Annual report on the administration of the Privacy Act 2023-2024

On this page

• List of charts
• List of acronyms and abbreviations
• 1. Introduction
  • 1.1. The Privacy Act
  • 1.2. Mandate of Canadian Heritage
• 2. Structure of the access to information and privacy secretariat
• 3. Delegation order
• 4. Administration of requests
  • 4.1. Privacy requests
  • 4.2. Disposition of completed requests
  • 4.3. Extensions
  • 4.4. Exemptions
  • 4.5. Exclusions
  • 4.6. Consultations
  • 4.7. Costs
• 5. Training and awareness
• 6. Policies, guidelines and procedures
  • 6.1 Policy instruments
  • 6.2 Information about programs and information holdings
• 7. Initiatives and projects to improve privacy
• 8. Complaints and federal court cases
• 9. Material privacy breaches
• 10. Privacy impact assessments
• 11. Disclosure of personal information pursuant to paragraph 8(2)
• 12. Monitoring compliance
• Appendix A – Delegation Order
• Appendix B – Statistical report on the Privacy Act
  • Statistical report on the Privacy Act
  • Supplemental Statistical Report on the Access to Information Act and the Privacy Act

List of charts

• Chart 1: Number of requests received, 2019-2020 to 2023-2024

List of acronyms and abbreviations

AORS

ATIP Online Request Service

ATIP

Access to information and privacy

ATIP/D

Director, Access to Information and Privacy Secretariat

ATIP/DD

Deputy Director, Access to Information and Privacy Secretariat

CS

Corporate Secretary

DM

Deputy Minister

DMA

Associate Deputy Minister

PIA

Privacy impact assessment

TBS

Treasury Board Secretariat

Alternate format

Annual report on the administration of the Privacy Act 2023-2024 [PDF version - 1.68 MB]

1. Introduction

The Department of Canadian Heritage is pleased to table in Parliament its annual report on the administration of the Privacy Act (the Act) for the fiscal year April 1, 2023, to March 31, 2024.

Section 72 of the Act requires that the head of every federal government institution submit an annual report to Parliament on the administration of the Act during the fiscal year.

1.1. The Privacy Act

The purpose of the Act is to protect the privacy of individuals with respect to personal information about themselves held by a government institution and to provide individuals with a right of access to their information. It also protects the privacy of individuals by exercising strict control over the collection, disclosure and use of such information.

The Department of Canadian Heritage is fully committed to both the spirit and the intent of the Act, which are based on the principles of open government and the assurance of privacy of individuals with respect to their personal information held by the Department.

1.2. Mandate of Canadian Heritage

The Department’s mandate is set out in the Department of Canadian Heritage Act and centres on fostering and promoting “Canadian identity and values, cultural development, and heritage.”

To achieve its objectives, Canadian Heritage collaborates with a wide range of partners from the private sector, creative enterprises, public institutions and non-governmental organizations to enrich cultural experiences, strengthen identity, and promote participation in sport and communities. The Department also engages with Canadians through programs that support a wide range of activities from youth exchanges, through commemorations and celebrations, to high-performance sports and multiculturalism and anti-racism initiatives. These programs are delivered through headquarters and five regional offices across the country.

The Department of Canadian Heritage is responsible for programs and policies that help all Canadians participate in their shared cultural and civic life. The Department's legislative mandate, set out in the Department of Canadian Heritage Act and other statutes for which the Minister of Canadian Heritage is responsible, lists the Minister's many responsibilities under the heading of powers and duties related to "Canadian identity, values, cultural development and heritage."

The Department oversees numerous statutes, including the Broadcasting Act, the Copyright Act and the Investment Canada Act (the latter two acts shared with Innovation, Science and Economic Development Canada), the Official Languages Act, the Museums Act, the Canada Traveling Exhibitions Indemnification Act, the Cultural Property Export and Import Act, the Status of the Artist Act, the Canadian Multiculturalism Act and the Physical Activity and Sport Act (shared with Health Canada).

The Department of Canadian Heritage is specifically responsible for formulating and implementing cultural policies related to copyright, foreign investment and broadcasting, as well as policies related to arts, culture, heritage, official languages, multiculturalism, sport, state ceremonial and protocol, and Canadian symbols. In addition, in the coming years, one of the main objectives of the Department will be to strengthen the cultural and creative sectors. The Department’s programs, delivered through headquarters and multiple points of service including five regional offices across the country, fund community and third-party organizations to promote the benefits of culture, identity and sport for Canadians.

In 2023-2024, the Minister of Canadian Heritage was responsible to Parliament for the activities of the Department, three departmental agencies, eleven Crown corporations and two administrative tribunals, supported by the Minister of Sport and Physical Activity, the Minister of Diversity, Inclusion and Persons with Disabilities, the Minister of Employment, Workforce Development and Official Languages, and the Minister for Women, Gender Equality and Youth.

2. Structure of the access to information and privacy secretariat

The Access to Information and Privacy (ATIP) Secretariat is responsible for administering the Act within the Department of Canadian Heritage. Its mandate is to act on behalf of the Minister of Canadian Heritage in ensuring compliance with legislation, regulations, and government policy and to create departmental directives, including standards, in all matters relating to the Act.

During the reporting period, the ATIP Secretariat consisted of a director, a deputy director, two employees in the Privacy and Governance Unit, six analysts and two administrative resources to support the operations of the Secretariat.

The Operations Unit is responsible for processing requests under the Act. This includes receiving requests from the public, performing a line-by-line review of the records requested, conducting external consultations as required and representing the Department in dealings with the Office of the Privacy Commissioner regarding the application of the Act.

The Privacy and Governance Unit provides policy advice and guidance to the Department on the protection of personal information. It develops policy instruments and processing products and tools. It is responsible for assisting program officials when they complete privacy risk checklists and/or conduct a privacy impact assessment (PIA) to ensure privacy legislation and policy requirements are respected. The unit liaises with employees and prepares and delivers training and awareness sessions throughout the Department. In addition, the unit prepares the Department’s annual reporting requirements and publishes its Information about programs and information holdings, formerly known as Info Source.

In the departmental organizational structure, the ATIP Secretariat reports to the Corporate Secretariat for Canadian Heritage.

3. Delegation order

The powers, duties and functions of the administration of the Act have been delegated by the Minister to the Deputy Minister, the Corporate Secretary and the Director of the ATIP Secretariat. A copy of Canadian Heritage’s delegation order is appended to this report as Appendix A.

4. Administration of requests

The statistical report submitted to the Treasury Board Secretariat on the administration of the Act has been completed and is appended to this report as Appendix B.

4.1. Privacy requests

Between April 1, 2023, and March 31, 2024, 16 formal requests for information were received under the Act. This represents 7 more requests received than in the previous reporting period, and the highest number of requests received in the last 5 years, on par with fiscal year 2021-2022, as shown in Chart 1.

Chart 1: number of requests received, 2018-2019 to 2022-2023 – text version

This bar graph shows the number of requests received from 2018-2019 to 2022-2023. Data is as follows:

• 2019-2020: 14
• 2020-2021: 15
• 2021-2022: 16
• 2022-2023: 9
• 2023-2024: 16

Two requests were carried over from the previous reporting period. In addition, at the end of the reporting period, one request was carried forward to the next fiscal year beyond the time limits set out in the Act. This request was received in 2023-2024.

No formal requests for correction of personal information were received for this fiscal year.

4.2. Disposition of completed requests

Seventeen requests were completed during the reporting period. Records for one request were disclosed in full, 3 requests were disclosed in part, and 4 were abandoned. There were no records found for 9 requests.

Full disclosure was provided for 5.9% of the requests, and partial disclosure for 17.6%.

A total of 64.7% of the requests were responded to within the time prescribed under the Act. Among the 17 requests processed:

• 10 requests were completed within 30 days;
• 3 requests were completed within 31 to 60 days;
• 3 requests were completed within 61 to 120 days;
• One request was completed within 181 to 365 days.

4.3. Extensions

Requests can be extended for up to 30 additional days beyond the 30-day statutory time frame in two circumstances: when meeting the original time limit would unreasonably interfere with the operations of the government institution or when consultations are necessary. The Department requested an extension beyond the legal limit for one request this fiscal year, based on the large number of pages to be processed.

In 2023-2024, 6 requests were not processed within the statutory time limit due to other complexities.

4.4. Exemptions

The Act sets out specific exceptions to the right of access. These exceptions are known as exemptions. Each exemption is intended to protect information relating to a particular public or private interest and form the only basis for refusing access to personal information under the Act. Only section 26 (personal information about another individual) was applied, for 3 requests.

4.5. Exclusions

The Act does not apply to information that is already publicly available, such as government publications and material in libraries and museums. It also excludes material deemed Cabinet confidences. There were no exclusions cited in the requests completed during the reporting period.

4.6. Consultations

To assist other institutions in processing their requests, the ATIP Secretariat reviews requests for access to records concerning Canadian Heritage and makes recommendations for their release. In 2023-2024, Canadian Heritage did not receive any consultation requests related to the Act from other Government of Canada institutions or other organizations.

4.7. Costs

For the reporting period, the cost for the ATIP Secretariat to administer the Act was $233,168 of which $225,058 was for salaries and $8,110 was for goods and services.

5. Training and awareness

To increase understanding of the Act among the Department's employees, awareness and training sessions were provided by the ATIP Secretariat. Privacy Awareness training is part of the mandatory training curriculum given to new PCH employees. All employees are also invited to repeat this training every two years.

During the reporting period, a training schedule was posted monthly on the Department's intranet site and all employees were invited to register. The training was conducted remotely via Teams. These sessions provided information on the purpose and provisions of the Act, as well as the roles and responsibilities of the Department's employees and the ATIP Secretariat. The ATIP Secretariat also provided specific training to certain branches that requested it, and tailored the information offered to their specific needs.

In addition, in 2023-2024, the ATIP Secretariat has also added a new tool to its training curriculum to facilitate information access training for departmental employees. This tool has been developed with LMS365 software and takes the form of a SharePoint page that includes various training documents. The aim of this tool is to facilitate registration for training courses given by the Secretariat and to enable better collection and management of statistical data.

During the reporting period, 12 privacy awareness training sessions were conducted. A total of 97 employees participated in these training sessions.

The ATIP Secretariat intranet page provides PCH employees with information on the Act and related policies and procedures. In 2023-2024, the ATIP Secretariat added to its awareness tools a toolbox for Offices of Primary Interest. The objective of this tool is to better equip Offices of Primary Interest to understand their obligations when processing requests for access to personal information and to respond more effectively to such requests by having a better understanding of our internal processes, the purpose of the Act and their privacy obligations. This tool is updated periodically.

6. Policies, guidelines and procedures

6.1 Policy instruments

During the reporting period, the ATIP Secretariat continued to work toward creating a culture of privacy in the Department by updating its policy instruments and tools in use within the Department.

In 2023-2024, the ATIP Secretariat introduced a new mechanism for tracking overdue requests from branches, with a view to improve the Department's overall performance of meeting deadlines. The purpose of this mechanism is to remind branches that are late in submitting requested documents or recommendations, of the legal deadlines to be respected. All follow-up e-mails also contain an infographic of the internal ATIP request process and timelines, to facilitate understanding of their obligations under the Act.

The ATIP Secretariat has also updated the legal delegation of authority for the application of the Act to reflect the addition of a new player in the Department, the Associate Deputy Minister. Like the Deputy Minister, the Associate Deputy Minister enjoys full delegation.

The Secretariat has also created a detailed guide to the preparation and submission of annual reports on the application of the Access to Information Act and the Privacy Act. This step-by-step guide will be used by any new employee joining the ATIP Secretariat's governance team, which is responsible for these annual reports on behalf of the Department.

6.2 Information about programs and information holdings

The publication entitled Information about programs and information holdings (formerly known as Info Source) provides information about the functions, programs, activities and related information holdings of government institutions. It provides individuals, as well as current and former government employees, with relevant information to assist them to access personal information about themselves held by government institutions.

The Treasury Board Secretariat (TBS) requires that government institutions publish their Information about programs and information holdings chapter on their website. During the reporting period, the Department of Canadian Heritage has completed the process of updating its chapter, that is now published on its website.

7. Initiatives and projects to improve privacy

During the reporting period, Canadian Heritage began a complete overhaul of its internal forms and letter templates used to communicate with external stakeholders, such as requesters, third parties and the Information Commissioner of Canada. The aim of this redesign is to make these documents fully accessible, contributing to the goal of an accessible and barrier-free Canada. In particular, this will help improve access to information for all Canadians, including people living with disabilities. The new forms and letter templates are expected to be implemented over the next fiscal year.

The ATIP Secretariat has been working with departmental partners such as Information Technology, the Accessibility Unit within the Inclusion, Diversity, Equity and Accessibility (IDEA) Office, Communications and Security to send department-wide awareness messages on the steps to follow when creating forms. The objective, from a privacy point of view, is to make employees creating forms aware of the need to add a privacy notice when a collection of personal information is contemplated. In the longer term, this working group intends to create a procedure involving all stakeholders to ensure that employees comply with all requirements in these different areas each time they create a form.

Finally, in 2023-2024, Canadian Heritage continued to use modern technological tools to facilitate applicants' access to requested personal information. The SharePoint tool is used to transmit electronic documents to applicants. This easy-to-use tool makes it possible to transmit large, accessible documents. In addition, the ATIP Online Request Service (AORS), developed by TBS to modernize service delivery and facilitate application processing, was also used during the reporting period. This initiative has improved the requester's experience, facilitated transmission of the request to the institution, and enabled effective communication with the requester.

8. Complaints and federal court cases

Two complaints under the Act were filed with the Office of the Privacy Commissioner against the Department of Canadian Heritage in 2023-2024. Both complaints concerned delays in processing requests.

There were no Federal Court cases concerning the refusal of access during this reporting period.

9. Material privacy breaches

A privacy breach is deemed a material breach if it involves sensitive personal information, could reasonably be expected to cause serious injury or harm to the individual, or involves a large number of affected individuals.

One significant breach was reported to the Treasury Board Secretariat and the Office of the Privacy Commissioner during the reporting period. This concerned the privacy breach relating to BGRS relocation services and Sirva Canada, which affect most federal institutions. The Department of Canadian Heritage has identified 134 current and former employees whose information may have been compromised between 1999 and 2023.

10. Privacy impact assessments

At the end of the reporting period, a Privacy Impact Assessment (PIA) was completed. This was the PIA for the Young Canada Works program. The program, led by Employment and Social Development Canada and delivered in collaboration with eleven federal departments, Agencies and Crown corporations, including Canadian Heritage, offers students and graduates short-term employment and internship opportunities in the fields of heritage, arts, culture and official languages. The privacy risk for this activity has been assessed as medium following analysis by the ATIP Secretariat. Once the recommendations have been implemented by the program, the residual risk is low. Canadian Heritage has also been working to implement the recommendations of the Office of the Privacy Commissioner of Canada following comments received during its review of the PIA.

In 2023-2024, several programs sought advice on the use and disclosure of personal information. 35 privacy risk checklists for new or modified programs or systems were reviewed during the reporting period. In addition, 58 informal privacy requests were received and reviewed. The review of all these requests for advice resulted in the drafting of 20 privacy opinions.

11. Disclosure of personal information pursuant to paragraph 8(2)

Subsection 8(2) of the Privacy Act stipulates under which circumstances personal information under the control of a government institution may be disclosed. Paragraph 8(2)(m) states that the disclosure of personal information is permitted for any purpose where, in the opinion of the head of the institution, the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure, or the disclosure would clearly benefit the individual to whom the information relates. Paragraph 8(2)(e) states that personal information may be disclosed to an investigative body specified in the regulations upon written request, indicating the purpose and nature of the information, provided that the information is requested for the purpose of enforcing any law of Canada or a province, or for the purpose of conducting lawful investigations.

During the reporting period, no records containing personal information were disclosed pursuant to paragraphs 8(2)(e) and 8(2)(m) of the Act.

12. Monitoring compliance

Internally, the ATIP Secretariat monitored request processing times on a daily basis using the ATIP case management system (Access Pro Case Management/ Redaction), in addition to holding biweekly meetings with Secretariat management. A follow-up mechanism for solicitation notices sent to offices of primary interest has also been set up to make them aware of accumulated delays. These practices ensure that the time taken to process requests is kept under control, and that inter-institutional consultations are limited to those that are necessary. The bi-weekly meeting also enables Secretariat management to ensure that internal privacy advice is provided in a timely manner, and that appropriate mitigation measures are put in place and included in PCH contracts, where applicable.

Appendix A – Delegation Order

Access to Information Act and Privacy Act

Pursuant to Section 95 of the Access to Information Act and Section 73 of the Privacy Act, I, as head of the Department of Canadian Heritage, hereby designate the persons holding the positions set out in the schedule hereto, or persons occupying on an acting basis those positions, to exercise my powers and functions under these Acts specified opposite each position.

This Delegation Order supersedes all previous Access to Information Act and Privacy Act Delegation Orders.

The Honourable Pascale St-Onge
Minister of Canadian Heritage
Date: February 27, 2024

Powers and functions delegated pursuant to Section 73 of the Privacy Act and Privacy Regulations

Legend:

DM

Deputy Minister

DM-A

Associate Deputy Minister

CS

Corporate Secretary

ATIP/D

Director, Access to Information and Privacy Secretariat

ATIP/DD

Deputy Director, Access to Information and Privacy Secretariat

Appendix B – Statistical report on the Privacy Act

Statistical report on the Privacy Act

Name of institution:

Canadian Heritage

Reporting period:

2023-04-01 to 2024-03-31

Section 1: requests under the Privacy Act

1.1 Number of requests

1.2 Channel of requests

Section 2: Informal requests

2.1 Number of informal requests

2.2 Channel of informal requests

2.3 Completion time of informal requests

2.4 Pages released informally

Section 3: Requests closed during the reporting period

3.1 Disposition and completion time

3.2 Exemptions

3.3 Exclusions

3.4 Format of information released

3.5 Complexity

3.5.1 Relevant pages processed and disclosed for paper and e-record formats

3.5.2 Relevant pages processed by request disposition for paper and e-record formats by size of request

3.5.3 Relevant minutes processed and disclosed for audio formats

3.5.4 Relevant minutes processed per request disposition for audio formats by size of request

3.5.5 Relevant minutes processed and disclosed for video formats

3.5.6 Relevant minutes processed per request disposition for video formats by size of requests

3.5.7 Other complexities

3.6 Closed requests

3.6.1 Number of requests closed within legislated timelines provided by The Act

3.7 Deemed refusals

3.7.1 Reasons for not meeting legislated timelines provided by The Act

3.7.2 Requests closed beyond legislated timeline (including any extension taken)

3.8 Requests for translation

Section 4: Disclosures under subsections 8(2) and 8(5)

Section 5: Requests for correction of personal information and notations

Section 6: Extension

6.1 Reasons for extensions

6.2 Length of extensions

Section 7: Consultation received from other institutions and organizations

7.1 Consultations received from other Government of Canada institutions and other organizations

7.2 Recommendations and completion time for consultations received from other Government of Canada institutions

7.3 Recommendations and completion time for consultations received from other organizations outside of the Government of Canada

Section 8: Completion time of consultations on cabinet confidences

8.1 Requests with Legal Services

8.2 Requests with Privy Council Office

Section 9: Complaints and investigations notices received

Section 10: Privacy Impact Assessments (PIA) and Personal Information Banks (PIBs)

10.1 Privacy Impact Assessments

10.2 Institution-specific and Central Personal Information Banks

Section 11: Privacy breaches

11.1 Material privacy breaches reported

11.2 Non-Material privacy breaches

Section 12: Resources related to the Privacy Act

12.1 Allocated costs

12.2 Allocated costs

Supplemental Statistical Report on the Access to Information Act and the Privacy Act

Name of the institution:

Canadian Heritage

Reporting period:

2022-04-01 to 2023-03-31

Section 1: Open requests and complaints under the Access to Information Act

1.1 Enter the number of open requests that are outstanding from previous reporting periods.

1.2 Enter the number of open complaints with the Information Commissioner of Canada that are outstanding from previous reporting periods.

Section 2: Open requests and complaints under the Privacy Act

2.1 Enter the number of open requests that are outstanding from previous reporting periods.

2.2 Enter the number of open complaints with the Privacy Commissioner of Canada that are outstanding from previous reporting periods.

Section 3: Social Insurance Number (SIN)

Section 4: Universal Access under the Privacy Act

© His Majesty the King in Right of Canada, represented by the Minister of the Department of Canadian Heritage, 2023
Catalogue number: CH1-1/2E-PDF
ISSN: 1926-781