Report on the administration of the Privacy Act 2023-2024

Summary of the purpose of the Privacy Act

The Privacy Act (the Act), promulgated on July 1, 1983, aims to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution.

The purpose of the Act is to protect personal information by allowing individuals to consult information about them. It also imposes strict controls on how such information is gathered, used, and shared.

Annual report prepared in accordance with section 72

This document was prepared in response to section 72 of the Act, which requires federal institutions to submit an annual report to Parliament on the administration of the Act. This report provides details on activities related to the administration of the Act at Canada Economic Development for Quebec Regions (CED). This report was also prepared in accordance with section 20 of the Service Fees Act.

Mandate of the institution

CED is the key economic development player for Quebec’s regions for small and medium-sized enterprises (SMEs). In order to accomplish its core responsibility, which is economic development in Quebec, CED fosters business start-ups and growth. It helps them become more innovative, productive, and competitive. It supports efforts to engage the regions of Quebec and attract investments that will help boost the economic well-being of Quebec and Canada.

CED contributes to the economic vitality of all of Quebec’s regions by leveraging their competitive regional advantages, such as wind power and marine technologies. It also supports the transition and diversification of communities that remain dependent on a limited number of sectors or that have been affected by an economic shock, such as the closure of the chrysotile mines.

CED achieves its results by supporting businesses, primarily SMEs, and non-profit organizations (NPOs), through strategic investments. Through its 12 business offices across Quebec’s regions and the relationships it has developed with other economic development players, CED stays abreast of the needs of the regions and businesses and is able to offer financial support to carry out projects that support businesses and communities in their economic development efforts.

To learn more about CED's mandate, programming, and activities, visit its website: https://ced.canada.ca.

Access to Information and Privacy Office

CED fulfills its responsibilities under the Access to Information Act (ATIA), including Part 2 on proactive publication, and the Privacy Act (PA) through an Access to Information and Privacy (ATIP) Office to process requests. The ATIP Office reports to the manager of the Corporate Secretariat, which in turn reports to the Chief of Staff to the Deputy Minister/President.

The ATIP Office has an access to information and privacy coordinator and an advisor. In addition to being responsible for all daily ATIP activities, the coordinator, who is supported by the advisor, oversees the development, coordination, and implementation of policies, guidelines, and procedures necessary to manage the agency’s compliance with the acts.

Through its delegated authority, the ATIP Office represents CED on matters relating to the ATIA and PA in dealings with the public, the Treasury Board Secretariat, information and privacy commissioners, and with other federal institutions and departments.

During the reporting period, CED did not receive or provide any services under section 73.1 of the PA.

Agreement with the Access to Information and Privacy Communities Development Office (APCDO)

In 2022-2023, CED joined the newly formed Access to Information and Privacy Communities Development Office (APCDO). This was created to address capacity issues within the Access to Information and Privacy community across Government of Canada institutions subject to the Acts.

During the reporting period, CED’s ATIP Office actively participated in several training sessions offered by the APCDO. Thus, the APCDO contributed to the development and sustainability of the Access to Information and Privacy community by conducting recruitment, retention, learning, networking and partnership activities in the spirit of diversity, inclusiveness and accessibility focused on community engagement.

Requests received and processed

During fiscal year 2023–2024, CED received 3 personal information requests, and no requests were carried over from the previous year. This represents an increase in the number of requests received and processed compared with the previous fiscal year, during which no requests were received.

The following graph shows the number of requests for access to personal information received since 2019–2020. Excluding abandoned requests, CED processed 14 personal information requests during this period.

Text version: Requests Received

Requests Received

• In 2023-2024, 3 requests were received
• In 2022-2023, 0 requests were received
• In 2021-2022, 9 requests were received
• In 2020-2021, 3 requests were received
• In 2019-2020, 8 requests were received

Disposition and processing times

Of the 3 requests closed in 2023-2024, 2 were answered within 15 days (67%) and one within 45 days (33%). CED received and processed only one request for which no documents existed. Although no document was provided, the ATIP Office still had to process the request, deal with the applicant, and coordinate a document search by the office of primary interest.

It is important to note that the access request that was responded to beyond the 30-day period prescribed by the Act, was due to a technological problem beyond CED’s control. In fact, for each new access request submitted in the Treasury Board Secretariat’s (TBS) ATIP Online Management Tools (AOMT), a notification is sent by email to inform the organization. However, in the case of this request, no such notification was received by CED. It was during a random check of the AOMT, carried out several days after the request was submitted that the ATIP Office became aware of the request. After numerous discussions with TBS’s Online ATIP Request Service and with CED’s Information and Technology Solutions Branch, it was confirmed that the notification was indeed issued by AOMT, but it was never received by CED’s technological infrastructure and that no CED firewall prevented its receipt.

Although this was an exceptional situation, it did not meet the requirements stipulated in section 15 of the PA to justify an extension of the processing time, and this is why CED was late in processing this request. Nevertheless, the actual processing time for this access request was 15 days, i.e., from the day on which the ATIP Office became aware of the request to the day on which the reply was given to the applicant.

Exemptions and exclusions invoked

Considering the 2 requests for which documents were disclosed, only one was communicated in full, without applying protection. In the other case, the exception for section 26 (information about another individual) was invoked.

Pages processed and pages disclosed

In 2023-2024, requests for access to personal information led the ATIP Office to process and disclose 600 pages. This represents a significant increase from the previous year, during which no pages were reviewed or disclosed in relation with requests for access to personal information.

The following chart shows the number of personal information requests received since 2019-2020. Excluding abandoned requests, CED processed 14 personal information requests during this period.

Text version: Pages Processed

Pages processed

• In 2023-2024, 600 pages were processed
• In 2022-2023, 0 page were processed
• In 2021-2022, 1713 pages were processed
• In 2020-2021, 319 pages were processed
• In 2019-2020, 1928 pages were processed

Extensions

The Act stipulates that a request for access to personal information must be answered within 30 calendar days. Extensions are only granted in exceptional cases. During the reporting period, no request required an extension.

Consultations

During the 2023-2024 fiscal year, CED did not conduct any consultations in connection with the requests for access to personal information received. In addition, CED did not receive any consultations from another institution.

Active complaints

CED did not receive any complaints regarding the Privacy Act during the 2023–2024 fiscal year.

Costs

Costs pertaining to the administration of the Act during the reporting period totalled $12,545, a decrease of $2,804 compared to last year, due in particular to the acquisition cost in 2022-2023 of a new access to information and privacy request management software. These expenses include $12,214 in salaries for the equivalent of 0.1 full-time employees and $331 in travel, training, software licenses, supplies, and translation expenses.

Statistical report

A copy of the 2023–2024 statistical report on the administration of the Privacy Act is appended to this report.

Complaints

CED did not receive any privacy complaints during the reporting period.

Audits

CED was not the subject of any audits or investigations during the reporting period.

Monitoring of the processing time

Since 2011, the ATIP Office has monitored the processing time of privacy requests using software for managing and processing requests for access to information and personal information. This system also facilitates the tracking of the various activities and tasks surrounding the processing of a request and serves as a tool to ensure compliance with the deadlines set out in the PA. The time required to process requests for personal information is tracked through the software dashboard, and a status report on the file is provided to the ATIP Office manager.

Limitations on consultations between institutions

In order to limit the need for inter-institutional consultations, the ATIP Office ensures that it targets only the information in each request for which it needs more information to properly exercise its discretion not to disclose information or where the ATIP Office intends to disclose potentially sensitive information.

As CED effectively identifies the need for such consultations, no specific monitoring was conducted during the period covered by this report to limit them.

Frequently requested information

Year after year, the same trend is seen with respect to information frequently sought in requests received at CED, namely, information related to grants and contributions granted by CED or information related to the institution’s internal activities.

Since some of this information is already available through the proactive publications that CED issues in accordance with the requirements set out in Part 2 of the ATIA, no specific monitoring was conducted during the period covered by this report to make this information available by other means.

Privacy measures included in contracts, agreements, and arrangements

When entering into a contract, agreement, or arrangement that involves personal information, besides the standard clauses and conditions, CED ensures that appropriate additional clauses are included to protect and manage personal information, such as the storage of personal information and the obligation for the third party to immediately notify the institution of any security breach involving personal information.

Furthermore, in accordance with the Policy on Government Security, CED is required to use the Security Requirements Checklist (SRCL) for entry into contracts, agreements, or arrangements.

As CED meets all requirements for contracts, agreements, and arrangements, no specific monitoring was conducted during the reporting period.

Monitoring requests for correction

Requests for correction of personal information are processed by the ATIP Office and recorded in an internal tracking system. No requests for correction of personal information were received during the reporting period.

ACCESS TO INFORMATION AND PRIVACY ACT DELEGATION ORDER / ARRÊTÉ DE DÉLÉGATION EN VERTU DE LA LOI SUR L’ACCÈS À L’INFORMATION ET DE LA LOI SUR LA PROTECTION DES RENSEIGNEMENTS PERSONNELS

Schedule / Annexe

Signed in Gatineau on this 11 day of September, 2023

Signé à _________________, le ______ jour de _______________ 2023

___________________________________________________

Sony Perron, Deputy Minister/President of
Canada Economic Development for Quebec Regions

Sony Perron, sous-ministre/président de
Développement économique Canada pour les régions du Québec

Statistical Report on the Privacy Act

Name of institution: Canada Economic Development for Quebec Regions

Reporting period: 2023-04-01 to 2024-03-31