Annual Report to Parliament on the Administration of the Privacy Act 2023-2024

Table of Contents

• Introduction
  • Purpose of the Privacy Act
  • Mandate of the Institution
• Organizational Structure
• Delegation Order
• Performance 2023-2024
  • Number of Requests
  • Active Requests Carried Over to the Next Reporting Period
  • Extensions
  • Compliance Rate
  • Completion Time
  • Disposition of Completed Requests
  • Consultations from Other Institutions
  • Staffing
• Training and Awareness
• Policies, Guidelines, and Procedures
  • Step by Step guide
  • Guidelines
  • Outreach
  • ATIP at the Corporate Management Meeting
  • HR Strategies
  • Privacy Tools and Initiatives
• Initiatives and Projects to Improve Privacy
  • New Request Processing Software Solution
• Summary of Key Issues and Actions Taken on Complaints
  • Requests for Personal Information
  • Management of Personal Information
  • Active Complaints Carried Over to the Next Reporting Period
• Material Privacy Breaches
• Privacy Impact Assessments
  • 1 - Flight PS752 Commemorative Scholarship Program
  • 2 - Global Affairs Learning Management System (LMS)
• Public Interest Disclosures
• Monitoring Compliance
  • Ongoing Reporting
  • Limiting Inter-institutional Consultations
  • Frequently Requested Types of Information
  • Privacy Protection in Contracting
• Annex A: Designation Order
• Annex B: Global Affairs Canada 2023-2024 Statistical Report
• Annex C: Global Affairs Canada 2023-2024 Supplemental Statistical Report

Introduction

We are pleased to table the Annual Report to Parliament on the administration of the Privacy Act (the Act) for fiscal year 2023-2024, as required under section 72 of the Act. Global Affairs Canada is not reporting on behalf of wholly owned subsidiaries or non-operational institutions.

Note: The Department is referred to in this report as Global Affairs Canada (GAC). Its legal name, however, remains the Department of Foreign Affairs, Trade and Development, as set out in the Department of Foreign Affairs, Trade and Development Act.

Purpose of the Privacy Act

The purpose of this Act is to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution and that provide individuals with a right of access to that information.

Mandate of the Institution

Global Affairs Canada, under the leadership of the Minister of Foreign Affairs; the Minister of Export Promotion, International Trade and Economic Development; and the Minister of International Development, is responsible for advancing Canada’s international relations, including:

• Developing and implementing foreign policy;
• Fostering the development of international law, international trade and commerce;
• Providing international assistance (encompassing humanitarian, development, and peace and security);
• Providing consular services for Canadians; and
• Overseeing the Government of Canada’s global network of missions abroad.

Global Affairs Canada manages Canada’s diplomatic and consular relations with foreign governments and international organizations, engaging and influencing international players to advance Canada’s political, legal and economic interests, including poverty reduction, the empowerment of women and girls, the promotion of a rules-based international order, international peace and security, human rights, inclusive and accountable governance, peaceful pluralism, inclusion and respect for diversity, and environmental sustainability.

In support of efforts to eradicate global poverty and contribute to a more peaceful, prosperous, and inclusive world, the department manages the majority of Canada’s international assistance. The department also leads coordinated Canadian responses to crises and natural disasters abroad, including the provision of needs-based humanitarian assistance.

Global Affairs Canada also manages Canada’s international platform—a global network of missions in approximately 110 countries that supports the international work of the department and partner departments, agencies, and co-locators.

To improve and maintain market access for Canadian businesses, Global Affairs Canada leads the negotiation of bilateral, plurilateral and multilateral trade agreements, the administration of export and import controls, as well as the management of international trade disputes. The Department also provides advice and services to help Canadian businesses succeed abroad and attract foreign direct investment to Canada, and supports international innovation, science, and technology.

The Department delivers consular services and provides travel information to Canadians.

It also supports global peace and stability and addresses international security threats such as terrorism, transnational organized crime and the proliferation of weapons, and materials of mass destruction.

Global Affairs Canada develops and implements policy and programming based on analysis of available evidence, including through consultation and engagement with Canadians and international stakeholders. The department is responsible for fostering the development of international law and its applications in Canada’s foreign relations.

The department’s legal responsibilities are detailed in the 2013 Department of Foreign Affairs, Trade and Development Act.

For more information on the ministers’ mandated commitments, see the ministers’ mandate letters.

Organizational Structure

The Access to Information and Privacy Protection Division (The ATIP Division) is responsible for the administration of the Access to Information Act and the Privacy Act (PA), including the processing of requests and consultations. The Director of the ATIP Division reports to the Corporate Secretary who, in turn, reports to the Deputy Minister of Foreign Affairs.

In 2023-2024, the ATIP Division had 69 Full-time Equivalent positions to fulfill the Department’s obligations under both the Access to Information Act and the Privacy Act. During the fiscal year, the ATIP Division filled on average, 50 of those 69 positions and relied on up to 7 ATIP consultants.

The ATIP Division is led by a director, who manages the teams that administer the access to information and privacy acts:

• The Operational Unit is managed by four deputy directors who head one or two processing teams. There are five team leaders who supervise processing teams. one senior advisor, twenty-two analysts, and seven consultants distributed throughout these teams. The Operational Unit is responsible for the processing and review of access, privacy, and consultation It also includes a team with dedicated resources to work on complaints, which processes legacy complaints and works closely to resolve them with the Office of the Information Commissioner and the Office of the Privacy Commissioner (OPC).
• The Privacy Policy Team is managed by one deputy director and includes one team leader, five analysts, who deal directly with privacy breaches, departmental complaints, privacy impact assessments, and requests for privacy advice.
• The Policy and Governance Team is managed by one deputy director and includes one senior ATIP policy and governance advisor who coordinates process modernization, procedural updates, and departmental training.
• The Business Practices and Systems Unit is managed by one deputy director and includes one ATIP systems analyst, three business analysts and four clerks who process incoming and outgoing ATIP correspondence, imaging services, technical support, and other administrative tasks.
• The Corporate Affairs Unit is managed by one deputy director and includes one administrative assistant and one consultant. This group is responsible for the oversight of the division’s human resources, budget management, and general administration.

All employees are working within a hybrid model, with telework from home and in-office presence at headquarters (125 Sussex Drive). Global Affairs Canada did not have any regional ATIP staff. 

During the 2023-2024 fiscal year, Global Affairs Canada did not have any service agreements pursuant to section 73.1 of the Privacy Act.

Delegation Order

Consistent with section 73 of the Privacy Act, the Minister’s authority is delegated to the deputy ministers, to the Corporate Secretary, to the Director of the ATIP Division, and to the deputy directors of the ATIP Division. It is also delegated to heads of mission for the purpose of public interest disclosures under paragraph 8(2)(m) of the Act.

A copy of Global Affairs Canada’s signed Designation Order is provided in Annex A.

Performance 2023-2024

Number of Requests

In 2023-2024, the Department received 361 new requests under the Privacy Act, an increase of 206% compared to the 2022-2023 fiscal year. A total of 61 requests were carried over into this reporting period; 36 requests were outstanding from the previous reporting period and 25 outstanding from more than one reporting period.

During the same reporting period, 344 requests were completed; an increase of 177% compared to the 2022-2023 fiscal year. The rise in the number of received and completed requests, compared to 2022-2023, reflects a small group of individuals that submitted 220 requests. Several days after submitting these requests, these individuals decided to abandon all their requests.

Active Requests Carried Over to the Next Reporting Period

At the end of reporting period, 35% of Global Affairs Canada’s outstanding requests were still on time. The carry-over of active files at the end of fiscal year 2023-2024 was 78.

Extensions

During the reporting period, the Department took extensions on 17 out of the 344 requests it closed. The reasons for extension include 12 extensions taken under paragraph 15(a)(i) for interference with operations and 5 extensions under paragraph 15 (a)(ii) for required consultation.

Compliance Rate

The compliance rate is defined as the percentage of privacy requests that the Department responded within the deadline required under the Act. In 2023-2024, the departmental compliance rate for Global Affairs Canada was 82%. This means that 18% of privacy requests received a response beyond the deadline. The compliance rate for the reporting period increased by 30 percentage points compared to the previous reporting period.

Completion Time

During the reporting period, the Department closed a total of 258 requests closed in 15 days or less (75%), 19 requests closed within 16-30 days (5%), 16 requests closed within 31-60 days (5%), 28 requests closed within 61-120 days (8%), 10 requests closed within 121-180 days (3%), 6 requests closed within 181-365 days (2%), and 7 requests took over 365 days to complete (2%).

Disposition of Completed Requests

Of the 344 privacy requests closed during the 2023-2024 fiscal year, 10 were all disclosed (3%), 54 were disclosed in part (16%), 1 was all exempted (<1%), 1 was all excluded (<1%), 14 had no records in existence (4%), and 264 were abandoned (77%).

Consultations from Other Institutions

Given its mandate and various responsibilities at the international level, the Department plays a key role under the Act on behalf of other institutions of the Government of Canada. Specifically, the Department consulted foreign governments on behalf of other federal government institutions when the latter needed to determine whether they could release records that originated abroad.

During the reporting period, the Department received two new consultations from other government institutions and didn’t carry over any consultation from the previous reporting period. Global Affairs Canada was able to complete these two consultation requests during the fiscal year having reviewed 124 pages.

Of the two consultation requests closed this fiscal year, one request was closed within 16-30 days (50%), and one request within 61-120 days (50%).

Staffing

In 2023-2024, the ATIP Division had approximately 12 Full time Equivalents dedicated to privacy activities (personal information requests and privacy policy). This is consistent with the staffing level of the previous reporting period.

Training and Awareness

The ATIP Division continues to develop tools, guidance and training for ATIP analysts, ATIP liaison officers and subject matter experts across Global Affairs Canada.

Again, during the reporting period, the ATIP Division benefited from its Professional Development Program (PDP), which allows the Department to train and promote its ATIP analysts from junior (PM-01) to senior (PM-05) levels. This long-standing program continues to be highly successful in addressing recruitment, retention, and succession planning issues. Most of the employees working in the ATIP Division are already part of the PDP and are eligible for promotion to the next level once they meet the required objectives. The PDP aims to build a more robust ATIP capacity within Global Affairs Canada by “growing its own”, thereby addressing the shortage of analysts and team leaders across the federal ATIP community.

ATIP Training was also provided to the ATIP Division at Global Affairs Canada. During the reported fiscal year, the ATIP Division hired a consultant to deliver an introductory course on the administration of the Access to Information Act and Privacy Act. The course was delivered to 28 employees from June 20 to June 22, 2023. Furthermore, on December 4, 2023, the same consultant provided an in-depth training on the application of exemptions and exclusions of the Access to Information Act and Privacy Act, 37 employees attended the training entitled “Exemptions provisions of ATIP” which was geared for ATIP analysts and ATIP team leaders. Lastly, on February 22, 2024, a different consultant provided training to 43 employees on the application of subsection 70(1) of the Privacy Act. The training provided insight on how to identify confidences of the King’s Privy Council for Canada and the necessary steps to undertake when excluding information pertaining to subsection 70(1) of the PA.

Additionally, the ATIP Division provided the following training modules to GAC employees:

• ATIP for liaison officers
• ATIP for reviewing officers

Due to GAC’s rotational employee structure, ATIP training sessions were made available upon request and attendance varied between 1 and 76 employees. During the fiscal year, a total of 57 training sessions were delivered to 691 Global Affairs Canada employees. Of these presentations, 50 were delivered virtually via the use of MS Teams and 7 training sessions were delivered in person.

Along with internal coaching, the division also participated in training for other divisions within the Department. For example, the Blended Learning Program for administrative/executive assistants at headquarters educated 37 participants on privacy awareness and gave an overview of their obligations vis-à-vis the Privacy Act. Furthermore, ATIP training was provided to 13 participants during the Foreign Service Executive Administrative Assistants onboarding program.   

The Privacy Policy Team maintains an updated spreadsheet, documenting all privacy training sessions conducted within the organization throughout the fiscal year, ensuring an accurate reflection of specific topics discussed and keeping track of employees’ increasing privacy awareness.

Over the reporting period, the Privacy Policy Unit delivered privacy training to the Missions Inspections Group through three dedicated sessions, each involving 13 participants. These sessions were structured to include active learning techniques, utilizing depersonalized privacy examples to illustrate key concepts while ensuring that sensitive information remained confidential. This method facilitated an engaging environment where participants could freely discuss their questions and concerns. In addition to these tailored sessions, the Privacy Policy Unit also supported broader departmental training initiatives.

In addition, the Unit conducted a specialized session for the Crime and Terrorism Policy Division. This session was designed to meet the specific business requirements of the program, focusing on the Privacy Impact Assessment (PIA) process and its essential components.

The Privacy Policy Unit also conducted training for the broader ATIP Division on public interest disclosures, privacy breaches, and the definition of personal information. This training, attended by 40 members of the division, included detailed discussions and practical examples to clarify these critical issues. The sessions aimed to ensure that all participants understood how to manage privacy-related matters in line with departmental policies and regulations. This effort underscores the unit’s commitment to improving the division’s expertise in privacy management and supporting its role in upholding information security standards.

Policies, Guidelines, and Procedures

Step by Step guide 

During the reporting period, the ATIP Division at Global Affairs Canada developed a comprehensive step-by-step manual to help both junior and more experienced ATIP Analysts in navigating the A-To-Z process of both Access to Information and/or Privacy Act requests at Global Affairs Canada. The manual is divided into multiple chapters covering topics such as: detailing the specific steps an analyst must follow when handling new requests, steps when reviewing responsive records, and the actions required before completing the approval process and disclosing the information to the requester. Each chapter was drafted one at a time and was reviewed by management who provided comments and insight before the guide was implemented and shared with the ATIP Division.

Guidelines

Throughout the fiscal year, the ATIP Division also implemented the following three guidelines:

1. How to handle the names of Global Affairs Canada officials and exempt staff at Global Affairs Canada under the Access to Information Act.
2. Processing cellular numbers under the Access to Information Act at Global Affairs Canada.
3. Processing an Access to Information Act request which contains personal information of the requester.

Each guideline was drafted individually and reviewed by the management team who provided comments and insights before the guidelines were shared with the entire division and implemented.

Outreach

During fiscal year 2022-2023, the responsibility of retrieving and providing recommendations for the disclosure of records made pursuant to the ATIA or PA shifted from the Director’s General office to the Assistant Deputy Minister (ADM) office. Since the implementation of the ATIP ADM Tasking initiative, two ADM offices have contacted the Corporate Secretary/ATIP Division to get a sense of their branch’s performance in relation to their response time and administration of the ATIA and PA. During the 2023-2024 fiscal year, the ATIP Division, represented by the Corporate Secretary and/or the Director of the Access to Information Division, delivered presentations to the Indo-Pacific sector as well as the Consular, Security and Emergency Management sector at their executive meetings.

ATIP at the Corporate Management Meeting

During the 2023-2024 fiscal year, the Corporate Secretary of Global Affairs Canada responsible for overseeing the administration of the Access to Information Act attended GAC’s Corporate Management Meeting (CMC) on November 8, 2023. At the meeting, the Corporate Secretary emphasized the importance of responding promptly to ATIP requests and of reducing the backlog of ATIP taskings. Best practices were discussed to best achieve these goals.

HR Strategies

The implementation of the hybrid work model proved beneficial for the retention of staff in the ATIP Division. However, recruitment of skilled analysts, at GAC as in other government institutions, remains a challenge, especially at the senior analyst level. Despite the challenges, there have been recent successes having onboarded five new employees in the 2023-2024 fiscal year. The ATIP division also actively utilizes its Professional Development Program resulting in the promotion of one senior analyst.  

These initiatives have aided in the ATIP Division’s successes in the 2023-2024 fiscal year.

Privacy Tools and Initiatives

The implementation of the Privacy Management Framework, officially launched in November 2022, continues to be a cornerstone for the Department's privacy practices. Over the past year, this framework has guided the development and refinement of privacy policies and procedures, ensuring adherence to evolving legislative regulations. It underscores our commitment to transparency, accountability, and robust security measures in data processing, storage, and sharing. The ongoing application of this framework enhances our ability to safeguard individual privacy rights and reinforces the trust between GAC and Canadian citizens, marking a significant advancement in our privacy management efforts.

The ATIP Division is making significant progress with several key initiatives. The Privacy Impact Assessment policy, which was launched in August 2023, plays a critical role in identifying and mitigating privacy risks associated with new or revised programs and projects. Looking ahead, the development of handling practices for senior management, a Data and Privacy Breach Protocol, and a Protocol for the Handling of Personal Information for Non-Administrative Purposes are all on track, with completion anticipated for Fall 2024. These tools are essential for ensuring that senior management is equipped to address privacy issues, that breaches are managed efficiently, and that personal information is handled appropriately in non-administrative contexts. Collectively, these efforts demonstrate the unit's ongoing commitment to advancing privacy management and bolstering information security across the department. 

The Privacy Policy Team continued to actively participate in the Department of Justice led modernization of the Privacy Act and awaits the next meetings on its development so that Global Affairs Canada’s views can be reflected within.

Initiatives and Projects to Improve Privacy

New Request Processing Software Solution

The current case management software used to process requests is becoming obsolete and will no longer be supported by the vendor in the coming years. GAC is using this opportunity to replace the legacy software and leverage new technology to increase efficiencies in our service delivery and to better handle the large volume of ATIP requests. Deployment of the new solution is anticipated for fiscal year 2025-2026.

Summary of Key Issues and Actions Taken on Complaints

Requests for Personal Information

During fiscal year 2023-2024, 20 complaints were made to the Office of the Privacy Commissioner of Canada regarding privacy requests to the Department. The reasons for the complaints are as follows:

Over the course of the reporting period, 8 complaints against the Department were closed. The findings on closed complaints were as follows:

All closed complaints regarding access to personal information were resolved by responding to or providing additional information to the requesters. The ATIP Division ensured continuous and consistent follow-ups on outstanding taskings, utilizing escalation procedures to fully respond to requesters and close complaints.

The ATIP Division continues to operate a team dedicated to managing complaints from the Office of the Privacy Commissioner (OPC). This team serves as the primary point of contact between Global Affairs Canada and the OPC, working closely and collaboratively to strengthen relationships and improve Global Affairs Canada’s ATIP program performance.

Management of Personal Information

The Privacy Policy Team received 1 new complaint during the reporting period relating to the management of personal information. Specifically, they can be summarized as:

A mission’s unauthorized disclosure of personal information of an employee to the rest of employees.

The team closed the complaint relating to the management of personal information during the reporting period May 11, 2023. In this instance the Office of the Privacy Commissioner sought representations from the Department, further to any steps taken since the incident to ensure the security and the privacy of staff information. The Department informed the OPC that as an effective measure in preventing reoccurrence, a privacy training will include elements specifically related to communications and how details that could be considered personal information should be effectively managed.

Training will include examples of specific cases such as this one dealing with vaccination policy.

Active Complaints Carried Over to the Next Reporting Period

Material Privacy Breaches

During fiscal year 2023-2024, six material privacy breaches were reported to the Department. At the end of the fiscal year, six material privacy breach notifications were reported to the Treasury Board Secretariat and the Office of the Privacy Commissioner.

Privacy Impact Assessments

During the fiscal year, Global Affairs Canada finalized two Privacy Impact Assessments.

1 - Flight PS752 Commemorative Scholarship Program

On January 8, 2020, fifty-five Canadians and thirty Canadian permanent residents were lost in the downing of Ukraine International Airlines Flight 752 (PS752) by an Iranian surface-to-air missile. In December 2020, Cabinet approved the establishment of the Flight PS752 Commemorative Scholarship Program as a tribute to those lost. Its purpose is to acknowledge the significant number of academics and students among the victims of Flight PS752, and to pay tribute to their contribution to Canadian postsecondary institutions. Following Cabinet’s approval, five million dollars over the course of five years was allocated to the Program in memory of the victims of PS752. The Program’s planned implementation was announced by the Minister of Foreign Affairs in January 2022 with the aim of delivering the first scholarships to applicants for the 2024-25 academic year; the launch date was later amended by the Minister of Foreign Affairs to the 2023-24 academic year.

In the management, administration, and operation of the Program, GAC will be collecting personal information from scholarship applicants. Personal information will generally be limited to an applicant’s name, biographic, and contact information; past education and academic information; planned uses of scholarship funds; and the applicant’s connection to Flight PS752. As each scholarship is to be awarded in the memory of a victim of Flight PS752, kinship with the victims, specifically those applicants from countries with economic hardship and/or oppressive regimes, is to be considered as part of the Program’s eligibility and evaluation criteria. The Program is open to both Canadian and international students planning on attending Canadian educational institutions to pursue their studies, personal information is likely to be collected from both Canadians and foreign nationals. Information collected and used to confirm or certify the veracity and eligibility of applicant includes:

• Applicant’s immigration status in Canada
• Information supporting a stated familial relationship with a victim of PS752,
• Financial and banking information
• Information about registered studies in Canada

Personal information may also be used in support of the distribution and administration of scholarship awards. As a commemorative scholarship, and as a tribute to the victims of Flight PS752, information about scholarship recipients may be disclosed to the families of Flight victims or made public by GAC through Program reports and corporate communications. This includes GAC or GAC-supported websites, posters, and brochures used for Program promotion. Personal information may also be shared under new agreement or an existing information-sharing arrangement with Canadian and foreign academic institutions, a student's diplomatic representation in Canada and foreign embassy in Canada, or a Canadian embassy/high commission/consulate abroad. Limited personal information may also be disclosed to other federal institutions, such as the Canada Revenue Agency (for tax reporting purposes), Immigration, Refugees and Citizenship Canada, or the Canada Border Services Agency (to ensure compliance with the immigration or visitation terms and conditions to which the student has agreed in relation to the completion of their studies)

The PIA for the program was completed under the direction of the Head of the PS752 Task Force. It included a review of the Program’s application and evaluation process, and a review of policies, procedures and controls implemented by GAC to ensure that its collection and use of applicant information complies with federal requirements and best practices for the handling of personal information. The PIA also included a summary review of the platform to be used for the collection of personal information, and an assessment of program evaluation and reporting plans.

Based on the present assessment, privacy risks arising from the implementation, management, administration of the PS752 Commemorative Scholarship Program are expected to be moderate to low. GAC has significant experience in the creation and implementation of international scholarship programs and is expected to leverage existing processes, IT infrastructure, and systems to ensure the secure collection, use, disclosure, and retention of personal information. Although the receipt and vetting of applications (along with the selection or recommendation of scholarship recipients) has been delegated to an arm’s length Program Administrator, the contract governing the Program Administrator’s services includes essential clauses pertaining to privacy and security. All personal information collected from applicants will remain under the care and custody of the Government of Canada and will not be used for purposes other than those for which it was first collected or a use consistent with its collection.

Applicant information will be housed on GAC servers in a Protected B environment, consistent with the information’s sensitivity, and securely destroyed after it is of no further value. Notwithstanding the privacy positive measures noted above, several issues were identified during the PIA process requiring remedial action. The following recommendations are intended to address those issues. Once implemented, the overall or residual level of privacy risk relating to the Program and its management and administration is expected to be reduced to a low or acceptable level.

Recommendations

1. Notification – It is recommended that GAC develop a stand-alone privacy notice for inclusion in the Program posting and scholarship application form. The privacy notice should include all mandatory elements prescribed by the Treasury Board of Canada Secretariat’s (TBS) Directive on Privacy Practices, including a link to an approved Personal Information Bank (PIB).
2. Data Review and Minimization – It is recommended that GAC undertake an annual review of personal information elements to be collected in relation to the Program to ensure that each element is directly related and demonstrably necessary to meet the Program’s needs and objectives.
3. Data Management – It is recommended that the PS752 Task Force (as the Program owner) identify and adopt, where appropriate, standard departmental practices and protocols developed by GAC’s International Scholarships Program for the handling of personal information in relation to the PS752 Scholarship Program. Alternatively, the PS752 Task Force should develop a stand-alone privacy protocol to support the proper handling of PS752 scholarship data. That protocol should set out key roles, responsibilities, and accountabilities for the proper handling of personal information, and establish express limits on the collection, use, disclosure, and retention of applicant information.
4. Monitoring and Compliance – It is recommended that GAC track and monitor the Program Administrator’s compliance with the data privacy requirements set out in its master service agreement, particularly those pertaining to access to Program data and its use, disclosure, retention, and security.
5. Data De-Identification - It is recommended that GAC de-identify or anonymize personal information belonging to scholarship applicants where that information is to be used for non-administrative purposes, including Program evaluation, promotion, reporting, policy, research, and statistical purposes.
6. Openness – It is recommended that GAC identify an appropriate PIB describing the collection, use, disclosure, and retention of personal information in relation to the Program to ensure that the Department meets transparency requirements prescribed under the Privacy Act. A new PIB may be required where the activities of the PS752 Scholarship Program and/or the handling of applicant information is not in keeping with the collection, use, disclosure, and retention of personal information by GAC in relation to its broader International Scholarships Program (as currently described in PIB GAC PPU 911).

GAC has reviewed the above recommendations and has developed a mitigation plan to address each risk and recommendation. Wherever possible, potential impacts on the privacy of scholarship applicants will be managed by GAC through existing legal, policy, and technical measures geared at the protection of personal information.

A new PIB for the program was created:

• PIB Title: Flight PS752 Commemorative Scholarship Program
• PIB#: GAC PPU 953
• TBS Registration#: 20230023

2 - Global Affairs Learning Management System (LMS)

Global Affairs Canada (CFSI) currently is a sub-school of the Canada School of Public Service (the School), using the current Learning Management System (LMS) via the service provider Saba, currently known as MyAccount. The current LMS will be decommissioned on August 31st 2022. The School engaged in a contract with Desire to Learn (D2L) and GAC signed an MOU with the School for the use of their contract with D2L under a federated multi-tenancy model. The federated multi-tenancy model provides autonomy to GAC in the management of their departmental learning platform and benefit from the collective work undertaken by the School, including, procurement, system configurations, accessibility and official languages compliance, as well as cyber security assessments that align to the GC Security control profile for cloud based GC services (ITSG-33 & PROTECTED B / Medium Integrity / Medium Availability) guidelines provided by the Canadian Centre for Cyber Security. Under this secure Next Generation Digital Learning Environment (NGDLE) umbrella, GAC can benefit from its own instance of Brightspace, a LMS provided by the vendor, D2L. GAC can configure the system to its specific needs and will manage its own integrations, modifying as required. Included as a component of the learning platform ecosystem is Course Merchant, a product catalog that allows users to advertise offerings and enable registrations. In the federated multi-tenancy model, GAC leverages the School’s contract with D2L to gain access to these software as a service (SaaS) products. GAC works directly with the vendor(s) for all system implementation or administration support as outlined in the contract, providing the same level of access to the vendor as the School. The new LMS solution for which this PIA is requested is to be assessed as a separate initiative in its entirety; This PIA represents a new service provided by CFSI to the Global Affairs learning community. If there is any leverage of CSPS services, it is uniquely for contractual purpose towards parties like, for example, the 3rd party solution Desire2Learn or SSC.

Recommendations

Openness – It is recommended that GAC identify an appropriate PIB describing the collection, use, disclosure, and retention of personal information in relation to the Program to ensure that the Department meets transparency requirements prescribed under the Privacy Act. A new PIB is under development.

GAC a mitigation plan to address each risk and recommendation. Wherever possible, potential impacts on the privacy of learners will be managed by GAC through existing legal, policy, and technical measures geared at the protection of personal information.

All the identified risks were low, and the mitigation measures are already in place.

Public Interest Disclosures

Subsection 8(2) of the Privacy Act provides that “personal information under the control of a government institution may be disclosed” without consent under certain specific circumstances.

During the 2023-2024 fiscal year, the Department made a total of 102 disclosures pursuant to paragraph 8(2)(m) of the Privacy Act. In 20 cases, the Department determined that the public interest in disclosing personal information clearly outweighed any invasion of privacy that could result. All other disclosures were determined to clearly benefit the individual to whom the information related.

Disclosures pursuant to subparagraph 8(2)(m)(i):

• 9 disclosures were made in the interest of public safety.

Disclosures pursuant to subparagraph 8(2)(m)(ii):

• 10 disclosures were made to notify the relevant authorities of an individual’s detainment and arrest abroad.
• 1 disclosure was made to a family member on compassionate grounds.
• 4 disclosures were made to a family member as subject was distressed or missing abroad.
• 2 disclosures were made to a family member for next of kin notification.
• 1 disclosure was related to advising local authorities, or agencies regarding a child welfare case.
• 1 disclosure was made to a non-custodial parent for child safety purposes.
• 5 disclosures were related to advising authorities regarding a possible kidnapping.
• 4 disclosures were made to the local authorities to conduct a wellness check, and
• 65 disclosures were made to either the family, friend, doctor, or legal counsel of an individual requiring medical assistance.

In all instances notification to the Privacy Commissioner occurred after disclosure.

Monitoring Compliance

Ongoing Reporting

The ATIP Division prepares and distributes a weekly statistics report to the ATIP Division’s management team that tracks the number of requests that were received and closed, as well as any emerging trends and performance statistics. The report also allows for comparison of workload and completion rates in relation to the previous year to identify changes in ATIP processing.

Additionally, an active tasking report is generated and posted to the intranet weekly to identify all current active taskings within the Department. This report is available for all offices of primary interest (OPIs) to view and lists all open taskings by branch, highlighting late files.

During fiscal year 2023-2024, the director general and corporate secretary overseeing the administration of the access to information and privacy acts continued to send the ATIP Twice Monthly Performance Report to deputy ministers, assistant deputy ministers, and directors general, outlining the number of active taskings and compliance within each of the branches/special bureaus. The intent of this procedure is to sensitize senior management to the backlog of active taskings, thereby increasing compliance.

New in the reporting period, the ATIP Division implemented the ATIP Quarterly Report. ATIP Quarterly Reports are also sent to deputy ministers, assistant deputy ministers, and directors general, outlining branches and special bureaus' performance on completed taskings and compliance under the Access to Information Act and Privacy Act. This report's intent was to recognize the ATIP work completed throughout the year by branches and bureaus by keeping a close eye on their ATIP compliance rate.  

Limiting Inter-institutional Consultations

During the reporting period, the ATIP Division monitored superfluous inter-institutional consultations by having experienced ATIP team leaders oversee the relevant records before they were sent out for consultation. By doing so, ATIP team leaders were able to reduce the number of consultations sent to the other Government of Canada institutions and other organizations outside the Government of Canada, reducing the amount of time to process requests and not overburdening other departments with unnecessary consultations.

Frequently Requested Types of Information

Throughout fiscal year 2023-2024, Global Affairs Canada did not monitor or review frequently requested types of information for the purpose of making the information available by other means.

Privacy Protection in Contracting

In reviewing contracts, the Privacy Policy Team provides privacy clauses that are written to call out privacy protections and regulatory requirements within the statement of work and then mapped to service-level agreements to ensure there are no questions concerning data privacy responsibilities, breach response, incident response, media press releases on breaches, and other considerations, as if the vendor were part of the organization.

As per the information sharing agreements, the Privacy Policy group ensure privacy protection assisted by the TBS Guidance on Preparing Information Sharing Agreements Involving Personal Information.

Annex A: Designation Order

Annex B: Global Affairs Canada 2023-2024 Statistical Report

Statistical Report on the Privacy Act

Name of institution: Global Affairs Canada

Reporting period: 2023-04-01 to 2024-03-31

Section 1: Requests Under the Privacy Act

1.1 Number of requests received

1.2 Channels of requests

Section 2: Informal Requests

2.1 Number of informal requests

2.2 Channels of informal requests

2.3 Completion time of informal requests

2.4 Pages released informally

Section 3: Requests Closed During the Reporting Period

3.1 Disposition and completion time

3.2 Exemptions

3.3 Exclusions

3.4 Format of information released

3.5 Complexity

3.5.1 Relevant pages processed and disclosed for paper and e-record formats

3.5.2 Relevant pages processed by request disposition for paper and e-record formats by size of requests

3.5.3 Relevant minutes processed and disclosed for audio formats

3.5.4 Relevant minutes processed per request disposition for audio formats by size of requests

3.5.5 Relevant minutes processed and disclosed for video formats

3.5.6 Relevant minutes processed per request disposition for video formats by size of requests

3.5.7 Other complexities

3.6 Closed requests

3.6.1 Number of requests closed within legislated timelines

• Number of requests closed within legislated timelines: 285
• Percentage of requests closed within legislated timelines (%): 82.84883721

3.7 Deemed refusals

3.7.1 Reasons for not meeting legislated timelines

3.7.2 Request closed beyond legislated timelines (including any extension taken)

3.8 Requests for translation

Section 4: Disclosures Under Subsections 8(2) and 8(5)

Section 5: Requests for Correction of Personal Information and Notations

Section 6: Extensions

6.1 Reasons for extensions

6.2 Length of extensions

Section 7: Consultations Received From Other Institutions and Organizations

7.1 Consultations received from other Government of Canada institutions and other organizations

7.2 Recommendations and completion time for consultations received from other Government of Canada institutions

7.3 Recommendations and completion time for consultations received from other organizations outside the Government of Canada

Section 8: Completion Time of Consultations on Cabinet Confidences

8.1 Requests with Legal Services

8.2 Requests with Privy Council Office

Section 9: Complaints and Investigations Notices Received

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

10.1 Privacy Impact Assessments

• Number of PIAs completed: 2
• Number of PIAs modified: 0

10.2 Institution-specific and Central Personal Information Banks

Section 11: Privacy Breaches

11.1 Material Privacy Breaches Reported

• Number of material privacy breaches reported to TBS: 3
• Number of material privacy breaches reported to OPC: 3

11.2 Non-Material Privacy Breaches

• Number of non-material privacy breaches: 4

Section 12: Resources Related to the Privacy Act

12.1 Allocated Costs

12.2 Human Resources

Annex C: Global Affairs Canada 2023-2024 Supplemental Statistical Report

Supplemental Statistical Report on the Access to Information Act and the Privacy Act

Name of institution: Global Affairs Canada

Reporting period: 2023-04-01 to 2024-03-31

Section 1: Open Requests and Complaints Under the Access to Information Act

1.1 Enter the number of open requests that are outstanding from previous reporting periods.

1.2 Enter the number of open complaints with the Information Commissioner of Canada that are outstanding from previous reporting periods.

Section 2: Open Requests and Complaints Under the Privacy Act

2.1 Enter the number of open requests that are outstanding from previous reporting periods.

2.2 Enter the number of open complaints with the Privacy Commissioner of Canada that are outstanding from previous reporting periods.

Section 3: Social Insurance Number

Has your institution begun a new collection or a new consistent use of the SIN in 2023-24? No

Section 4: Universal Access under the Privacy Act

How many requests were received from foreign nationals outside of Canada in 2023-24? 234