Annual Report to Parliament on the Administration of the Privacy Act 2018-2019

Table of Contents

• Introduction
  • Purpose of the Privacy Act
  • Mandate of the Institution
  • Organizational Structure
  • Delegated Authorities
  • Highlights of the Report
• Administration of Requests
  • Privacy Requests
  • Disposition of Completed Requests
  • Exemptions and Exclusions
  • Relevant Pages Processed and Disclosed
  • Extensions
  • Consultations Received from Other Institutions
• Internal Operations
  • Training and Development
  • New or Revised Policies, Guidelines and Procedures
  • Complaints, Audits, and Investigations
  • Monitoring Processing Times
• Administration of Personal Information
  • Privacy Breaches
  • Privacy Impact Assessments (PIA)
  • Disclosure of Personal Information
• Annex A: Designation Order
• Annex B: Global Affairs Canada 2018-2019 Statistical Report

Introduction

We are pleased to table the Annual Report to Parliament on the administration of the Privacy Act for fiscal year 2018-2019, as required under section 72 of the Act.

NOTA: The Department is referred to in this report as Global Affairs Canada. Its legal name, however, remains the Department of Foreign Affairs, Trade and Development, as set out in the Department of Foreign Affairs, Trade and Development Act.

Purpose of the Privacy Act

The Privacy Act provides Canadian citizens and individuals present in Canada with the right to seek access to their personal information that is held by the federal government. It also governs the collection, use, disclosure, retention, and disposal of personal information.

Mandate of the Institution

Global Affairs Canada is Canada’s face to the world, working to advance Canada’s political and economic interests in the international community as well as to apply Canadian experience to help address global issues.

The Department's legal mandate, as set out in the Department of Foreign Affairs, Trade and Development Act, SC 2013, c. 33, s. 174, is to:

• conduct all diplomatic and consular relations on behalf of Canada;
• conduct all official communication between the Government of Canada and the government of any other country and between the Government of Canada and any international organization;
• conduct and manage international negotiations as they relate to Canada;
• coordinate Canada’s international economic relations;
• foster the expansion of Canada’s international trade and commerce;
• foster sustainable international development and poverty reduction in developing countries and provide humanitarian assistance during crises;
• coordinate the direction given by the Government of Canada to the heads of Canada’s diplomatic and consular missions;
• manage Canada’s diplomatic and consular missions;
• administer the foreign service of Canada; and
• foster the development of international law and its application in Canada’s external relations.

The Minister of Foreign Affairs is also responsible for the Export and Import Permits Act, RSC 1985, c. E-19, which authorizes the government to control and monitor the trans-border flow of specified goods, and for the Special Economic Measures Act, SC 1992, c. 17, which authorizes the government to apply economic sanctions in response to a serious threat to international peace and security.

The Department also provides administrative support to other federal government institutions with personnel abroad.

Organizational Structure

The Access to Information and Privacy Protection (ATIP) Division is responsible for the administration of the Privacy Act, including the processing of requests and consultations. The Director of the ATIP Division reports to the Corporate Secretary, who in turn reports to the Deputy Minister of Foreign Affairs.

In 2018-2019, the ATIP Division employed 57 Full-Time Equivalents to fulfill the Department’s obligations under both the Access to Information Act and the Privacy Act. During most of the fiscal year, the Division’s staff included up to five consultants and one student.

The Division’s structure consists of a Director, five Deputy Directors, eight Team Leaders, one Senior Advisor, one Manager, one Administrative Assistant, forty-five Analysts, two System Administrators, and seven Clerks. This list includes the Privacy Policy and Governance Team which is comprised of a Team Leader and three Analysts who work exclusively on the application of the Privacy Act. It also includes one Team Leader and five Analysts dedicated to the Intake Team pilot project, which was launched in November 2018. Not all positions in the Division were staffed during the reporting period.

Delegated Authorities

Consistent with Section 73 of the Privacy Act, the Minister’s authority is delegated to the Deputy Ministers, to the Corporate Secretary, to the Director of the ATIP Division, and to the Deputy Directors of the ATIP Division. It is also delegated to Heads of Mission for the purpose of public interest disclosures under section 8(2)(m) of the Act.

Highlights of the Report

Number of requests:

In fiscal year 2018-2019, the number of requests addressed to the Department under the Privacy Act increased by 65% compared to the previous reporting period and by 14% compared with the average of the previous three reporting periods. The number of requests completed by the Department increased by 58% compared to the previous reporting period.

Deemed refusal rate:

The Department’s deemed refusal rate in 2018-19 (i.e., the percentage of requests under the Privacy Act that received a response beyond the deadline required under the Act) was 39%. This represented a 6% increase over the deemed refusal rate for the previous reporting period and a 9% increase over the average of the previous three reporting periods.

Staffing:

In 2018-19, the Division had approximately 7 Full-Time Equivalents (FTE) working on Privacy Protection requests and Privacy Policies. This represented a 13% decrease over the previous reporting period. The Department took measures to improve its performance by staffing the ATIP Division with additional resources.

Innovation to improve operational efficiency:

During the reporting period, the ATIP Division continued the process of reviewing and streamlining its operations. A very significant result of this process has been the Intake Team pilot project. The purpose of this team is to triage incoming requests and consultations, re-scope the requests and retrieve the relevant documents in order to alleviate the overall administrative burden for analysts. Early statistics indicate that analyst productivity will be increased by over 30%. The project was launched in November 2018 and is ongoing.

Administration of Requests

The following section explains key elements of the Statistical Report to the Treasury Board Secretariat provided in annex B.

Privacy Requests

In 2018-2019, the Department received 142 requests for personal information under the Privacy Act. In addition, 35 requests were carried over from the previous fiscal year, for a total of 177 active requests.

During the reporting period, 109 requests were completed. As a result, 68 active files were carried over to the next reporting period.

Disposition of Completed Requests

The disposition of requests for personal information received during the reporting period was as follows:

Exemptions and Exclusions

The exemptions under the Act most commonly applied by the Department during the reporting period were section 26 [information about another individual] (applied to 40 requests) and 27 [solicitor-client privilege] (applied to 9 requests).

Relevant pages processed and disclosed

During the reporting period, the Department disclosed 11,319 pages of the 14,106 relevant pages processed.

Extensions

During the reporting period, the Department claimed 29 extensions pursuant to subsection 15(a)(i) and 7 extensions pursuant to subsection 15(a)(ii).

Consultations received from other institutions

When a request addressed to a Department contains records that are of interest to another government institution, the Department consults the ATIP Coordinator of that institution accordingly.

Given its mandate and various responsibilities at the international level, the Department played a key role under the Privacy Act on behalf of other institutions of the Government of Canada. Specifically, the Department consulted foreign governments and organizations on behalf of other federal government institutions when the latter needed to determine whether they could release records that originated abroad. During the reporting period, the Department received 14 new consultations under the Act, all but one from other federal government institutions. In total, the Department completed 14 consultations.

Internal Operations

Training and Development

During fiscal year 2018-2019, the ATIP Division continued to provide its analysts with the necessary training and tools to perform their jobs effectively, notably by ensuring that all staff members had learning plans in their performance evaluation agreements.

The ATIP Division benefited from its Professional Development Program, which allows the Department to train and promote its analysts from junior to senior levels. This program has been very successful in addressing recruitment, retention and succession planning issues. At the end of the fiscal year, 14 employees were in the program and further recruitment was underway.

The ATIP Division continues to develop tools and guidance material to assist and inform the Department. In an effort to foster meaningful dialogue with internal clients, a Departmental outreach event was held for Right to Know Week. In addition, during this reporting period, 685 employees completed an online interactive ATIP awareness tutorial, developed in collaboration with the Canadian Foreign Service Institute. Internal training initiatives for the ATIP Division also include the ATIP mentorship program, a legal workshop on jurisprudence, and guest speakers from the ATIP community.

To assist Consular officials in understanding their roles and responsibilities vis-à-vis the Access to Information Act and the Privacy Act in the context of providing consular services to Canadians, a specific training program was delivered to 66 employees on Confidentiality and Personal Information.

In order to decentralize the responsibility of training among teams, the ATIP Division introduced guidelines for delivering ATIP training. This yielded benefits such as relationship-building between analysts and subject matter experts, skill-building opportunities for analysts in the Professional Development Program, and ensured continuous training offerings throughout the Department. During the reporting period, at least 25 formal ATIP training sessions were delivered to approximately 199 employees.

New or Revised Policies, Guidelines and Procedures

As a result of the Lean initiatives of 2017-18, efforts have been made to foster more effective dialogue between the ATIP Division and subject matter experts. A yearlong rationale campaign has included outreach initiatives, and the provision of helpful statistics in order to identify areas for improvement. For example, the monthly Bureau Performance Report is now circulated by the Corporate Secretary and encompasses all bureaus whose internal deadlines have been missed. This has yielded a significant response from bureaus, and a renewed awareness of tasking deadlines.

With the assistance of the Senior Policy and Governance Advisor, the Intake Team pilot project has centralized administrative functions, and allows analysts to focus their efforts on the review of records. The Intake Team also serves as a training unit and assists in the onboarding of new employees. Once new employees have completed their term with the Intake Team, they are transitioned to regular portfolios. Upon this transition, they are further supported by the ATIP Division’s Mentorship Program, another Lean initiative.

During the Reporting Period, the Privacy Policy Group has undertaken significant efforts to improve its Information Management practices. The Case Management configuration was adapted and documented to improve oversight and operations. It initiated a study to adopt new software to better track correspondence and tasks. Practices have been streamlined to reduce administrative burden.

The Department continued to place a heavy emphasis on educating departmental officials on their ATIP roles and responsibilities to ensure compliance and efficiencies.

Complaints, Audits, and Investigations

During the reporting period, the Department received 17 new complaints. In addition, 7 complaints were carried over from the previous fiscal year. The Department closed 4 complaints, of which two had been opened in a previous fiscal year. Consequently, 13 complaints were carried over to the next fiscal year.

Of the 17 complaints received in the reporting period:

• 3 related to the exemptions used by the Department when responding to a request under the Privacy Act.
• 6 pertain to delays in providing a response to a requester.
• 5 alleged deemed refusal.
• 1 alleged that Global Affairs Canada contravened the use and disclosure provision of the Privacy Act;
• 2 alleged that the Department had improperly disclosed personal information.

Of the 4 complaints closed during the reporting period:

• 1 complaint for deemed refusal was discontinued.
• 2 complaints dealt with the exemptions used by the Department under the Privacy Act. One was deemed to be not well-founded by the Office of the Privacy Commissioner of Canada while the other was deemed well founded.
• 1 complaint alleged inappropriate collect of information and was deemed well founded.

The Department took the issue of complaints seriously and addressed any problems that were identified, notably through training. The Division had a dedicated officer dealing with the resolution of complaints.

Monitoring Processing Times

The Department monitored the processing time for requests and tracked their status. The tools in place for this purpose included:

• An Active Tasking Report (weekly): This report identified all current active taskings within the Department. For each tasking, it included the responsible area and bureau, type of tasking, a summary of the request, and the name of the assigned analyst. This report was provided to all Assistant Deputy Ministers and Directors General in the Department.
• A File Discussion (weekly): This meeting included all managers in the ATIP Division. It provided an opportunity to monitor the status of all active requests and resolve issues that could impede their timely completion.
• A new weekly report was designed to monitor analyst performance and help with workload distribution.
• The monthly Bureau Performance Report was introduced to increase management awareness of departmental areas experiencing longer delays in responding to ATIP tasks.

Administration of Personal Information

Privacy Breaches

During the reporting period, the Department reported one material privacy breach:

PBR-2017-01189: Information relating to the Prime Minister’s visit to the National Governors’ Conference in Rhode Island and a staff member’s work-related/personal items were stolen from the trunk of the staff member’s rental car. The breach was reported to the Privacy Commissioner and to the Information and Privacy Policy Division of the Treasury Board Secretariat. In consultation with RCMP/departmental security, they are in agreement that the incident does not constitute a security breach. Various measures were taken to contain the material breach including informing the department’s Access to Information and Privacy Policy section, advising Washington’s IT section, remotely wiping and disabling electronics, and advising the GAC HQ security and Washington Mission Security. As part of a larger security initiative, all mission staff will be re-briefed on security protocols at the mission, including a discussion on security protocols for events outside of the mission to limit any further potential for a breach.

Privacy Impact Assessments (PIA)

The Department completed three (3) privacy impact assessments in fiscal year 2018-2019:

• The Diplomatic Registration System examined the privacy risks of the system for the accreditation/registration of foreign representatives and their family members when coming to Canada. The assessment identified potential risks and corresponding strategies to mitigate these risks.

• The Case, Contact, and Emergency Management (CCEM) Solution project PIA examined the privacy risks associated with the modernization of the COSMOS system with the introduction of CCEM and GAC’s broader “Going Digital” strategy. The assessment identified potential risks and corresponding strategies to mitigate these risks.

• The Ministerial Appointment activity PIA examined the privacy risks associated with the appointment process of ministers at Global Affairs Canada. The assessment identified potential risks and corresponding strategies to mitigate these risks.

Disclosure of Personal Information

Subsection 8(2) of the Privacy Act provides that “personal information under the control of a government institution may be disclosed” without consent under certain specific circumstances.

During fiscal year 2018-2019, the Department made a total of 32 disclosures pursuant to subsection 8(2)(m) of the Privacy Act. In 6 cases, the Department determined that the public interest in disclosing personal information clearly outweighed any invasion of privacy that could result. All other disclosures were determined to clearly benefit the individual to whom the information related.

Disclosures pursuant to subparagraph 8(2)(m)(i):

• 7 disclosures were made in the interest of public safety.
• Disclosures pursuant to subparagraph 8(2)(m)(ii):
• 1 disclosure was made to notify the relevant authorities of an individual’s detainment and arrest abroad;
• 4 disclosures were related to advising local authorities or agencies regarding child welfare cases;
• 9 disclosures were made in an effort to assist with repatriation of an individual to Canada;
• 8 disclosures were made to either the family, friend, doctor, or legal counsel of an individual requiring medical assistance; and
• 3 disclosures were made to advise relevant authorities in the interest of the individual’s safety.

32 disclosures pursuant to paragraph 8(2)(m) were made during fiscal year 2018-2019 and a total of 21 notifications were sent out to the Privacy Commissioner of Canada. The Division is currently in the process of sending out the remainder of notifications to the Privacy Commissioner of Canada for the disclosures made during the fiscal year 2018-2019.

Annex A: designation order

Privacy Act Designation Order

The Minister of Foreign Affairs, pursuant to section 73 of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons acting in those positions, to exercise the powers and perform the duties and functions of the Minister of Foreign Affairs as the head of a Government institution under the sections of the Act set out after each position in the schedule. This designation replaces the designation dated October 2, 2009.

Schedule

Position

1. Deputy Minister of Foreign Affairs (all sections)
2. Deputy Minister of International Trade (all sections)
3. Deputy Minister of International Development (all sections)
4. Associate Deputy Minister of Foreign Affairs (all sections)
5. Assistant Deputy Minister, Consular Services (pursuant only to paragraph 8(2)(m) as it relates to public interest disclosure)
6. Heads of Mission (pursuant only to paragraph 8(2)(m) as it relates to public interest disclosure)
7. Director General, Corporate Secretariat (all sections)
8. Director, Access to Information and Privacy Protection Division (all sections)
9. Deputy Directors, Access to Information and Privacy Protection Division (all sections)

The Honourable Chrystia Freeland, P.C., M.P.
Ottawa, July 04, 2017

Annex B: Global Affairs Canada 2018-2019 Statistical Report

Statistical Report on the Privacy Act

Name of institution: Global Affairs Canada

Reporting period: 2018-04-01 to 2019-03-31

Part 2: Requests Closed During the Reporting Period

2.5 Complexity

2.6 Deemed refusals

Part 3: Disclosures Under Subsections 8(2) and 8(5)

Part 4: Requests for Correction of Personal Information and Notations

Part 5: Extensions

Part 6: Consultations Received From Other Institutions and Organizations

Part 7: Completion Time of Consultations on Cabinet Confidences

Part 8: Complaints and Investigations Notices Received

Part 9: Privacy Impact Assessments (PIAs)

Part 10: Resources Related to the Privacy Act