Annual Report to Parliament on the Administration of the Privacy Act 2021-2022

Table of Contents

• Introduction
  • Purpose of the Privacy Act
  • Mandate of the Institution
• Organizational Structure
• Delegation Order
• Performance 2021-2022
  • Number of Requests
  • Active Requests Outstanding from Previous Reporting Periods
  • Extensions
  • Compliance Rate
  • Completion Time
  • Disposition of Completed Requests
  • Consultations from Other Institutions
  • Staffing
• Training and Awareness
• Policies, Guidelines, Procedures and Initiatives
  • Backlog Strategy
  • Software Access on Unclassified System
  • Hybrid Workplace
  • HR Strategies
• Summary of Key Issues and Actions Taken on Complaints
  • Active Complaints Outstanding from Previous Reporting Periods
• Monitoring Compliance
• Material Privacy Breaches
• Privacy Impact Assessments
• Public Interest Disclosures
• Annex A: Designation Order
• Annex B: Global Affairs Canada 2021-2022 Statistical Report
• Annex C: Global Affairs Canada 2021-2022 Supplemental Statistical Report

Introduction

We are pleased to table the Annual Report to Parliament on the administration of the Privacy Act (the Act) for fiscal year 2021-2022, as required under section 72 of the Act. Global Affairs Canada is not reporting on behalf of wholly owned subsidiaries or non-operational institutions.

This report is also prepared and tabled in accordance with section 20 of the Service Fees Act.

NOTE: The Department is referred to in this report as Global Affairs Canada. Its legal name, however, remains the Department of Foreign Affairs, Trade and Development, as set out in the Department of Foreign Affairs, Trade and Development Act.

Purpose of the Privacy Act

The purpose of this Act is to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution and that provide individuals with a right of access to that information.

Mandate of the Institution

Global Affairs Canada, under the leadership of the Minister of Foreign Affairs; the Minister of International Trade, Export Promotion, Small Business and Economic Development; and the Minister of International Development and Minister responsible for the Pacific Economic Development Agency of Canada, is responsible for advancing Canada’s international relations, including:

• Developing and implementing foreign policy;
• Fostering the development of international law, international trade and commerce;
• Providing international assistance (encompassing humanitarian, development, and peace and security);
• Ensuring Canada’s strong and sustained engagement in La Francophonie’s institutions;
• Providing consular services for Canadians; and
• Overseeing the Government of Canada’s global network of missions abroad.

Global Affairs Canada manages Canada’s diplomatic and consular relations with foreign governments and international organizations, engaging and influencing international players to advance Canada’s political, legal and economic interests, including poverty reduction, the empowerment of women and girls, the promotion of a rules-based international order, international peace and security, human rights, inclusive and accountable governance, peaceful pluralism, inclusion and respect for diversity, and environmental sustainability.

To eradicate global poverty and to contribute to a more peaceful, prosperous and inclusive world, the Department manages the majority of Canada’s international assistance. The Department also leads coordinated Canadian responses to crises and natural disasters abroad, including the provision of needs-based humanitarian assistance.

Global Affairs Canada also manages Canada’s international platform—a global network of missions in approximately 110 countries that supports the international work of the department and partner departments, agencies and co-locators.

To improve and maintain market access for Canadian businesses, Global Affairs Canada leads the negotiation of bilateral, plurilateral and multilateral trade agreements, the administration of export and import controls, as well as the management of international trade disputes. The Department also provides advice and services to help Canadian businesses succeed abroad and attract foreign direct investment to Canada, and supports international innovation, science and technology.

The Department delivers consular services and provides travel information to Canadians.

It also supports global peace and stability and addresses international security threats such as terrorism, transnational organized crime and the proliferation of weapons and materials of mass destruction.

The Department helps ensure Canada’s strong and sustained engagement in La Francophonie’s various institutions, in particular l’Organisation internationale de la Francophonie (OIF). It works with member states and governments of the Organisation to better define its core mandate, improve its functioning and transparency, and increase its impact.

Global Affairs Canada develops and implements policy and programming based on analysis of available evidence, including through consultation and engagement with Canadians and international stakeholders. The Department is responsible for fostering the development of international law and its applications in Canada’s foreign relations.

The department’s legal responsibilities are detailed in the 2013 Department of Foreign Affairs, Trade and Development Act.

For more information on the ministers’ mandated commitments, see the ministers’ mandate letters.

Organizational Structure

The Access to Information and Privacy Protection (ATIP) Division is responsible for the administration of the Act, including the processing of requests and consultations. The Director of the ATIP Division reports to the Corporate Secretary, who in turn reports to the Deputy Minister of Foreign Affairs.

In 2021-2022, the ATIP Division had 69 Full-Time Equivalent (FTE) positions to fulfill the Department’s obligations under both the Access to Information Act and the Privacy Act. During the fiscal year, the ATIP Division was able to fill, on average, 41 of those 69 positions and was also able to rely on the services of up to seven ATIP consultants.

The division’s staffing structure consists of 1 Director, 5 Deputy Directors, 1 Manager, 8 Team Leaders, 45 ATIP Analysts, 1 ATIP Systems Analyst, 3 Business Analysts, 4 ATIP Clerks and 1 Administrative Assistant, who all have adopted to a hybrid working model. All these employees are working from home and at Headquarters, 125 Sussex Drive. Global Affairs Canada did not have any regional ATIP staff. 

The division is organized into 9 teams in order to fulfill its Access to Information and Privacy responsibilities. 

• The Operational Unit consists of 6 ATIP processing teams, each under the supervision of a Team Leader. These teams are comprised of analysts who process and review access, privacy, and consultation requests. During the reporting period, a Deputy Director was heading 2 to 3 processing teams.
• The Privacy Policy Team deals directly with privacy matters such as breaches, departmental complaints, privacy impact assessments (PIAs), and requests for privacy advice.
• The Policy and Governance Team coordinates process modernization, procedural updates, and training.
• The Business Practices and Systems Unit processes incoming and outgoing ATIP correspondence, performs imaging services, provides technical support, and is responsible for other administrative tasks.
• Finally, the division delegated resources to work on Complaints Team which processes legacy complaints and works closely with the Office of the Information Commissioner.

During the fiscal year 2021-2022, Global Affairs Canada didn’t have any service agreement pursuant to section 73.1 of the Privacy Act.

Delegation Order

Consistent with Section 73 of the Privacy Act, the Minister’s authority is delegated to the Deputy Ministers, to the Corporate Secretary, to the Director of the ATIP Division, and to the Deputy Directors of the ATIP Division. It is also delegated to Heads of Mission for the purpose of public interest disclosures under section 8(2)(m) of the Act.

A copy of Global Affairs Canada’s signed Delegation Order is provided in Annex A.

Performance 2021-2022

Number of Requests

In 2021-2022, the Department received 109 new requests under the Privacy Act, an increase of 33% compared to the 2020-2021 fiscal year, but within 1% in comparison to the average of the previous three reporting periods. A total of 73 requests were carried over into this reporting period; 47 requests were outstanding from the previous reporting period and 26 outstanding from more than one reporting period, for a total of 182 active requests.

During the same reporting period, 110 requests were completed, an increase of 49% compared to the 2020-2021 fiscal year and of 13% compared to the average of the previous three reporting periods. The rise in the number of completed requests, compared to 2020-2021, reflects a gradual normalization of access to the workplace that followed the first year of the pandemic, during which time in office access was severely constrained.

The carry-over of active files at the end of fiscal year 2021-2022 was 72.

Active Requests Outstanding from Previous Reporting Periods

At the end of reporting period, 43% of Global Affairs Canada’s outstanding requests from previous reporting period were still on time.

Extensions

During the reporting period, the Department took extensions on 15 out of the 110 requests it closed. The reasons for extension include 9 extensions taken under section 15(a)(i) for interference with operations and 6 extensions taken under section 15(a)(ii) for required consultations.

Compliance Rate

The Department’s compliance rate in 2021-2022 (i.e. the percentage of Privacy requests that were responded to within deadline required under the  Act) was 45%. This means that 55% of Privacy requests received a response beyond the deadline. The compliance rate for the reporting period increased by 35 percentage points compared to the previous reporting period.

Completion Time

During the reporting period, the Department was able to close a total of 19 requests in 15 days or less (17%), 20 requests within 16-30 days (18%), 14 requests within 31-60 days (13%), 16 requests within 61-120 days (15%), 5 requests within 121-180 days (5%), 18 requests within 181-365 days (16%), and 18 requests took over 365 days to complete (16%).

Disposition of Completed Requests

Of the 110 Privacy requests closed in the 2021-2022 fiscal year, 13 were all disclosed (12%), 41 were disclosed in part (37%), 2 were all exempted (2%), 16 had no records in existence (14%), and 38 were abandoned (35%).

Consultations from Other Institutions

Given its mandate and various responsibilities at the international level, the Department played a key role under the Act on behalf of other institutions of the Government of Canada. Specifically, the Department consulted foreign governments and organizations on behalf of other federal government institutions when the latter needed to determine whether they could release records that originated abroad.

During the reporting period, the Department received one new consultation from another government institution and had carried over 6 consultations from the previous reporting period. Of these 7 active requests, the Department closed 6 consultation requests reviewed 616 pages as a result.

Of the 6 consultation requests closed this fiscal year, 1  request was closed in 15 days or less (16.67%), 1 request within 61-120 days (16.67%) 1 request within 121-180 days (16.67%), 2 requests within 181-365 days (33.33%), and 1 request took over 365 days to complete (16.67%).

Staffing

In 2021-22, the division had approximately 11 Full-Time Equivalent (FTE) positions working on Privacy Protection requests and Privacy Policy. This is consistent with the staffing level of the previous reporting period.

Training and Awareness

The ATIP Division continues to develop tools, guidance and training to ATIP Analysts, ATIP Liaison Officers and subject matter experts across Global Affairs Canada.

This fiscal year, the ATIP Division hired a consultant to deliver a course entitled Introduction to the Access to Information Act and the Privacy Act. The course took a total of 4 mornings; one session was delivered in English (December 2021) and one session was delivered in French (February 2022). A total of 28 ATIP Analysts successfully completed this course.

Again this fiscal year, the ATIP Division benefited from its Professional Development Program (PDP), which allows the Department to train and promote its ATIP Analysts from junior (PM-01) to senior (PM-04) levels. This long standing program continues to be very successful in addressing recruitment, retention and succession planning issues. The majority of the employees working in the ATIP Division are already part of the PDP and are subject to move to the next level once they meet the required objectives. The PDP is in place to build a more robust ATIP capacity within Global Affairs Canada by “growing its own” ATIP Analysts, thereby addressing the shortage of ATIP Analysts across the federal ATIP Community. In 2021, the ATIP Division amended the ATIP Professional Development Program to include staffing positions at the PM-05 level.

The ATIP Division also participated in the Blended Learning Program for Administrative/Executive Assistance at Headquarters, which provided 42 participants with privacy awareness training as well as an overview of their obligations vis-à-vis the Access to Information Act. In January 2022, a comprehensive training session on the importance of privacy was given to the Department’s Corporate Planning, Finance and Information Technology Branch (338 participants).

The ATIP Division continues to offer training at the divisional level in order to address the specific business and operational needs of the individual groups within the department. Additionally, the ATIP Division frequently engaged informal individual training as immediate needs manifested themselves. During the 2021-2022 fiscal year, the ATIP Division provided a one-hour session entitled ATIP for Liaison Officers to 85 participants and also provided a one-hour session entitled ATIP for Reviewing Officers to 55 participants.

In addition, during the reporting period 70 employees successfully completed an online interactive ATIP awareness tutorial, developed in collaboration with the Canadian Foreign Service Institute (CFSI).

Policies, Guidelines, Procedures and Initiatives

Backlog Strategy

Since September 2021, the ATIP Division at Global Affairs Canada has deployed the Backlog Reduction Strategy. A dedicated Backlog Reduction Team composed of experienced consultants was set up with its own Team Leader (also a consultant with considerable experience) and an experienced Deputy Director who was assigned to supervise that team. Consultants were previously embedded in various operation teams; while they were processing current complex files, backlog files were not their sole focus. Setting up a centralized structure allowed the ATIP Division to ensure proper resources were dedicated to backlog reduction.

Other key elements of the Backlog Reduction Strategy were:

• backlog definition: defined as Access to Information and Privacy files which were received before April 1^st 2021;
• additional resources: during the fiscal year, the number of ATIP consultants was increased;
• contacting requesters: requesters were contacted for older files with a view to reconfirm interest to proceed;
• factors like the passage of time, the nature of the request and the potential harm were taken into consideration in a coherent manner.

Software Access on Unclassified System

During the fiscal year, the ATIP Division successfully implemented a new IM/IT solution, adding another version of the processing software (Access Pro Suite) previously housed solely on the classified network on the unclassified network. This allowed employees to process unclassified files from home; the Global Affairs Canada ATIP office was among the first institutions to fully implement a hybrid workplace model.

Hybrid Workplace 

The ATIP Division adopted a hybrid workplace during the fiscal year of 2021-2022. Employees working for the ATIP Division work a minimum of 2 days a week in the office. Depending on the position held and work requirements, some employees are working in office full-time. The ATIP Division offers flexible work arrangements, but puts operational needs at the forefront of its work arrangements.

HR Strategies

Prior to implementing the hybrid office model, the ATIP Division had difficulty competing against other institutions that had the ability to offer full-time work from home arrangements; employee retention during this fiscal year proved challenging. Although the ATIP Division continues to face HR challenges, there have been recent successes and the division has on-boarded 15 new employees. Staffing strategies included hiring a new Deputy Director within the division to manage upcoming staffing processes at multiple levels. The ATIP Division also participated in the ATIP Community Development Office, a TBS led staffing initiative. Furthermore, the ATIP Division also expanded its Professional Developmental Program at the PM-05 level. 

These initiatives have aided in the ATIP Division’s successes in the 2021-2022 fiscal year.

During the 2021-2022 fiscal year, the ATIP Division developed a Privacy Management Framework (PMF) which adapts to the institution’s needs and mandate; it will enable best practices for privacy and the handling of personal information at Global Affairs Canada. The PMF is intended to ensure accountability for privacy compliance and promote awareness of privacy issues as well as obligations across the Department regarding the protection of personal information.

Further to its development, the Privacy Policy Team has developed various tools to respond to the Audit Plan:

• A Privacy Impact Assessment (PIA) policy which sets out the requirements for PIAs at Global Affairs Canada and provides guidance for employees on how to best comply with those requirements. Its intent is to inform, enable, support, and promote the performance of PIAs within the Department to ensure that privacy is an integral part of program and service design;
• A guide for employees on meeting the Department’s privacy obligations and to promote a coherent and effective departmental approach for privacy protection;
• A strategic privacy plan for 2023-2026, with the overarching objective to ensure that Global Affairs Canada is able to meet its legal and regulatory requirements under the Privacy Act.

The Privacy Policy Team continues to actively participate in the Department of Justice led modernization of the Privacy Act. Global Affairs Canada provided a number of recommendations reflecting the important work the Department does in Canada as well as through our missions abroad.

Summary of Key Issues and Actions Taken on Complaints

During fiscal year 2021-2022, 11 complaints were made to the Office of the Privacy Commissioner of Canada regarding Privacy requests to the Department. The reasons for the complaints are as follows:

Over the course of the reporting period, 5 complaints against the Department were closed. The findings on closed complaints were as follows:

Additionally, 2 new complaints were received during the reporting period that related to the management of personal information; one related to a privacy breach regarding a mission’s inadvertent disclosure of personal information in the delivery of a Canadian Citizenship Certificate (of a minor) to an unintended recipient. The other related to the collection/disclosure of personal information recorded within an employee’s End of Specified Period Employment Notice that was sent to the Pay Center.

One of the complaints relating to the management of personal information has since been closed.

The ATIP Division continued to operate a dedicated team to manage complaints from the Office of the Privacy Commissioner (OPC). This team serves as the primary point of contact between Global Affairs Canada and the OPC; the team continues to work closely and collaboratively to strengthen relationships and improve Global Affairs Canada’s ATIP program performance.

Active Complaints Outstanding from Previous Reporting Periods

Monitoring Compliance

The Department continues to use the same tools to help ensure timely processing of ATIP requests.

The ATIP Division prepares and distributes to management, a weekly statistics report which tracks the number of requests received and closed, as well as any emerging trends and performance statistics. The report also allows for comparison of workload and completion rates in relation to the previous year in order to identify changes in ATIP processing.

Additionally, an active tasking report is generated and posted to the intranet weekly to identify all current active taskings within the Department. This report is available for all offices of primary interest to view and lists all open taskings by bureau, highlighting late files.

Finally, every week a report is shared within the Department that includes summaries of upcoming Access to Information requests soon to be disclosed and the proposed packages available for review.

Material Privacy Breaches

During fiscal year 2021-2022, 10 material privacy breaches were reported to the Department. This number has increased compared to previous reporting periods and can be largely attributed to the many initiatives, processes, and tools adopted in order to allow for telework across the Department. At the end of the fiscal year, one material privacy breach notification was reported to the Treasury Board Secretariat and the Office of the Privacy Commissioner.

Of the remaining notifications, one has been reported to Treasury Board Secretariat and the Office of the Privacy Commissioner during the 2022-2023 fiscal year, while eight notifications remain outstanding due to workload factors.

Notifications to Treasury Board Secretariat and the Office of the Privacy Commissioner for the remaining material privacy breaches (8) are anticipated to be completed by September 2022.

Privacy Impact Assessments

During the fiscal year, Global Affairs Canada finalized three Privacy Impact Assessments.

Public Interest Disclosures

Subsection 8(2) of the Privacy Act provides that “personal information under the control of a government institution may be disclosed” without consent under certain specific circumstances.

During fiscal year 2021-2022, the department made a total of 115 disclosures pursuant to subsection 8(2)(m) of the Privacy Act. In 35 cases, the department determined that the public interest in disclosing personal information clearly outweighed any invasion of privacy that could result. All other disclosures were determined to clearly benefit the individual to whom the information related.

Disclosures pursuant to subparagraph 8(2)(m)(i):

• 35 disclosures were made in the interest of public safety.

Disclosures pursuant to subparagraph 8(2)(m)(ii):

• 44 disclosures were made to notify the relevant authorities of an individual’s detainment and arrest abroad;
• 2 disclosures were made to a family member on compassionate grounds;
• 1 disclosure was made in the interest of fairness related to legal matters;
• 10 disclosures were related to advising local authorities or agencies regarding child welfare cases; and
• 23 disclosures were made to either the family, friend, doctor, or legal counsel of an individual requiring medical assistance.

Because of the constraints brought on by the COVID-19 pandemic, no notifications were sent out to the Privacy Commissioner of Canada for the 115 disclosures pursuant to paragraph 8(2)(m) that were made during fiscal year 2021-2022. However, the division is currently in the process of sending out all notifications to the Privacy Commissioner of Canada.

Annex A: Designation Order

Annex B: Global Affairs Canada 2021-2022 Statistical Report

Statistical Report on the Privacy Act

Name of institution: Global Affairs Canada

Reporting period: 2021-04-01 to 2022-03-31

Section 1: Requests Under the Privacy Act

1.1 Number of requests

1.2 Channels of requests

Section 2: Informal requests

2.1 Number of informal requests

2.2 Channels of informal requests

2.3 Completion time of informal requests

2.4 Pages released informally

Section 3: Requests Closed During the Reporting Period

3.1 Disposition and completion time

3.2 Exemptions 

3.3 Exclusions 

3.4 Format of information released

3.5 Complexity

3.5.1 Relevant pages processed and disclosed for paper and e-record formats

3.5.2 Relevant pages processed per request disposition for paper and e-record formats by size of requests

3.5.3 Relevant minutes processed and disclosed for audio formats

3.5.4 Relevant minutes processed per request disposition for audio formats by size of requests

3.5.5 Relevant minutes processed and disclosed for video formats

3.5.6 Relevant minutes processed per request disposition for video formats by size of requests

3.5.7 Other complexities

3.6 Closed requests

3.6.1 Requests closed within legislated timelines

3.7 Deemed refusals

3.7.1 Reasons for not meeting legislated timelines

3.7.2 Requests closed beyond legislated timelines (including any extension taken)

3.8 Requests for translation

Section 4: Disclosures Under Subsections 8(2) and 8(5)

Section 5: Requests for Correction of Personal Information and Notations

Section 6: Extensions

6.1 Reasons for extensions

6.2 Length of extensions

Section 7: Consultations Received from Other Institutions and Organizations

7.1 Consultations received from other Government of Canada institutions and other organizations

7.2 Recommendations and completion time for consultations received from other Government of Canada institutions

7.3 Recommendations and completion time for consultations received from other organizations outside the Government of Canada

Section 8: Completion Time of Consultations on Cabinet Confidences

8.1 Requests with Legal Services

8.2 Requests with Privy Council Office

Section 9: Investigations and Reports of finding

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

10.1 Privacy Impact Assessments

10.2 Institution-specific and Central Personal Information Banks

Section 11: Privacy Breaches

11.1 Material Privacy Breaches reported

11.2 Non-Material Privacy Breaches

Section 12: Resources Related to the Privacy Act

12.1 Allocated Costs

12.2 Human Resources

Annex C: Global Affairs Canada 2021-2022 Supplemental Statistical Report

Supplemental Statistical Report on the Access to Information Act and the Privacy Act

Name of institution: Global Affairs Canada

Reporting period: 2021-04-01 to 2022-03-31

Section 1: Capacity to Receive Requests under the Access to Information Act and the Privacy Act

Enter the number of weeks your institution was able to receive ATIP requests through the different channels.

Section 2: Capacity to Process Records under the Access to Information Act and the Privacy Act

2.1 Enter the number of weeks your institution was able to process paper records in different classification levels.

2.2 Enter the number of weeks your institution was able to process electronic records in different classification levels.

Section 3: Open Requests and Complaints Under the Access to Information Act

3.1 Enter the number of open requests that are outstanding from previous reporting periods.

3.2 Enter the number of open complaints with the Information Commissioner of Canada that are outstanding from previous reporting periods.

Section 4: Open Requests and Complaints Under the Privacy Act

4.1 Enter the number of open requests that are outstanding from previous reporting periods.

4.2 Enter the number of open complaints with the Privacy Commissioner of Canada that are outstanding from previous reporting periods.

Section 5: Social Insurance Number (SIN)