2023 to 2024 Annual Report on the Privacy Act

Information contained in this publication or product may be reproduced, in part or in whole and by any means, for personal or public non-commercial purposes, without charge or further permission, unless otherwise specified. Commercial reproduction and distribution are prohibited except with written permission from the Financial Consumer Agency of Canada.

For more information, contact:

Financial Consumer Agency of Canada
427 Laurier Ave. West
Ottawa, ON K1R 7Y2

www.canada.ca/en/financial-consumer-agency

ISSN 2816-9832

©His Majesty the King in Right of Canada, as represented by the Minister of Finance Canada, November, 2023.

Aussi disponible en français sous le titre : 2023 à 2024 Rapport annuel sur la Loi sur la protection des renseignements personnels

Introduction

The Financial Consumer Agency of Canada (FCAC or the Agency) is pleased to submit to Parliament its annual report on the administration of the Privacy Act (the Act) for the reporting period commencing on April 1, 2023 and ending on March 31, 2024. This report was prepared and tabled in accordance with section 72 of the Act.

The Act which took effect on July 1, 1983, gives Canadian citizens, permanent residents, or all individuals who are present in Canada but who are not Canadian citizens or permanent residents within the meaning of the Immigration and Refugee Protection Act and all corporations that are present in Canada, a right to access information contained in government records, subject to certain specific and limited exceptions. This is an Act to extend the present laws of Canada that protect the privacy of individuals and that provide individuals with a right of access to personal information about themselves.

FCAC is a federal government agency that derives its mandate from the Financial Consumer Agency of Canada Act (FCAC Act). The FCAC Act outlines the Agency’s powers, duties and functions, and lists the federal laws and regulations under its supervision.

FCAC doesn’t have any non-operational (“paper”) subsidiaries during this reporting period.

The Agency confirms that this report has been submitted and tabled to Parliament.

Organizational Structure

The Agency’s Commissioner is the designated head of FCAC for the purpose of the Act. The Commissioner has delegated certain authorities under the Act to the positions of Assistant Commissioner, Corporate Services; Access to Information and Privacy (ATIP) Coordinator; and Senior ATIP Advisor. This serves to oversee the administration of the Act within the Agency and ensures compliance with the legislation. FCAC has one Senior ATIP Advisor and uses consultants as necessary to fulfill its obligations.

The ATIP Coordinator, is accountable for the development, coordination and implementation of effective Agency policies, guidelines, systems, and procedures relevant to the Act. This ensures that the Agency’s responsibilities and obligations are met and that there is appropriate processing and proper protection, and that the disclosure of information are made in accordance with the Act.

The main activities of the ATIP Coordinator (Director, Finance and Administration, Corporate Services) during this reporting period included:

• processing requests pursuant to the Act;
• developing and maintaining policies, procedures, and guidelines to ensure the FCAC comply with its responsibilities and obligations under the Act;
• promoting awareness of the Act to ensure FCAC’s responsiveness to the obligations imposed on the government;
• monitoring FCAC’s compliance with the Act, regulations and relevant procedures and policies;
• preparing annual reports to Parliament and other statutory reports, as well as other material that may be required by central agencies;
• representing FCAC in dealings with the Treasury Board of Canada Secretariat (TBS), the Office of the Privacy Commissioner of Canada (OPC) and other government departments and agencies regarding the application of the Act as it relates to the Agency; and
• supporting FCAC in meeting its commitments in relation to greater openness and transparency through proactive disclosure of information and the disclosure of information through informal avenues.

The Agency was not party to any service agreement under section 73.1 of the Privacy Act during this reporting period.

Reading room

The Agency has provided space for a reading room where the public may consult documents, at the following address:

• Enterprise Building - 427 Laurier Avenue West, 5th Floor Ottawa, Ontario K1R 1B9

Delegation Order

The Delegation Order sets out the powers, duties, and functions for the administration of the Act that have been delegated by the Agency’s Commissioner as the head of the institution. The Delegation Order is attached as Appendix A.

Performance - Overview

The Statistical Report for 2023-2024 is attached as Appendix B.

Requests

During this reporting period, the Agency responded to 100% of the requests received by FCAC within the legislative timeline.

The Agency did not carry over any requests from the previous reporting period and received ten new requests. Within this reporting period, two requests were completed within 0-15 days and eight within 16-30 days. The Agency did not carry over any active request and did not require any extension since 50% of requests were abandoned and the other 50% had no records. Therefore, no records were disclosed.

Complaints

During this reporting period, the Agency had no active complaints.

Consultations

During this reporting period, the Agency did not receive any consultation requests from other government institutions or organizations.

Training and Awareness

During this reporting period, ATIP training was included as part of the FCAC new employee training session, and a coaching approach was applied with employees involved with the access to information and privacy procedures. As such, an individual’s responsibilities were explained, and the retrieval obligations and workflow were described, and their application monitored.

The Agency also continue to enforce a mandatory training via the Canada School of Public Service for the Office of Primary Interest staff members regarding Privacy.

FCAC also promoted the access to information and privacy awareness by publishing information, on its internal website, during the Access to Information and Privacy Week

Policies, Guidelines and Procedures

During this reporting period, the Agency applied the Act and TBS’ policies, procedures and guidelines for the processing of requests along with developing and implementing updated internal privacy request procedures.

Initiatives and Projects to Improve Privacy

In order to modernize the delivery of services, facilitate information management and request processing, the Agency implemented the ATIP Online AOMT V4 has parts of its process. Furthermore, the Agency is in the process of acquiring a Request Processing Software Solutions.

Summary of Key Issues and Actions Taken on Complaints

During this reporting period, the Agency did not have any active complaints.

Material Privacy Breaches

No material privacy breaches occurred during this reporting period.

Privacy Impact Assessments

During the reporting period, the Agency didn’t complete any privacy impact assessment.

Public Interest Disclosures

During this reporting period, the Agency did not make any disclosures of personal information pursuant to paragraph 8(2)(m) of the Act.

Monitoring Compliance

FCAC monitors processing times by entering all actions and activities in an electronic database. A timeline for processing is established according to permissible legislated timeframes. This timeline and accompanying workflow were reviewed and adjusted in cases where extensions were required. A report is produced and provided to the ATIP Coordinator on a monthly basis which is, in return, shared with the CFO and Associate Commissioner.

During this reporting period, no inter-institutional consultation was required, and the Agency did not receive frequently requested types of information, therefore, no monitoring to that effect was conducted.

The Agency is ensuring appropriate privacy protections by entering all information in an electronic database which secures the personal information which is accessible only on a need to know basis.

Appendix A: Delegation Order

Privacy Act Delegation Order

The Commissioner of the Financial Consumer Agency of Canada, pursuant to section 73 of the Privacy Act, hereby designates the following persons to exercise or perform the powers, duties or functions of the head of the institution set out in the sections of the act indicated beside each position.

Original signed by

Judith Robertson
Commissioner, Financial Consumer Agency of Canada

Date: June 16, 2021

Appendix B: Statistical Report on the Privacy Act

Name of institution: Financial Consumer Agency of Canada

Reporting period: 2023-04-01 to 2024-03-31

Section 1: Requests Under the Privacy Act

Section 2: Informal requests

Section 3: Requests Closed During the Reporting Period

3.5 Complexity

3.6 Closed requests

3.7 Deemed refusals

Section 4: Disclosures Under Subsections 8(2) and 8(5)

Section 5: Requests for Correction of Personal Information and Notations

Section 6: Extensions

Section 7: Consultations Received From Other Institutions and Organizations

Section 8: Completion Time of Consultations on Cabinet Confidences

Section 9: Complaints and Investigations Notices Received

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

Section 11: Privacy Breaches

Section 12: Resources Related to the Privacy Act

Note: Enter values to three decimal places.

Supplemental Statistical Report on the Access to Information Act and the Privacy Act

Name of institution: Financial Consumer Agency of Canada

Reporting period: 2023-04-01 to 2024-03-31

Section 1: Open Requests and Complaints Under the Access to Information Act

Section 2: Open Requests and Complaints Under the Privacy Act

Section 3: Social Insurance Number

Section 4: Universal Access under the Privacy Act