2022-23 Annual Report on the Administration of the Privacy Act

Table of Contents

• Introduction
• Organizational Structure
• Delegation Order
  • Workload
  • Timeliness
  • Disclosure
  • Complaints
• Training and Awareness
• Policies, Guidelines, and Procedures
• Initiatives and Projects to Improve Privacy
• Summary of Key Issues and Actions Taken on Complaints
• Material Privacy Breaches
• Privacy Impact Assessments
• Public Interest Disclosures
• Monitoring Compliance
• Annex A

Introduction

The Privacy Act (Act) safeguards the privacy of individuals by protecting personal information held by government institutions. The Act also gives individuals the right to access their own personal information. The Office of the Information Commissioner (OIC) has been subject to the Privacy Act since 2007. The OIC pursues all measures to protect personal information and provide prompt access to the personal information it holds in response to requests.

This report, prepared and tabled in accordance with section 72 of the Privacy Act, reviews the OIC’s privacy-related activities for 2022-23.

The Office of the Information Commissioner (OIC) was created in 1983 under the Access to Information Act to support the work of the Information Commissioner. The mandate of the OIC is to conduct efficient, fair and confidential investigations into complaints about government institutions’ handling of access to information requests. Investigators conduct these enquiries in private, giving all parties the opportunity to present their positions on the matters under investigation.

The OIC supports the Commissioner in her advisory role to Parliament and parliamentary committees on all matters pertaining to access to information. The OIC actively supports freedom of information in Canada through targeted initiatives such as Right to Know Week and ongoing dialogue with Canadians, Parliament and government institutions.

Organizational Structure

The OIC supports the Information Commissioner in her advisory role to Parliament and parliamentary committees on all matters pertaining to access to information.

The Commissioner is supported by a staff complement of approximately 128 employees, including a senior management team of three deputy commissioners:

• Deputy Commissioner, Investigations and Governance
• Deputy Commissioner, Legal Services and Public Affairs
• Deputy Commissioner, Corporate Services, Strategic Planning and Transformation Services

The Access to Information and Privacy Secretariat falls under the Legal Services and Public Affairs Sector. The ATIP Manager and the Deputy Commissioner of Legal Services and Public Affairs hold full-delegated authority under the Act.

The OIC has a small team of specialists who carry out the organization’s Access to Information and Privacy (ATIP) activities. In 2022-23, the ATIP team consisted of the ATIP Manager and 3 ATIP Officers. Secretariat members process requests, proactively publish completed Access requests, provide training on access and privacy matters to new employees, and develop and implement policies and procedures to ensure that the institution meets its obligations under the Acts.

The OIC was not party to any service agreements under section 73.1 of the Privacy Act.

Delegation Order

The following delegation order was in effect March 31, 2023:

Text version

Delegation orders for the purpose of the Access to Information Act and the Privacy Act

Arrêté de délégation en vertu de la Loi sur l’accès à l’information et de la Loi sur la protection des renseignements personnels

The Information Commissioner of Canada, pursuant to Section 73 of the Access to Information Act and of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers and functions of the Information Commissioner of Canada as the head of a government institution that is, the Office of the Information Commissioner of Canada. This Delegation Order supersedes all previous Delegation Orders pursuant to section 73.

This delegation order is effective on May 22, 2018

Dated, at the City of Gatineau, this 22 day of May 2018

Original signed by

En vertu de l’article 73 de la Loi sur l’accès à l’information et de la Loi sur la protection des renseignements personnels, la Commissaire à l’information du Canada délègue aux titulaires des postes mentionnés à l’annexe ci-après, ainsi qu’aux personnes occupant à titre intérimaire lesdits postes, les attributions dont elle est investie en qualité de responsable d’une institution fédérale, c’est-à-dire le Commissariat à l’information du Canada.  Le présent arrêté de délégation annule et remplace tout arrêté antérieur fait en vertu de l’article 73.

Cet arrêté de délégation prend effet le 22 mai 2018.

Daté, à la ville de Gatineau, ce 22 jour de mai 2018

Original signé par

______________________________________________

Caroline Maynard

Information Commissioner of Canada

Commissaire à l’information du Canada

Text version

Delegation Order, Access to Information Act

Schedule / Annexe
Position / Poste	Privacy Actand Regulations / Loi sur la protection des renseignements personnelset règlement.	Access to Information Act and Regulations / Loi sur l’accès à l’informationet règlement.
Deputy Commissioner, Legal Services and Public Affairs / Sous commissaire, Services juridiques et Affaires publiques	Full Authority / Autorité Absolue	Full Authority / Autorité Absolue
Manager, Access to Information and Privacy / Gestionnaire, Accès à l’information et protection des renseignements personnels	Full Authority / Autorité Absolue	Full Authority / Autorité Absolue
ATIP Officer / Agent de l’AIPRP	Sections of the Act : no delegation / Articles de la Loi : aucune délégation Sections of the Regulations / Articles du Règlement : 11(2), 11(4)	Sections of the Act / Articles de la loi : 4(2.1), 8(1), 11(6), 27(1), 27(4). Sections of the Regulations / Articles du Règlement : 6(1)

Performance 2022‑23

Appendix A contains the OIC’s statistical report on the Privacy Act for 2022‑23. The following sets out some highlights from that report, along with notable trends related to workload, timeliness and disclosure over the last 5 years. 

Workload

The OIC saw unprecedented increases in all areas in 2022‑23. 43 new requests were received, an increase of 154% from the previous fiscal year. A total of 33,429 pages were processed, representing an increase of 979%.

There were no informal privacy requests received during this reporting period.

There were no requests carried over from 2021‑22 and no requests were carried forward into 2023‑24.

One request for consultation was received and closed within the reporting period.

Timeliness

The OIC completed all requests within the reporting period and all requests received in 2022‑23 were completed on time. This ongoing commitment to ensuring timely access to information has been a pillar of the OIC’s Access to Information and Privacy program for over 10 years. Members of the ATIP team monitor file status on an ongoing basis to ensure that all files are dealt with within statutory deadlines. This is accomplished through regular reports drawn from our case management system.

The average time taken to respond to privacy requests was 15.8 days for 2022‑23. In 2021‑22, the average was 18.3 days; in 2020‑21, the average was 17.6 days; and finally 17.5 days in 2019‑20. No extensions were taken under section 15 of the Privacy Act. Of the 43 requests completed in 2022‑23, 21 were completed within 1-15 days. The remaining 22 files were completed within 16 and 30 days.

Operations were not affected by any COVID-19 related measures.

Disclosure

The OIC disclosed all records for twelve of the requests (27.9%) in 2022‑23. The records were disclosed in part for another eleven files (25.5%). Six request were abandoned (14%), twelve requests had no records found to respond to the request (27.9%). The final two requests were treated informally (4.7%). Overall, the OIC disclosed 33,429 pages.

In 2022‑23, the OIC claimed exemptions to withhold information in thirteen of the forty-three requests processed. The most frequently-used exemption this year was subsection 22(1)(b) (law enforcement and investigations), followed by section 26 (personal information of someone other than the requester), and section 27 (solicitor-client privilege). These three exemptions are consistently the top three exemptions invoked, with 22(1)(b) traditionally the most frequently invoked exemption.

The OIC made no disclosures of personal information in the public interest under paragraph 8(2)(m).

Complaints

The Office of the Privacy Commissioner received two complaints about the OIC’s handling of privacy matters in 2022‑23. Both complaints were discontinued.

Training and Awareness

The OIC ATIP team provides ongoing training on access and privacy matters to OIC employees. In 2022‑23, the Secretariat held formal training sessions for all new employees. A total of 15 employees participated in these sessions. Informal training sessions were held on an ad hoc basis with current employees as required.

Policies, Guidelines, and Procedures

No new policies, guidelines and procedures were implemented during this reporting period.

Initiatives and Projects to Improve Privacy

Several initiatives were undertaken in 2022‑23 to improve access to information and privacy within the OIC.

Updated Case Management System

A new database was created and preparations were made to transition to the most up-to-date version of ATIPXpress, the case management system used at the OIC. The adoption of this new version, launched April 1, 2023, will result in greater efficiency in processing requests and fewer technical difficulties.

Electronic Document Retrieval

Recognizing the need for a document retrieval system that reflected the advent of remote work and the increasing digitization of records, with the support of senior management ATIP worked in collaboration with partners in Information Technology, Information Management to develop a new digital-first process. This process included a more comprehensive retrieval checklist, a designated retrieval file framework, as well as changes to the roles and responsibilities of the Office of Primary Interest. Thus far, this initiative has proven very successful and we continue to modify and adapt to new challenges as they arise.

ATIP Online Management Tool Pilot

The OIC was among a select group of institutions given the opportunity to participate in the testing of the new ATIP Online Management Tool (AOMT), developed by TBS and on April 1, 2022, began using the new platform. Through this pilot phase, OIC ATIP employees provided useful feedback to TBS, contributing to the successful July 2022 launch, at which point the tool became accessible to all institutions.

Summary of Key Issues and Actions Taken on Complaints

While there were two complaints received during this reporting period, both were discontinued, and as a result there were no recommendations provided.

Material Privacy Breaches

There were no material breaches reported in 2022‑23

Privacy Impact Assessments

There was one Privacy Impact Assessment completed in 2022‑23. This PIA was commissioned in order to analyse the operationalization of section 6.1 of the Access to Information Act. This section allows institutions to seek approval from the Information Commissioner to decline to act upon requests that are vexatious, made in bad faith or is otherwise an abuse of the right of access. In order to be able to review these applications, the OIC developed a process to collect and disclose information that is transparent and respects obligations under the Privacy Act. The PIA covers the process of operationalizing the responsibility conferred on the OIC, the process, the risks and mitigation strategies. 

A summary of this PIA will be posted to the OIC website in the near future.

Public Interest Disclosures

The OIC made no disclosures of personal information in the public interest under paragraph 8(2)(m).

Monitoring Compliance

The OIC monitors compliance with the Privacy Act in a variety of ways. This includes regular meetings with the team as a whole, bilateral meetings, and reporting file status via a weekly report shared with management.

In order to ensure that timelines are respected the OIC ATIP Secretariat only consults other government institutions when absolutely necessary, and in a manner that ensures timely responses and is in line with the Implementation Notice published by Treasury Board Secretariat.

The right of public access to information is reflected in contracts, information sharing agreements and arrangements via the inclusion of standard clauses to ensure awareness of obligations under the Access to Information Act and the Privacy Act.

Annex A

Statistical Report on the Privacy Act

Name of institution: Office of the Information Commissioner of Canada

Reporting period: 2022-04-01 to 2023-03-31

Section 1: Requests Under the Privacy Act

1.1 Number of requests received

1.2 Channels of requests

Section 2: Informal requests

2.1 Number of informal requests

2.2 Channels of informal requests

2.3 Completion time of informal requests

2.4 Pages released informally

Section 3: Requests Closed During the Reporting Period

3.1 Disposition and completion time

3.2 Exemptions

3.3 Exclusions

3.4 Format of information released

3.5 Complexity

3.5.1 Relevant pages processed and disclosed for paper and e-record formats

3.5.2 Relevant pages processed by request disposition for paper and e-record formats by size of requests

Supplemental Statistical report on the Access to Information Act and the Privacy Act

Name of institution: Office of the Information Commissioner of Canada

Reporting period: 2022-04-01 to 2023-03-31

Section 1: Capacity to Receive Requests under the Access to Information Act and the Privacy Act

Enter the number of weeks your institution was able to receive ATIP requests through the different channels.

Section 2: Capacity to Process Records under the Access to Information Act and the Privacy Act

2.1 Enter the number of weeks your institution was able to process paper records in different classification levels.

2.2 Enter the number of weeks your institution was able to process electronic records in different classification levels.

Section 3: Open Requests and Complaints Under the Access to Information Act

3.1 Enter the number of open requests that are outstanding from previous reporting periods.

3.2 Enter the number of open complaints with the Information Commissioner of Canada that are outstanding from previous reporting periods.

Section 4: Open Requests and Complaints Under the Privacy Act

4.1 Enter the number of open requests that are outstanding from previous reporting periods.

4.2 Enter the number of open complaints with the Privacy Commissioner of Canada that are outstanding from previous reporting periods.

Section 5: Social Insurance Number (SIN)

Section 6: Universal Access under the Privacy Act