2020-21 Annual Report on the Administration of the Privacy Act

Introduction
About the Office of the Information Commissioner
2020–21 Statistics and Trends
Privacy Activities at the OIC
- Privacy Breaches
- Privacy Impact Assessments
Appendix A: Delegation Order, Privacy Act
Appendix B: 2020–21 Statistical Report

Introduction

The Privacy Act (Act) safeguards the privacy of individuals by protecting personal information held by government institutions. The Act also gives individuals the right to access their own personal information. The Office of the Information Commissioner (OIC) has been subject to the Privacy Act since 2007. The OIC pursues all measures to protect personal information and provide prompt access to the personal information it holds in response to requests.

This report, prepared and tabled in accordance with section 72 of the Privacy Act, reviews the OIC’s privacy-related activities for 2020-21.

The OIC received fourteen privacy requests in 2020-21 and had no requests carried over from the previous year. All fourteen requests were completed within the year. The organization also achieved an average completion time for these files of 17.6 days. Please see the “Timeliness” section for more information.

About the Office of the Information Commissioner

The Office of the Information Commissioner (OIC) was established in 1983 under the Access to Information Act to support the work of the Information Commissioner of Canada.

OIC staff carry out confidential investigations into complaints about federal institutions’ handling of access requests, giving both complainants and institutions the opportunity to present their positions.

The OIC strives to maximize compliance with the Act, using the full range of tools, activities and powers at the Commissioner’s disposal. These include negotiating with complainants and institutions without the need for formal investigations, making formal recommendations and/or issuing orders to resolve matters at the conclusion of investigations.

The OIC supports the Information Commissioner in her advisory role to Parliament and parliamentary committees on all matters pertaining to access to information. The OIC also raises awareness regarding the right of access in Canada through targeted initiatives such as Right to Know Week and ongoing dialogue with Canadians, Parliament and federal institutions.

The Commissioner is supported by a staff complement of approximately 150 employees, including a senior management team of three deputy commissioners:

Deputy Commissioner, Investigations and Governance
Deputy Commissioner, Legal Services and Public Affairs
Deputy Commissioner, Corporate Services, Strategic Planning and Transformation Services

The Access to Information and Privacy Secretariat falls under the Legal Services and Public Affairs branch. The ATIP Manager and the Deputy Commissioner of Legal Services and Public Affairs hold full delegated authority under the Act. A copy of the delegation order is included at Appendix A of this report.

The OIC has a small team of specialists who carry out the organization’s access to information and privacy (ATIP) activities. In 2020-21, the ATIP Secretariat was comprised of the ATIP Manager (full-time) supported by a full-time ATIP Analyst and a part-time student. An additional ATIP analyst was with the team for approximately half of the year.

Secretariat staff process requests, provide training on access and privacy matters to new staff, and develop and implement policies and procedures to ensure that the institution meets it’s obligations under the Acts.

2020-21 Statistics and Trends

Appendix B contains the OIC’s statistical report on the Privacy Act for 2020-21. The following sets out some highlights from that report, along with some trends related to workload, timeliness and disclosure over the years the OIC has been subject to the Privacy Act.

Workload

The OIC received fourteen new requests in 2020-21 and had no requests carried over from the previous year. This is a slight decrease from the 18 files received in 2019-20. The OIC processed 3 416 pages throughout those requests. There was one request that required the processing of over 1 000 pages. The OIC also processed one consultation from another institution.

The OIC has continued to adapt to the evolving pandemic situation in an efficient manner, maintaining operations and ensuring service to Canadians.

Timeliness

The OIC completed all requests within the reporting period. None of the requests the OIC completed in 2020-21 were late. This ongoing commitment to ensuring timely access to information has been a pillar of the OIC’s Access to Information and Privacy program for over 10 years. File status is monitored on an ongoing basis by all members of the ATIP team to ensure that all files are answered within statutory deadlines. This is done through regular reports drawn from our case management system.

The average time taken to respond to privacy requests was 17.6 days for 2020-21, this is in line with recent trends. No extensions were taken under section 15 of the Privacy Act. The average processing time in 2019-20 was 17.5 days, and in 2018-19 it was 17.75 days.

Disclosure

The OIC disclosed all records for two of the requests in 2020-21. The records were disclosed in part for another four files. One request was abandoned and in the remaining seven requests there were no records found to respond to the request. Overall, the OIC disclosed 3,236 pages, nearly 95% of the number of pages processed.

In 2020-21, the OIC claimed exemptions to withhold information in four of the fourteen requests processed. The most often-used exemption this year was section 26 (personal information of someone other than the requester; two instances), followed by both subsection 22(1)(b) (law enforcement and investigations) and section 27 (solicitor-client privilege) with one instance each. This is a change from recent trends which saw subsection 22(1)(b) as traditionally the most frequently invoked exemption.

The OIC applied no exclusions to records in 2020-21.

The OIC made no disclosures of personal information in the public interest under paragraph 8(2)(m).

Complaints

The Office of the Privacy Commissioner received no complaints about the OIC’s handling of privacy matters in 2020-21.

Privacy Activities at the OIC

In 2020-21, the ATIP Secretariat held awareness and training sessions for all new employees on their responsibilities under the Privacy Act. A total of approximately 28 staff attended these sessions.

No new policies, guidelines, procedures or initiatives were implemented during the reporting period.

Privacy Breaches

There were no material breaches in 2020-21.

Privacy Impact Assessments

One Privacy Impact Assessment was completed in 2020-21. This was to assess the privacy implications of engaging a company to administer exams in the course of staffing processes.

Appendix A: Delegation Order, Privacy Act

Delegation Order, Privacy Act

Text version

Arrêté de délégation en vertu de la Loi sur l’accès à l’information et de la Loi sur la protection des renseignements personnels

Delegation orders for the purpose of the Access to Information Act and the Privacy Act

En vertu de l’article 73 de la Loi sur l’accès à l’information et de la Loi sur la protection des renseignements personnels, la Commissaire à l’information du Canada délègue aux titulaires des postes mentionnés à l’annexe ci-après, ainsi qu’aux personnes occupant à titre intérimaire lesdits postes, les attributions dont elle est investie en qualité de responsable d’une institution fédérale, c’est-à-dire le Commissariat à l’information du Canada. Le présent arrêté de délégation annule et remplace tout arrêté antérieur fait en vertu de l’article 73.

Cet arrêté de délégation prend effet le 22 mai 2018.

Daté, à la ville de Gatineau, ce 22 jour de mai 2018

Original signé par

The Information Commissioner of Canada, pursuant to Section 73 of the Access to Information Act and of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers and functions of the Information Commissioner of Canada as the head of a government institution that is, the Office of the Information Commissioner of Canada. This Delegation Order supersedes all previous Delegation Orders pursuant to section 73.

This delegation order is effective on May 22, 2018

Dated, at the City of Gatineau, this 22 day of May 2018

Original signed by

______________________________________________

Caroline Maynard

Commissaire à l’information du Canada

Information Commissioner of Canada

Delegation Order, Privacy Act

Text version

Schedule
Schedule / Annexe
Position / Poste	Privacy Actand Regulations/Loi sur la protection des renseignements personnelset règlement.	Access to Information Act and Regulations/Loi sur l’accès à l’informationet règlement.
Deputy Commissioner, Legal Services and Public Affairs/ Sous commissaire, Services juridiques et Affaires publiques	Autorité Absolue / Full Authority	Autorité Absolue / Full Authority
Gestionnaire, Accès à l’information et protection des renseignements personnels / Manager, Access to Information and Privacy	Autorité Absolue / Full Authority	Autorité Absolue / Full Authority
Agent de l’AIPRP / ATIP Officer	Articles de la Loi / Sections of the Act : aucune délégation no delegation Articles du Règlement / Sections of the Regulations : 11(2), 11(4)	Articles de la loi / Sections of the Act : 4(2.1), 8(1), 11(6), 27(1), 27(4). Articles du Règlement / Sections of the Regulations : 6(1)

Appendix B: 2020-21 Statistical Report

Statistical Report on the Privacy Act

Name of institution: Office of the Information Commissioner of Canada

Reporting period: 2020-04-01 to 2021-03-31

Section 1: Requests under the Privacy Act

1.1 Number of requests

**Number of requests**
	Number of Requests
Received during reporting period	14
Outstanding from previous reporting period	0
Total	14
Closed during reporting period	14
Carried over to next reporting period	0

Section 2: Requests closed during the reporting period

2.1 Disposition and completion time

Disposition of requests	Completion time
Disposition of requests	1 to 15 days	16 to 30 days	31 to 60 days	61 to 120 days	121 to 180 days	181 to 365 days	more than 365 days	Total
All disclosed	0	2	0	0	0	0	0	2
Disclosed in part	0	4	0	0	0	0	0	4
All exempted	0	0	0	0	0	0	0	0
All excluded	0	0	0	0	0	0	0	0
No records exist	4	3	0	0	0	0	0	7
Request abandoned	1	0	0	0	0	0	0	1
Neither confirmed nor denied	0	0	0	0	0	0	0	0
Total	5	9	0	0	0	0	0	14

2.2 Exemptions

Section	Number of requests
18(2)	0
19(1)(a)	0
19(1)(b)	0
19(1)(c)	0
19(1)(d)	0
19(1)(e)	0
19(1)(f)	0
20	0
21	0
22(1)(a)(i)	0
22(1)(a)(ii)	0
22(1)(a)(iii)	0
22(1)(b)	1
22(1)(c)	0
22(2)	0
22.1	0
22.2	0
22.3	0
23(a)	0
23(b)	0
24(a)	0
24(b)	0
25	0
26	2
27	1
27.1	0
28	0

2.3 Exclusions

Section	Number of requests
69(1)(a)	0
69(1)(b)	0
69.1	0
70(1)	0
70(1)(a)	0
70(1)(b)	0
70(1)(c)	0
70(1)(d)	0
70(1)(e)	0
70(1)(f)	0
70.1	0

2.4 Format of information released

Paper	Electronic	Other
0	6	0

2.5 Complexity

2.5.1 Relevant pages processed and disclosed

Number of Pages Processed	Number of Pages Disclosed	Number of Requests
3416	3236	7

2.5.2 Relevant pages processed and disclosed by size of requests

Disposition	Less than 100 pages processed		101 to 500 pages processed		501 to 1,000 pages processed		1,001 to 5,000 pages processed		more than 5,000 pages processed
Disposition	Number of requests	Pages disclosed	Number of requests	Pages disclosed	Number of requests	Pages disclosed	Number of requests	Pages disclosed	Number of requests	Pages disclosed
All disclosed	2	33	0	0	0	0	0	0	0	0
Disclosed in part	1	32	1	178	1	825	1	2168	0	0
All exempted	0	0	0	0	0	0	0	0	0	0
All excluded	0	0	0	0	0	0	0	0	0	0
Request abandoned	1	0	0	0	0	0	0	0	0	0
Neither confirmed nor denied	0	0	0	0	0	0	0	0	0	0
Total	4	65	1	178	1	825	1	2168	0	0

2.5.3 Other complexities

Disposition	Consultation required	Legal advice sought	Interwoven information	Other	Total
All disclosed	0	0	0	0	0
Disclosed in part	0	0	0	0	0
All exempted	0	0	0	0	0
All excluded	0	0	0	0	0
Request abandoned	0	0	0	0	0
Neither confirmed nor denied	0	0	0	0	0
Total	0	0	0	0	0

2.6 Closed requests

2.6.1 Number of requests closed within legislated timelines

	Requests closed within legislated timelines
Number of requests closed within legislated timelines	14
Percentage of requests closed within legislated timelines (%)	100

2.7 Deemed refusals

2.7.1 Reasons for not meeting statutory deadline

Number of Requests Closed Past the Legislated Timelines	Principal reason
Number of Requests Closed Past the Legislated Timelines	Interference with Operations / Workload	External consultation	Internal consultation	Other
0	0	0	0	0

2.7.2 Requests closed beyond legislated timelines (including any extensions taken)

Number of days past deadline	Number of requests past deadline where no extension was taken	Number of requests past deadline where an extension was taken	Total
1 to 15 days	0	0	0
16 to 30 days	0	0	0
31 to 60 days	0	0	0
61 to 120 days	0	0	0
121 to 180 days	0	0	0
181 to 365 days	0	0	0
More than 365 days	0	0	0
Total	0	0	0

2.8 Requests for translation

Translation requests	Accepted	Refused	Total
English to French	0	0	0
French to English	0	0	0
Total	0	0	0

Section 3: Disclosures under subsections 8(2) and 8(5)

Paragraph 8(2)(e)	Paragraph 8(2)(m)	Subsection 8(5)	Total
0	0	0	0

Section 4: Requests for correction of Personal Information and Notations

Disposition for correction requests received	Number
Notations attached	0
Requests for correction accepted	0
Total	0

Section 5: Extensions

5.1 Reasons for extensions and disposition of requests

Number of requests where an extension was taken	15(a)(i) Interference with operations				15 (a)(ii) Consultation			15(b) Translation purposes or conversion
Number of requests where an extension was taken	Further review required to determine exemptions	Large volume of pages	Large volume of requests	Documents are difficult to obtain	Cabinet Confidence Section (Section 70)	External	Internal	15(b) Translation purposes or conversion
0	0	0	0	0	0	0	0	0

5.2 Length of extensions

Length of Extensions	15(a)(i) Interference with operations				15 (a)(ii) Consultation			15(b) Translation purposes or conversion
Length of Extensions	Further review required to determine exemptions	Large volume of pages	Large volume of requests	Documents are difficult to obtain	Cabinet Confidence Section (Section 70)	External	Internal	15(b) Translation purposes or conversion
1 to 15 days	0	0	0	0	0	0	0	0
16 to 30 days	0	0	0	0	0	0	0	0
31 days or greater								0
Total	0	0	0	0	0	0	0	0

Section 6: Consultations received from other institutions and organizations

6.1 Consultations received from other Government of Canada institutions and other organizations

Consultations	Other Government of Canada institutions	Number of pages to review
Received during the reporting period	1	14
Outstanding from the previous reporting period	0	0
Total	1	14
Closed during the reporting period	1	0
Pending at the end of the reporting period	0	14

6.2 Recommendations and completion time for consultations received from other Government of Canada institutions

Recommendation	Number of days required to complete consultation requests
Recommendation	1 to 15 days	16 to 30 days	31 to 60 days	61 to 120 days	121 to 180 days	181 to 365 days	More than 365 days	Total
All disclosed	1	0	0	0	0	0	0	1
Disclosed in part	0	0	0	0	0	0	0	0
All exempted	0	0	0	0	0	0	0	0
All excluded	0	0	0	0	0	0	0	0
Consult other institution	0	0	0	0	0	0	0	0
Other	0	0	0	0	0	0	0	0
Total	1	0	0	0	0	0	0	1

6.3 Recommendations and completion time for consultations received from other organizations

Recommendation	Number of days required to complete consultation requests
Recommendation	1 to 15 days	16 to 30 days	31 to 60 days	61 to 120 days	121 to 180 days	181 to 365 days	More than 365 days	Total
All disclosed	0	0	0	0	0	0	0	0
Disclosed in part	0	0	0	0	0	0	0	0
All exempted	0	0	0	0	0	0	0	0
All excluded	0	0	0	0	0	0	0	0
Consult other institution	0	0	0	0	0	0	0	0
Other	0	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0	0

Section 7: Completion time of consultations on Cabinet confidences

7.1 Requests with Legal Services

Number of days	Fewer than 100 pages processed		101 to 500 pages processed		501 to 1,000 pages processed		1,001 to 5,000 pages processed		More than 5,000 pages processed
Number of days	Number of requests	Pages disclosed	Number of requests	Pages disclosed	Number of requests	Pages disclosed	Number of requests	Pages disclosed	Number of requests	Pages disclosed
1 to 15	0	0	0	0	0	0	0	0	0	0
16 to 30	0	0	0	0	0	0	0	0	0	0
31 to 60	0	0	0	0	0	0	0	0	0	0
61 to 120	0	0	0	0	0	0	0	0	0	0
121 to 180	0	0	0	0	0	0	0	0	0	0
181 to 365	0	0	0	0	0	0	0	0	0	0
More than 365	0	0	0	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0	0	0	0

7.2 Requests with Privy Council Office

Number of days	Fewer than 100 pages processed		101 to 500 pages processed		501 to 1,000 pages processed		1,001 to 5,000 pages processed		More than 5,000 pages processed
Number of days	Number of requests	Pages disclosed	Number of requests	Pages disclosed	Number of requests	Pages disclosed	Number of requests	Pages disclosed	Number of requests	Pages disclosed
1 to 15	0	0	0	0	0	0	0	0	0	0
16 to 30	0	0	0	0	0	0	0	0	0	0
31 to 60	0	0	0	0	0	0	0	0	0	0
61 to 120	0	0	0	0	0	0	0	0	0	0
121 to 180	0	0	0	0	0	0	0	0	0	0
181 to 365	0	0	0	0	0	0	0	0	0	0
More than 365	0	0	0	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0	0	0	0

Section 8: Complaints and Investigations Notices Received

Section 31	Section 33	Section 35	Court action	Total
0	0	0	0	0

Section 9: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIB)

Number of PIA(s) completed	1

Section 9.2: Personal Information Banks

Personal Information Banks	Active	Created	Terminated	Modified
	56	0	0	0

Section 10: Material Privacy Breaches

Number of material privacy breaches reported to TBS	0
Number of material privacy breaches reported to OPC	0

Section 11: Resources related to the Privacy Act

11.1 Costs

Expenditures	Amount
Salaries	$109,286
Overtime	$0
Goods and services	$155
Professional services contracts	$0
Other	$155
Total	$109,441

11.2 Human Resources

Resources	Person years dedicated to privacy activities
Full-time employees	1.245
Part-time and casual employees	0.00
Regional staff	0.00
Consultants and agency personnel	0.00
Students	0.00
Total	1.245

Note: Enter values to two decimal places.

Supplemental Statistical Report on the Access to Information Act and Privacy Act