Privacy Act - Annual Report 2014-2015

Table of contents

• 1. Introduction
  • 1.1 Purpose of the Privacy Act
  • 1.2 Mandate of Canadian Heritage
• 2. The Structure of the Access to Information and Privacy Secretariat
• 3. Delegation Order
• 4. Administration of Requests
  • 4.1 Privacy Requests
  • 4.2 Disposition of Completed Requests
  • 4.3 Extensions
  • 4.4 Exemptions
  • 4.5 Costs
• 5. Education and Training Activities
• 6. Policies, Guidelines and Procedures
• 7. Complaints and Federal Court Cases
• 8. Monitoring the Processing of Requests and Requests for Corrections
• 9. Material Privacy Breaches
• 10. Privacy Impact Assessment
• 11. Disclosure of Personal Information Pursuant to Paragraph 8(2)(m)

1. Introduction

2. The Structure of the Access to Information and Privacy Secretariat

The Access to Information and Privacy (ATIP) Secretariat is responsible for administering the Privacy Act within Canadian Heritage. Its mandate is to act on behalf of the Minister of Canadian Heritage in ensuring compliance with legislation, regulations and government policy and to create departmental directives, including standards, in all matters relating to the Act.

During the reporting period, the Secretariat consisted of the following positions: Director, Deputy Director, six analysts, one project manager and two administrative support staff. In the departmental organizational structure, the ATIP Secretariat reports to the Corporate Secretariat for Canadian Heritage.

The activities of the ATIP Secretariat include:

• receiving and processing requests in accordance with the Act;
• promoting awareness of the Act within the Department;
• preparing the annual report to Parliament and the annual statistical report and maintaining the Department’s Info Source chapter;
• monitoring departmental compliance with the Act;
• providing professional advice and guidance to senior management and all departmental staff on the Act; and
• assisting in the privacy impact assessment process and in creating or modifying personal information banks.

3. Delegation Order

The powers, duties and functions of the administration of the Privacy Act have been fully delegated by the Minister to the Director of the ATIP Secretariat. A copy of the Canadian Heritage’s delegation order is appended to this report as Appendix A.

4. Administration of Requests

The statistical report submitted to the Treasury Board Secretariat on the administration of the Privacy Act has been completed and is appended to this report as Appendix B.

5. Education and Training Activities

To increase the knowledge and understanding of the Privacy Act across the department, training and awareness sessions were delivered to departmental employees. These sessions provided basic information on the purpose and provisions of the Privacy Act, as well as the roles and responsibilities of departmental employees and the ATIP Secretariat. The information for these awareness sessions was tailored to meet the specific needs of the branches concerned.

This reporting period, the ATIP Secretariat delivered 3 awareness sessions on the Privacy Act to departmental employees in the National Capital Region and regional offices. In total, 52 employees attended information sessions.

The internal website for the ATIP Secretariat is a tool that is accessible to all departmental employees which describes the ATIP Secretariat’s roles and responsibilities and provides information on the Privacy Act and related departmental policies and procedures.

6. Policies, Guidelines and Procedures

The Government of Canada’s Open Government policy led to improvements and changes of procedures in the treatment of privacy requests within Canadian Heritage. In the fall of 2014, Canadian Heritage started to receive online requests through the Government of Canada Access to Information and Privacy (ATIP) Online Request Service portal. As a result of this change, Canadian Heritage updated its procedures for opening and closing requests and renewed the ATIP content on the departmental website.

7. Complaints and Federal Court Cases

No complaints regarding the processing of requests were filed with the Office of the Privacy Commissioner (OPC) against Canadian Heritage in the fiscal year. The OPC completed their investigation into one access complaint on Canadian Heritage that was received in January 2014. Their finding concluded that the complaint was not well founded and that no action was required. There were no Federal Court cases concerning the refusal of access during this reporting period.

8. Monitoring the Processing of Requests and Requests for Corrections

The ATIP Secretariat monitors the processing of requests on a daily basis using the ATIP management system (Access Pro Case Management/Redaction) as well as through bi-weekly meetings between the officers and management of the Secretariat. This ensures accurate and timely responses to applicants.

9. Material Privacy Breaches

A Privacy Breach is deemed to be a material breach if it involves sensitive personal information, could reasonably be expected to cause serious injury or harm to the individual, or involves a large number of affected individuals. During this reporting period, the ATIP Secretariat was informed of one potential material privacy breach.  The breach involved a misplaced USB key containing the names and the contact information of program applicants. Following a review of the incident, it was determined that the breach was not material in nature as there was a very low probability of risk of harm.  In this instance, the individuals concerned were not notified of the incident. As a result of the investigation into this breach, the program tightened its mailing procedures.

10. Privacy Impact Assessment

Fifty-three Privacy Impact Assessment Checklists were evaluated for new or changed programs or systems, five of which resulted in the recommendation to perform a full privacy impact assessment (PIA).  Additionally, the ATIP Secretariat drafted thirteen privacy notices further to the analysis of Privacy Impact Assessment Checklists. Departmental colleagues also requested advice on the use and disclosure of personal information in nine cases. During the reporting period, no PIAs were completed.

11. Disclosure of Personal Information Pursuant to Paragraph 8(2)(m)

Subsection 8(2) of the Privacy Act stipulates under which circumstances personal information under the control of a government institution may be disclosed. Paragraph 8(2)(m) states that disclosure of personal information is permitted for any purpose where, in the opinion of the head of the institution, the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure, or the disclosure would clearly benefit the individual to whom the information relates. During the reporting period, no disclosures were made pursuant to paragraph 8(2)(m) of the Privacy Act.

Appendix A. Delegation order

Appendix B: Statistical Report on the Privacy Act

Name of institution: Canadian Heritage

Reporting period: 01/04/2014 to: 31/03/2015