Annual report on the administration of the Access to Information Act 2013-2014

2.1 About Employment and Social Development Canada

ESDC’s mission is to build a stronger and more competitive Canada, to support Canadians in making choices that help them live productive and rewarding lives and to improve Canadians’ quality of life.

To do this, we:

• develop policies that make Canada a society in which all can use their talents, skills and resources to participate in learning, work and their community;
• create programs and support initiatives that help Canadians move through life’s transitions—from families with children to seniors, from school to work, from one job to another, from unemployment to employment, from the workforce to retirement;
• create better outcomes for Canadians through service excellence with Service Canada and other partners; and
• engage our employees, establish a healthy work environment, nurture a culture of teamwork and build our leadership capacity.

4.1 Access to information delegations

Section 73 of the Access to Information Act empowers the head of the institution to delegate any of the powers, duties or functions assigned to him or her by the Act to employees of the institution.

In February 2009, the Honourable Diane Finley, the then Minister of Human Resources and Skills Development, approved a Delegation Order for the Access to Information Act, delegating the authority for access to information to key positions within the senior management team, as well as to Departmental officials who have the knowledge and expertise to exercise the powers, duties or functions of the Minister under the legislation.

The Delegation Order is attached as Annex A.

4.2 Chief Privacy Officer

The Chief Privacy Officer is the Department’s functional authority on all privacy matters, which includes the provision of authoritative advice and functional direction to all Departmental branches and regions. The Chief Privacy Officer is responsible for the proactive management of privacy issues in the Department and the establishment of comprehensive privacy management frameworks, programs, review processes, and risk-based approaches to privacy management.

In addition to establishing Departmental privacy directives, standards, guidelines, and processes, the Chief Privacy Officer is accountable for the implementation of the Department’s privacy management program, including the coordination and management of privacy activities, which includes oversight of the Department’s privacy governance structure with clear accountabilities and defined objectives that are aligned with Departmental and government-wide policies, priorities and plans. The Department’s privacy program is monitored, assessed and reported-on to measure performance against expected results.

4.3 Transition in Access and Privacy roles and responsibilities

Effective October 1, 2013, the Access to Information and Privacy (ATIP) and Privacy Renewal Divisions were re-aligned to address the evolution of the privacy management function within the Department. The objectives of the re-alignment include:

• Support the continued modernization of the Department’s privacy function and the implementation of the Privacy Renewal Action Plan;
• Clarify the mandates, roles, responsibilities, and accountabilities of the Divisions to better
• Respond to the evolving needs of the Department;
• Better align resources to Departmental priorities; and
• Structure the organization to optimize performance and results.

The Divisions are re-aligned as follows.

5.1 Privacy management division

The Privacy Management Division is the Departmental focal-point for the management of privacy policy and the implementation of the Department’s Privacy Management Framework. Under the authority and direction of the Chief Privacy Officer, the Privacy Management Division supports the horizontal coordination and implementation of Departmental strategic plans and priorities as it relates to the protection of privacy, including the Department’s multi-year Privacy Management Action Plan. The Division also manages the Department’s privacy risk management function, including the Privacy Impact Assessment process and the development of Information Sharing Agreements involving personal information.

The Privacy management division includes two units:

• The Privacy compliance and review unit provides advice, guidance, and privacy-related services to Departmental officials on the application of relevant privacy legislation, policies, directives and guidance. This includes the management of the Department’s Personal Information Banks in InfoSource, the review of privacy notice statements, contracts, and other forms and instruments for privacy compliance, and the provision of advice and guidance for the development of Information Sharing Agreements. The Unit is also tasked with the day-to-day issues management related to the protection of personal information under the custody and control of the Department; and
• The Policy, planning, and coordination unit is responsible for the development and implementation of the Department’s privacy policy suite, strategic support services to the Chief Privacy Officer and the Privacy and Information Security Committee, and strategic planning and reporting functions. The Unit is also responsible for the design and implementation of the Department’s Privacy Program, the privacy risk management process, the review and assessment of strategic policy and program priorities, and research and evaluation of emerging trends. The Unit also supports the management and implementation of horizontal issues and working groups.

5.2 Access to Information and Privacy Operations Division

The Access to Information and Privacy Operations Division carries out the Department’s legislated requirements under the Privacy Act and the Access to Information Act. The Division leads the processing of all requests under the Access to Information Act, and coordinates the processing of Privacy Act requests, many of which are handled at the regional level. This work involves responding to requests from the public and delivering training and awareness programs to employees with respect to administration of the two Acts.

The Division is responsible for providing guidance to the regions with respect to the operational and reporting components of the Access to Information and Privacy function. As part of the delegated authority within this unit, the Division responds to legal instruments in which the Department is asked to share personal information, (i.e., subpoenas, court orders, search warrants), liaises with the Office of the Information Commissioner and the Office of the Privacy Commissioner regarding complaints received by the Department, and serves as the Departmental point of contact with the Office of the Privacy Commissioner on privacy breaches. The Division is also responsible for managing the disclosure of information to third parties via public interest disclosures.

The ATIP Operations Division includes two units:

• The ATIP processing unit performs a line-by-line review of records requested under the Access to Information Act and the Privacy Act. Reports are provided for information purposes on a weekly basis to the Deputy Ministers’ Offices and the Ministers’ Offices, both on new Access to Information requests and upcoming releases under the Access to Information Act.
• The Incident management and legislative disclosures unit helps support consistent treatment of personal information entrusted to the Department, and leads the Departmental response to all legal instruments received. The Unit also manages complaints to the OPC by Departmental clients and interacts with the OPC on privacy breaches, working in partnership with the Departmental Security Office.

5.3 Branch and regional access to information activities

While the ATIP Operations Director, with support from the Division’s ATIP Operations officers, has overall authority for the administration of the Access to Information Act, branches and regions also play a key role.

The Department has a network of regional, local and branch coordinators to undertake many of its key privacy responsibilities. The majority of the thousands of Privacy Act requests that ESDC receives in a typical year are processed by employees within ESDC’s regional offices. Regional privacy activities have been centralized under Regional Privacy Centres of Specialization to maintain capacity and expertise. ESDC’s Regional Privacy Centres of Specialization officers have delegated authority to process formal privacy requests under the Privacy Act and also process informal requests received by the Department. Under the functional direction of the Departmental Chief Privacy Officer, regional offices also provide privacy advice and guidance to regional management and members of the public.  

5.4 ESDC’s commitment to respect timeframes

Except for specific circumstances in which an extension can be claimed, the Access to Information Act provides 30 calendar days for responding to requests. Given these strict timeframes and the Department’s commitment to respect the spirit and the letter of the legislation, the following processes and responsibilities are established at ESDC:

• Retrieval of relevant records and formulation of recommendations: Targeted branches and regions (offices of primary interest) are allotted eight working days to retrieve complete and accurate records in response to requests and provide them, along with recommendations, to the ATIP Operations Division.
• Line-by-line review of the responsive records: The ATIP Processing Unit is provided with eight working days to do a thorough line-by-line review of the records and to invoke the limited and specific exemption and exclusion provisions that are applicable.
• Seen and noted signatures, and copies for information: If requested, the Executive Head of the targeted branch or region is provided a copy of the release package and is given four working days to provide his or her signature indicating that he or she is aware that the records are being released (i.e. for seen and noted purposes). At the same time that the records are provided to the office of primary interest, copies of the package are provided to Departmental communications officials. Employees from the Deputy Ministers’ Offices and the Ministers’ Offices are also given a copy of the package for information purposes, when requested. Some files may require the preparation of media lines. The preparation of communications products is undertaken by communications and branch officials and does not impact the timely processing of access to information requests.

The three steps described account for a total of 20 working days. ESDC’s ATIP Operations Division has a long-standing history of keeping its partners informed throughout the process when responding to access to information requests. This collaborative approach supports a no-surprise environment for stakeholders within ESDC, enabling officials in the ATIP Operations Division to appropriately administer the legislation with few delays.

6.1 Challenges

This year was marked by the retirement of senior employees in the ATIP Processing Unit which greatly impacted the workforce capacity, creating a need for expertise within the office. To maintain an effective handling of requests within the existing resources, the ATIP Operations Division recognized the importance of seeking new and innovative ways to process requests within the legislated timeframe.

6.2 Business process redesign

Consequently, in May 2013, ESDC launched a Business Process Redesign (BPR) of the Access to Information (ATI) process in the Department, to oversee and identify more efficient and innovative ways of dealing with the increasing volume and complexity of ATI requests. The initiative’s goal was also to improve efficiencies in the management and processing of ATI requests across ESDC (ESD, Service Canada and the Labour Program); simplify and streamline work requirements for ATIP Operations Divisional staff and partners (Branches and Regions); better fulfill our obligations under the Access to Information Act; and, reduce the paper burden.

A cross functional workgroup was created to examine the current process, using the BPR methodology. Some quick modifications to the process were quickly implemented and other innovative medium-term solutions are being analyzed, to determine the way forward in the fourth and final phase of implementation.

6.3 Stewardship of information and effective workplace behaviours tool

ESDC has developed a mandatory online training course designed to provide employees with the knowledge of how to protect and manage the resources, including personal information, entrusted to them as employees of ESDC. The Stewardship of Information and Effective Workplace Behaviours training tool, produced by the Service Canada College of ESDC, was created by pedagogical experts in collaboration with subject matter experts, including from the ATIP Operations Division. The module covers six disciplines related to the stewardship of information: security, information technology (IT) security, information management, values and ethics/code of conduct, privacy, and access to information.

Launched in 2013-2014, this course supports the Department’s commitment to enhancing the responsible use and care of Departmental and personal information and is required to be completed by all employees across the Department. To date, more than 44 % of employees have completed the training. This module will be required to be retaken every two years. New employees joining the Department are also required to complete this course. This is the first training of its kind available at ESDC and will support a culture of access to information awareness within the Department.

6.4 Access to Information and Privacy training and awareness activities

In 2013–2014, the ATIP Operations Division provided 14 in-person training sessions on access to information and privacy issues to 109 employees across the Department. In response to recurring questions from program experts regarding the scoping of records and on the formulation of recommendations regarding the Access to Information Act’s exemption and exclusion provisions, the ATIP Operations Division updated and shared its guidance on these topics with program areas. Recognizing that not all employees are tasked with requests on a regular basis, the guidance is brief and provides key pointers to assist those responsible for gathering records to fulfill their responsibilities.

In addition to the sessions that were offered by the ATIP Operations Division, the regional officials responsible for privacy in the regions also provided information sessions to their colleagues. Regional officials provided 20 sessions to 677 employees during 2013–2014.

Overall, provision of in-person access to information training has been replaced by the Departmental transition to an online, self-directed integrated learning model, not only for access to information but also for privacy, security, IT security, information management and values and ethics/code of conduct.

7.1 Requests for Information under the Access to Information Act

The following is a summary of the information contained in the Statistical Report on the Access to Information Act for 2013–2014, which is attached as Annex B.

Access to Information Act – Delegation of authority

Part 1 - Request under the Access to Information Act

Part 2 - Requests closed during the reporting period

Appendix A

The tables above in Appendix A of the Statistical Report include reporting data under both the Access to Information Act and the Privacy Act pursuant to 2013-2014 Treasury Board Secretariat reporting requirements.