Privacy Act — Annual Report — April 1, 2016, to March 31, 2017

Table of contents

Introduction

The Privacy Act (R.S., 1985, c. P-21) was proclaimed on July 1, 1983.

The Privacy Act (the Act) gives individuals the right to access information about them that is held by the government. This is, however, subject to specific and limited exceptions.

The Act also protects individuals' privacy by preventing others from accessing their personal information and by giving them rights to request access and request corrections to their personal information.

Section 72 of the Act requires that the head of every federal government institution prepare an Annual Report, for submission to Parliament, on the administration of the Act within the institution. Every report shall be laid before each House of Parliament within three months after the financial year in respect of which it is made or, if that House is not then sitting, on any of the first 15 days next thereafter that it is sitting.

This Annual Report provides a summary of the management and administration of the Act within the Public Service Commission of Canada (PSC) for the fiscal year 2016-2017.

Part I – General Information on the Public Service Commission of Canada

1. Raison d'être and mandate

Raison d'être

The mandate of the Public Service Commission (PSC) is to promote and safeguard merit-based appointments and, in collaboration with other stakeholders, to protect the non-partisan nature of the public service. The PSC reports independently on its mandate to Parliament.

Under the delegated staffing system set out in the Public Service Employment Act (PSEA), the PSC fulfills its mandate by providing policy guidance and expertise as well as by conducting effective oversight. In addition, the PSC delivers innovative staffing and assessment services.

Responsibilities

The PSC is responsible for promoting and safeguarding merit-based appointments that are free from political influence and, in collaboration with other stakeholders, for protecting the non-partisan nature of the public service.

The PSC is mandated to:

• Make appointments to and within the public service, based on merit and free from political influence. The PSEA provides the authority to the Commission to delegate to deputy heads its authority to make appointments to positions in the public service. This authority is currently delegated to the deputy heads subject to the PSEA, across the federal government;
• Administer the provisions of the PSEA that are related to the political activities of employees and deputy heads. Part 7 of the PSEA recognizes the right of employees to engage in a political activity, while maintaining the principle of political impartiality in the public service. It also sets out specific roles and responsibilities related to political activities for employees and for the PSC; and
• Oversee the integrity of the staffing system and, in collaboration with other stakeholders, ensure non-partisanship. This oversight role includes: The regulatory authority and policy-setting function, the ongoing support and guidance and the monitoring of the staffing performance of delegated organizations, the conduct of audits that provide an independent assessment of the performance and management of staffing activities and the conduct of investigations of staffing processes and improper political activities by public servants.

2. Strategic outcome and Program Alignment Architecture

The PSC Program Alignment Architecture consists of one strategic outcome and four programs.

Public Service Commission strategic outcome

To provide Canadians with a highly competent, non-partisan and representative public service, able to provide service in both official languages, in which appointments are based on merit and the values of fairness, access, representativeness and transparency.

Program activity – Staffing System Integrity and Political Impartiality

The Staffing System Integrity and Political Impartiality program is focused on independently safeguarding merit and non-partisanship in the federal public service. This program includes developing and advancing strategic policy positions and directions; conducting policy research; establishing Public Service Commission (PSC) policies and standards; providing advice, interpretation and guidance; and administering delegated and non-delegated authorities, including official languages, the political activities regime and priority entitlements program.

Program activity – Staffing Services and Assessment

The Staffing Services and Assessment program maintains the systems that link Canadians and public servants seeking employment opportunities in the federal public service with hiring departments and agencies. It provides assessment-related products and services in the form of research and development, consultation, assessment operations and counselling for use in recruitment, selection and development throughout the federal public service. This program also includes delivering staffing services, programs and products to departments and agencies, to Canadians and public servants, through client service units located across Canada.

Program activity – Oversight of Integrity in Staffing and of Non-partisanship

The Oversight of Integrity in Staffing and of Non-Partisanship program provides an accountability regime for the implementation of the appointment policy and regulatory framework for safeguarding the integrity of public service staffing and ensuring staffing is free from political influence. This program includes monitoring departments’ and agencies’ staffing performance and compliance with legislative requirements; conducting audits and studies; carrying out investigations; and reporting to Parliament on the integrity of public service staffing and the non-partisanship of the public service.

Program activity – Internal Services

Internal Services are groups of related activities and resources that are administered to support the needs of programs and other corporate obligations of an organization. Internal services include only those activities and resources that apply across an organization, and not those provided to a specific program. The groups of activities are:

• Management and Oversight Services;
• Communications Services;
• Legal Services;
• Human Resources Management Services;
• Financial Management Services;
• Information Management Services;
• Information Technology Services;
• Real Property Services;
• Materiel Services; and
• Acquisition Services.

Part II – Report on the Access to Information Act

1. Organization of delegation and activities

1.1 Delegation order

The President of the Public Service Commission (PSC) is designated as the head of the government institution for purposes of the administration of the Act.

Pursuant to section 73 of the Act, deputy heads may delegate any of their powers, duties or functions under the Act by signing an order authorizing one or more officers or employees of the institution, who are at the appropriate level, to exercise or perform the powers, duties or functions of the head specified in the order.

The powers, duties and functions of the PSC President, under the Act, are delegated to the Chief of Staff, who is the designated ATIP Coordinator for the PSC. Operational responsibility for the application of the Act resides with the ATIP Manager, who has partial delegation. See Annex A – Delegation Instrument.

1.2 The Access to Information and Privacy Coordinator

The ATIP Coordinator is responsible and accountable for the development, coordination and implementation of effective policies, guidelines, systems and procedures to enable the efficient processing of requests under the Access to Information Act and the Privacy Act.

The Coordinator is also responsible for the development, coordination and implementation of policies, systems and procedures that are required by both Acts as well as Treasury Board of Canada policies and directives. The activities of the coordinator include:

• Processing requests made under both Acts;
• Acting as spokesperson for the PSC in dealings with Treasury Board Secretariat (TBS), the Office of the Information Commissioner (OIC) and other government departments and agencies on matters related to the Act;
• Responding to consultation requests submitted by other federal institutions for PSC documents;
• Reviewing information collection in accordance with the Communications Policy of the Government of Canada and the Procedures for the Management of Public Opinion Research;
• Preparing the Annual Report to Parliament and other statutory reports, as well as other material that may be required by central agencies;
• Promoting awareness and providing advice to PSC employees to ensure responsiveness to the obligations of both Acts, TBS policies and their impact on various program initiatives; and
• Monitoring the PSC's compliance with both Acts, Regulations and other relevant policies and procedures.

1.3 The Access to Information and Privacy Office

The Access to Information and Privacy Office (the ATIPO) supports the ATIP coordinator in administering the provisions of the Acts and related TBS policies for the PSC. The ATIPO is currently comprised of a manager, two analysts and one administrative assistant.

During the reporting period, the ATIP functions transferred from the Corporate Affaires Branch to the Corporate Secretariat.

Due to a temporary sharp increase in the number of requests, the ATIPO hired four consultants during the course of this reporting period to assist with the processing of official requests.

The analysts are responsible for processing requests and consultations under both the Access to Information Act and Privacy Act, preparing responses to complaints, reviewing the PSC’s Info Source chapter and supporting all other ATIP responsibilities.

The ATIPO updates its intranet site on a regular basis and uses it as the primary vehicle for communicating with PSC employees. In addition, the ATIPO delivers training sessions for PSC employees.

The ATIPO also reviews policies and procedures to improve the support it provides to its branch liaison officers and promote a better understanding of their roles, responsibilities and obligations related to the processing of requests under both Acts.

1.4 Access to Information and Privacy Act liaison officers

The ATIPO processes requests with the assistance of ATIP liaison officers who are employees knowledgeable of their branch’s activities. There is one liaison officer for each branch as well as for the Corporate Secretariat. In addition to acting as the point of contact between their branch and the Office, ATIP liaison officers are responsible for:

• Tasking the appropriate program experts within their branch to search for relevant records;
• Advising if there are other offices of primary interest;
• Keeping the ATIPO apprised of any issues in relation to specific requests (e.g., delays, interference with operations, consultations required); and
• Duly delivering to the ATIPO the relevant records, complete with branch recommendations. Liaison officers play an important role in ensuring that the Commission conducts a thorough and complete search of its record holdings when processing information requests.

The ATIPO regularly holds meetings and discussions with liaison officers to discuss best practice and explore improvements to internal processes. The ATIPO will also reach out to liaison officers to obtain background information to assist in the clarification of requests with requesters.

2. Statistical report: Interpretation

Over the last two reporting periods, the PSC experienced a sharp, yet temporary, surge in the number of requests. Beginning in May 2015, a single requester began periodically submitting multiple requests under both Acts, totalling 1,048 requests in fiscal year 2015-2016 and 3,009 requests in fiscal year 2016-2017.

If we exclude this temporary surge, the number of requests submitted under both Acts during the 2016-21017 reporting period was 179. This represents a 6% increase in requests received when compared with the previous year. The PSC received approximately twice the historical average of requests during each of the last two reporting periods. The nature and outcomes of these remaining requests are consistent with previous years

The following detailed analysis is based on the Statistical Report in Annex B, including the temporary surge.

2.1 Requests under the Privacy Act

From April 1, 2016, to March 31, 2017, the PSC received 3,062 new requests under the Privacy Act (PA), in addition to 117 requests that were carried over from the previous period. This represents a 295.6% increase in requests received, compared with the previous year.

The PSC responded to 3,175 requests during the reporting period, requiring the review of 45,253 pages of records. Four requests were ongoing at the end of the reporting period, which were carried forward to the next one.

2.2 Nature of requests

Breaking from the trend established in previous years, the majority of the 3175 closed requests were for personal information held by specific employees of the PSC, with the nature of the remaining requests being similar to that of the previous reporting period:

• 3,052 requests (96.15%) were for personal information held by specific employees of the PSC;
• Thirty-nine requests (1.2%) dealt with staffing activities. For the most part, requesters were seeking information related to staffing documents, Priority Administration and assessments;
• Twenty-six requests (0.8%) pertained to investigations and audits conducted under the PSEA;
• The remaining 58 requests (1.9%) were on a variety of subjects.

2.3 Inter-organizational consultations

The PSC received 8 requests for consultation from other government departments and agencies during this reporting period with one request being carried over from the previous reporting period. The processing of these requests required a review of 566 pages of documents. No consultations were outstanding at the end of the period to be carried over into the 2017-2018 reporting period.

In response to the nine consultations completed during the reporting period, the PSC determined that information should be disclosed in full for four requests and disclosed in part for five requests.

The PSC consulted other government departments and agencies 61 times in relation to the processing of 30 of the requests completed during the reporting period.

2.4 Informal requests

In an attempt to increase and facilitate access, the PSC promotes informal methods of access whenever possible. Requesters may obtain access to their personal information on an informal basis by contacting the manager of the program area that controls the records. In these instances, the ATIP Office provides assistance and advice, as required.

2.5 Disposition of requests completed

For the 3175 closed requests, information was released either in whole or in part in 317 cases, representing 10% of the requests.

2.6 Exemptions invoked

Sections 18 through 28 of the Act set out the exemptions intended to protect information pertaining to a particular public or private interest. During the reporting period, the most frequently invoked exemptions were paragraph 22(1)(b) [law enforcement and investigations], section 26 [personal information of another individual] and section 27 [solicitor-client privilege].

2.7 Exclusions invoked

Section 69 of the Act outlines certain types of information to which the Act does not apply. These exclusions relate to published material, library and museum material, material placed in Library and Archives Canada by or on behalf of third parties, some materials relating to the Canada Broadcasting Corporation and Cabinet Confidences.

The PSC did not invoke any exclusions during the reporting period.

2.8 Extensions of time limits

Extensions of the 30-day statutory response time are permissible under section 15 of the Act. A request may be extended in accordance with multiple provisions of this section. During the reporting period, a total of 43 extension provisions were invoked in the processing of 40 (1.3%) requests completed during the reporting period.

2.9 Completion time

Of the 3,175 closed requests, the PSC responded to 2,938 within 30 days or less, representing 92.5% of all the requests completed. 202 requests (6.4%) were completed within 31 to 60 days, 26 (0.1%) within 61 to 120 days and 9 (0.1%) required more than 120 days to process.

Of these, 2,985 (94%) were closed within the allowable time limit. Of the 190 late requests, 151 of them did not meet the statutory deadline due to the sudden influx of nearly 800 requests in a 24-hour period. New procedures were implemented to address reoccurrences and the number of late requests dropped considerably.

2.10 Translation

The PSC did not receive any requests for translation of personal information pursuant to paragraph 17(2)(b) of the Act.

2.11 Format of information released

Regarding the 317 requests for which information was released in whole or in part, information for 185 requests (58.47%) was provided on paper and 132 (41.6%) was provided electronically.

2.12 Corrections and notations

The PSC did not receive any requests for the correction of personal information under subsection 12(2) of the Act.

2.13 Costs

During the reporting period, the ATIP Office spent $283,159 on salaries and $177,060 on goods and services, including $163,397 for professional service contracts, for the administration of the Privacy Act.

The salary and professional service costs represented 4.18 full-time equivalent employees.

3. Summary of Access to Information and Privacy Office activities

3.1 Development of policies, directives, guidelines and other key documents

Special procedures were created in response to receiving groups of several hundred requests. With the assistance of our Liaison Officers, procedures were developed in order to efficiently and effectively process surges of requests for information held by individual employees of the department. These procedures were successfully put into place with positive results.

3.2 Advice and training

Advice

In addition to processing Access to Information Act and Privacy Act requests, the Office provides advice to PSC managers and employees, as well as to other organizations and members of the public regarding a variety of issues and questions related to both Acts.

Requests for guidance and advice were of the following nature:

• Reviewing memoranda of understanding, information-sharing agreements to ensure compliance with the requirements of the Acts and associated policies;
• Reviewing audit reports, responses to parliamentary questions and other documents prior to publication to ensure that information is released in accordance with the Acts;
• Reviewing administrative investigation reports (such as reports on violence in the workplace or harassment reports) prior to disclosure to the concerned parties to ensure that information is released in accordance with the principles of exemptions defined in the Acts; and
• Answering general written and telephone enquiries from the public.

Participation in the governance process

The ATIP coordinator is a member of the Information Management, Information Technology Committee, the Integration Committee and the Resource Management Committee. The ATIP manager is a member of the Project Review Committee, the Security Committee, the Open Data Core Project Team and the Open Government Advisory Council . Active participation in these committees and various other working groups allows the Office to:

• Be aware of upcoming issues, initiatives and projects that may have ATIP implications; and
• Integrate ATIP considerations in the planning for and implementation of initiatives and projects.

Open Government

The PSC’s Open Government Implementation Plan (OGIP) outlines a set of activities and deliverables for the PSC to meet its requirements under the TBS Directive on Open Government. The goal of the OGIP is for the PSC to develop the internal mechanisms necessary to maximize the release of government information and data of business value. As members of the Open Government Advisory Council and the Open Data Core Project team, the ATIPO provides ongoing strategic advice regarding privacy, confidentiality, and security concerns.

Internal Reporting

In order to keep senior management informed of trends in access to information requests, the ATIPO provides ad hoc briefings as required.

Training

The Office delivered an ongoing core training program for supervisors and managers of the PSC. The primary goal of the program is to ensure that managers are fully aware of their responsibilities under both Acts and related policies. The Office delivered 14 training sessions.

The ATIP Liaison Working Group met five times during the reporting period to discuss best practices, address gaps and to provide training opportunities.

3.3 Tracking system and imaging software

The ATIPO continues to use AccessPro Case Management and AccessPro Redaction software. With the eventual department-wide migration to Windows 10, the last available release of AccessPro Suite is being tested prior to deployment within the ATIP Office.

3.4 Collection, use and disclosure of personal information

3.4.1 Personal Information Banks

During this reporting period, the PSC reviewed its 69 Personal Information Banks (PIBs) to ensure that they were aligned with its Program Activity Architecture.

3.4.2 Exempt banks

The PSC does not have any exempt banks. There were no denials of access under subsection 18(2) of the Act.

3.4.3. Disclosure under subsection 8(2) of the Act

Personal information under the control of a government institution should not, without the consent of the individual to whom it relates, be disclosed by the institution except in accordance with subsection 8(2) of the Act.

Paragraph 8(2)(e) of the Act allows for the disclosure of personal information, without the consent of the individual, upon request from an investigative body for the purpose of enforcing a law or carrying out a lawful investigation. During the reporting period, the PSC received one such request from the RCMP and provided the requested information.

Paragraph 8(2)(m) of the Act concerns cases where, in the opinion of the head of the institution, the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure or where disclosure would clearly benefit the individual to whom the information relates. This provision was not used during the reporting period.

3.4.4 Review of documents

The ATIP Office regularly reviews certain documents prior to disclosure or to project implementation in order to identify personal information that may have been included. These reviews also ensure that proper procedures for their release are followed and respect provisions of the Act.

In order to protect the privacy of participants in internal investigations, the ATIPO offers a service to review investigation reports before they are communicated to concerned individuals. The ATIP Office reviewed five such reports for the Human Resources Management Directorate.

The ATIPO reviewed and provided advice regarding updates to two Privacy Notice Statements. No privacy/security contract clauses were reviewed over the course of this reporting period.

The ATIP Office helped in the review of one information sharing agreement.

3.5 Privacy breaches

There were five confirmed privacy breaches during the reporting period. While two of these resulted from unintentional human error, three breaches were caused by a lack of awareness of requirements of the Privacy Act.

The PSC’s internal Policy on Privacy Breaches does not distinguish between material and immaterial privacy breaches. As such, all privacy breaches are reported to the OPC and TBS.

At the time of drafting of this report, the OPC has provided a response to two of the five privacy breaches. Both were deemed to be minor breaches.

3.6 Annual Report on the status of Privacy Impact Assessments

On March 24, 2017, the ATIP Office presented the second annual and redesigned Status Report on PIAs to the EMC. The purpose of the redesigned report is to:

• List all collections of personal information conducted by program areas;
• Provide information on the status of PIAs at the PSC;
• Identify gaps related to the management of risks associated with collections of personal information; and
• Provide recommendations related to the elimination of these gaps.

A key recommendation from this report is for the ATIP Office to develop a PIA Architecture during the 2017-2018 fiscal year, as it was not possible to complete it during the previous fiscal year. This PIA Architecture will lead to an end-state model that will support the complete identification and proper management of risks associated with all PSC collections of personal information. This recommendation was approved by EMC and has been included in the Department’s Integrated Business Plan as a priority.

4. Complaints

4.1 Number of complaints

During the reporting period, the PSC was advised of 2,183 complaints to the OPC regarding the processing Privacy Act requests as well as four complaints regarding the management of personal information by the PSC. Most of the complaints received during the reporting period originated from the individual who submitted multiple requests. Eight complaints were submitted by other individuals.

4.2 Nature of complaints

The complaints received during the reporting period breakdown as follows:

• One complaints regarding the use of extensions;
• Thirteen complaints that the PSC did not respond within the statutory deadline;
• Two thousand, one hundred and sixty five complaints regarding the denial of access following a request for personal information; and
• Four complaints regarding the disclosure of personal information.

4.3 Complaints closed

During the reporting period, the OPC confirmed that 2,343 investigations were discontinued with the consent of the complainant.

The OPC deemed 11 complaints to be well founded, all of which pertained to the PSC failing to respond within the statutory time limit. These 11 complaints were deemed resolved by the OIC and no further action was required.

Eight investigations were carried forward to the next reporting period.

5. Privacy Impact Assessments

The Privacy Impact Assessment Policy came into effect in May 2002 and was replaced by the Directive on Privacy Impact Assessment in April 2010. The goal of the directive is to allow government institutions to identify whether a program or a service delivery initiative involving the collection, use or disclosure of personal information, as defined in the Act, complies with privacy principles. PIAs also aim to avoid or mitigate any identifiable risks to privacy. The ATIP Office provides advice and guidance to PSC managers throughout the PIA production processes, including the review of PIA reports and liaison with the OPC.

The PSC completed an updated PIA on the Priority Administration Program and Priority Information Management System (PIMS) and forwarded it to the OPC and TBS during the reporting period.

Summaries of completed PIAs are posted on the PSC’s Internet site.

The PSC’s Personnel Psychology Centre has initiated a PIA on its Assessment Activities. The ATIP Office will continue to support the development of this PIA during the 2017-18 fiscal year.

Annex A – Delegation Instrument

Privacy Act – Delegation Order

The President of the Public Service Commission of Canada, as head of the government institution, hereby designates Pursuant to section 73 of the Privacy Act, the persons holding the positions set out below, or the persons occupying on an acting basis those positions, to exercise the powers, duties or functions of the President vested in him by the Privacy Act.

This delegation is effective as of the 29^th day of the month of December, 2016.

Christine Donoghue
Acting President

Date : December 16, 2016

Annex B – 2015-2016 Annual Privacy Act Statistical Report

Name of institution: Public Service Commission of Canada

Reporting period: 2016-04-01 to 2017-03-31

Part 1: Requests Under the Privacy Act