Annual Report to Parliament on the Administration of the Privacy Act - 2016-2017

Table of contents

• Introduction
  • Purpose of the Privacy Act
  • Mandate of the Institution
  • Organizational Structure
  • Delegated Authorities
• Administration of Requests
  • Privacy Requests
  • Disposition of Completed Requests
  • Exemptions and Exclusions
  • Relevant Pages Processed and Disclosed
  • Extensions
  • Consultations Received from Other Institutions
• Internal Operations
  • Training and Development
  • New or Revised Policies, Guidelines and Procedures
  • Key Issues Raised, and Actions Taken as a Result of Complaints, Audits and Investigations
  • Monitoring Processing Times
• Administration of Personal Information
  • Privacy Breaches
  • Privacy Impact Assessment (PIA)
• Disclosure of Personal Information
  • Subsection 8(2)(M)
• Annex A: Designation Order
• Annex B: Department of Foreign Affairs, Trade and Development Canada 2016-2017 Statistical Report

Introduction

We are pleased to table the Annual Report to Parliament on the administration of the Privacy Act (PA or the Act) for fiscal year 2016-2017, as required under section 72 of the Act.

Nota: The Department is referred to in this report as Global Affairs Canada. However, its legal name remains the Department of Foreign Affairs, Trade and Development as set out in the Department of Foreign Affairs, Trade and Development Act.

Purpose of the Privacy Act

The Privacy Act provides Canadian citizens and individuals present in Canada the right to seek access to their personal information that is held by the federal government. It also governs the collection, use, disclosure, retention and disposal of personal information.

Mandate of the Institution

Global Affairs Canada is Canada’s face and voice to the world, working to advance Canada’s political and economic interests in the international community as well as to apply Canadian experience to help address global issues.

The Department's legal mandate, as set out in the Department of Foreign Affairs, Trade and Development Act, SC 2013, c. 33, s. 174 is to:

• conduct all diplomatic and consular relations on behalf of Canada;
• conduct all official communication between the Government of Canada and the government of any other country and between the Government of Canada and any international organization;
• conduct and manage international negotiations as they relate to Canada;
• coordinate Canada’s international economic relations;
• foster the expansion of Canada’s international trade and commerce;
• foster sustainable international development and poverty reduction in developing countries and provide humanitarian assistance during crises;
• coordinate the direction given by the Government of Canada to the heads of Canada’s diplomatic and consular missions;
• manage Canada’s diplomatic and consular missions;
• administer the foreign service of Canada; and
• foster the development of international law and its application in Canada’s external relations.

The Minister of Foreign Affairs is also responsible for the Export and Import Permits Act, RSC 1985, c. E-19, which authorizes the government to control and monitor the trans-border flow of specified goods, and for the Special Economic Measures Act, 40-41 Elizabeth II, c. 17, which authorizes the government to apply economic sanctions in response to a serious threat to international peace and security.

The Department also provides administrative support to other government institutions with personnel abroad.

Organizational Structure

The Access to Information and Privacy Protection Office (ATIP Office) is responsible for the administration of the Act, including the processing of requests and consultations.  The Director of the ATIP Office reports to the Corporate Secretary, who in turn reports to the Deputy Minister of Foreign Affairs.

In 2016-2017, the ATIP Office staff fluctuated from forty-five to sixty (including consultants) to fulfill the Department’s obligations under the Access to Information Act and the Privacy Act. As of March 31, 2017, the ATIP Office consisted of: a director, four deputy directors, nine team leaders, twenty nine analysts at various levels, eight clerical staff, four consultants, one student, one part-time student, four casual employees, and one systems administrator. The ATIP Office’s work ranges from processing complex and/or voluminous requests to more straightforward, routine requests and consultations from other government departments, as well as providing advice to internal and external stakeholders and providing training to departmental staff.

Delegated Authorities

Consistent with Section 73 of the Act, the Minister’s authority is delegated to the Deputy Ministers, to the Corporate Secretary, to the Director of the Access to Information and Privacy Protection Division, and to the Deputy Directors of the ATIP Office, as well as to Heads of Mission for the purposes of disclosure under section 8 (2) (m) of the Privacy Act.

Administration of Requests

The following section explains in more detail the TBS statistical report as provided in Annex B

Privacy Requests

In 2016-2017, the Department received 153 requests for personal information under the Privacy Act.  Along with those new requests, 33 requests were carried over from the previous fiscal year, for a total of 186.

During the reporting period, 168 requests were completed and 18 still active files were carried over to the next reporting period. More files were closed in this reporting period compared to the previous fiscal year.

Disposition of Completed Requests

The distribution of completed requests is as follows:

Exemptions and Exclusions

The exemption most commonly used by the Department during the period was section 26 [Information about another individual] of the Privacy Act.  It was invoked in 50 requests. Global Affairs Canada did not apply exclusions under subsection 70(1) [confidences of cabinet] during this reporting period.

Relevant Pages Processed and Disclosed

In all, during this reporting period, the Department disclosed 14 002 pages of the 17 423 relevant pages processed.

Extensions

During the reporting period, Global Affairs Canada claimed extensions pursuant to subsections 15(a)(i) and 15(a)(ii): 34 and 11 times, respectively.

Consultations Received from Other Institutions

When a request contains records that are of interest to another institution, the Access to Information and Privacy Coordinator of that institution is consulted.  Between April 1, 2016 and March 31, 2017, Global Affairs Canada received 19 consultations under the Privacy Act from other federal government institutions.

During the reporting period, 11 consultations were completed under the Privacy Act.

Internal Operations

Training and Development

During 2016-2017, the ATIP Office continued to provide analysts with the necessary training and tools to perform their jobs effectively. The Learning Roadmaps developed in a previous year have continued to be an effective tool to identify and formalize the training requirements for employees in the ATIP Division.

The ATIP Office also continued to benefit from its Professional Development Program, which allows the Department to develop its own Analysts due to the shortage within the federal ATIP Community. This program has been very successful in addressing recruitment, retention and succession planning issues. Thirteen employees are presently in the program and recruiting continues.

The Policy and Governance Team assists in addressing the training needs of the ATIP Office and the Department. The Policy and Governance Team also advises the Department regarding compliance with the Access to Information Act, the Privacy Act, their regulations and relevant Treasury Board of Canada policy requirements.

The ATIP Office continues to broaden its use of internal collaboration tools to share information, best practices, and facilitate cooperation across the Department. A structured, department-wide ATIP awareness program is in place and includes: attendance at staff meetings, “Global Affairs Canada 101” courses which are designed for all employees, pre-posting training sessions in order to better prepare employees for their work at Canada’s missions abroad, and individual sessions with subject matter experts and liaison officers. In addition, an online interactive ATIP awareness tutorial, developed in collaboration with the Canadian Foreign Service Institute, continues to be used.

To assist Consular Officers in understanding their roles and responsibilities vis-à-vis the Access to Information Act and the Privacy Act in the context of providing consular services to Canadians, a specific training program is delivered using scenario-based practical exercises to better prepare employees for situations they may encounter in the course of their duties.

During the reporting period, 21 formal ATIP training sessions were delivered to approximately 502 employees. The Department’s ATIP Division continuously strives to develop and refine its training tools through comments from employees participating in the various training session delivered.

In addition, seven training sessions focused on privacy policy were completed and attended by a total of 77 participants. In the coming year, the team will be implementing a number of tools to establish a more proactive, risk-based approach to privacy management and awareness within Global Affairs Canada.

New or Revised Policies, Guidelines and Procedures

While the workload has grown, the Access to Information and Privacy Protection Office at the department is continually working to find efficiencies. The division’s internal guidelines document has been converted to an “evergreen” electronic document which is updated whenever new policies are implemented or new ones are revised.

The Department continued to place emphasis on educating departmental officials on their ATIP roles and responsibilities to ensure compliance and efficiencies.

Key Issues Raised, and Actions Taken as a Result of Complaints, Audits, and Investigations

During the reporting period, the Department received five complaints. The Department closed three complaints over the same period, two of which had been opened in previous years. Four complaints have been carried over to the next fiscal year.

• Of the five complaints received, four dealt with the exemptions used by Global Affairs Canada. These four complaints are still being dealt with in cooperation with the Office of the Privacy Commissioner of Canada.
• The other complaint opened this fiscal year dealt with a delay in providing a response to the requester. This complaint was well-founded and has been resolved.
• One of the complaints that has been closed dealt with alleged unlawful disclosure of information. The complaint was deemed to be not well-founded by the Office of the Privacy Commissioner of Canada.
• The third complaint closed dealt with the exemptions used by the Department and has been resolved.

The Department takes the issue of complaints seriously. In order to avoid complaints, the ATIP Office has provided ATIP Awareness sessions throughout the Department, updating the Bureau Intranet and Internet ATIP web sites, and ensures that new personnel receive appropriate training. The Department also offers more thorough training on the privacy act for consular staff before they go abroad.

Monitoring Processing Times

The Department monitors time to process requests using the following tools:

• Active Tasking Report (bi-weekly): Identifies all current active taskings within the Department, and includes for each tasking the responsible area and bureau, type of tasking, summary of the request and the name of the assigned analyst. These are provided to all Assistant Deputy Ministers and Directors General in the Department.

• Quarterly Performance Report to the Executive Board: This is a Departmental overview of each area’s compliance with ATIP taskings (number of extensions requested, percentage of completion on time, average response time). The Executive Board consists of Global Affairs Deputy Ministers and Assistant Deputy Ministers, as well as the Corporate Secretariat, Senior General Counsel, and the Chief Audit Executive, and five senior Heads of Mission.

Administration of Personal Information

Privacy Breaches

Details regarding the ten privacy breaches which took place during the reporting period:

• PBR-2015-02298 - Inspector General Reports incorrectly uploaded onto CCM Mercury. Reported to the Privacy Commissioner.
• PBR-2015-02594 - List of citizens in Asia who had applied for Canadian Travel Visas was shared with the host government in error. Reported to the Privacy Commissioner.
• PBR-2016-00636 - Two passport applications missing from mission in Santiago, Chile. Reported to the Privacy Commissioner.
• PBR-2016-00640 - One passport missing from embassy in UAE. Reported to Privacy Commissioner.
• PBR-2016-00641 - Loss of one cancelled Emergency Travel Document at High Commission in Nairobi, Kenya. Reported to Privacy Commissioner.
• PBR-2016-01147 - Email sent to multiple Locally Engaged Staff at mission in Washington D.C., USA regarding a grievance filing was addressed so that all recipients of the email could see the names of other individuals involved in the grievance. Reported to the Privacy Commissioner.
• PBR-2016-01307 - One passport missing from mission in Guatemala City, Guatemala. Reported to the Privacy Commissioner.
• PBR-2016-01374 - Email containing personal information of client in South Africa sent from the Emergency Watch Desk in HQ to a third party by mistake. Reported to the Privacy Commissioner.
• PBR-2016-01586 - Unauthorized disclosure of personal information of a consular client to a family member. Reported to the Privacy Commissioner.
• PBR-2016-01593 - One expired passport and supporting documentation mailed to incorrect client at mission in Tel Aviv, Israel. Reported to the Privacy Commissioner.

Privacy Impact Assessment (PIA)

Global Affairs Canada completed two privacy impact assessments (PIA) in FY 2016-2017.

• The Consular Services Case Management System (COSMOS) PIA examined privacy risks related to the use of the COSMOS in support of the management and delivery of consular services.  The scope of the PIA was limited to the COSMOS, more specifically, its business and operational processes. The assessment identified 8 potential risks and corresponding strategies to mitigate these risks.
• The Administrative Investigations Program PIA examined risks related to the Department’s investigation of alleged misconduct by employees, contractors, vendors or locally engaged staff. The assessment identified two potential risks and corresponding strategies to mitigate these.

Disclosure of Personal Information

Subsection 8(2) of the Privacy Act provides that “personal information under the control of a government institution may be disclosed” without consent under certain specific circumstances.

Subsection 8(2)(m):

Personal information may be disclosed “for any purpose where, in the opinion of the head of the institution,

(i) the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure, or

(ii) disclosure would clearly benefit the individual to whom the information relates.”

During the 2016-2017 fiscal year, Global Affairs Canada made a total of 55 disclosures pursuant to subsection 8(2)(m). In 5 of the 55 total disclosures, GAC determined that the public interest in disclosing personal information clearly outweighed any invasion of privacy that could result. All other disclosures were determined to clearly benefit the individual to whom the information relates.

Disclosures pursuant to subsection 8(2)(m)(i): 3 disclosures were made in the interest of public safety, whereas 2 disclosures were made to assist with investigations.

Disclosures pursuant to subsection 8(2)(m)(ii): 5 disclosures were made to notify the relevant authorities, or family, of an individual’s detainment or arrest abroad; 4 disclosures were made in an effort to locate individuals in distress; 6 disclosures related to advising local authorities or agencies regarding child welfare cases; 4 disclosures were made in an effort to assist with repatriation of an individual to Canada; and finally, 31 disclosures were made to either the families, friends or legal counsel of individuals requiring medical assistance.

All notifications to the Privacy Commissioner of Canada occurred after the disclosures were made. A recent change in procedure requires the Department to include the names of individuals subject to the disclosures under paragraph 8(2)(m) in the notifications to the Privacy Commissioner.  This resulted in some delays in our notifications and as of March 31st 2017, a number of disclosures of personal information under paragraph 8(2)(m) of the Act have not yet been reported to the Privacy Commissioner. We are currently preparing our notifications to the Privacy Commissioner to ensure we are complying with our obligations pursuant to 8(5) of the Privacy Act.

Annex A: Designation Orders

Privacy Act Designation Order

The Minister of Foreign Affairs, pursuant to section 73 of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons acting in those positions, to exercise the powers and perform the duties and functions of the Minister of Foreign Affairs as the head of a Government institution under the sections of the Act set out after each position in the schedule. This designation replaces the designation dated October 2, 2009.

Schedule

Position

1. Deputy Minister of Foreign Affairs (all sections)
2. Deputy Minister of International Trade (all sections)
3. Deputy Minister of International Development (all sections)
4. Associate Deputy Minister of Foreign Affairs (all sections)
5. Assistant Deputy Minister, Consular Services (pursuant only to paragraph 8(2)(m) as it relates to public interest disclosure)
6. Heads of Mission (pursuant only to paragraph 8(2)(m) as it relates to public interest disclosure)
7. Director General, Corporate Secretariat (all sections)
8. Director, Access to Information and Privacy Protection Division (all sections)
9. Deputy Directors, Access to Information and Privacy Protection Division (all sections)

The Honourable Chrystia Freeland, P.C., M.P.
Ottawa, July 04, 2017

Annex B: Department of Foreign Affairs, Trade and Development 2016-2017 Statistical Report

Statistical Report on the Privacy Act

Name of institution: Global Affairs Canada

Reporting period: 2016-04-01 to 2017-03-31

Part 1 - Requests under the Privacy Act

Part 2 - Requests Closed During the Reporting Period

2.1 Disposition and completion time

2.2 Exemptions

2.3 Exclusions

2.4 Format of information released

2.5 Complexity

2.5.1 Relevant pages processed and disclosed

2.5.2 Relevant pages processed and disclosed by size of requests

2.5.3 Other complexities

2.6 Deemed refusals

2.6.1 Reasons for not meeting statutory deadline

2.6.2 Number of days past deadline

2.7 Requests for translation

Part 3 - Disclosures Under Subsection 8(2) and 8(5)

Part 4 - Requests for Correction of Personal Information and Notations

Part 5 - Extensions

5.1 Reasons for extensions and disposition of requests

5.2 Length of extensions

Part 6 - Consultations Received From Other Institutions and Organizations

6.1 Consultations received from other government institutions and organizations

6.2 Recommendations and completion time for consultations received from other government institutions

6.3 Recommendations and completion time for consultations received from other organizations

Part 7 - Completion Time of Consultations on Cabinet Confidences

7.1 Requests with Legal Services

7.2 Requests with Privy Council Office

Part 8 - Complaints and Investigations Notices Received

Part 9 - Privacy Impact Assessments (PIAs)

Part 10 - Resources Related to the Privacy Act

10.1 Costs

10.2 Human Resources

Note: Enter values to two decimal places.