Report on the administration of the Privacy Act 2021-2022

Introduction

Summary of the purpose of the Privacy Act

The Privacy Act (the Act), promulgated on July 1, 1983, aims to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution.

The purpose of the Act is to protect personal information by allowing individuals to consult information about them.  It also imposes strict controls on how such information is gathered, used and shared.

Annual report prepared in accordance with section 72

This document was prepared in response to section 72 of the Act, which requires federal institutions to submit an annual report to Parliament on administration of the Act. This report provides details on activities related to administration of the Act at Canada Economic Development for Quebec Regions (CED). This report is also prepared in accordance with section 20 of the Service Fees Act.

Mandate of the institution

CED is a regional economic development agency. Quebec communities and businesses—especially small and medium-sized enterprises (SMEs)— are at the heart of its action. Through the projects it funds and its networking and integration role, CED is the key federal actor in the Quebec entrepreneurial ecosystem.

CED maintains client relations with businesses and supports them in their projects. It makes strategic investments that promote competitive regional advantages and support the transition and modernization of communities. Aiming to position Quebec businesses at the leading edge of tomorrow’s economy, CED focuses on business growth, innovation, clean technologies, inclusive economy and the participation of groups that are generally underrepresented in the labor market.

Well rooted in the regions thanks to its 12 business offices, CED builds on collaboration and creating synergies with businesses, communities, supporting organizations and other levels of government to increase the quality and impact of its programs. For example, it forms partnerships to foster a concerted action by regional economic development actors and ensures a better exchange of information between federal organizations.

CED provides a regional strategic perspective that supports national priorities and works with other departments to ensure coordination of government policies and programs. Its action has a significant impact on Quebec communities and businesses, not only through its direct investments, but also because it contributes to understanding the economic development needs of the regions.

CED’s Grants and Contributions Programs and Initiatives, in effect in 2021-2022

The main recipients of CED’s programs are SMEs, business groups or associations and NPOs whose principal mission is to support businesses or economic development. These programs include repayable and non-repayable contributions.

To learn more about the CED’s mandate, programming and operations, go to its Web site: ced.canada.ca.

Organizational structure

Access to Information and Privacy Office

CED fulfills its Access to Information Act (ATI) and Privacy Act (PA) responsibilities with an Access to Information and Privacy Office (AIPO) to process requests. The AIPO reports to the Manager of the Corporate Secretariat, who in turn reports to the Chief of Staff of the Deputy Minister/President.

AIPO has an access to information and privacy coordinator, as well as an advisor. The coordinator, with the help of the advisor, oversees compliance with legislation, regulations, procedures and broad government trends.

Through its delegated authority, AIPO represents the Agency on matters relating to the Act in dealings with the public, Treasury Board Secretariat, the Commissioners of Information and Privacy and other federal departments and institutions.

Delegation order

CED’s enabling legislation identifies its head as being the Deputy Minister / President. In addition to managing the institution and overseeing management of its personnel, the Deputy Minister / President is responsible for application of the Privacy Act.

To this end, the authority for application of the Act was delegated to the Coordinator, Access to Information and Privacy, while most administrative authority was delegated to the Advisor, Access to Information and Parliamentary Affairs.

A copy of the signed and dated delegation order is attached to this report.

Highlights of the statistical report 2020-2021

Requests received and processed

During the 2021-2022 fiscal year, 9 requests for access to personal information were received. No requests were carried over from the previous year. This represents a significant increase in the number of requests from the previous year when only 3 requests were received. In comparison with the previous year when 1 request was abandoned, this year three requests were abandoned. In two of theses cases, the AIPO redirected and advised requesters to submit new requests to the appropriate department and to abandon those submitted to CED following an error in identifying the department by the requester. Since CED has been accepting on-line filing of requests for access to personal information, more requests are being abandoned because they are submitted to CED in error. The third request was converted to an access to information request to better meet the needs of the applicant.  Of the six remaining requests, documents were partially disclosed for all of them (100%).

The following graph shows the number of requests for access to personal information received since 2017-2018. Excluding abandoned requests, CED processed 16 requests for access to personal information during this period.

Table 1: Requests received

Text version

Requests received

In 2021-2022, 9 requests were received

In 2020-2020, 3 requests were received

In 2019-2020, 8 requests were received

In 2018-2019, 11 requests were received

In 2017-2018, 7 requests were received and 1 request was carried over from last fiscal year

Disposition, completion times and extensions

The Act stipulates that a request for access to personal information must be answered within 30 calendar days. Extensions are granted only in exceptional cases. The three requests that were abandoned were done so before the 15th day following receipt of the request. Of the six requests completed, all were closed within the time limit set out in the Act.

CED currently has no active requests that are outstanding from previous reporting periods.

Table 2: Disposition and completion time

Exemptions and exclusions invoked

Exemptions for section 26 (information about another individual) of the Privacy Act were invoked in the processing of all requests where records were partially disclosed.

In addition, one exemption was invoked under section 22(1)(b) regarding information relating to an ongoing investigation. Finally, exemptions were claimed under section 22.3 (Public Servants Disclosure Protection Act) in the processing of two requests. Invoking these last two sections of the Act is exceptional for the ATIPO.

Pages processed and pages disclosed

In 2021-2022, requests for access to personal information resulted in the ATIPO processing 1713 pages and disclosing 1712 pages. This represents a significant increase from the previous year when only 319 pages were processed. However, given the low rate of privacy requests typically processed by CED, we do not believe this represents a significant long-term trend.

Table 3: Pages processed

Text version

Pages processed

In 2021-2022, 1713 pages were processed

In 2020-2020, 319 pages were processed

In 2019-2020, 1928 pages were processed

In 2018-2019, 0 pages were processed

In 2017-2018, 871 pages were processed

Consultations

CED did not conduct any consultations in connection with the requests for access to personal information received. In addition, CED did not receive any consultations from another institution.

Active complaints

During 2021-2022, CED did not receive any complaints regarding the Privacy Act.

Cost

Expenses related to the administration of the Act totalled $10,008 in 2021-2022. This amount includes $9,781 in salaries for the equivalent of 0.118 full-time employees. An amount of $227 was also spent on travel, software rental, supplies and translation.

Impacts of COVID-19 pandemic measures on the institution's ability to fulfill its responsibilities under the Privacy Act

The measures taken by CED in connection with the COVID-19 pandemic, such as telework, did not have an impact on the organization's ability to fulfill its responsibilities under the Privacy Act.

Statistical Report

A copy of the 2021-2022 statistical report on the administration of the Privacy Act as well as the supplementary statistical report on applications affected by COVID-19 are appended to this report.

Training and awareness

In 2021-2022, several training sessions regarding the protection of personal information were offered to the organization's employees through various activities. In the spring, approximately 60 people participated in information sessions regarding management, access and protection of information. In the summer, an awareness message regarding the protection of personal information was delivered to approximately 20 managers and employees who make up the union-management committee. In the fall, presentations on the principles of access to information and protection of personal information were given to new employees of the organization, as well as to information management employees and a regional business office, totalling some 40 people.

Finally, a message intended for all employees as well as information capsules were posted on the organization's intranet page highlighting good practices regarding access to information, protection of personal information and privacy breaches during the summer. The ATIPO is always available to provide specific training to employees whose duties require some knowledge of access to information.

Policies, guidelines, procedures and initiatives

CED did not implement any new policies, guidelines, procedures or initiatives during the reporting period. However, the organization has updated its internal procedures on the application of access to information and privacy requests, as well as on the management of privacy breaches, including the establishment of an annual log.

Summary of key issues and actions taken on complaints or audits

Complaints

During the 2021-2022 fiscal year, CED did not receive any complaints related to a request for access to personal information.

Audits

CED was not the subject of any audit over the reporting period.

Monitoring compliance

Monitoring of the processing time

Since 2011, the AIPO has equipped itself with software to manage and track access to information requests and privacy requests. This program makes it easier to follow every activity and task related to any request and serves as a tool to monitor processing time to comply with the provisions on timeframes as set out in the Act.

Requests for corrections

Requests to correct personal information are processed by the AIPO and recorded in an internal tracking system. No requests to correct personal information were received during the reporting period.

Material Privacy Breaches

No material privacy breaches occurred at CED during the 2021-2022 period.

Privacy Impact Assessments

In 2019-2020, CED's Access to Information and Privacy Office began drafting a new Privacy Impact Assessment (PIA) for its grants and contributions programs and initiatives. With the implementation of the Cortex computer system, the Regional Economic Growth through Innovation (REGI) program, as well as some ad hoc initiatives such as the Women Entrepreneurship Fund, it was determined that a new assessment was required to include additional personal information such as minority community membership, level and field of education, and student status, while ensuring the security of our computer systems to preserve the integrity of this information.

The PIA was drafted in collaboration with key areas of the organization including Operations, Policy and Programs Branch, and Information Management and Technology Solutions Branch and its final content received Treasury Board Secretariat approval in 2021. The review found that the collection of personal information for CED programs and initiatives is very limited and that, although personal information is sometimes considered by the Agency, decisions resulting from this process are not made with respect to the individuals to whom the information relates, but rather with respect to organizations, based on proposed projects. The personal information collected through these linked activities is therefore not used for an "administrative purpose" within the meaning of the Privacy Act.

Three recommendations have been made by the ATIP Office regarding the retention of personal information: systematically limiting certain accesses, implementing security alerts for non-secure devices, and conducting sporadic audits of access to records.

CED’s PIA summary can be accessed directly at the following link: https://ced.canada.ca/en/transparency-proactive-disclosure/privacy-impact-assessment/quebec-economic-development-program/?_ga=2.41613738.98196096.1652792488-1500160317.1652792488&_gl=1*138l7yq*_ga*MTUwMDE2MDMxNy4xNjUyNzkyNDg4*_ga_Q2F69KPVZ5*MTY1Mjc5MjQ4Ny4xLjEuMTY1Mjc5MjU5NS4w

Public interest disclosures

During fiscal year 2021-2022, no information was disclosed pursuant to subsection 8(2)(m) of the Privacy Act.

Conclusion

Canada Economic Development for Quebec Regions recognizes the right to privacy as a fundamental right. Convinced of the crucial importance of protecting personal information in the context of its programs and activities, the Agency ensures compliance with related principles such as transparency, need-to-know and adequate data collection and protection standards, whether it be the personal information of employees or that of its clients.

To do so, DEC deploys multiple means such as ensuring the security of its computer systems, good information management practices as well as training and messages to employees to make them aware of their obligations and responsibilities in this regard. Canada Economic Development for Quebec Regions is proud to have contributed to the application of these principles during the 2021-2022 fiscal year and will continue its efforts in this regard in the coming years.