2019 to 2020 Annual Report on the Privacy Act

Introduction

The Financial Consumer Agency of Canada (FCAC) is pleased to submit to Parliament its annual report on the administration of the Privacy Act (the Act) for the reporting period commencing on April 1, 2019 and ending on March 31, 2020. This report was prepared and tabled in accordance with section 72 of the Act.

The Act which took effect on July 1, 1983, gives Canadian citizens, permanent residents, or any person and corporation present in Canada, a right to access information contained in government records, subject to certain specific and limited exceptions.

The Agency derives its mandate from the Financial Consumer Agency of Canada Act (FCAC Act). The FCAC Act outlines the Agency’s functions and administration and enforcement powers, and lists the sections of federal laws and regulations under its supervision.

The FCAC Act identifies the objects of the Agency, which are listed in Sections 3(2) and 3(3) at the following link: https://laws-lois.justice.gc.ca/eng/acts/F-11.1/page-1.html#h-222474

FCAC’s mandate is to protect financial consumers. It achieves this in two primary ways: by supervising financial institutions and other federally regulated entities, and by enhancing the financial literacy of Canadians through education and research.

In 2019–2020, the Agency renewed its vision and mission statements. The new vision statement, “To be a leader and innovator in financial consumer protection” expresses how the Agency’s role as regulator and educator helps it protect financial consumers. The new mission statement, “Protect, Supervise, Educate” embodies the Agency’s commitment to protect consumers of financial products and services, supervise federally regulated financial entities, and educate financial consumers to help them make informed decisions and improve their financial literacy. Together, these statements define FCAC’s purpose and identity, and affirm its focus on finding ways to improve outcomes for all Canadian financial consumers.

Organization or activities

The Agency’s Commissioner is the designated head of FCAC for the purpose of the Act. The Commissioner has delegated certain authorities under the Act to the positions of Assistant Commissioner, Corporate Services; Access to Information and Privacy (ATIP) Coordinator; and Senior ATIP Advisor. This serves to oversee the administration of the Act within the Agency and ensures compliance with the legislation.

The ATIP Coordinator, is accountable for the development, coordination and implementation of effective Agency policies, guidelines, systems, and procedures relevant to the Act . This ensures that the Agency’s responsibilities are met and that there is appropriate processing and proper protection and disclosure of information.

The main activities of the ATIP Coordinator (Director, Finance and Administration, Corporate Services) include:

• processing requests under the Act;
• developing and maintaining policies, procedures, and guidelines to ensure the Act is respected by FCAC;
• promoting awareness of the Act to ensure FCAC’s responsiveness to theobligations imposed on the government;
• monitoring FCAC’s compliance with the Act, regulations and relevant procedures and policies;
• preparing annual reports to Parliament and other statutory reports, as well as other material that may be required by central agencies;
• representing FCAC in dealings with the Treasury Board Secretariat (TBS), the Office of the Information Commissioner of Canada (OIC) and other government departments and agencies regarding the application of the Act as it relates to the Agency; and
• supporting FCAC in meeting its commitments in relation to greater openness and transparency through proactive disclosure of information and the disclosure of information through informal avenues.

Reading Room

The Agency has provided space for a reading room where the public may consult documents, at the following address:

Enterprise Building
427 Laurier Avenue West
6^th Floor
Ottawa, Ontario

Delegation order

The Delegation Order sets out the powers, duties, and functions for the administration of the Act that have been delegated by the Agency’s Commissioner as the head of the institution. The Delegation Order is attached as Appendix A.

Statiscal report

The Statistical Report is attached as Appendix B.

Requests

During this reporting period, the Agency received zero formal requests under the Act and there were no outstanding requests from the previous reporting period.

Consultations

During this reporting period, the Agency did not receive any consultation requests from other government institutions or organizations.

Multi-Year Trends

Disclosures made pursuant to paragraph 8(2)(m) of the Privacy Act

During this reporting period, the Agency did not make any disclosures of personal information pursuant to paragraph 8(2)(m) of the Act

Privacy impact assessment

During the reporting period, the Agency commenced the development of a privacy impact assessment (PIA) but it was not finalized by year end. Also, no new data-sharing activities took place.

Privacy breaches

No privacy breaches occurred during this reporting period.

Awareness and training activities

During this reporting period, ATIP training was included as part of the FCAC new employee training session, and a coaching approach was applied with employees involved with the access to personal information process. As such, an individual’s responsibilities were explained, and the retrieval obligations and workflow were described, and their application monitored.

Agency policies and procedures

During this reporting period, the Agency applied its institution-specific policies and procedures for the processing of requests. FCAC monitors processing times by entering all actions and activities in an electronic database. A timeline for processing is established according to permissible legislation time frames. This timeline and accompanying workflow were reviewed and adjusted in cases where extensions were required.

Privacy Act complaints

During this reporting period, the Agency received no complaints and was not subject to investigations or appeals to the courts. In addition, the Office if the Privacy Commissioner of Canada did not raise any concerns or issues.

Costs

During this reporting period, the costs incurred relating to the application of the Privacy Act totaled $39,612. These costs were incurred to develop a Privacy Impact Assessment (PIA); work commenced on the PIA, but it was not completed by the end of the fiscal year. All costs related to hiring ATIP consultants.

Personnel……………………………………………………… $39,612

Appendix A: Delegation Order

Privacy Act Delegation Order

The Commissioner of the Financial Consumer Agency of Canada, pursuant to section 73 of the Privacy Act, hereby designates the following persons to exercise or perform the powers, duties or functions of the head of the institution set out in the sections of the act indicated next to beside each position.

Original signed by

Judith Robertson

Commissioner, Financial Consumer Agency of Canada

Date: June 16, 2020

Appendix B: Statistical Report on the Privacy Act

Financial Consumer Agency of Canada

Reporting period: 2019-04-01 to 2020-03-31

Section 1: Requests under the Privacy Act

Secton 2: Requests Closed During the Reporting Period

2.5 Complexity

2.6 Closed requests

2.7 Deemed refusals

Section 3: Disclosures under subsections 8(2) and 8(5)

Section 4: Requests for Correction of Personal Information and Notations

Section 5: Extensions

Section 6: Consultations Received From Other Institutions and Organizations

 Section 7: Completion Time of Consultations on Cabinet Confidences

Section 8: Complaints and Investigations Notices Received

Section 9: Privacy Impact Assessments (PIA) and Personal Information Banks (PIB)

Section 10: Material Privacy Breaches

Section 11: Resources Related to the Privacy Act

Note: Enter value to two decimal places. 

Appendix C: Additional Reporting requirements

Completed Privacy Impact Assessments (PIAs):

Note (correction)

Annual Privacy Report (2018-19)

6. Policies, Guidelines, Procedures and Initiatives

FCAC did not implement any new or revised institution-specific Privacy-related policies, etc.