations attached	0
Requests for correction accepted	0
Total	0

PART 5: Extensions

5.1  Reasons for extensions and disposition of requests

Disposition of Requests Where an Extension Was Taken	15(a)(i) Interference With Operations	15(a)(ii) Consultation	15(b) Translation or Conversion
Section 70	Other
All disclosed	0	0	0	0
Disclosed in part	0	0	0	0
All exempted	0	0	0	0
All excluded	0	0	0	0
No records exist	0	0	0	0
Request abandoned	0	0	0	0
Total	1	0	0	0

5.2  Length of extensions

Length of Extensions	15(a)(i) Interference with operations	15(a)(ii) Consultation	15(b) Translation purposes
Section 70	Other
1 to 15 days	0	0	0	0
16 to 30 days	1	0	0	0
Total	1	0	0	0

PART 6: Consultations Received From Other Institutions and Organizations

6.1  Consultations received from other Government of Canada institutions and other organizations

Consultations	Other Government of Canada Institutions	Number of Pages to Review	Other Organizations	Number of Pages to Review
Received during the reporting period	0	0	0	0
Outstanding from the previous reporting period	0	0	0	0
Total	0	0	0	0
Closed during the reporting period	0	0	0	0
Pending at the end of the reporting period	0	0	0	0

6.2  Recommendations and completion time for consultations received from other Government of Canada institutions

Recommendation	Number of Days Required to Complete Consultation Requests
1 to 15 Days	16 to 30 Days	31 to 60 Days	61 to 120 Days	121 to 180 Days	181 to 365 Days	More Than 365 Days	Total
All disclosed	0	0	0	0	0	0	0	0
Disclosed in part	0	0	0	0	0	0	0	0
All exempted	0	0	0	0	0	0	0	0
All excluded	0	0	0	0	0	0	0	0
Consult other institution	0	0	0	0	0	0	0	0
Other	0	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0	0

6.3  Recommendations and completion time for consultations received from other organizations

Recommendation	Number of days required to complete consultation requests
1 to 15 Days	16 to 30 Days	31 to 60 Days	61 to 120 Days	121 to 180 Days	181 to 365 Days	More Than 365 Days	Total
All disclosed	0	0	0	0	0	0	0	0
Disclosed in part	0	0	0	0	0	0	0	0
All exempted	0	0	0	0	0	0	0	0
All excluded	0	0	0	0	0	0	0	0
Consult other institution	0	0	0	0	0	0	0	0
Other	0	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0	0

PART 7: Completion Time of Consultations on Cabinet Confidences

7.1 Requests with Legal Services

Number of Days	Fewer Than 100 Pages Processed	101-500 Pages Processed	501-1000 Pages Processed	1001-5000 Pages Processed	More Than 5000 Pages Processed
Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed
1 to 15	0	0	0	0	0	0	0	0	0	0
16 to 30	0	0	0	0	0	0	0	0	0	0
31 to 60	0	0	0	0	0	0	0	0	0	0
61 to 120	0	0	0	0	0	0	0	0	0	0
121 to 180	0	0	0	0	0	0	0	0	0	0
181 to 365	0	0	0	0	0	0	0	0	0	0
More than 365	0	0	0	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0	0	0	0

7.2 Requests with Privy Council Office

Number of Days	Fewer Than 100 Pages Processed	101-500 Pages Processed	501-1000 Pages Processed	1001-5000 Pages Processed	More Than 5000 Pages Processed
Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed
1 to 15	0	0	0	0	0	0	0	0	0	0
16 to 30	0	0	0	0	0	0	0	0	0	0
31 to 60	0	0	0	0	0	0	0	0	0	0
61 to 120	0	0	0	0	0	0	0	0	0	0
121 to 180	0	0	0	0	0	0	0	0	0	0
181 to 365	0	0	0	0	0	0	0	0	0	0
More than 365	0	0	0	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0	0	0	0

PART 8: Complaints and Investigations Notices Received

Section 31	Section 33	Section 35	Court action	Total
0	0	5	0	5

PART 9: Privacy Impact Assessments (PIAs)

Number of PIA(s) completed	1

Part 10: Resources Related to the Privacy Act

10.1 Costs

Expenditures	Amount
Salaries	$67,716
Overtime	$0
Goods and Services	$4,900
Professional services contracts	$4,860
Other	$40
Total	$72,616

10.2 Human Resources

Resources	Person Years Dedicated to Privacy Activities
Full-time employees	0.70
Part-time and casual employees	0.00
Regional staff	0.00
Consultants and agency personnel	0.00
Students	0.00
Total	0.70

Note: Enter values to two decimal places.