Annual Report on the Administration of the Privacy Act 2021-2022

Introduction

The Privacy Act (the Act) came into force on July 1, 1983.

The Act provides the legal framework for the collection, retention, use, disclosure, disposition, and accuracy of personal information in the administration of programs and activities by federal government institutions. It also provides Canadian citizens and permanent residents with a right of access to, and correction of, their own personal information under the control of a federal institution with certain specific and limited exceptions.

Section 72 of the Act requires that the head of every federal government institution prepare an annual report, for submission to Parliament, on the administration of the Act within the institution. The report must be tabled before each House of Parliament within the first 15 sitting days of the parliamentary session after September 1.

Prepared and tabled in Parliament in accordance with section 72 of the Act, this annual report provides a summary of the administration of the Act within the Public Service Commission of Canada for the 2021–2022 fiscal year.

This report is also available on the Publications page of the Public Service Commission of Canada’s website.

Part I – About the Public Service Commission of Canada

Raison d’être, mandate and role: who we are and what we do

Raison d’être

The President of the Queen’s Privy Council for Canada is identified as the appropriate minister for the Public Service Commission of Canada (PSC) in accordance with the Financial Administration Act and is responsible for tabling the PSC’s annual report under the Public Service Employment Act. The PSC reports independently on its mandate to Parliament.

Through collaboration with departments and agencies, it is dedicated to building tomorrow’s public service that is based on excellence and is representative of Canada’s diversity. It safeguards non-partisanship and promotes and protects merit and the use of both official languages in a staffing and recruitment context. It supports departments and agencies in recruiting talented people from coast to coast using innovative and modern services, tools, and practices.

Mandate and role

Under the delegated staffing system set out in the Public Service Employment Act, the Public Service Commission fulfills its mandate by promoting and safeguarding a non-partisan, merit-based and representative public service that serves all Canadians. We do this by:

• supporting departments and agencies in hiring qualified individuals into and within the public service
• overseeing and ensuring the integrity of public service hiring
• protecting the non-partisan nature of the public service while respecting employees’ rights to participate in political activities
• delivering recruitment programs and assessment services

Programs

As per the Service Inventory, the PSC offered its services via four programs during the reporting period, all of which support the delivery of its departmental results. While programs to the PSC sectors, they were not designed to reflect that structure. For instance, a program’s departmental result can rely on the work of more than one sector. Each of the PSC’s programs is headed by a vice-president who is responsible for ensuring success.

Policy Direction and Support

The Policy Direction and Support Program exists to support departments and agencies in hiring qualified individuals into and within the public service, in experimenting and innovating with their staffing approaches and supporting strategies to help them both meet their business needs and achieve their diversity and employment equity objectives. The Policy Direction and Support Program establishes government-wide direction on staffing through regulations and policy. This program also provides guidance to organizations to enable legislative, regulatory and policy compliance, including providing expert advice. The program also assesses public servants' requests for permission to become candidates for elected office and conducts outreach to ensure public servants know their legal rights and responsibilities regarding political activities.

Recruitment and Assessment Services

The Recruitment and Assessment Services Program exists to support departments and agencies in the hiring of qualified individuals into and within the public service, helping to shape a workforce reflecting Canada’s diversity. The program includes the delivery of recruitment programs, student programs, assessment and accommodation services and the administration of legislated priority entitlements. Through outreach and the use of modern tools, online systems, and technology, it reduces barriers for Canadians accessing public service jobs. This program also collaborates with departments and agencies to create and implement innovative staffing and assessment approaches to meet the Government of Canada’s strategic recruitment priorities and renew the public service.

Oversight and Monitoring

The Oversight and Monitoring Program exists to ensure the integrity of the merit-based public service hiring process and to identify areas for continuous improvement of the public service. The program performs audits and investigations and conducts surveys to monitor organizational compliance with staffing legislation, regulations, policies, and to provide a system-wide view of the public service staffing environment. This program also monitors and analyzes hiring data and conducts research to provide departments and agencies, and Canadians with an informed view of the dynamics of public service hiring.

Internal Services

Internal Services are those groups of related activities and resources that the Federal Government considers to be services in support of programs and/or required to meet corporate obligations of an organization. Internal Services refer to the activities and resources of ten distinct services that support program delivery in the organization, regardless of the Internal Services delivery model in a department. These services are: Acquisition Management Services, Communications Services, Financial Management Services, Human Resources Management Services, Information Management Services, Information Technology Services, Legal Services, Materiel Management Services, Management and Oversight Services, Real Property Management Services.

Part II – Annual report on the Privacy Act

1. Organization structure and delegation

1.1 Delegation order

The President of the PSC is designated as the head of the institution for the administration of the Privacy Act (the Act).

Pursuant to section 73 of the Act, the head of an institution may delegate any of their powers, duties or functions under the Act by signing an order authorizing one or more officers or employees at the appropriate level to exercise or perform the powers, duties or functions of the head specified in the order.

Most of the powers, duties, and functions of the President under the Act are delegated to the Director, Sector Management and ATIP Coordination. The Director is the designated Access to Information and Privacy (ATIP) Coordinator for the PSC.

Operational responsibility for the application of the Act resides with the ATIP Manager, who has partial delegation. Partial delegation under the Act is also granted to the Chief Security Officer, to disclose personal information pursuant to paragraph 8(2)(m) of the Act. This delegation is limited to specific circumstances related to security when the information was obtained outside PSC program activities.

Refer to Annex A – Delegation instrument.

1.2 ATIP Coordinator

The ATIP Coordinator is responsible for developing, coordinating and implementing effective policies, guidelines, systems and procedures to ensure requests are processed efficiently under the Act and as directed by Treasury Board of Canada Secretariat (TBS) policies and directives. The activities of the Coordinator include:

• responding to requests made under the Act
• acting as spokesperson for the PSC in dealings with TBS, the Office of the Information Commissioner, the Office of the Privacy Commissioner and other government departments and agencies on matters related to the Act
• responding to consultation requests submitted by other federal institutions with respect to PSC documents
• reviewing information collected in accordance with the Policy on Communications and Federal Identity and the Mandatory Procedures for Public Opinion Research
• preparing the Annual Report to Parliament on the administration of the Privacy Act and other statutory reports, as well as other material that may be required by central agencies
• promoting awareness and providing advice to our employees to ensure that the obligations of the Act and TBS policies are met, and assessing their impact on various program initiatives
• monitoring the PSC’s compliance with the Act, regulations and other relevant policies and procedures

1.3 Access to Information and Privacy Office

The Access to Information and Privacy Office (the ATIP Office) supports the ATIP Coordinator in administering the provisions of the Act and related TBS policies for the PSC. The Office currently houses one Manager, one Senior Advisor and two Analysts. The Office is part of the Corporate Affairs Sector.

The ATIP Office provides general and personalized training sessions to employees. It also reviews its policies and procedures to improve support to sector liaison officers and help them to better understand their roles, responsibilities, and obligations in processing requests under the Act.

The Senior Advisor is responsible for administering the departmental privacy protection program, as well as supporting activities of the PSC by providing guidance and reviewing privacy breaches and privacy impact assessments. In addition, the Senior Advisor supports the Manager in reviewing requests for personal information from the public and employees, and by conducting regular reviews of the departmental Info Source chapter.

The Analysts are responsible for processing requests and consultations under the Act, preparing responses to complaints and supporting all other ATIP responsibilities. They provide privacy advice and support in the evaluation of program activities, and help create privacy compliance documents, such as privacy notice statements and privacy impact assessments. They also help departmental officials manage privacy breaches and disclosures of personal information. 

The PSC did not enter into any new service agreements for ATIP services for or from other government institutions during the reporting period.

1.4 Liaison Officers

The ATIP Office processes requests with the help of liaison officers. There is a liaison officer for each sector of the PSC, as well as for the Corporate Secretariat and the Office of the Chief Audit and Evaluation Executive. Liaison officers have extensive knowledge of their respective sector’s activities, which enables them to act as the point of contact between their area and the ATIP Office.

Liaison officers play an important role in making sure the PSC thoroughly and fully searches its record holdings when handling requests. They also:

• assign program experts to search for relevant records
• advise if there are other offices of primary interest
• inform the ATIP Office of any issues regarding specific requests (delays, interference with operations, need to consult)
• deliver relevant records, with sector recommendations, to the ATIP Office

2. 2021-2022 Performance

In the 2021-22 reporting period, the PSC received a total of 84 requests under the Access to Information Act and the Privacy Act. This is a 24% increase in volume received compared to the previous year. Excluding the limited surge observed in 2015–16 and 2016-17, the number of requests received during the reporting period is comparable with the average annual volume received by the PSC over the last 10 reporting periods.

Text version

Year	Received	Completed
2012-2013	101	96
2013-2014	73	82
2014-2015	56	53
2015-2016	1216	1097
2016-2017	3188	3303
2017-2018	151	158
2018-2019	124	124
2019-2020	106	106
2020-2021	68	67
2021-2022	84	85

2.1 Requests under the Privacy Act

From April 1, 2021 to March 31, 2022, the PSC received 40 requests under the Act, in addition to 3 requests that were carried over from the previous period. This represents a 33% increase in requests received compared with the previous year.

Text version

Year	Received	Completed
2012-2013	32	31
2013-2014	18	19
2014-2015	16	17
2015-2016	1036	919
2016-2017	3062	3175
2017-2018	51	54
2018-2019	49	47
2019-2020	64	62
2020-2021	30	32
2021-2022	40	39

The PSC closed 39 requests during the reporting period. A total of 18,670 pages were reviewed. At the end of the reporting period, 4 requests were still being processed and were carried forward to the next period.

These 39 requests touched on similar topics as those received in previous years:

• 12 (31%) pertained to second language testing
• 11 (28%) were for investigations conducted under the Public Service Employment Act
• 9 (23%) pertained to staffing activities (for the most part, applicants were looking for information related to staffing documents, priority entitlement administration and assessments)  
• 5 (13%) were for personal information held by the PSC
• the remaining 2 requests (5%) dealt with various subjects

2.2 Disposition of requests completed

For the 39 requests closed during this reporting period, information was released in whole or in part in 29 cases, representing 74% of the total volume. Of the remaining requests, 7 were abandoned by the applicant (18%) and 3 produced no records (8%).

Text version

Disposition	Percentage
All disclosed	15%
Disclosed in part	59%
No records exist	8%
Abandoned	18%

2.3 Exemptions and exclusions invoked

Sections 18 to 28 of the Act set out exemptions to protect information pertaining to a particular public or private interest. During the reporting period, the exemptions used most often were to protect personal information of others and ongoing investigations (section 26 and paragraph 22(1)(b), respectively).

During this reporting period, the PSC did not invoke sections 69 and 70 of the Act, which outline certain types of information that it does not apply to:

• published material
• library and museum material
• material placed in Library and Archives Canada by or on behalf of third parties
• some materials relating to the Canadian Broadcasting Corporation and Cabinet confidences

2.4 Completion time and extensions

Of the 39 requests closed during the reporting period:

• 10 (26%) were completed within the initial 15 days or less
• 15 (38%) were completed within 30 days or less
• 10 (26%) were completed within 31 to 60 days
• 4 (10%) were completed within 61 to 120 days

The 30-day response time required by law may be extended under section 15 of the Act. A request may be extended in accordance with multiple provisions of this section. During the reporting period, the extension provision was invoked 10 times due to interference with operations (workload) and 1 time due to a need for external consultation.

All requests were closed within legislated timelines. When the due date of a request falls on a weekend or a statutory holiday, the request is still deemed to be completed on time if the response is issued during the next available working day.

2.5 Translation

The PSC did not receive any requests for translation of personal information pursuant to paragraph 17(2)(b) of the Act.

2.6 Format of information released

All information disclosed during the reporting period was provided in electronic format.

2.7 Corrections and notations

The PSC received no requests for corrections, in accordance with subsection 12(2) of the Act. 

2.8 Inter-organizational consultations

The PSC received no requests for consultation from other government departments and agencies during this reporting period, and none were carried over from the previous reporting period. No consultations were outstanding at the end of the period.

The PSC did not consult other government departments and agencies during this reporting period.

2.9 Informal requests

To improve and facilitate access, the PSC promotes informal methods of access whenever possible. Requesters may, in some cases, obtain access to their personal information on an informal basis by contacting the manager of the program area that controls the records. In these instances, the ATIP Office provides assistance and advice, as required.

No informal requests under the Act were received by the ATIP Office during the reporting period.

2.10 Impact of COVID-19

The ongoing COVID-19 pandemic has not significantly disrupted the administration of the Actat the PSC, specifically the processing of requests. The ATIP Office receives most requests via the ATIP Online Request Service and has been enabled to electronically process requests since before the pandemic. Virtual approval processes implemented at the start of the COVID-19 pandemic continued to prove to be efficient and are being integrated into the planning of a hybrid work environment. The ATIP Office continued to rely on a secure file transfer platform to provide requesters and other federal institutions with responses to their requests and consultations.

However, the pandemic has had some indirect impacts on other Privacy-related activities. Of note, there are significant delays in the completion of previously planned privacy impact assessments (PIA) due to shifting priorities within the PSC and the reduced availability of resources (refer to Section 5 of this report for more information on PIAs).

3. Summary of ATIP Office activities

3.1 Development of policies, directives, guidelines and other key documents

In this reporting period, the ATIP Office continued documenting its processes and reviewing internal policies, with a view to making adjustments and improving efficiency. An increase in overall demand and the departure of a team member further delayed completion of this activity, as priority was given to the processing of requests and internal consultations.

3.2 Advice, training and awareness

Advice

In addition to processing requests under the Act, the ATIP Office advises PSC managers and employees, as well as other organizations and members of the public, on a variety of issues and questions related to the Act.

Requests for guidance and advice were of the following nature:

• reviewing memoranda of understanding and information-sharing agreements to ensure compliance with the requirements of the Act and associated policies
• reviewing audit reports, responses to parliamentary questions and other documents prior to publication to ensure that information is released in accordance with the Act
• reviewing administrative investigation reports (such as reports on violence or harassment in the workplace) prior to disclosure to the concerned parties, to ensure that such information is released in accordance with the principles of exemptions defined in the Act
• making recommendations regarding the disclosure of personal information
• answering general written and telephone enquiries from the public and organizations

Governance

Members of the ATIP Office participate in several governance committees, including:

• Departmental Open Government Advisory Group
• Information Management and Information Technology Committee
• Security Committee
• Open Data Core Project Team

Active participation in these committees and various other working groups allows the ATIP Office to remain aware of upcoming issues, initiatives and projects that may have ATIP implications and integrate ATIP considerations in the planning and implementation of initiatives and projects (for example, the GC Jobs Transformation Core Management Committee).

Open government

The PSC Open Government Implementation Plan outlines a set of activities and deliverables to meet its requirements under the TBS Directive on Open Government. Through the Plan, the PSC develops the internal mechanisms it needs to maximize the release of government information and data of business value. As a member of the Open Government Advisory Council and the Open Data Core Project Team, the ATIP Office provides ongoing strategic advice on privacy, confidentiality, and security concerns.

The PSC has put in place business processes for Open Information and Open Data, which include a review by the ATIP Office. The review considers the principles of exemptions defined in the Act to protect sensitive information before it is published.

In 2021-2022, the PSC Open Government Secretariat initiated a pilot project to increase awareness and provide tools for determining whether governance documents are eligible for publication on the Open Government Portal. This has likely contributed to the increase in internal consultations completed by the ATIP Office relating to Documents to be published on Open Government

Internal reporting

The PSC has a stable and effective ATIP program. The ATIP Office works closely with PSC employees to make sure all requests are handled on time. The ATIP Office relies on open communication with PSC sectors, government organizations, third parties and requesters. Specific issues are reported to senior management when required.

The ATIP Office also annually reports to the Executive Management Committee and the Information Management and Information Technology Committee on the administration of the ATIP and provides a status update on privacy impact assessments.

Training

The ATIP Office continues to offer a core training program for supervisors and managers. The primary goal of this training program is to ensure that managers are fully aware of their responsibilities under the Act and related internal policies.

The Canada School of Public Service’s self‑directed course “Fundamentals of Access to Information and Privacy” is recommended for all employees. Additionally, a workshop developed in the previous reporting period, titled “Protecting Privacy at the PSC”, was updated and delivered.

3.3 Tracking system and imaging software

The ATIP Office continues to use AccessPro Case Management and AccessPro Redaction.

3.4 Collection, use and disclosure of personal information

Personal information banks

During this reporting period, the ATIP Office received no request to update personal information banks.

The PSC does not have any exempt banks.

No access was denied under subsection 18(2) of the Act.

Public Interest Disclosures

Pursuant to subsection 8(2) of the Act, personal information under the control of a government institution cannot be disclosed without the consent of the individual.

Paragraph 8(2)(e) of the Act applies to communication to designated investigative bodies for the purpose of enforcing the laws of Canada or a province, or to conduct legal investigations. The PSC did not invoke this provision on any occasion during the reporting period.

Paragraph 8(2)(m) of the Act applies to communications when, in the opinion of the head of the institution, reasons of public interest clearly outweigh the resulting invasion of privacy, or if the person concerned would gain a definite advantage from it. The PSC did not invoke this provision on any occasion during the reporting period. 

Review of documents

The ATIP Office regularly reviews documents prior to disclosure in order to identify personal information that may have been included. These reviews ensure that proper procedures for release of these documents are followed and respect the provisions of the Act.

3.5 Privacy breaches

A total of 7 privacy breaches were recorded during the reporting period. All these cases involved human error, and none were deemed material. To allow for staff to fully appreciate the impact of their actions, privacy awareness training was delivered to the program areas where the breaches occurred.

The PSC Policy on Privacy Breaches does not distinguish between material and immaterial privacy breaches. Therefore, the Office of the Privacy Commissioner and TBS are informed of all privacy breaches.

At the time of drafting this report, the Office of the Privacy Commissioner had responded to one of these privacy breaches.

4. Complaints

During the reporting period, 3 new complaints were filed with the Office of the Privacy Commissioner, and 1 complaint was closed.

At the end of the reporting period, 4 complaints were still active, 2 of which had been carried over from previous years.

5. Privacy Impact Assessments

The Directive on Privacy Impact Assessments (PIA)came into effectin April 2010. The goal of the directive is to allow government institutions to identify whether a program or a service-delivery initiative involving the collection, use or disclosure of personal information, as defined in the Act, complies with privacy principles. PIAs also aim to avoid or mitigate any identifiable risks to privacy. The ATIP Office provides advice and guidance to the PSC throughout the PIA production process, including the review of PIA reports and liaison with the Office of the Privacy Commissioner.

While most of its programs and activities predate the Directive on Privacy Impact Assessment, the PSC recognizes the importance of identifying and mitigating privacy risks. In 2019, the PSC undertook a five-year plan to conduct privacy assessments of all programs and activities that collect and use personal information. This plan will be reviewed in light of pandemic-related delays.

No PIAs were initiated or completed during the reporting period. However, work continued on 2 assessments initiated during previous reporting periods:

• Personnel Psychology Centre PIA
• GC Jobs Transformation PIA

The ATIP Office continues to support the program areas to finalize these reports.
Finally, 2 additional assessments initiated before this reporting period were put on hold until further notice:

• Data Services and Analytics PIA 
• Framework assessment on the Assessment and Recruitment Services

6. Costs

During the reporting period, the PSC expended $138,471 on salaries to ensure the administration of the Act, which corresponds to 1.47 full-time equivalent.

his represents a 56% reduction compared to the previous reporting period and is the result of staff departures and delays in filling vacant positions during the reporting period.

Annex A – Delegation instrument

Privacy Act – Delegation Order

The President of the Public Service Commission of Canada, as head of the government institution, hereby designates pursuant to section 73 of the Privacy Act (the Act), the persons holding the positions set out below, or the persons occupying on an acting basis those positions, to exercise the powers, duties or functions of the President vested in them by the Act.

This delegation is effective as of December 22, 2020.

Appendix A

Privacy Act

Privacy Regulations