Annual Report to Parliament on the Administration of the Privacy Act - 2017-2018

Table of Contents

• Introduction
  • Purpose of the Privacy Act
  • Mandate of the Institution
  • Organizational Structure
  • Delegated Authorities
  • Highlights of the Report
• Administration of Requests
  • Privacy Requests
  • Disposition of Completed Requests
  • Exemptions and Exclusions
  • Relevant Pages Processed and Disclosed
  • Extensions
  • Consultations Received from Other Institutions
• Internal Operations
  • Training and Development
  • New or Revised Policies, Guidelines and Procedures
  • Complaints, Audits, and Investigations
  • Monitoring Processing Times
• Administration of Personal Information
  • Privacy Breaches
  • Privacy Impact Assessments (PIA)
  • Disclosure of Personal Information
• Annex A: Designation Order
• Annex B: Global Affairs Canada 2017-2018 Statistical Report

Introduction

We are pleased to table the Annual Report to Parliament on the administration of the Privacy Act for fiscal year 2017-2018, as required under section 72 of the Act.

NOTA: The Department is referred to in this report as Global Affairs Canada. Its legal name, however, remains the Department of Foreign Affairs, Trade and Development, as set out in the Department of Foreign Affairs, Trade and Development Act.

Purpose of the Privacy Act

The Privacy Act provides Canadian citizens and individuals present in Canada with the right to seek access to their personal information that is held by the federal government. It also governs the collection, use, disclosure, retention, and disposal of personal information.

Mandate of the Institution

Global Affairs Canada is Canada’s face to the world, working to advance Canada’s political and economic interests in the international community as well as to apply Canadian experience to help address global issues.

The Department's legal mandate, as set out in the Department of Foreign Affairs, Trade and Development Act, SC 2013, c. 33, s. 174, is to:

• conduct all diplomatic and consular relations on behalf of Canada;
• conduct all official communication between the Government of Canada and the government of any other country and between the Government of Canada and any international organization;
• conduct and manage international negotiations as they relate to Canada;
• coordinate Canada’s international economic relations;
• foster the expansion of Canada’s international trade and commerce;
• foster sustainable international development and poverty reduction in developing countries and provide humanitarian assistance during crises;
• coordinate the direction given by the Government of Canada to the heads of Canada’s diplomatic and consular missions;
• manage Canada’s diplomatic and consular missions;
• administer the foreign service of Canada; and
• foster the development of international law and its application in Canada’s external relations.

The Minister of Foreign Affairs is also responsible for the Export and Import Permits Act, RSC 1985, c. E-19, which authorizes the government to control and monitor the trans-border flow of specified goods, and for the Special Economic Measures Act, SC 1992, c. 17, which authorizes the government to apply economic sanctions in response to a serious threat to international peace and security.

The Department also provides administrative support to other federal government institutions with personnel abroad.

Organizational Structure

The Access to Information and Privacy Protection (ATIP) Division is responsible for the administration of the Privacy Act, including the processing of requests and consultations. The Director of the ATIP Division reports to the Corporate Secretary, who in turn reports to the Deputy Minister of Foreign Affairs.

In 2017-2018, the ATIP Division employed 62 Full-Time Equivalents to fulfill the Department’s obligations under both the Access to Information Act and the Privacy Act. During most of the fiscal year, the division’s staff included up to 7 consultants and two students.

The Division’s structure consists of a Director, five Deputy Directors, nine Team Leaders, one Senior Advisor, one Manager, one Administrative Assistant, forty-four Analysts, two System Administrators, and seven Clerks. This list includes the Privacy Policy and Governance Team which is comprised of a Team Leader and three Analysts who work exclusively on the application of the Privacy Act. Not all positions in the Division were staffed during the reporting period.

The ATIP Division’s work includes processing requests to access personal information held by the Department and consultations received from other government departments, as well as providing advice on privacy issues to internal and external stakeholders and training to departmental staff.

Delegated Authorities

Consistent with Section 73 of the Privacy Act, the Minister’s authority is delegated to the Deputy Ministers, to the Corporate Secretary, to the Director of the ATIP Division, and to the Deputy Directors of the ATIP Division. It is also delegated to Heads of Mission for the purpose of public interest disclosures under section 8(2)(m) of the Act.

Highlights of the Report

NUMBER OF REQUESTS:

In fiscal year 2017-2018, the number of requests addressed to the Department under the Privacy Act declined by 44% compared to the previous reporting period and by 36% compared with the average of the previous three reporting periods. The number of requests completed by the Department declined by 59% compared to the previous reporting period.

DEEMED REFUSAL RATE:

The Department’s deemed refusal rate in 2017-18 (i.e. the percentage of requests under the Privacy Act that received a response beyond the deadline required under the Act) was 33%. This represented a 10% increase over the deemed refusal rate for the previous reporting period and a 6% increase over the average of the previous three reporting periods.

INNOVATION TO IMPROVE OPERATIONAL EFFICIENCY:

During the reporting period, the ATIP Division undertook a systematic and on-going process to review and streamline its operations. This process involved the identification of specific reforms calculated to improve efficiency, as well as the creation of project teams responsible for the implementation of these reforms. The benefits of these initiatives are expected to be felt during the next fiscal year. In addition, the Division identified a position for a Senior ATIP Policy and Governance Advisor. A key task for this position is to promote improved procedures and training to support the application of the Privacy Act.

Administration of Requests

The following section explains key elements of the Statistical Report to the Treasury Board Secretariat provided in annex B.

Privacy Requests

In 2017-2018, the Department received 86 requests for personal information under the Privacy Act. In addition, 18 requests were carried over from the previous fiscal year, for a total of 104 active requests.

During the reporting period, 69 requests were completed. As a result, 35 active files were carried over to the next reporting period.

Disposition of Completed Requests

The disposition of requests for personal information received during the reporting period was as follows:

Exemptions and Exclusions

The only exemptions under the Privacy Act used by the Department during the reporting period were section 26 [information about another individual] (applied to 29 requests) and 27 [solicitor-client privilege] (applied to 3 requests).

Relevant Pages Processed and Disclosed

During the reporting period, the Department disclosed 6,797 pages of the 8,932 relevant pages processed.

Extensions

During the reporting period, the Department claimed 27 extensions pursuant to subsection 15(a)(i) and 2 extensions pursuant to subsection 15(a)(ii).

Consultations Received from Other Institutions

When a request addressed to the Department contained records that were of interest to another institution, the Department consulted the ATIP Coordinator of that institution.

Given its mandate and various responsibilities at the international level, the Department played a key role under the Privacy Act on behalf of other institutions of the Government of Canada. Specifically, the Department consulted foreign governments and organizations on behalf of other federal government institutions when the latter needed to determine whether they could release records that originated abroad. During the reporting period, the Department received 3 new consultations under the Act, all from other federal government institutions. In total, the Department completed 7 consultations.

Internal Operations

Training and Development

During fiscal year 2017-2018, the ATIP Division continued to provide its analysts with the necessary training and tools to perform their jobs effectively, notably by ensuring that all staff members had learning plans in their performance evaluation agreements.

The ATIP Division benefited from its Professional Development Program, which allows the Department to train and promote its analysts from junior to senior levels. This program has been very successful in addressing recruitment, retention and succession planning issues. At the end of the fiscal year, 17 employees were in the program and further recruitment was underway.

The ATIP Division continued to broaden its use of internal collaboration tools to share information, best practices, and facilitate cooperation across the Department. A structured, department-wide, ATIP awareness program was in place and included: quarterly formal training sessions, pre-posting training sessions to prepare employees for their work at Canada’s missions abroad, and individualized training sessions. In addition, during the reporting period, 182 employees completed an online interactive ATIP awareness tutorial, developed in collaboration with the Canadian Foreign Service Institute.

To assist Consular Officers in understanding their roles and responsibilities vis-à-vis the Access to Information Act and the Privacy Act in the context of providing consular services to Canadians, a specific training program was delivered using scenario-based practical exercises. Similarly, a tailored training program was offered to the staff of the Summits Management Office in preparation for Canada’s role as host of the 2018 G7 Summit.

The Division’s new Senior ATIP Policy and Governance Advisor was tasked with organizing and delivering training on the application of the Privacy Act for departmental employees, as well as training to deepen the expertise of staff in the Division. When the Senior Advisor position was unoccupied, training for the Department was delivered by a roster of experienced members from the Division.

During the reporting period, at least 33 formal ATIP training sessions were delivered to approximately 532 employees. The Department’s ATIP Division continuously strove to develop and refine its training tools through comments from employees participating in these training sessions.

In addition, the Division’s Privacy Policy and Governance Team delivered 2 formal training sessions to approximately 24 participants. These sessions focused specifically on privacy policy issues, such as the principles that govern the unauthorized disclosure of personal information under paragraph 8(2) of the Privacy Act.

New or Revised Policies, Guidelines and Procedures

During the reporting period, the ATIP Division’s Privacy Policy and Governance Team undertook several initiatives to improve the implementation of privacy principles within the Department. These included:

• implementing new internal procedures to guide the handling of privacy cases;
• introducing an improved questionnaire that allows programs in the Department to provide relevant information about how they plan on handling personal information and to request guidance from the Team; and
• updating the Department’s internal reference tools so that staff are better equipped to handle privacy-related issues (e.g. outlining the steps to take and the relevant contact points when dealing with a privacy breach).

In September 2017, the Division launched a comprehensive review of its ATIP procedures using the LEAN methodology. By the end of the reporting period, several project teams were finalising detailed plans to implement reforms in the next fiscal year. Initiatives under consideration included internal administrative efficiency enhancements (e.g. eliminating redundant verifications of documents) and wider efforts to change departmental culture (e.g. ensuring that divisions consulted on an ATIP request fully justify any suggested exemptions).

The new Senior ATIP Policy and Governance Advisor position was also entrusted with identifying ways to improve divisional performance. Notably, the tasks assigned to the Senior Advisor include the complete overhaul of the Division’s internal guidelines. The position was vacant at the end of the reporting period, but the project is expected to be implemented once staffing is completed in the next fiscal year.

The Department continued to place a heavy emphasis on educating departmental officials on their ATIP roles and responsibilities to ensure compliance and efficiencies.

Complaints, Audits, and Investigations

During the reporting period, the Department received 3 new complaints. In addition, 12 complaints were carried over from the previous fiscal year. The Department closed 8 complaints, all of which had been opened in previous years. Consequently, 7 complaints were carried over to the next fiscal year.

Of the 3 complaints received in the reporting period:

• 1 dealt with the exemptions used by the Department when responding to a request under the Privacy Act; 
• 1 dealt with a delay in providing a response to a requester; and
• 1 alleged that the Department had improperly disclosed personal information.

Of the 8 complaints closed during the reporting period:

• 4 related to incomplete searches for personal information. From this group, 1 complaint was deemed to be well-founded by the Office of the Privacy Commissioner of Canada and was resolved. The other 3 complaints were deemed not well-founded;
• 3 complaints dealt with a delay in providing a response to a requester. All 3 were deemed to be not well-founded by the Office of the Privacy Commissioner of Canada; and
• 1 complaint dealt with the exemptions used by the Department under the Privacy Act and was deemed to be not well-founded by the Office of the Privacy Commissioner of Canada.

The Department took the issue of complaints seriously and addressed any problems that were identified, notably through training. The Division had a dedicated officer dealing with the resolution of complaints.

Monitoring Processing Times

The Department monitored the processing time for requests under the Privacy Act using the weekly Active Tasking Report. This report identified all current active taskings within the Department. For each tasking, it included the responsible area and bureau, type of tasking, a summary of the request, and the name of the assigned analyst. This report was provided to all Assistant Deputy Ministers and Directors General in the Department.

Administration of Personal Information

Privacy Breaches

• PBR-2017-01813 – A master control sheet for a charitable fundraising initiative with the names of employee and their contributions was sent in error by email to all Deputy Ministers, Assistant Deputy Ministers, Chiefs of Staff, and Branch fundraising ambassadors. The breach was reported to the Privacy Commissioner and to the Information and Privacy Policy Division of the Treasury Board Secretariat. A full review of the process used to download the information from the fundraising website was undertaken. New procedures were implemented and additional training provided to staff to ensure privacy would be respected and to limit any further potential for a privacy breach.

Privacy Impact Assessments (PIA)

The Department did not complete any privacy impact assessments in fiscal year 2017-2018.

Disclosure of Personal Information

Subsection 8(2) of the Privacy Act provides that “personal information under the control of a government institution may be disclosed” without consent under certain specific circumstances.

During fiscal year 2017-2018, the Department made a total of 40 disclosures pursuant to subsection 8(2)(m) of the Privacy Act. In 6 cases, the Department determined that the public interest in disclosing personal information clearly outweighed any invasion of privacy that could result. All other disclosures were determined to clearly benefit the individual to whom the information related.

Disclosures pursuant to subparagraph 8(2)(m)(i):

• 3 disclosures were made in the interest of public safety;
• 3 disclosures were made to assist with investigations.

Disclosures pursuant to subparagraph 8(2)(m)(ii):

• 1 disclosure was made to notify the relevant authorities of an individual’s detainment and arrest abroad;
• 5 disclosures were made in an effort to locate individuals in distress;
• 2 disclosures were related to advising local authorities or agencies regarding child welfare cases;
• 10 disclosures were made in an effort to assist with repatriation of an individual to Canada;
• 13 disclosures were made to either the family, friend, doctor, or legal counsel of an individual requiring medical assistance;
• 3 disclosures were made to advise relevant authorities in the interest of the individual’s safety.

In all cases, the Privacy Commissioner of Canada was notified after the disclosures were made.

Although 40 disclosures pursuant to paragraph 8(2)(m) were made during fiscal year 2017-2018, a total of 109 notifications were sent out to the Privacy Commissioner of Canada. This discrepancy is explained by the Department’s efforts to address a backlog of disclosures that should have been notified to the Privacy Commissioner during previous reporting periods.

Annex A: Designation Order

Privacy Act Designation Order

The Minister of Foreign Affairs, pursuant to section 73 of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons acting in those positions, to exercise the powers and perform the duties and functions of the Minister of Foreign Affairs as the head of a Government institution under the sections of the Act set out after each position in the schedule. This designation replaces the designation dated October 2, 2009.

Schedule

Position

1. Deputy Minister of Foreign Affairs (all sections)
2. Deputy Minister of International Trade (all sections)
3. Deputy Minister of International Development (all sections)
4. Associate Deputy Minister of Foreign Affairs (all sections)
5. Assistant Deputy Minister, Consular Services (pursuant only to paragraph 8(2)(m) as it relates to public interest disclosure)
6. Heads of Mission (pursuant only to paragraph 8(2)(m) as it relates to public interest disclosure)
7. Director General, Corporate Secretariat (all sections)
8. Director, Access to Information and Privacy Protection Division (all sections)
9. Deputy Directors, Access to Information and Privacy Protection Division (all sections)

The Honourable Chrystia Freeland, P.C., M.P.
Ottawa, July 04, 2017

Annex B: Global Affairs Canada 2017-2018 Statistical Report

Statistical Report on the Privacy Act

Name of institution: Global Affairs Canada

Reporting period: 2017-04-01 to 2018-03-31

Part 1: Requests Under the Privacy Act

Part 2: Requests Closed During the Reporting Period

2.5 Complexity

2.6 Deemed refusals

Part 3: Disclosures Under Subsections 8(2) and 8(5)

Part 4: Requests for Correction of Personal Information and Notations

Part 5: Extensions

Part 6: Consultations Received From Other Institutions and Organizations

Part 7: Completion Time of Consultations on Cabinet Confidences

Part 8: Complaints and Investigations Notices Received

Part 9: Privacy Impact Assessments (PIAs)

Part 10: Resources Related to the Privacy Act