Annual Report to Parliament on the Administration of the Privacy Act 2019-2020

Table of contents

• Introduction
  • Purpose of the Privacy Act
  • Mandate of the institution
  • Organizational structure
  • Delegated authorities
  • Highlights of the report
• Administration of requests
  • Privacy requests
  • Disposition of completed requests
  • Exemptions and exclusions
  • Relevant pages processed and disclosed
  • Extensions
  • Consultations received from other institutions
• Internal operations
  • Training and development
  • New or revised policies, guidelines and procedures
  • Complaints, audits, and investigations
  • Monitoring processing times
• Administration of personal information
  • Privacy breaches
  • Privacy Impact Assessments (PIA)
  • Disclosure of personal information
  • Impact of COVID-19
• Annex A: Designation order
• Annex B: Global Affairs Canada 2019-2020 statistical report

Introduction

We are pleased to table the Annual Report to Parliament on the administration of the Privacy Act for fiscal year 2019-2020, as required under section 72 of the Act.

Nota: The Department is referred to in this report as Global Affairs Canada. Its legal name, however, remains the Department of Foreign Affairs, Trade and Development, as set out in the Department of Foreign Affairs, Trade and Development Act.

Purpose of the privacy act

The Privacy Act provides Canadian citizens and individuals present in Canada with the right to seek access to their personal information that is held by the federal government. It also governs the collection, use, disclosure, retention, and disposal of personal information.

Mandate of the institution

Global Affairs Canada is Canada’s face to the world, working to advance Canada’s political and economic interests in the international community as well as to apply Canadian experience to help address global issues.

The Department's legal mandate, as set out in the Department of Foreign Affairs, Trade and Development Act, SC 2013, c. 33, s. 174, is to:

• conduct all diplomatic and consular relations on behalf of Canada;
• conduct all official communication between the Government of Canada and the government of any other country and between the Government of Canada and any international organization;
• conduct and manage international negotiations as they relate to Canada;
• coordinate Canada’s international economic relations;
• foster the expansion of Canada’s international trade and commerce;
• foster sustainable international development and poverty reduction in developing countries and provide humanitarian assistance during crises;
• coordinate the direction given by the Government of Canada to the heads of Canada’s diplomatic and consular missions;
• manage Canada’s diplomatic and consular missions;
• administer the foreign service of Canada; and
• foster the development of international law and its application in Canada’s external relations.

The Minister of Foreign Affairs is also responsible for the Export and Import Permits Act, RSC 1985, c. E-19, which authorizes the government to control and monitor the trans-border flow of specified goods, and for the Special Economic Measures Act, SC 1992, c. 17, which authorizes the government to apply economic sanctions in response to a serious threat to international peace and security.

The Department also provides administrative support to other federal government institutions with personnel abroad.

Organizational structure

The Access to Information and Privacy Protection (ATIP) Division is responsible for the administration of the Privacy Act, including the processing of requests and consultations. The Director of the ATIP Division reports to the Corporate Secretary, who in turn reports to the Deputy Minister of Foreign Affairs.

In 2019-2020, the ATIP Division employed 59 Full-Time Equivalents to fulfill the Department’s obligations under both the Access to Information Act and the Privacy Act. During most of the fiscal year, the Division’s staff included up to five consultants and two student.

The Division’s structure consists of a Director, five Deputy Directors, eight Team Leaders, one Senior Advisor, one Manager, one Administrative Assistant, forty-four Analysts, one System Administrators, one Administrative Coordinator and seven Clerks. This list includes the Privacy Policy and Governance Team which is comprised of a Team Leader and three Analysts who work exclusively on the application of the Privacy Act. It also includes one Team Leader and five Analysts dedicated to the Intake Team, which was launched initially as a pilot project in November 2018. Not all positions in the Division were staffed during the reporting period.

Delegated authorities

Consistent with Section 73 of the Privacy Act, the Minister’s authority is delegated to the Deputy Ministers, to the Corporate Secretary, to the Director of the ATIP Division, and to the Deputy Directors of the ATIP Division. It is also delegated to Heads of Mission for the purpose of public interest disclosures under section 8(2)(m) of the Act.

Highlights of the report

Number of requests:

In fiscal year 2019-2020, the number of requests addressed to the Department under the Privacy Act decreased by 26% compared to the previous reporting period and by 17% compared with the average of the previous three reporting periods. The number of requests completed by the Department increased by 1% compared to the previous reporting period.

Deemed refusal rate:

The Department’s deemed refusal rate in 2019-20 (i.e., the percentage of requests under the Privacy Act that received a response beyond the deadline required under the Act) was 45%. This represented a 16% increase over the deemed refusal rate for the previous reporting period and a 42% increase over the average of the previous three reporting periods.

Staffing:

In 2019-20, the Division had approximately 10 Full-Time Equivalents (FTE) working on Privacy Protection requests and Privacy Policies. This represented a 37% increase over the previous reporting period. The Department took measures to improve its performance by staffing the ATIP Division with additional resources.

Innovation to improve operational efficiency:

During the reporting period, the ATIP Division has maintained its commitment to continuous improvement and innovation. Anchored by successfully piloted projects from previous years, the ATIP division has engaged a change-management consultant to advise in process modernization. The process modernization aims to further stream-line ATIP operations to ensure that the innovation, which began with LEAN training and the Intake Unit pilot project, continues in order to increase the department’s efficiency in meeting the information needs of Canadians.

In January of 2020, the ATIP Division began a telework pilot project within its access to information and privacy policy groups. By engaging with ATIP colleagues at other departments who had successful established telework initiatives, the division implemented a policy that has proved invaluable in adapting operations during the covid-19 pandemic.  With the Telework Pilot in place, the ATIP policy and privacy policy teams were able to maintain functionality while physically absent from the office. The pilot also laid the foundation on which an expanded telework project could be built. The ATIP division continues in making strides toward full-implementation of telework to reflect the new work-from-home emphasis of the COVID context.

Another project started in FY2019-20, the Epost, uses a service offered by Canada Post that allows for the transmission of files, including large files, securely between senders, up to and including Protected B level, to respond to requesters. This should allow GAC to respond to all or almost all privacy and access to information requests electronically.

Administration of requests

The following section explains key elements of the Statistical Report to the Treasury Board Secretariat provided in annex B.

Privacy requests

In 2019-2020, the Department received 105 requests for personal information under the Privacy Act. In addition, 68 requests were carried over from the previous fiscal year, for a total of 173 active requests.

During the reporting period, 110 requests were completed. As a result, 63 active files were carried over to the next reporting period.

Disposition of completed requests

The disposition of requests for personal information received during the reporting period was as follows:

Exemptions and exclusions

The exemptions under the Act most commonly applied by the Department during the reporting period were section 26 [information about another individual] (applied to 50 requests) and 21 [International affairs and defence] (applied to 16 requests).

Relevant pages processed and disclosed

During the reporting period, the Department disclosed 17,400 pages of the 27,360 relevant pages processed.

Extensions

During the reporting period, the Department claimed 34 extensions pursuant to subsection 15(a)(i) and 9 extensions pursuant to subsection 15(a)(ii).

Consultations received from other institutions

When a request addressed to a Department contains records that are of interest to another government institution, the Department consults the ATIP Coordinator of that institution accordingly.

Given its mandate and various responsibilities at the international level, the Department played a key role under the Privacy Act on behalf of other institutions of the Government of Canada. Specifically, the Department consulted foreign governments and organizations on behalf of other federal government institutions when the latter needed to determine whether they could release records that originated abroad. During the reporting period, the Department received 9 new consultations under the Act, all from other federal government institutions. In total, the Department completed 13 consultations.

Internal operations

Training and development

During fiscal year 2019-2020, the ATIP Division continued to provide its analysts with the necessary training and tools to perform their jobs effectively, notably by ensuring that all staff members had learning plans in their performance evaluation agreements. The ATIP division continues to develop tools and guidance to assist analysts in their application of the Access to Information Act and ensure consistency of approach. Internal training initiatives for the ATIP Division also include the ATIP mentorship program, and guest speakers from the ATIP community.

The ATIP Division benefited from its Professional Development Program, which allows the Department to train and promote its analysts from junior to senior levels. This program has been very successful in addressing recruitment, retention and succession planning issues. At the end of the fiscal year, 14 employees were in the program and further recruitment was underway.

The ATIP Division continues to foster dialogue with internal clients. Within the reporting period, the ATIP division expanded its efforts to address the appetite for training within the department. This yielded benefits such as relationship-building between analysts and subject matter experts, skill-building opportunities for analysts in the Professional Development Program, and ensured continuous training offerings throughout the Department. With larger outreach and expanded employee resources, the ATIP division has delivered training to a record number of officers. During the report period, DCP trained approximately 80 liaison officers and 388 subject-matter experts, an increase of 235% over last year.

In addition, during this reporting period, 184 employees completed an online interactive ATIP awareness tutorial, developed in collaboration with the Canadian Foreign Service Institute.

New or revised policies, guidelines and procedures

As a result of the Lean initiatives since 2017-18, efforts have been made to foster more effective dialogue between the ATIP Division and subject matter experts. A yearlong campaign has included outreach initiatives, and the provision of helpful statistics in order to identify areas for improvement. For example, the monthly Bureau Performance Report that is circulated by the Corporate Secretary and encompasses all bureaus whose internal deadlines have been missed. This has yielded a significant response from bureaus, and a renewed awareness of tasking deadlines.

The Intake Team is no longer a pilot project. Its centralization of administrative functions has demonstrated its benefits. The Intake Team also serves as a training unit and assists in the onboarding of new employees. Once new employees have completed their term with the Intake Team, they are transitioned to regular portfolios. Upon this transition, they are further supported by the ATIP Division’s Mentorship Program, another Lean initiative.

During the Reporting Period, the Privacy Policy Group has undertaken significant efforts to improve its Information Management practices. The Case Management configuration was adapted and documented to improve oversight and operations. It initiated a study to adopt new software to better track correspondence. Practices have been streamlined to reduce administrative burden.

With the aim of increasing the efficiency of managing requests from clients, the Privacy Policy Group has initiated, in collaboration with Information Technology experts, the development of a new client interface. This interface will enable clients to submit requests with mandatory information fields to ensure completeness; automatically issue reference numbers; and allow for the timely tracking and processing of cases. This new interface is expected to be launched in Fall 2020.

The Department continued to place a heavy emphasis on educating departmental officials on their ATIP roles and responsibilities to ensure compliance and efficiencies.

A telework pilot project was implemented with the Privacy team and the Policy and governance team in January 2020. This has allowed both teams to remain at full operational capability when COVID-19 confinement was declared in March 2020.

Complaints, audits, and investigations

During the reporting period, the Department received 12 new complaints and closed 9 complaints.

Of the 12 complaints received in the reporting period:

• 8 pertain to delays in providing a response to a requester.
• 3 alleged deemed refusal.
• 1 alleged that personal information was improperly collected and disclosed.

Of the 9 complaints closed during the reporting period, all were determined to be well-founded by the Office of the Privacy Commissioner and all were related to deemed refusals.

The Department took the issue of complaints seriously and addressed any problems that were identified, notably through training. The Division had a dedicated officer dealing with the resolution of complaints as well as a student and a team leader (part-time).

Monitoring processing times

The Department monitored the processing time for requests and tracked their status. The tools in place for this purpose included:

An Active Tasking Report (weekly): This report identified all current active taskings within the Department. For each tasking, it included the responsible area and bureau, type of tasking, a summary of the request, and the name of the assigned analyst.

A File Discussion (weekly): This meeting included all managers in the ATIP Division. It provided an opportunity to monitor the status of all active requests and resolve issues that could impede their timely completion.

A report is used to monitor individual analyst performance and help with workload distribution.

The monthly Bureau Performance Report was introduced to increase management awareness of departmental areas experiencing longer delays in responding to ATIP tasks.

Administration of personal information

Privacy breaches

During the reporting period, the Department reported no material privacy breaches. It is worth noting that over the past year, the Privacy Policy Group has enhanced its collaboration with the Corporate Security to better align the department’s efforts to minimize security breaches involving personal information.  In 2020-2021, the Privacy Policy Group will work with Corporate Security to update the existing Privacy Breach Protocol to clarify the roles and responsibilities of the two groups. This will also increase awareness of employees across the department of privacy breaches, security incidents, and how to address them should they occur.

Privacy impact assessments (PIA)

During the fiscal year, GAC did not finalize any new or revised PIAs; however, significant work was undertaken on some PIAs. Newly established projects are also subject to a PIA, and GAC is reviewing the parameters of these initiatives in accordance with PIA requirements. In the coming fiscal year, GAC will publish PIA summaries online for any newly completed or revised PIAs.

Disclosure of personal information

Subsection 8(2) of the Privacy Act provides that “personal information under the control of a government institution may be disclosed” without consent under certain specific circumstances.

During fiscal year 2019-2020, the Department made a total of 32 disclosures pursuant to subsection 8(2)(m) of the Privacy Act. In 6 cases, the Department determined that the public interest in disclosing personal information clearly outweighed any invasion of privacy that could result. All other disclosures were determined to clearly benefit the individual to whom the information related.

Disclosures pursuant to subparagraph 8(2)(m)(i):

• 7 disclosures were made in the interest of public safety.

Disclosures pursuant to subparagraph 8(2)(m)(ii):

• 1 disclosure was made to notify the relevant authorities of an individual’s detainment and arrest abroad;
• 4 disclosures were related to advising local authorities or agencies regarding child welfare cases;
• 9 disclosures were made in an effort to assist with repatriation of an individual to Canada;
• 8 disclosures were made to either the family, friend, doctor, or legal counsel of an individual requiring medical assistance; and
• 3 disclosures were made to advise relevant authorities in the interest of the individual’s safety.

32 disclosures pursuant to paragraph 8(2)(m) were made during fiscal year 2019-2020 and a total of 30 notifications were sent out to the Privacy Commissioner of Canada. The Division is currently in the process of sending out the remainder of notifications to the Privacy Commissioner of Canada for the disclosures made during the fiscal year 2019-2020.

Impact of COVID-19

On March 13, 2020, the Government of Canada announced a lockdown of government building restricting access only to critical staff due to the COVID-19 crisis. This resulted in a complete stop of access to information processing at Global Affairs Canada decreasing by at least 4% the total expected output. Measure to implement a telework capability were already in march which allowed a small access to information policy and governance team as well as a privacy policy team to continue working, while all other employees were forced to remain home without being able to complete their workload.

Annex A: Designation order

Annex B: Global Affairs Canada 2019-2020 statistical report

Statistical Report on the Privacy Act

Name of institution: Global Affairs Canada

Reporting period: 2019-04-01 to 2020-03-31

Section 1: Requests Under the Privacy Act

1.1 Number of requests

Section 2: Requests Closed During the Reporting Period

2.1 Disposition and completion time

2.2 Exemptions

2.3 Exclusions

2.4 Format of information released

2.5 Complexity

2.5.1 Relevant pages processed and disclose

2.5.2 Relevant pages processed and disclosed by size of requests

2.5.3 Other complexities

2.6 Closed requests

2.6.1 Number of requests closed within legislated timelines

2.7 Deemed refusals

2.7.1 Reasons for not meeting legislated timelines

2.7.2 Requests closed beyond legislated timelines (including any extension taken)

2.8 Requests for translation

Section 3: Disclosures Under Subsections 8(2) and 8(5)

Section 4: Requests for Correction of Personal Information and Notations

Section 5: Extensions

5.1 Reasons for extensions and disposition of requests

5.2 Length of extensions

Section 6: Consultations Received From Other Institutions and Organizations

6.1 Consultations received from other Government of Canada institutions and other organizations

6.2 Recommendations and completion time for consultations received from other Government of Canada institutions

6.3 Recommendations and completion time for consultations received from other organizations

Section 7: Completion Time of Consultations on Cabinet Confidences

7.1 Requests with Legal Services

7.2 Requests with Privy Council Office

Section 8: Complaints and Investigations Notices Received

Section 9: Privacy Impact Assessments (PIA) and Personal Information Banks (PIB)

9.1 Privacy Impact Assessments

9.2 Personal Information Banks

Section 10: Material Privacy Breaches

Section 11: Resources Related to the Privacy Act

11.1 Costs

11.2 Human Resources