Annual Report to Parliament on the Administration of the Privacy Act - 2015-2016

Table of contents

• Introduction
  • Purpose of the Privacy Act
  • Mandate of the Institution
  • Organizational Structure
  • Delegated Authorities
• Administration of Requests
  • Privacy Requests
  • Disposition of Completed Requests
  • Exemptions and Exclusions
  • Relevant Pages Processed and Disclosed
  • Extensions
  • Consultations Received from Other Institutions
• Internal Operations
  • Training and Development
  • New or Revised Policies, Guidelines and Procedures
  • Key Issues Raised, and Actions Taken as a Result of Complaints, Audits and Investigations
  • Monitoring Processing Times
• Administration of Personal Information
  • Privacy Breaches
  • Privacy Impact Assessment (PIA)
• Disclosure of Personal Information
  • Subsection 8(2)(M)
• Annex A: Designation Order
• Annex B: Department of Foreign Affairs, Trade and Development 2015-2016 Statistical Report

Introduction

We are pleased to table the Annual Report to Parliament on the administration of the Privacy Act (PA or the Act) for fiscal year 2015-2016, as required under section 72 of the Act.

Nota: The Department is referred to as Global Affairs Canada; however, the legal name remains the Department of Foreign Affairs, Trade and Development.

Purpose of the Privacy Act

The Privacy Act provides Canadian citizens and individuals present in Canada the right to seek access to their personal information that is held by the federal government. It also governs the collection, use, disclosure, retention and disposal of personal information.

Mandate of the Institution

On behalf of the Government of Canada, the Department of Foreign Affairs, Trade and Development is Canada’s face and voice to the world, working to advance Canada’s political and economic interests in the international community as well as to apply Canadian experience to help address global issues.

The Department's legal mandate, as set out in the Department of Foreign Affairs, Trade and Development Act, SC 2013, c. 33, s. 174 is to:

• conduct all diplomatic and consular relations on behalf of Canada;
• conduct all official communication between the Government of Canada and the government of any other country and between the Government of Canada and any international organization;
• conduct and manage international negotiations as they relate to Canada;
• coordinate Canada’s international economic relations;
• foster the expansion of Canada’s international trade and commerce;
• foster sustainable international development and poverty reduction in developing countries and provide humanitarian assistance during crises;
• coordinate the direction given by the Government of Canada to the heads of Canada’s diplomatic and consular missions;
• manage Canada’s diplomatic and consular missions;
• administer the foreign service of Canada; and
• foster the development of international law and its application in Canada’s external relations.

The Minister of Foreign Affairs is also responsible for the Export and Import Permits Act, RSC 1985, c. E-19, which authorizes the government to control and monitor the trans-border flow of specified goods, and for the Special Economic Measures Act, 40-41 Elizabeth II, c. 17, which authorizes the government to apply economic sanctions in response to a serious threat to international peace and security.

The Department also provides administrative support to other government institutions with personnel abroad.

Organizational Structure

The Access to Information and Privacy Protection Division (ATIP Office) is responsible for the administration of the Act, including the processing of requests and consultations. The Director of the ATIP Office reports to the Corporate Secretary, who in turn reports to the Deputy Minister of Foreign Affairs.

In 2015-2016, the ATIP Office staff fluctuated at around fifty-five to seventy (including consultants) to fulfill the Department’s obligations under the Access to Information Act and the Privacy Act. As of March 31, 2016, the ATIP Office consisted of; a director, four deputy directors, seven team leaders, twenty nine analysts at various levels, seven clerical staff, seven consultants, 1 student, seven part-time and casual employees, and one systems administrator. The work ranges from processing complex and/or voluminous requests to more straightforward, routine requests and consultations from other government departments as well as providing advice to internal and external stakeholders and providing training to departmental staff.

Delegated Authorities

Under Section 73 of the Act, the Minister’s authority is delegated to enable the Department to meet its legislated requirements as well as exercise its powers. As a result of amalgamation, the Department is currently operating with two separate and distinct Delegation Orders. Since October 2009, responsibility for all sections of the Act was delegated to the Deputy Ministers, to the Corporate Secretary, to the Director of the ATIP Office, to the Deputy Directors of the ATIP Office, as well as to Heads of Mission for the purposes of disclosure under section 8(2)(m) of the Privacy Act. (See Annex A).

Administration of Requests

The following section explains in more detail the TBS statistical report as provided in Annex B

Privacy Requests

Between April 1, 2015 and March 31, 2016, the Department received 135 requests for personal information under the Privacy Act. Along with those new requests, 25 requests were carried over from the previous fiscal year, for a total of 160. During the reporting period, 127 requests were completed and 33 still active files were carried over to the next reporting period. More files were closed in this reporting period compared to the previous fiscal year.

Disposition of Completed Requests

The distribution of completed requests is as follows:

Exemptions and Exclusions

The exemption most commonly used by the Department during the period was section 26 [Information about another individual] of the Privacy Act. It was invoked in 73 requests. DFATD did not apply exclusions under subsection 70(1) [confidences of cabinet] during this reporting period.

Relevant Pages Processed and Disclosed

In all, during this reporting period, the Department disclosed 20,083 pages of the 27,851 relevant pages processed.

Extensions

During the reporting period, DFATD claimed extensions pursuant to subsections 15(a)(i) and 15(a)(ii): 37 and 21 times, respectively.

Consultations Received from Other Institutions

When a request contains records that are of interest to another institution, the Access to Information and Privacy Coordinator of that institution is consulted. Between April 1, 2015 and March 31, 2016, DFATD received 16 consultations under the Privacy Act from other federal government institutions.

During the reporting period, 15 consultations were completed under the Privacy Act

Internal Operations

Training and Development

During 2015-2016, the ATIP Office continued to provide analysts with the necessary training and tools to perform their jobs effectively via training sessions developed to meet the ATIP Office’s training needs. The Learning Roadmaps developed in a previous year have continued to be an effective tool to identify and formalize the training requirements for employees in the ATIP Division.

The ATIP Office also continued to benefit from its ATIP Professional Development Program which allows the Department to “grow its own” ATIP Analysts due to the shortage of experienced ATIP Analysts within the federal ATIP Community. This program has been very successful in addressing recruitment, retention and succession planning issues. Thirteen employees are presently in the program and recruiting continues.

The Policy & Governance Team assists in addressing the ATIP training needs of the ATIP Office, the Department and other federal government institutions. The Policy and Governance Team also advises the Department regarding compliance with the Access to Information Act, the Privacy Act, their regulations and relevant Treasury Board of Canada policy requirements.

The ATIP Office continues to broaden its use of internal collaboration tools to share information, best practices, and facilitate cooperation across the Department. A structured, department-wide ATIP awareness program is in place and includes the following events: attendance at staff meetings, “Global Affairs Canada 101” courses which are designed for all employees, pre-posting training sessions in order to better prepare employees for their work at Canada’s missions abroad, and in sessions with subject matter experts during which records are reviewed in order to educate employees on the exercise of discretion when making recommendations. In addition, an online interactive ATIP awareness tutorial, developed in collaboration with the Canadian Foreign Service Institute, continues to be used.

To assist Consular Officers in understanding their roles and responsibilities vis-a-vis the Access to Information Act and the Privacy Act in the context of providing consular services to Canadians, a specific training program is delivered using scenario-based practical exercises to better prepare employees for situations they may encounter in the course of their duties.

In all, during the reporting period, forty one formal training sessions were delivered to approximately five hundred and eighteen employees. The Department’s ATIP Division continuously strives to develop and refine its training tools through comments from employees participating in the various training session delivered.

New or Revised Policies, Guidelines and Procedures

While the workload has stabilized, it remains substantial and the Access to Information and Privacy Protection Office at the department is continually working to find efficiencies. In the past year, the division’s internal guidelines documents were converted to an “evergreen” electronic document.

The Department continued to place emphasis on educating departmental officials on their ATIP roles and responsibilities to ensure compliance and efficiencies.

Key Issues Raised, and Actions Taken as a Result of Complaints, Audits, and Investigations

During the reporting period, the Department received five complaints, of which three were on the same file. Two have been completed and three carried over to the next fiscal year.

• Three delay complaints of which one was discontinued, two were well founded, one of which has not yet been resolved.
• In one complaint, the requester alleges that the Department has information that it has not disclosed. We are still awaiting a response from the Privacy Commissioner of Canada
• On the same file, the requester also alleges that the Department improperly applied exemptions to withhold information. Awaiting response from the Privacy Commissioner.
• The Department also closed a complaint from a previous fiscal year where the requester alleged that exemptions were improperly applied. The complaint was determined to be not well founded by the Privacy Commissioner.

The Department takes the issue of complaints seriously. In order to avoid complaints, the ATIP Office provided ATIP Awareness sessions throughout the Department, updating the Bureau Intranet and Internet ATIP web sites, ensuring that new personnel receive appropriate training.

Monitoring Processing Times

The Department monitors time to process requests using the following tools:

• Active Tasking Report (bi-weekly): Identifies all the current active taskings within the Department, and includes for each tasking the responsible area and bureau, type of tasking, summary of the request and the name of the assigned analyst. These are provided to all Assistant Deputy Ministers and Director Generals in the Department.

• Quarterly Performance Report to Executive Board: Departmental overview of each area’s compliance with ATIP taskings (number of extensions requested, % of completion on time, average response time). The Executive Board consists of: the Deputy Minister of Foreign Affairs, the Deputy Minister of International Trade and the Deputy Minister of International Development, an Associate Deputy Minister, all Assistant Deputy Ministers, the heads of communications and of the Corporate Secretariat, and four senior Heads of Mission.

Administration of Personal Information

Privacy Breaches

Details regarding the six privacy breaches which took place during the reporting period:

• PBR-2015-01633 - One temporary passport missing from mission in San Francisco, USA. Reported to the Privacy Commissioner. 
• PBR-2015-02099 - Missing package from Honorary Consulate in Busan, Korea containing valid Canadian passport, completed renewal application, 2 passport photos. Reported to the Privacy Commissioner.
• PBR-2015-02103 - One passport missing from mission in Beirut, Lebanon. Reported to the Privacy Commissioner.
• PBR-2015-02181 - Loss of two passports by courier while in transit in Canberra, Australia. Reported to the Privacy Commissioner.
• PBR-2015-02246 - Incomplete Citizenship Application mailed back to wrong client in Rome, Italy. Reported to the Privacy Commissioner.
• PBR-2015-02371 - Loss of one passport by FEDEX while in transit between mission and client in Mexico. Reported to the Privacy Commissioner.

Privacy Impact Assessment (PIA)

No PIAs were completed in 2015-2016.

Disclosure of Personal Information

Subsection 8(2) of the Privacy Act provides that “personal information under the control of a government institution may be disclosed” without consent under certain specific circumstances.

Subsection 8(2)(m):

Personal information may be disclosed “for any purpose where, in the opinion of the head of the institution,

(i) the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure, or

(ii) disclosure would clearly benefit the individual to whom the information relates.”

All notifications to the Privacy Commissioner of Canada occurred after the disclosures were made. There were 93 disclosures pursuant to subsection 8(2)(m) of the Privacy Act, as follows:

• P8M-2014-01743 - Subject's mother notified the department that subject was travelling to Middle East to join mercenary fighting force in Syria. Personal information was shared with the RCMP.
• P8M-2014-02168 - Subject was detained in Mexico for assault. Personal information was shared with the RCMP.
• P8M-2014-02228 - Subject and her children were detained for smuggling drugs. Personal information was shared with the Ontario Children’s Aid Society.
• P8M-2014-02386 - Compliance with the Auditor General’s November 2014 report. Proactive reporting to the RCMP of a travelling child sex offender convicted abroad, Cambodia.
• P8M-2014-02402 - Subject suspected of being suicidal. Personal information was shared with local authorities in Peru.
• P8M-2014-02403 - Subject under Power of Attorney with severe mental health issues travelling in New Zealand. Personal information was shared with family members.
• P8M-2014-02404 - Subject hospitalized with suspected mental health issues in Barcelona, Spain. Personal information was shared with family members.
• P8M-2015-00099 - Subject was detained by authorities and in distress in Uganda. Personal information was shared with family members.
• P8M-2015-00394 - Subject was detained in Saudi Arabia and subsequently deported. Personal information was shared with RCMP.
• P8M-2015-00468 - Subject was being held in North Korea. Personal information was released to those individuals under whose authority subject was travelling.
• P8M-2015-00619 - Compliance with the Auditor General’s November 2014 report. Proactive reporting to the RCMP of a travelling child sex offender convicted abroad, Korea.
• P8M-2015-00625 - Compliance with the Auditor General’s November 2014 report. Proactive reporting to the RCMP of a travelling child sex offender convicted abroad, Cuba.
• P8M-2015-00626 and P8M-2015-00628 - Compliance with the Auditor General’s November 2014 report. Proactive reporting to the RCMP of a travelling child sex offender convicted abroad, United Kingdom.
• P8M-2015-00627 - Compliance with the Auditor General’s November 2014 report. Proactive reporting to the RCMP of a travelling child sex offender convicted abroad, New Zealand.
• P8M-2015-00630 - Subject travelling in Jakarta in distress. Personal information was shared with family members.
• P8M-2015-00635 - Subject hospitalized and unconscious in Thailand. Personal information was shared with family members.
• P8M-2015-00636 - Subject hospitalized and identified as posing a threat to public safety. Information was shared with the RCMP.
• P8M-2015-00637 - Subject deceased in Ghana. Personal information was shared with passport guarantor.
• P8M-2015-00638 - Subject hospitalized, doctors determined subject unable to make decisions in their best interest in the United Kingdom. Personal information was shared with family members.
• P8M-2015-00662 - Subject deceased in Moscow, Russia. Personal information was shared with contact references in passport application.
• P8M-2015-00673 - Subject had abducted children to Yemen, and was attempting to return children to Canada without knowledge of mother or authorities. Personal information was shared with the RCMP, CBSA and Gatineau Police.
• P8M-2015-00629
  P8M-2015-00657
  P8M-2015-00665 to P8M-2015-00666
  P8M-2015-00675
  P8M-2015-00677 to P8M-2015-00684
  P8M-2015-00686 to P8M-2015-00688
  P8M-2015-00741 to P8M-2015-00745
  P8M-2015-00747 to P8M-2015-00755
  P8M-2015-00765 to P8M-2015-00768
  P8M-2015-00770 to P8M-2015-0780
  P8M-2015-0782 to P8M-2015-00783
  P8M-2015-00811 to P8M-2015-00822
  P8M-2015-00827 to P8M-2015-00838

Compliance with the Auditor General’s November 2014 report. Proactive reporting to the RCMP of a travelling child sex offender convicted abroad, USA.

Annex A: Designation Orders

Privacy Act Designation Order

The Minister of Foreign Affairs, pursuant to section 73 of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons acting in those positions, to exercise the powers and perform the duties and functions of the Minister of Foreign Affairs as the head of a Government institution under the sections of the Act set out opposite each position in the schedule. This designation replaces the designation dated March 11, 1998.

Schedule

1. Position: Deputy Minister of Foreign Affairs
   Section(s) of Privacy Act: All sections
2. Position: Deputy Minister for International Trade
   Section(s) of Privacy Act: All sections
3. Position: Director General Corporate Secretariat
   Section(s) of Privacy Act: All sections
4. Position: Director, Access to Information and Privacy Protection Division
   Section(s) of Privacy Act: All sections
5. Position: Deputy Director, Access to Information and Privacy Protection Division
   Section(s) of Privacy Act: All sections
6. Position: Heads of diplomatic/consular missions
   Section(s) of Privacy Act: Paragraph 8(2)(m)

The Honourable Lawrence Cannon, P.C., M.P.
Ottawa, October 02, 2009

Privacy Act Designation Order

The Minister of Foreign Affairs, pursuant to section 73 of the Privacy Act, hereby designates the persons holding the positions in the Canadian International Development Agency set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers and perform the duties and functions of the Minister of Foreign Affairs as the head of a government institution under the Act. This designation replaces the designation dated August 11, 1993.

Schedule

1. Position: President
   Section(s) of Privacy Act: All sections
2. Position: Secretary General
   Section(s) of Privacy Act: All sections
3. Position: Coordinator, ATIP
   Section(s) of Privacy Act: All sections
4. Position: Senior ATIP Advisor
   Section(s) of Privacy Act: 14, 15, 33(2)

The Honourable Lawrence Cannon, P.C., M.P.
Ottawa, October 02, 2009

Annex B: Department of Foreign Affairs, Trade and Development 2015-2016 Statistical Report

Statistical Report on the Privacy Act

Name of institution: Global Affairs Canada

Reporting period: 2015-04-01 to 2016-03-31

Part 1 - Requests under the Privacy Act

Part 2 - Requests Closed During the Reporting Period

2.1 Disposition and completion time

2.2 Exemptions

2.3 Exclusions

2.4 Format of information released

2.5 Complexity

2.5.1 Relevant pages processed and disclosed

2.5.2 Relevant pages processed and disclosed by size of requests

2.5.3 Other complexities

2.6 Deemed refusals

2.6.1 Reasons for not meeting statutory deadline

2.6.2 Number of days past deadline

2.7 Requests for translation

Part 3 - Disclosures Under Subsection 8(2) and 8(5)

Part 4 - Requests for Correction of Personal Information and Notations

Part 5 - Extensions

5.1 Reasons for extensions and disposition of requests

5.2 Length of extensions

Part 6 - Consultations Received From Other Institutions and Organizations

6.1 Consultations received from other government institutions and organizations

6.2 Recommendations and completion time for consultations received from other government institutions

6.3 Recommendations and completion time for consultations received from other organizations

Part 7 - Completion Time of Consultations on Cabinet Confidences

7.1 Requests with Legal Services

7.2 Requests with Privy Council Office

Part 8 - Complaints and Investigations Notices Received

Part 9 - Privacy Impact Assessments (PIAs)

Part 10 - Resources Related to the Privacy Act

10.1 Costs

10.2 Human Resources

Note: Enter values to two decimal places.