Annual Report on the Administration of the Privacy Act 2022-2023

April 1, 2022 to March 31, 2023

Accessibility

As of the date of publication, this document has been verified for accessibility.

If you encounter any issues with this document, please contact the author.

GCDoc# 16313050 

Table of Contents

• Introduction
• Part I – About the Public Service Commission of Canada
• Part II – Annual report on the Privacy Act
• 1. Organization structure and delegation
  • 1.1 Delegation order
  • 1.2 Organizational structure
• 2. 2022-2023 Performance
  • 2.1 Requests under the Privacy Act
  • 2.2 Disposition of requests completed
  • 2.3 Exemptions and exclusions invoked
  • 2.4 Completion time and extensions
  • 2.5 Format of information released
  • 2.6 Inter-organizational consultations
  • 2.7 Informal requests
  • 2.8 Impact of COVID-19
• 3. Summary of ATIP Office activities
  • 3.1 Policies, guidelines and procedures
  • 3.2 Advice, training and awareness
  • 3.3 Initiatives and projects to improve privacy
  • 3.4 Collection, use and disclosure of personal information
  • 3.5 Privacy breaches
  • 3.6 Monitoring compliance
• 4. Complaints
• 5. Privacy Impact Assessments
• 6. Costs
• Annex A – Delegation instrument
• Annex B – 2022-2023 Annual Privacy Act Statistical Report
• Annex C – Supplemental Statistical Report on the Access to Information Act and the Privacy Act

Introduction

The Privacy Act (the Act) came into force on July 1, 1983.

The Act provides the legal framework for the collection, retention, use, disclosure, disposition, and accuracy of personal information in the administration of programs and activities by federal government institutions. It also provides Canadian citizens and permanent residents with a right of access to, and correction of, their own personal information under the control of a federal institution with certain specific and limited exceptions.

Section 72 of the Act requires that the head of every federal government institution prepare an annual report, for submission to Parliament, on the administration of the Act within the institution. The report must be tabled before each House of Parliament within the first 15 sitting days of the parliamentary session after September 1.

Prepared and tabled in Parliament in accordance with section 72 of the Act, this annual report provides a summary of the administration of the Act by the Public Service Commission of Canada for the 2022–2023 fiscal year.

This report is also available on the Publications page of the Public Service Commission of Canada’s website.

Part I – About the Public Service Commission of Canada

Raison d’être, mandate and role: who we are and what we do

Raison d’être

The President of the King’s Privy Council for Canada is identified as the appropriate minister for the Public Service Commission of Canada (PSC) in accordance with the Financial Administration Act. The PSC reports independently on its mandate to Parliament.

Through collaboration with departments and agencies, the PSC is dedicated to building tomorrow’s public service that is based on excellence and is representative of Canada’s diversity. It safeguards non-partisanship and promotes and protects merit and the use of both official languages in a staffing and recruitment context. It supports departments and agencies in recruiting talented people from coast to coast using innovative and modern services, tools, and practices.

Mandate and role

Under the delegated staffing system set out in the Public Service Employment Act, the PSC fulfills its mandate by promoting and safeguarding a non-partisan, merit-based and representative public service that serves all Canadians. It does this by:

• supporting departments and agencies in hiring qualified individuals into and within the public service
• overseeing and ensuring the integrity of public service hiring
• protecting the non-partisan nature of the public service while respecting employees’ rights to participate in political activities
• delivering recruitment programs and assessment services

Programs

As per the Service Inventory, the PSC delivers services via four programs, all of which support the delivery of its departmental results. While programs correspond closely to the PSC sectors, they were not defined based on the organizational structure. In fact, a program’s departmental result can be the result of work accomplished in more than one sector. Each of the PSC’s programs is headed by a vice-president who is responsible for achieving results.

Policy Direction and Support

The Policy Direction and Support Program exists to support departments and agencies in hiring qualified individuals into and within the public service, in experimenting and innovating with their staffing approaches and supporting strategies to help them both meet their business needs and achieve their diversity and employment equity objectives. The Policy Direction and Support Program establishes government-wide direction on staffing through regulations and policy. This program also provides guidance to organizations to enable legislative, regulatory and policy compliance, including providing expert advice. The program also assesses public servants' requests for permission to become candidates for elected office and conducts outreach to ensure public servants know their legal rights and responsibilities regarding political activities.

Recruitment and Assessment Services

The Recruitment and Assessment Services Program exists to support departments and agencies in the hiring of qualified individuals into and within the public service, helping to shape a workforce reflecting Canada’s diversity. The program includes the delivery of recruitment programs, student programs, assessment and accommodation services and the administration of legislated priority entitlements. Through outreach and the use of modern tools, online systems, and technology, it reduces barriers for Canadians accessing public service jobs. This program also collaborates with departments and agencies to create and implement innovative staffing and assessment approaches to meet the Government of Canada’s strategic recruitment priorities and renew the public service.

Oversight and Monitoring

The Oversight and Monitoring Program exists to ensure the integrity of the merit-based public service hiring process and to identify areas for continuous improvement of the public service. The program performs audits and investigations and conducts surveys to monitor organizational compliance with staffing legislation, regulations, policies, and to provide a system-wide view of the public service staffing environment. This program also monitors and analyzes hiring data and conducts research to provide departments and agencies, and Canadians with an informed view of the dynamics of public service hiring.

Internal Services

Internal Services are those groups of related activities and resources that the Federal Government considers to be services in support of programs and/or required to meet corporate obligations of an organization. Internal Services refer to the activities and resources of 10 distinct services that support program delivery in the organization, regardless of the Internal Services delivery model in a department. These services are: Acquisition Management Services, Communications Services, Financial Management Services, Human Resources Management Services, Information Management Services, Information Technology Services, Legal Services, Materiel Management Services, Management and Oversight Services, Real Property Management Services.

Part II – Annual report on the Privacy Act

1. Organizational structure and delegation

The PSC has a stable and effective Access to Information and Privacy (ATIP) program. The ATIP Office works closely with PSC employees to make sure all requests are handled on time. It relies on open communication with PSC sectors, government organizations, third parties and requestors to ensure optimal application of the Act.

1.1 Delegation order

The President of the PSC is designated as the head of the institution for the administration of the Act. Pursuant to section 73 of the Act, the head of an institution may delegate any of their powers, duties or functions under the Act by signing an order authorizing one or more officers or employees at the appropriate level to exercise or perform the powers, duties or functions of the head specified in the order.

Most of the powers, duties, and functions of the President under the Act are delegated to the Director, Sector Management and ATIP Coordination. The Director is the designated ATIP Coordinator for the PSC. Partial delegation is also granted to the ATIP Manager, who has operational responsibility for the application of the Act, as well as to the Chief Security Officer, for the disclosure of personal information pursuant to paragraph 8(2)(m) of the Act. This delegation is limited to specific circumstances related to security when the information was obtained outside PSC program activities.

Refer to Annex A – Delegation instrument.

1.2 Organizational structure

ATIP Office

The ATIP Office supports the ATIP Coordinator in administering the provisions of the Act and related TBS policies for the PSC. Housed in the Chief Financial Officer and Vice-President’s Office of the Corporate Affairs Sector, the ATIP Office is currently supported by a Manager, a Senior Advisor and 2 Analysts.

The ATIP Coordinator is responsible for developing, reviewing and implementing effective policies, guidelines, systems and procedures to ensure requests are processed as required under the Act and as directed by Treasury Board of Canada Secretariat (TBS) policies and directives. The activities of the Coordinator include:

• responding to requests made under the Act
• acting as spokesperson for the PSC in dealings with TBS, the Office of the Privacy Commissioner and other government departments and agencies on matters related to the Act
• responding to consultation requests submitted by other government institutions with respect to PSC documents
• reviewing information collected in accordance with the Policy on Communications and Federal Identity and the Mandatory Procedures for Public Opinion Research
• preparing the Annual Report to Parliament on the administration of the Actand other statutory reports, as well as other material that may be required by central agencies
• promoting awareness and providing advice to PSC employees to ensure that the obligations of the Act and TBS policies are met, and assessing their impact on various program initiatives
• monitoring the PSC’s compliance with the Act, regulations and other relevant policies and procedures

In addition to receiving and processing requests made under the Act, the ATIP Office provides general and personalized training sessions to employees, maintains policies and procedures, provides support to sector liaison officers, and makes sure employees understand their roles, responsibilities, and obligations under the Act.

The ATIP Office Manager is responsible for administering the departmental privacy protection program, as well as supporting activities of the PSC by providing guidance and reviewing privacy breaches and privacy impact assessments. The Senior Advisor supports the Manager in reviewing requests for personal information and in conducting regular reviews of the departmental Info Source chapter and helps PSC employees manage privacy breaches and disclosures of personal information.

The Analysts are responsible for processing requests and consultations under the Act, preparing responses, and supporting all other ATIP responsibilities. They provide privacy advice and support in the evaluation of program activities, and help create privacy compliance documents, such as privacy notice statements and Privacy Impact Assessments (PIA).

The services of a subject matter expert are retained through a professional services contract on an as-needed basis, to assist in the writing and reviewing of PIAs. The PSC did not enter into any new service agreements for ATIP services with other government institutions during the reporting period.

Liaison Officers

The ATIP Office processes requests with the help of liaison officers, who are employees across the organization with extensive knowledge of their respective sector’s activities, which enables them to act as the point of contact between their area and the ATIP Office. There is a liaison officer for each sector of the PSC, as well as for the Corporate Secretariat and the Office of the Chief Audit and Evaluation Executive.

Liaison officers play an important role in making sure the PSC thoroughly searches its record holdings when handling requests. They also:

• assign program experts to search for relevant records
• advise if there are other offices of primary interest
• inform the ATIP Office of any issues regarding specific requests (delays, interference with operations, need to consult)
• deliver relevant records, with sector recommendations, to the ATIP Office

2. 2022-2023 Performance

In the 2022-23 reporting period, the PSC received a total of 78 requests under the Access to Information Act and the Privacy Act. This is a 7% decrease in overall volume received compared to the previous year. Excluding the limited surge in requests under the Privacy Act observed in 2015–16 and 2016-17, the overall number of requests received during the reporting period remains comparable to the average annual volume received by the PSC over the last 10 reporting periods.

2.1 Requests under the Privacy Act

From April 1, 2022 to March 31, 2023, the PSC received 44 requests under the Act, in addition to 4 requests that were carried over from the previous period. This represents a 10% increase in privacy requests received compared with the previous year.

The PSC closed 47 privacy requests during the reporting period. A total of 18, 829 pages were reviewed, of which 11,439 were disclosed in whole or in part. At the end of the reporting period, 1 request was still being processed and was carried forward to the next period.
These 47 requests touched on topics that tend to recur from year to year:

• 16 (36%) pertained to Second Language Evaluation
• 12 (27%) pertained to Human Resources (for the most part, applicants were looking for information related to staffing documents, priority entitlement administration and assessments) 
• 7 (16%) were for investigations conducted under the Public Service Employment Act
• 2 (5%) were for other personal information held by the PSC
• 7 (16%) were requests for information not held by the PSC (these requestors received information to help them better direct their enquiries)

2.2 Disposition of requests completed

For the 47 requests closed during this reporting period, information was released in whole or in part in 32 cases, representing 68% of the total volume. Of the remaining requests, 7 were abandoned by the applicant (15%) and 8 produced no records (17%).

2.3 Exemptions and exclusions invoked

Sections 18 to 28 of the Act set out exemptions to protect information pertaining to a particular public or private interest. During the reporting period, the exemption used most often was to protect personal information of others (section 26).

No exclusions were invoked.

2.4 Completion time and extensions

Of the 47 requests closed during the reporting period:

• 20 (43%) were completed within the initial 15 days or less
• 19 (40%) were completed within 30 days or less
• 6 (13%) were completed within 31 to 60 days
• 1 (2%) was completed within 61 to 120 days
• 1 (2%) was completed within 181 to 365 days

The 30-day response time required by law may be extended by a maximum of 30 days under multiple provisions of section 15 of the Act. During the reporting period, the extension provision was invoked 6 times due to interference with operations ( requests producing a large volume of pages to review).

All requests were closed within legislated timelines. When the due date of a request falls on a weekend or a statutory holiday, the request is still deemed to be completed on time if the response is issued during the next available working day. Two such situations were recorded for the current reporting period.

2.5 Format of information released

All information disclosed during the reporting period was provided in electronic format.

2.6 Inter-organizational consultations

The PSC received no requests for consultation on privacy requests from other government departments and agencies during this reporting period, and none were carried over from the previous reporting period.

The PSC did not consult other government departments and agencies during this reporting period.

2.7 Informal requests

To improve and facilitate access, the PSC promotes informal methods of access whenever possible. Requestors may, in some cases, obtain access to their personal information on an informal basis by contacting the manager of the program area that controls the records. In these instances, the ATIP Office provides assistance and advice, as required.

No informal requests under the Act were received by the ATIP Office during the reporting period.

2.8 Impact of COVID-19

During the reporting period, the COVID-19 pandemic did not significantly disrupt the administration of the Actat the PSC. The ATIP Office received most requests via the ATIP Online Request Service and was enabled to electronically process requests before the pandemic. Virtual approval processes implemented at the start of the COVID-19 pandemic continued to prove to be efficient and are taken into consideration in the planning of a hybrid work environment. The ATIP Office continues to rely on a secure file transfer platform to provide requestors and other government institutions with responses to their requests and consultations.

However, the PSC continued to experience delays in advancing previously planned work relative to the review of PSC privacy policies and the development of PIAs due to shifting priorities within the organization and the reduced availability of resources (refer to Section 5 of this report for more information on PIAs).

3. Summary of ATIP Office activities

3.1 Policies, guidelines and procedures

In this reporting period, no policies, guidelines, procedures or other key documents were developed or updated by the ATIP Office.

3.2 Advice, training and awareness

Advice

In addition to processing requests under the Act, the ATIP Office advises PSC managers and employees on a variety of issues related to the Act.

During the reporting period, the ATIP Office responded to 96 internal consultation requests, which pertained mainly to:

• documents to be published on the Open Government Portal
• audit reports, responses to parliamentary questions and other documents to be reviewed prior to publication to make sure information is released in accordance with the Act
• Privacy Notice Statements

Training and awareness

The ATIP Office maintains a core training program for PSC supervisors and managers. The main goal of this training program is to ensure that supervisors and managers are fully aware of their responsibilities under the Act and related internal policies.

The Canada School of Public Service’s self‑directed course “Fundamentals of Access to Information and Privacy” is also actively recommended for all employees.

During the reporting period, the ATIP office held a privacy awareness session for the summer cohort of students, targeted privacy awareness sessions for specific business lines, as well as information sessions on privacy impact assessments.

3.3 Initiatives and projects to improve privacy

Tracking system and imaging software

The ATIP Office continues to use AccessPro Case Management and AccessPro Redaction tools. During the reporting period, it also integrated ATIP Online Management Tool into its workflow. This change caused little-to-no disruptions to the activities of the ATIP Office and provides users, with a simple online tool to make requests under the Act, manage their ongoing and completed requests and track the progress of their requests.

Review of documents

The ATIP Office regularly reviews documents prior to disclosure in order to identify personal information that may be involved. Moreover, the ATIP Office provides information, guidance and advice to the PSC to ensure compliance with the Act and associated policies. It also reviews and makes recommendations regarding personal information in memoranda of understanding and information-sharing agreements as well as administrative investigation reports (such as reports on violence or harassment in the workplace) prior to disclosure to the concerned parties. The recommendations aim to ensure compliance with the Act.

Open government

The PSC Open Government Implementation Plan outlines a set of activities and deliverables to meet its requirements under the TBS Directive on Open Government. Through the Plan, the PSC develops the internal mechanisms it needs to maximize the release of government information and data of business value. To ensure protection of sensitive information before it is published and compliance with the Act, the ATIP Office provides ongoing strategic advice and reviews information.

In 2022-2023, the PSC Open Government Secretariat continued piloting its initiative to increase awareness and provide tools for determining whether governance documents are eligible for publication on the Open Government Portal. The intent of this initiative is to encourage increased proactive publication of PSC information that could be of value to Canadians.

3.4 Collection, use and disclosure of personal information

Personal information banks

The PSC currently has 21 active institution-specific personal information banks. During this reporting period, the ATIP Office received no request to create or update personal information banks.

The PSC does not have any exempt banks.

Public Interest Disclosures

Subsection 8(2) of the Act describes the conditions in which personal information under the control of a government institution may be disclosed.

Paragraph 8(2)(e) of the Act applies to disclosures to designated investigative bodies for the purpose of enforcing the laws of Canada or a province, or to conduct lawful investigations. The PSC did not invoke this provision on any occasion during the reporting period.

Paragraph 8(2)(m) of the Act applies to disclosures when, in the opinion of the head of the institution, reasons of public interest clearly outweigh any invasion of privacy that could result, or if the person concerned would clearly benefit from the disclosure. The PSC invoked this provision once during the reporting period and provided advance notice to the Office of the Privacy Commissioner, as required by subsection 8(5) of the Act. Disclosure was made to another government department with the intent of ensuring the physical and mental health and well-being of a public service employee who made alarming comments about themselves in the context of an investigation interview.

3.5 Privacy breaches

A total of 10 privacy incidents were documented during the reporting period, of which 9 were determined to be privacy breaches (immaterial). All these cases involved human error. Privacy awareness training was provided to the program areas where breaches occurred in order to strengthen knowledge and avoid future privacy incidents.

As its Policy on Privacy Breaches does not distinguish between material and immaterial privacy breaches, the PSC promotes transparency by informing the Office of the Privacy Commissioner and TBS of all privacy breaches.

3.6 Monitoring compliance

The PSC ATIP Office relies on software tools, namely AccessPro Case Management, to track all requests as they are received, analyzed and completed. For each request, information is input to document every step taken throughout processing, including any discussions with the requestor or with an office of primary interest (OPI) to clarify elements of the request. This process also allows for scheduling and monitoring of time taken to complete a request and to plan for any potential extensions. The ATIP Office assists the OPIs throughout the information retrieval process and takes steps to ensure timelines are met.

Employees of the ATIP Office meet regularly to discuss ongoing requests, and the ATIP Coordinator is briefed on workload and other related issues on a weekly basis.

4. Complaints

If requestors are not satisfied with the response provided to their request, they have the option to file a complaint with the Office of the Privacy Commissioner. This recourse process and related contact information are provided to every requestor in the response letter sent at the close of each request. At the end of the reporting period, a total of 7 complaints against the PSC were active, including 5 new complaints accepted by the Office of the Privacy Commissioner and 2 that were carried over from previous years. Two other complaints carried over from previous years were closed during the reporting period.

When a requestor alerts the PSC that they are unhappy with the response to their request, the ATIP Office can take measures to resolve the situation informally, for example by conducting a new search or by disclosing additional records after supplemental analysis. Most complaints are resolved in this manner; however, they are not tracked by the PSC as complaints and are therefore not reflected in yearly statistics.

5. Privacy Impact Assessments

The Directive on Privacy Impact Assessments came into effectin April 2010. The goal of the directive is to allow government institutions to identify whether a program or a service-delivery initiative involving the collection, use or disclosure of personal information, as defined in the Act, complies with privacy principles. PIAs also aim to avoid or mitigate any identifiable risks to privacy. Supported by a contract for consultant services specialized in PIA writing, the ATIP Office provides advice and guidance to the PSC throughout the PIA production process, including the review of PIA reports and liaison with the Office of the Privacy Commissioner.

While most of its programs and activities predate the Directive on Privacy Impact Assessment, the PSC recognizes the importance of identifying and mitigating privacy risks. In 2019, the PSC undertook a five-year plan to conduct privacy assessments of all programs and activities that collect and use personal information. This plan will be reviewed in light of ongoing pandemic-related delays.

No PIAs were initiated or completed during the reporting period. However, work continued on 2 assessments initiated during previous reporting periods:

• Personnel Psychology Centre PIA
• GC Jobs Transformation PIA

The ATIP Office continues to support the program areas to finalize these reports.

6. Costs

During the reporting period, the PSC incurred costs of $193,062 for salaries to ensure the administration of the Act, which corresponds to 1. 99 full-time equivalent. This represents a 39% increase compared to the previous reporting period and is the result of staffing vacant positions during the reporting period.

Additionally, a total cost of $2,531 was incurred for professional services during this reporting period, to acquire PIA writing expertise. This equates to 0.03 full-time equivalent.

Annex A – Delegation Instrument

Privacy Act – Delegation Order

The President of the Public Service Commission of Canada, as head of the government institution, hereby designates pursuant to section 73 of the Privacy Act (the Act), the persons holding the positions set out below, or the persons occupying on an acting basis those positions, to exercise the powers, duties or functions of the President vested in them by the Act.

This delegation is effective as of December 22, 2020.

Appendix A

Privacy Act

Privacy Regulations

Annex B – 2022–2023 Privacy Act Statistical Report

Name of institution: Public Service Commission of Canada

Reporting period: April 1, 2022 to March 31, 2023

Section 1: Requests Under the Privacy Act

1.1 Number of requests received

1.2 Channels of requests

Section 2: Informal requests

2.1 Number of informal requests

2.2 Channels of informal requests

2.3 Completion time of informal requests

2.4 Pages released informally

Section 3: Requests Closed During the Reporting Period

3.1 Disposition and completion time

3.2 Exemptions

3.3 Exclusions

3.4 Format of information released

3.5 Complexity

3.5.1 Relevant pages processed and disclosed for paper and e-record formats

3.5.2 Relevant pages processed by request disposition for paper and e-record formats by size of requests

3.5.3 Relevant minutes processed and disclosed for audio formats

3.5.4 Relevant minutes processed and disclosed for audio formats by size of requests

3.5.5 Relevant minutes processed and disclosed for video formats

3.5.6 Relevant minutes processed per request disposition for video formats by size of requests

3.5.7 Other complexities

3.6 Closed requests

3.6.1 Number of requests closed within legislated timelines

3.7 Deemed refusals

3.7.1 Reasons for not meeting legislated timelines

3.7.2 Requests closed beyond legislated timelines (including any extension taken)

3.8 Requests for translation

Section 4: Disclosures Under Subsections 8(2) and 8(5)

Section 5: Requests for Correction of Personal Information and Notations

Section 6: Extensions

6.1  Reasons for extensions and disposition of requests

6.2 Length of extensions

Section 7: Consultations Received From Other Institutions and Organizations

7.1 Consultations received from other Government of Canada institutions and other organizations

7.2 Recommendations and completion time for consultations received from other Government of Canada institutions

7.3 Recommendations and completion time for consultations received from other organizations outside the Government of Canada

Section 8: Completion Time of Consultations on Cabinet Confidences

8.1 Requests with Legal Services

8.2 Requests with Privy Council Office

Section 9: Complaints and Investigations Notices Received

Section 10: Privacy Impact Assessments (PIA) and Personal Information Banks (PIB)

10.1 Privacy Impact Assessments

10.2 Institution-specific and Central Personal Information Banks

Section 11: Privacy Breaches

11.1 Material Privacy Breaches reported

11.2 Non-Material Privacy Breaches

Section 12: Resources Related to the Privacy Act

12.1  Allocated Costs

12.2  Human Resources

Annex C – Supplemental Statistical Report on the Access to Information Act and the Privacy Act

Name of institution: Public Service Commission of Canada

Reporting period: April 1, 2022 to March 31, 2023

Section 1: Capacity to Receive Requests Under the Access to Information Act and the Privacy Act

1.3 Enter the number of weeks your institution was able to receive ATIP requests through the difference channels.

Section 2: Capacity to Process Records Under the Access to Information Act and the Privacy Act

2.1 Enter the number of weeks your institution was able to process paper records in different classification levels.

2.2 Enter the number of weeks your institution was able to process electronic records in different classification levels.

Section 3: Open Requests and Complaints Under the Access to Information Act

3.1 Enter the number of open requests that are outstanding from previous reporting periods.

3.2 Enter the number of open complaints with the Information Commissioner of Canada that are outstanding from previous reporting periods.

Section 4: Open Requests and Complaints Under the Privacy Act

4.1 Enter the number of open requests that are outstanding from previous reporting periods.

4.2 Enter the number of open complaints with the Privacy Commissioner of Canada that are outstanding from previous reporting periods.

Section 5: Social Insurance Number

Section 6: Universal Access Under the Privacy Act