Annual Report on the Administration of the Privacy Act 2015–2016

1.1: About the Privacy Act

The Privacy Act received Royal Assent on July 1, 1983. Its purpose is to impose obligations on federal institutions subject to the Privacy Act to respect the privacy rights of individuals by limiting the collection, use and disclosure of personal information. The Privacy Act also gives individuals the right of access to their personal information and the right to request the correction of that information.

Section 72 of the Privacy Act requires the head of a federal institution to submit an annual report to Parliament on the administration of the Act following the close of each fiscal year.

1.2: About Employment and Social Development Canada

The mission of Employment and Social Development Canada (ESDC), which includes the Labour Program and Service Canada, is to build a stronger and more competitive Canada, to support Canadians in making choices that help them live productive and rewarding lives and to improve Canadians’ quality of life.

ESDC is one of the largest and most geographically distributed federal departments in the Government of Canada. Citizens and clients interact with ESDC on a daily basis through 615 points of service across Canada. In 2015–16, ESDC provided approximately $110 billion in benefit payments and supported millions of Canadians through its many programs and services:

• 81.5 million visits to the Service Canada website;
• 8.1 million in-person visits to Service Canada Centres;
• 1.9 million calls answered by 1 800 O-Canada agents;
• 4.7 million passports issued;
• 2.78 million Employment Insurance claims, 1.3 million Canada Pension Plan and 2.6 million Old Age Security applications processed;
• $2.74 billion withdrawn from Registered Education Savings Plans by students to help fund their post-secondary education; and
• 94% of labour disputes settled as part of the collective bargaining process.

ESDC delivers a range of programs and services that affect Canadians throughout their lives. The Department provides seniors with basic income security, supports unemployed workers, helps students finance their post-secondary education and assists parents who are raising young children. The Labour Program is responsible for labour laws and policies in federally regulated workplaces. Service Canada helps citizens access ESDC’s programs, as well as other Government of Canada programs and services.

1.3: Our Ministers

The activities of ESDC are governed by federal legislation and reflected in the mandates of its three ministers:

• the Honourable Jean-Yves Duclos, Minister of Employment and Social Development, styled as Minister of Families, Children and Social Development;
• the Honourable Mary-Ann Mihychuk, Minister of Labour, styled as Minister of Employment, Workforce Development and Labour; and
• the Honourable Carla Qualtrough, Minister of Sport and Persons with Disabilities.

The Honourable Jean-Yves Duclos is the Minister responsible for the purposes of the Department of Employment and Social Development Act.

2.1: Legal framework for Privacy

The Privacy Act protects the privacy of individuals with respect to their personal information held by government institutions. The Privacy Act also provides individuals with a right of access to that information, subject to the exceptions set out in the legislation, as well as the right to request the correction of inaccurate information. Sections 4 to 8 of the Privacy Act, commonly referred to as the “Code of Fair Information Practices,” govern the collection, use, disclosure, retention and disposal of personal information.

Subsection 8(2) of the Privacy Act provides that personal information may be disclosed in accordance with that provision, subject to there being another Act of Parliament governing the disclosure of personal information. The disclosure of personal information by Employment and Social Development Canada is governed by one such Act of Parliament, Part 4 of the Department of Employment and Social Development Act. Part 4 provides that personal information obtained by Employment and Social Development Canada under a program or prepared from that information is privileged, and may only be made available in the specific and limited circumstances set out in that Part. Part 4 also sets out provisions governing the use of that personal information for research or statistical purposes.

2.2: Privacy Delegation Order

Section 73 of the Privacy Act empowers the head of the institution to delegate any of the powers, duties or functions assigned to him or her by this Act to employees of the institution. The Delegation Order, found in Annex A, outlines the delegations that were in effect as of June 3, 2015.

2.3: Departmental Privacy Management Framework

Given the importance of personal information protection at ESDC, the Department has adopted, and continues to implement, a risk-based and proactive approach to privacy management that promotes the concept of “privacy by design.” Privacy by design emphasizes the importance of building privacy directly into the design and architecture of new programs, systems, technologies and business processes. ESDC’s Privacy Management Framework includes the following key elements:

• Element 1 – Governance and Accountability: Roles and responsibilities for privacy management are clearly defined to meet legal requirements, regulations, policies, standards and public expectations.
• Element 2 – Stewardship of Personal Information: Appropriate privacy protections are implemented to manage personal information through its life cycle.
• Element 3 – Assurance of Compliance: Formal processes and practices are established to ensure adherence to privacy specifications, policies, standards and laws.
• Element 4 – Effective Risk Management: Structured and coordinated risk assessments are conducted to limit the probability and impact of negative events and maximize opportunities through risk identification, assessment and prioritization.
• Element 5 – Culture, Training, and Awareness: The protection of personal information is a core organizational value and is fundamental to maintaining the public’s trust. Formal privacy training and awareness activities promote a privacy-aware organization that values the protection and stewardship of personal information.

2.4: Privacy governance

ESDC fosters governance and decision-making responsibilities for privacy through the Department’s Corporate Management Committee and the Privacy and Information Security Committee.

2.5: Organization of the privacy function

The Corporate Secretariat is the Department’s office of primary interest for the development of privacy policy, the provision of privacy advice and guidance to the portfolio, and the management of access to information and privacy operations. ESDC’s Corporate Secretary serves as the Department’s Chief Privacy Officer.

Text description of figure 1 – Organization of the Privacy Function at ESDC

This organizational chart displays a hierarchy beginning with the Corporate Secretary and Chief Privacy Officer of ESDC at the top. To the bottom, a dotted line leads to the Regional Operations that include Access to Information and Privacy Managers. Directly below the Chief Privacy Officer are two branches which lead respectively to the Privacy Management Division and to the Access to Information and Privacy Operations Division.

Under the first of these two branches are two further branches. One represents Privacy Compliance and Review Unit while the other represents the Policy, Planning and Coordination Unit. Under the second branch are the Request Processing Unit and the Incident Management and Legislative Disclosures Unit.

3.1: Annual privacy and security workplan

In 2015–16, the Department developed and implemented its annual integrated privacy and security workplan to support the strategic planning and implementation of the Department’s privacy and security priorities. Overseen by the Privacy and Information Security Committee, the annual privacy and security workplan includes strategic and operational plans to achieve privacy and security management objectives. The 2015–16 priorities and workplan included effective privacy and security support to Departmental programs, enhanced horizontal linkages and privacy compliance assurance.

3.2: Completed Privacy Impact Assessments

In accordance with the Treasury Board Secretariat's Directive on Privacy Impact Assessments, ESDC is required to conduct a Privacy Impact Assessment before establishing any new or substantially modified program or activity involving the administrative use of personal information to identify the privacy impacts, risks, and associated mitigation strategies. In 2015–16, ESDC completed seven Privacy Impact Assessments. ^{Footnote 1} Copies of approved Privacy Impact Assessments were provided to the Treasury Board of Canada Secretariat and the Office of the Privacy Commissioner. The seven completed Privacy Impact Assessments for 2015–16 were as follows:

• Canada Apprentice Loans Phase II: Account Management
• Compensation for Employers of Reservists Program
• Employment Equity Programs ‎
• Federal Workers' Compensation under the Government Employees Compensation Act ‎
• Managed Web Services ‎
• Hosted Social Media Account Management Service – Hootsuite
• Interdepartmental Memorandum of Understanding on Collection Services with the Canada Revenue Agency ‎

For summaries of completed 2015–16 Privacy Impact Assessments, see Annex B.

3.3: Info source update

In 2015–16, ESDC completed a comprehensive review and update of its Info Source holdings. Info Source is a series of publications containing information about the Government of Canada's access to information and privacy programs. The primary purpose of Info Source is to assist individuals in exercising their rights under the Access to Information Act and the Privacy Act. Info Source also supports the Government's commitment to facilitate access to information regarding its activities. As part of the review, ESDC created or updated 55 Personal Information Bank descriptions and over 30 Class of Records.

3.4: Closure of the Office of the Privacy Commissioner investigation into the loss of a USB key at ESDC

On August 11, 2014, the Office of the Privacy Commissioner released its “Report of Findings” on the investigation into the loss of a USB key containing the personal information of 5,045 Canada Pension Plan Disability appellants. The report contained nine recommendations that were accepted in full by ESDC. On September 14, 2015, the Office of the Privacy Commissioner confirmed that they were satisfied with the Department’s response that all recommendations/management actions were implemented; and that no further action was required by their office. The investigation is now closed.

3.5: Audit of the Departmental Control Framework for the Management of Personal Information (Privacy)

The Internal Audit of the Departmental Control Framework for the Management of Personal Information (Privacy) was approved in August 2015. The objective of the audit was to assess the adequacy and effectiveness of the ESDC Privacy Management Framework (PMF) to safeguard the personal information of Canadians. The audit concluded that ESDC’s PMF is adequate to address most privacy-related concerns, however there were opportunities for improvement identified.

3.6: Program-Led Privacy Action Plans

ESDC has developed proactive Program-Led Privacy Action Plans for its major programs to understand and address potential privacy risks. Program efforts include risk assessments workplans, implementation, and reporting on progress. Program action plans improve compliance through clear accountabilities and have been approved by ESDC’s Corporate Management Committee which reviews their progress periodically.

3.7: Information sharing arrangements involving personal information

An information sharing arrangement (ISA) is a record of understanding between parties that outlines the terms and conditions under which personal information is shared between them. For ESDC, Part 4 of the Department of Employment and Social Development Act contains specific provisions for the sharing of information under limited and specific circumstances. In 2015–16, the Department updated its ISA template to assist in the development of agreements with other parties. In addition, ESDC established a repository of ISAs in 2015–16.

3.8: Raising Privacy Awareness

The Department continued to promote practical, easy to understand, and readily available privacy-related information and guidance to employees to reinforce proper privacy protection practices throughout 2015–16. This included an update to an internal Stewardship of Information web site available to employees, sessions on privacy-themed topics during Privacy Awareness Week from May 2 to May 6, 2015, and recognition of Data Privacy Day on January 28, 2016.

As part of its commitment to privacy awareness and training, the Department continued to provide a mandatory training module on the Stewardship of Information and Effective Workplace Behaviours. The mandatory integrated module covers six disciplines related to the stewardship of information (security, information management, information technology security, values and ethics, privacy and access to information). In 2015–16, 1,678 employees completed the Stewardship of Information and Effective Workplace Behaviours course. In addition, the Department has established an online training module entitled Privacy and Access to Information – It’s Everybody’s Business which was successfully completed by 1,742 employees in 2015–16.

4.1: Requests for information under the Privacy Act

In 2015–16, ESDC received 8,353 requests under the Privacy Act – an increase of 4.4% from 2014–15 when ESDC received 7,998 requests.

Text description of figure 3 – Requests received and completed under the Privacy Act

Fiscal Year	Formal requests received under the Privacy Act	Requests completed during the reporting period
2013-14	7,286	7,239
2014-15	7,998	7,781
2015-16	8,353	8,240

4.2: Requests by calendar days taken to complete

Despite the increase in Privacy Act requests, ESDC increased processing timelines performance in 2015–16, completing 7,169 of its 8,353 requests within 30 calendar days, up from 6,983 within 30 calendar days in 2014–15.

Text description of figure 4 – Privacy Act requests by calendar days taken to complete

Fiscal Year	Requests completed within 30 calendar days	Requests completed within 31-60 days	Requests completed in 61+ calendar days
2013-14	6,727	417	95
2014-15	6,983	663	135
2015-16	7,169	999	72

4.3: Pages reviewed

In addition to an increase of Privacy Act requests for 2015–16, the total number of pages of documents requiring review for exemptions and exclusions also increased. In 2015–16, 789,762 pages were reviewed which represented a 24.6% increase from 2014–15 when workload covered 633,787 pages.

4.4: Requests for correction of information

Individuals have a right to request correction of any erroneous personal information pertaining to them, provided that the individual can adequately substantiate the request. ESDC accepted four requests for correction of personal information in 2015–16.

4.5: Financial considerations

In 2015-16, the Department spent an estimated $4.5 million on salaries associated with administering the Privacy Act as well as $116,020 on overtime. Non-salary costs amounted to $71,730 bringing total expenditures to an estimated $4.7 million. A total of 86.36 person years were dedicated to privacy activities. This figure can be further broken down to 51.28 person years for regional staff, 31.92 person years for National Headquarters staff, 2.68 person years for part-time and casual employees, 0.03 person years for consultants and agency personnel and 0.45 person years for students.

4.6: Public interest disclosures reported to the Office of the Privacy Commissioner

As per section 2.1, “ESDC’s Legal Framework for Privacy” Part 4 of the Department of Employment and Social Development Act takes precedence over the Privacy Act as it relates to the use and disclosure of personal information. Accordingly, any disclosures in the public interest are made in accordance with subsection 37(1) of the Department of Employment and Social Development Act, which states that personal information may be disclosed “…if the Minister is of the opinion that the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure or that disclosure would clearly benefit the individual to whom the information relates.”

In 2015–16, Access to Information and Privacy Operations received notification from the regions regarding 184 public interest disclosures. These normally involved individuals who were threatening to harm themselves or others. Disclosure has been delegated to regional staff in instances where there is an imminent threat to the safety and security of individuals. Access to Information and Privacy Operations received and approved an additional 46 public interest disclosures for a total of 230 public interest disclosures reported to the Office of the Privacy Commissioner.

Text description of figure 5 – Public Interest Disclosures Reported to the Office of the Privacy Commissioner

Fiscal Year	Disclosures in the public interest
2013-14	206
2014-15	211
2015-16	230

4.7: Material Privacy breaches

A privacy breach involves improper or unauthorized collection, use, disclosure, retention or disposal of personal information. Per the Treasury Board of Canada Secretariat “Material Privacy Breaches,” “a material privacy breach has the highest risk impact and is defined as involving sensitive personal information; and could reasonably be expected to cause serious injury or harm to the individual and/or involves a large number of affected individuals.”

In 2015–16, ESDC reported 18 material privacy breaches to the Office of the Privacy Commissioner—an increase from 2014–15 when ESDC then reported three cases. Of the 18 material privacy breaches, 3 cases involved information on Social Insurance Number applications, 2 cases involved misdirected program benefit applications, 4 cases involved personal information shared incorrectly with the wrong individuals, business, or medical professionals, and 9 cases where passport information could have been compromised. Appropriate corrective measures were applied, procedures reviewed, mailing procedures were updated and training for employees implemented. The increase in the number of material privacy breaches reported between 2014–15 and 2015–16 is attributed to improved reporting and increased privacy training and awareness.

4.8: Complaints and investigations

In 2015–16, the Department was notified of 12 complaints received by the Office of the Privacy Commissioner. Of these cases, two related to delay, five related to denied access, two pertained to improper use and disclosure and three related to a time extension. ESDC also received findings on 14 complaints. The Office of the Privacy Commissioner ruled six were well founded, four were not well founded, one was settled in the course of the investigation and three were resolved.

In addition to the complaints associated with the processing of Privacy Act requests, in 2015-16, the Department received an additional four complaints—one for collection and three for use and disclosure. It also closed five complaints—three were well founded, one was not well founded and one was discontinued.

Text description of figure 7 – Complaints received by the Office of the Privacy Commissioner

Fiscal Year	Complaints to Privacy Commissioner of Canada
2013-14	27
2014-15	18
2015-16	26

4.9: Privacy training activities

ESDC has a comprehensive mandatory on-line training strategy to educate, increase knowledge of, and raise awareness about, the stewardship of information and effective workplace behaviours. The Department also offers online training on privacy and access to information to foster a common understanding of the proper management of information resources, ensuring that the privacy of information is respected, and to improve timeliness and compliance results.

Since the release of the mandatory online Stewardship of Information and Effective Workplace Behaviours training program in 2013–14, 24,147 employees have successfully completed the mandatory online training course (including 1,678 employees in 2015–16). In addition, the online training module Privacy and Access to Information – It’s Everybody’s Business, successfully trained 3,098 employees (including 1,742 employees in 2015–16).

The Department has undertaken a number of activities to educate and increase knowledge of access to information and privacy, such as regular meetings with liaison officers and in-person training sessions. Since 2013–14, the Department delivered 122 in-person sessions to 3,083 employees. In 2015–16, ESDC delivered 48 in-person sessions to 1,131 employees.

Text description of figure 8 – Online Training

Fiscal Year	Stewardship of Information and Effective Workplace Behaviours	Privacy and Access to Information – It`s Everybody’s Business
2013-14	8,669	Not applicable
2014-15	13,800	1,356
2015-16	1,678	1,742

Text description of figure 9 – In-Person Employee Training

Fiscal Year	Training Sessions	Employee Trained
2013-14	37	838
2014-15	37	1,120
2015-16	48	1,131

Employment and Social Development Canada

The Minister of Employment and Social Development, pursuant to section 18 of the Department of Employment and Social Development Act, hereby designates the persons, officers or employees holding the positions with Employment and Social Development set out in the schedules attached hereto, or the persons, officers or employees occupying on an acting basis those positions, to exercise the powers or perform the duties or functions of the Minister or to exercise or perform the powers, duties or functions of the head of the institution, as specified in the attached schedules.

• Part 4 of the Department of Employment and Social Development Act
• Privacy Act
• Access to Information Act

______________________________________

Original signed June 3, 2015 by Pierre Poilievre,

Minister of Employment and Social Development

Canada Apprentice Loans Phase II: Account management

In 2014, the Government of Canada announced the creation of Canada Apprentice Loans (CAL) to assist registered apprentices with the cost of technical training. These loans will help offset the costs to apprentices to complete the training required by their programs. A Privacy Impact Assessment for CAL Phase I was completed in 2014–2015. The Privacy Impact Assessment for CAL Phase II, completed in 2015–16, addresses the management and protection of personal information in the program’s account management process, including the electronic validation of a borrower’s on-going registration in an apprenticeship program through a data exchange with the apprentice’s respective provincial or territorial government.

Compensation for Employers of Reservists Program

The Compensation for Employers of Reservists Program offsets costs incurred by employers of active reservists such as hiring and training replacement workers, paying increased overtime, or purchasing equipment. It also provides compensation in the form of a grant to eligible employers of reservists and eligible self-employed reservists who are selected to serve on a designated Canadian Armed Forces operation. As this is a new governmental program, a Privacy Impact Assessment was undertaken to examine the privacy impacts of the establishment of new federal financial assistance to compensate civilian employers, build bridges with businesses and other stakeholders, and ensure that reservists continue to be fully integrated and readily available for military duty. ESDC, whose sharing of program responsibilities with the Department of National Defence is outlined in a Memorandum of Understanding, is responsible for the program’s administration, including application intake and validation, and issuing compensation to eligible applicants.

Employment Equity Programs

The Employment Equity Program comprises the Legislated Employment Equity Program (LEEP) and the Federal Contractors Program (FCP). Both programs promote equitable representation in the workplace for women, Aboriginal peoples, persons with disabilities and members of visible minorities. As a result of legislative changes to the Employment Equity Act, new ways to manage the FCP were required, including the expansion of the web-based Workplace Equity Information Management System (WEIMS) which allows employers to submit aggregate workforce data and to manage employee-level personal information to support workforce analysis. Under the Employment Equity Act, the Minister of Employment, Workforce Development and Labour (Minister of Labour) is required to share LEEP employer reports with the Canadian Human Rights Commission. A Privacy Impact Assessment was conducted to analyze the privacy impacts associated with the change in the management and collection of personal information for Employment Equity Programs, new and current modules in WEIMS, and other systems used to collect Employment Equity data.

Federal Workers' Compensation under the Government Employees Compensation Act

The Government Employees Compensation Act (GECA) is administered by the Federal Workers’ Compensation Service, Labour Program, ESDC, and provides the authority for worker’s’ compensation benefits and wage replacement to federal departments, agencies, and Crown Corporations for workplace injuries and occupational illnesses. To administer Federal Workers' Compensation under the GECA, the Labour Program receives, reviews and forwards claims from injured employees of those federal departments, agencies, and Crown Corporations to the appropriate provincial workers compensation board, which adjudicates claims on behalf of the Labour Program and provides workers’ compensation benefits for workplace injuries and illnesses. Once claims are adjudicated, the boards then charge the Labour Program for these services and the Labour Program recovers these costs from the employers from which the claims occurred.

The GECA program is undergoing modernization of the current, primarily paper-based, injury reporting process and renegotiating agreements with the provincial workers’ compensation boards. As such, a Privacy Impact Assessment was conducted to identify the privacy risks related to the flow of information for the processes and systems that are required with respect to the reporting and adjudication of injury claims.

Managed Web Services

Managed Web Services supports the Web Renewal Initiative which is focused on streamlining Canada’s federal web presence into a single Canada.ca web address with a common architecture and a consistent look and feel across all pages. Canada.ca is managed and maintained by Employment and Social Development Canada as the Principal Publisher for the Government of Canada. ESDC is responsible for the daily operation of the Managed Web Service and acts as the primary contact for the third-party web service provider as well as federal institutions for the operation of the Canada.ca site. A Privacy Impact Assessment was conducted to analyze the potential privacy risks associated with the amalgamation of the Government of Canada’s departmental websites into Canada.ca.

Hosted Social Media Account Management Service – Hootsuite

Government of Canada institutions have been rapidly increasing their presence on third-party social media platforms such as Facebook, Twitter, and LinkedIn. To standardize account management processes for official social media accounts, the Government of Canada procured, through Public Works and Government Services Canada, a third-party Hosted Social Media Account Management Service solution, known as Hootsuite, to update, publish and manage content on social media platforms for official social media accounts. ESDC, in its new role as Principal Publisher, administers Hootsuite to standardize account management processes for institutional official social media accounts. A Privacy Impact Assessment was conducted to analyze the use and administration of Hootsuite by the Department, and ensure data collection, retention and disposition are consistent with authorities.

Interdepartmental Memorandum of Understanding on Collection Services with the Canada Revenue Agency

A revised interdepartmental Memorandum of Understanding between the Canada Revenue Agency and ESDC came into force in November 2015, which designates respective roles and responsibilities along with the legal framework under which the Canada Revenue Agency is authorized to collect specific debts on behalf of ESDC, including the authority to recover overpayments for various ESDC programs. Given that the replacement of previous MOUs with a new umbrella MOU constitutes a significant modification to the previous instruments governing collection services, a Privacy Impact Assessment was conducted on the exchange and use of personal information outlined in the new agreement.

Statistical Report on the Privacy Act

Name of institution: Employment and Social Development Canada

Reporting period: 2015-04-01 to 2016-03-31