Health Canada annual report on the Access to Information Act and the Privacy Act: 2023 to 2024

Health Canada is the federal department responsible for helping the people of Canada maintain and improve their health. Health Canada is committed to improving the lives of all of Canada's people and to making this country's population among the healthiest in the world as measured by longevity, lifestyle and effective use of the public health care system.

Health Canada’s mission and vision statement

Également disponible en français sur le site Web de Santé Canada sous le titre :
Rapport annuel 2023-2024 sur la Loi sur l’accès à l’information et la Loi sur la protection des renseignements personnels

Health Canada
Access to Information and Privacy Operations Division
1600 Scott Street, Tower B, 3107A
7^th Floor, Suite 700
Ottawa, Ontario, K1A 0K9

Tel: 613-954-9165
Email: atip-aiprp@hc-sc.gc.ca

© His Majesty the King in Right of Canada, as represented by the Minister of Health, 2023

Publication date: 2024

This publication may be reproduced for personal or internal use without permission provided the source is fully acknowledged.

Cat.: H1-9/3E-PDF
ISBN: 1910-3506
Pub.: 240367

Table of Contents

• Introduction
  • About Health Canada
  • Purpose of the Acts
• Organizational Structure
  • Shared Services Partnership Agreement
  • Access to Information and Privacy Operations Division
  • Privacy Management Division
  • Total Full-Time Equivalents Supporting the ATIA and the Privacy Act
  • Governance
• Delegation of Authority
• Openness and Transparency
  • Part 2 of the Access to Information Act and Proactive Publication of Information
• Performance for 2023-2024
  • Access to Information Act
  • Privacy Act
• Reporting on Fees for the Service Fees Act
• Costs for Administering the Access to Information Act
• Costs for Administering the Privacy Act
• Training and Awareness
• Policies, Guidelines, Procedures and Initiatives
  • Betterment Solutions Working Group
  • ATIP Operations Division’s Professional Development Program
  • Privacy Breach Reporting Portal
  • Privacy Act Modernization
• Summary of Key Issues and Actions Taken on Complaints and Audits
  • Privacy Management Audit
  • Complaints Management
• Federal Court Cases
• Monitoring Compliance
• Other Reporting Requirements Specific to the Privacy Act
  • Material Privacy Breaches
  • Privacy Impact Assessments
  • Public Interest Disclosures
• Appendix A: Access to Information Act and Privacy Act – Delegation Order
  • Delegation of Authority Schedule
• Appendix B: Statistical Report on the Access to Information Act
  • Section 1: Requests Under the Access to Information Act
  • Section 2: Informal Requests
  • Section 3: Applications to the Information Commissioner on Declining to Act on Requests
  • Section 4: Requests Closed During the Reporting Period
  • Section 5: Extensions
  • Section 6: Fees
  • Section 7: Consultations Received From Other Institutions and Organizations
  • Section 8: Completion Time of Consultations on Cabinet Confidences
  • Section 9: Investigations and Reports of finding
  • Section 10: Court Action
  • Section 11: Resources Related to the Access to Information Act
• Appendix C: Statistical Report on the Privacy Act
  • Section 1: Requests Under the Privacy Act
  • Section 2: Informal Requests
  • Section 3: Requests Closed During the Reporting Period
  • Section 4: Disclosures under Subsections 8(2) and 8(5)
  • Section 5: Requests for Correction of Personal Information and Notations
  • Section 6: Extensions
  • Section 7: Consultations Received From Other Institutions and Organizations
  • Section 8: Completion Time of Consultations on Cabinet Confidences
  • Section 9: Complaints and Investigation Notices Received
  • Section 10: Privacy Impact Assessments (PIA) and Personal Information Banks (PIB)
  • Section 11: Privacy Breaches
  • Section 12: Resources Related to the Privacy Act
• Appendix D: Supplemental Statistical Report on the ATIA and Privacy Act
  • Section 1: Open Requests and Complaints under the Access to Information Act
  • Section 2: Open Requests and Complaints Under the Privacy Act
  • Section 3: Social Insurance Number (SIN)
  • Section 4: Universal Access Under the Privacy Act
• Appendix E: Federal Court Review
  • Actial Farmaceutical S.R.L. v. Minister of Health (dismissed)
  • Apotex Inc. v. Minister of Health and Attorney General of Canada (discontinued)
  • Bayer Inc. v. Minister of Health and Attorney General of Canada (discontinued)
  • Elanco Canada Limited v. Canada (Minister of Health)
  • Jamp Pharma Corporation v. Minister of Health et al (discontinued)
  • Provital Health v. Canada (Minister of Health), Preventous Collaborative Health v. Canada (Minister of Health), Copeman Healthcare v. Canada (Minister of Health)

Introduction

Health Canada is pleased to present to Parliament its consolidated annual report on the administration of Access to Information and Privacy (ATIP) services, in accordance with section 94 of the Access to Information Act (ATIA), section 72 of the Privacy Act and section 20 of the Service Fees Act. The report describes activities that support compliance with these laws for the fiscal year beginning April 1, 2023 and ending March 31, 2024.

About Health Canada

Health Canada is the federal department responsible for helping Canadians maintain and improve their health, while respecting individual choices and circumstances. Health Canada has regional offices in British Columbia, Alberta, Saskatchewan, Manitoba, Ontario, Quebec, and the Atlantic and Northern Regions.

For more information about Health Canada, please visit our website.

Purpose of the Acts

The ATIA gives Canadian citizens, permanent residents of Canada, and anyone present in Canada the right to access information contained in federal government records, subject to certain specific and limited exceptions. The ATIA complements, but does not replace, other means of obtaining government information.

The Privacy Act protects an individual's privacy by setting out provisions related to the collection, retention, accuracy, disposal, use and disclosure of personal information. It also gives individuals the right of access to information about themselves held by the federal government, with certain specific and limited exceptions.

Organizational Structure

Shared Services Partnership Agreement

ATIP Operations Division and the Privacy Management Division provide services to both Health Canada and the Public Health Agency of Canada, and do so as part of the Shared Services Partnership Agreement. These divisions are housed under the Corporate Policy, Planning and Services Directorate of Health Canada’s Corporate Services Branch. ATIP Operations Division manages the processing of requests under both the ATIA and the Privacy Act, while the Privacy Management Division is responsible for privacy policy and providing guidance to programs. Although ATIP services are provided to both institutions, the statistics and financial data in this report are only for Health Canada.

Access to Information and Privacy Operations Division

The primary function of the ATIP Operations Division is to ensure compliance of Health Canada's program delivery with the provisions of the ATIA and the Privacy Act, along with the policies and directives issued by the Treasury Board of Canada Secretariat.

The ATIP Operations Division is responsible for responding to access to information and privacy requests. It reviews information to support various disclosures including the appropriate sharing of investigation reports, proactive publication under Part 2 of the ATIA, as well as providing advice to Parliamentary Affairs when responding to Parliamentary motions. In addition, ATIP Operations Division promotes awareness of ATIP obligations and provides ATIP training to staff.

In 2023–2024, there were 70.490 full-time equivalents within the ATIP Operations Division supporting Health Canada’s administration of both the ATIA and the Privacy Act. A breakdown of the different types of full-time equivalents is provided in the table below.

Privacy Management Division

The primary functions of the Privacy Management Division include supporting compliance of Health Canada's program delivery with the provisions of the Privacy Act and the privacy-related policies and directives of the Treasury Board of Canada Secretariat. Responsibilities include:

• The development of privacy policies, procedures and practices;
• The delivery of privacy training and awareness programs to staff;
• Assessing and reporting on privacy breaches;
• Providing review and attestation of Treasury Board Submissions and Memoranda to Cabinet as Privacy Functional Area;
• Providing review and approval of section 8(2)(j) disclosures (for research) and section 8 (2)(m) disclosures (for public interest or to benefit the individual);
• Coordinating the Department’s InfoSource input; and
• Providing privacy analysis and advice using a number of tools including Privacy Impact Assessments and Privacy Protocols.

In 2023-2024, there were 13.935 full-time equivalents within the Privacy Management Division supporting compliance of Health Canada's program delivery with the provisions of the Privacy Act and the privacy-related policies and directives of the Treasury Board of Canada Secretariat. A breakdown of the different types of full-time equivalents is provided in the table below.

Total Full-Time Equivalents Supporting the ATIA and the Privacy Act

In 2023-2024, there were a total of 84.425 full-time equivalents supporting the administration of the ATIA and the Privacy Act. This comprised of 62.560 full-time equivalents supporting the ATIA and 21.865 full-time equivalents supporting the Privacy Act.

The following table illustrates the total resources from the ATIP Operations Division and the Privacy Management Division supporting the administration of the ATIA and the Privacy Act.

Governance

Initiatives related to access to information and privacy are governed through the ATIP Executive Leaders Committee. This committee is made up of executive-level representatives from across Health Canada who provide leadership and strategic direction on key topics, communicating them within their respective branches. The Committee is chaired by the Director General, Corporate Policy, Planning and Services Directorate, Corporate Services Branch, who is responsible for the ATIP Operations Division and the Privacy Management Division.

ATI and privacy matters requiring a higher level of oversight are also brought forward to Health Canada’s Executive Committee for strategic direction.

Delegation of Authority

In keeping with Treasury Board of Canada Secretariat recommendations on best practices, the Delegation Order extends authorities to multiple positions including the Deputy Minister, the Corporate Services Branch’s Assistant Deputy Minister, the Director General of Corporate Policy, Planning and Services Directorate, the Director of the Privacy Management Division, the Executive Director of ATIP Operations Division and ATIP Coordinator. As appropriate, certain administrative authorities are delegated to various levels within the ATIP Operations Division and the Privacy Management Division to support the effective and efficient administration of the ATIA and the Privacy Act. The delegation order that was in effect at the end of 2023-2024 is included in this report (Appendix A).

Openness and Transparency

Health Canada is committed to being open and transparent and continues to make more information available to Canadians. The Department continues to publish information in accordance with Part 2 of the ATIA including briefing note titles, travel and hospitality expenses, reclassification of positions, and contracts over $10,000.

Part 2 of the Access to Information Act and Proactive Publication of Information

Health Canada is a government institution that is listed in Schedule I of the Financial Administration Act for the purposes of Part 2 of the ATIA.

The ATIP Operations Division worked with the Strategic Policy Branch, Chief Financial Officer Branch, Corporate Services Branch and the Communications and Public Affairs Branch to ensure that records identified under Part 2 of the ATIA are proactively published. Health Canada leveraged existing procedures to facilitate the proactive publication of information. 

The processing of records for proactive publication involves several steps. Many of these steps are automated and an efficient approval process was implemented. A front-end approach for translation and ATI review has been established. Branches proactively identify information that may be subject to valid exceptions and ensure that briefing materials are prepared such that they can be readily published on the website.

The Strategic Policy Branch is responsible for proactively publishing the records listed in the tables below for the Ministers’ Office and on behalf of Health Canada. In 2023-2024, the Strategic Policy Branch published all applicable proactive requirements within legislated timelines.

Please see the following tables for the details.

The Chief Financial Officer Branch is responsible for proactively publishing the records listed in the tables below for the Ministers’ Office and on behalf of Health Canada. In 2023-2024, the Chief Financial Officer Branch proactively disclosed all applicable proactive requirements within legislated timelines. Please see the following tables for the details.

The Corporate Services Branch is responsible for proactively publishing records related to the reclassification of positions. In 2023-2024, the Corporate Services Branch published all notices for reclassification of position within legislated timelines. Please see the following table for the details.

The Communications and Public Affairs Branch is responsible for publishing records to the Government of Canada’s Open Government website. Records that have been proactively published can be found on Canada.ca: Proactive disclosure

Performance for 2023-2024

In 2023-2024, Health Canada received 3,497 requests (Access to Information, Access Informal and Privacy) and closed 3,744. When compared to the previous fiscal year, Health Canada received 24% more requests and closed 43% more requests.

The following section of the report includes an interpretation and explanation of the data contained in Health Canada’s Statistical Report, which summarizes Access to Information and Privacy-related activity for the period between April 1, 2023 and March 31, 2024 (Appendix B – ATI and Appendix C – Privacy)

Access to Information Act

Access Informal Requests

Requests can be made for records previously released under the ATIA, which are referred to as Access Informal Requests. Summaries of previously released access to information requests are posted monthly on the Open Government website where the public can make a request for the previously released records. This forms part of the Government of Canada’s commitment to openness and transparency.

Health Canada received 1,657 Access Informal requests and processed 1,984 in 2023-2024. A total of 57 requests were carried over to the next reporting period.

Caseload, Carry Forward and Outstanding Active Access to Information Requests

During 2023-2024, Health Canada managed a total of 3,548 active access to information requests. Of these active requests, 731 were outstanding from 2022-2023 and 1,185 were outstanding from previous years. Further details of the breakdown for outstanding requests from previous years can be found in Section 3.1 of Appendix C.

Health Canada closed 1,562 access to information requests and carried forward 1,986 to the 2024-2025 fiscal year. Of the 1,986 that are carried forward, 413 are within legislated timelines while 1,573 are beyond legislated timelines. Further details of this breakdown can be found in section 1 of Appendix B. 

A high volume of requests were carried forward. This is largely due to the pandemic and its impact to operations early on. The ATIP Operations Division is well-equipped to handle its accumulated inventory with a dedicated Backlog Team. This team has experience processing some of the oldest, largest and most complex requests.

Although Health Canada received and closed fewer requests when compared to the previous fiscal year, it reviewed more pages in 2023-2024. In the previous fiscal year, 385,225 pages were reviewed and 1,679 requests were closed while 454,024 pages were reviewed and 1,562 requests were closed in 2023-2024. This number of pages reviewed has increased steadily over the last three years as Health Canada works through its accumulated inventory. Details are included in the table below.

Processing Times for Requests

In 2023-2024, Health Canada closed a total of 1,562 requests. Below is the breakdown of the time taken to process these requests:

• 142 were closed within 1 to 15 days
• 217 were closed within 16 to 30 days
• 101 were closed within 31 to 60 days
• 431 were closed within 61 to 120 days
• 135 were closed within 121 to 180 days
• 141 were closed within 181 to 365 days
• 395 took more than 365 days

Of the 1,562 requests that Health Canada closed in 2023-2024, 690 requests (44%) were closed within legislated timelines (30 days plus applicable extension) while 872 (56%) were closed past the legislated timelines.

The breakdown of the time taken to process the 872 requests closed past legislated timelines (including any extensions taken) is as follows:

• 103 were closed 1 to 15 days past legislated timelines
• 75 were closed 16 to 30 days past legislated timelines
• 77 were closed 31 to 60 days past legislated timelines
• 104 were closed 61 to 120 days past legislated timelines
• 49 were closed 121 to 180 days past legislated timelines
• 100 were closed 181 to 365 days past legislated timelines
• 364 were closed more than 365 days past legislated timelines

Requests are closed past the legislated timelines for a number of reasons:

• 441 were closed past the legislated timelines due to ‘interference with operations/ workload’
• 89 were closed past the legislated timelines due to ‘external consultations’
• 13 were closed past the legislated timelines due to ‘internal consultations’
• 329 were closed past the legislated timelines for reasons ‘other’ than those specified above

Data Quality

Please note that small data variances may exist from year to year, including in the previously reported number of outstanding requests carried forward into the current fiscal year. Several reasons contribute to inevitable shifts in data, including requests by the Office of the Information Commissioner to re-open access to information requests in the context of complaint resolution, and requesters seeking to divide one incoming request into several files while retaining the initial date received.

Access to Information Requests Received & Completed

Figure 1 - Text description

The graph shows the ATI requests received and completed each fiscal year from 2019-2020 to 2023-2024.

• For 2019-2020, 2,087 requests were received; 2,153 requests were completed.
• For 2020-2021, 1,938 requests were received; 1,358 requests were completed.
• For 2021-2022, 2,153 requests were received; 2,036 requests were completed.
• For 2022-2023, 1,687 requests were received; 1,679 requests were completed.
• For 2023-2024, 1,632 requests were received; 1,562 requests were completed.

Source of Requests under the Access to Information Act

The majority of Health Canada’s access to information requests come from private businesses, mostly in the health sector (pharmaceutical, medical devices, natural health products, etc.), requesting records related to their competitors and their own products. Private businesses made up 51.7% of requests.

A total of 15.4% of requests came from the public, 10.2% from the media, 7.5% from organizations, 3.4% from academia, and 11.7% declined to identify which category they associate with.

Extensions

The majority of extensions, 836 (83%) invoked under the ATIA were to conduct consultations with third parties and other government departments while 174 (17%) were taken due to interference with operations for requests involving a large volume of records.

Completing consultations with other government organizations and third parties is a necessary step in the process, enabling Health Canada to release as much information as possible. Over the last several years, Health Canada has made more information accessible, continuously reassessing the balance between its commitment to openness and transparency, with the need to safeguard confidential business information. Health Canada’s commitment to transparency can be at odds with the views of third parties, who can challenge Health Canada’s proposed release of information, by seeking judicial review of Health Canada’s intended disclosure.

Consultations Completed From Other Institutions

In addition to processing its own requests, Health Canada also completes consultations received from other institutions and organizations.

In 2023-2024, Health Canada managed 206 consultations from other Government of Canada institutions (174 received in the 2023-2024 fiscal year and 32 received in 2022-2023). Health Canada also managed 24 consultations from other organizations (23 received in the 2023-2024 fiscal year and one received in 2022-2023).

Health Canada closed 214 consultations, reviewing 9,004 pages of records. A total of seven consultations were carried over to 2024-2025 within negotiated timelines, while nine were carried over beyond negotiated timelines.

Health Canada received fewer consultations (-20%) from other Government of Canada institutions and other organizations when compared to the previous fiscal year and closed fewer consultation requests (-9%). In most cases, Health Canada consented to full disclosure of the records.

Disposition of Completed Requests

Of the access to information requests completed in 2023-2024, 76% were either disclosed in part (70% of requests) or all disclosed (6% of requests). A total of 12% of access to information requests were abandoned, while no records existed for 11% of requests. The breakdown of the remaining ‘other’ completed files is as follows:

• 1.15% request transferred
• 0.38% all exempted
• 0.06% all excluded
• 0.06% neither confirmed nor denied
• 0.06% decline to act with the approval of the Information Commissioner

Numbers may not add up due to rounding.

Figure 2 - Text description

The doughnut chart shows the disposition of completed ATI requests by percent and color. The percent of requests 'disclosed in part' is in light blue (70%). The percent of requests 'all disclosed' is in dark blue (6%). The percent of ‘requests abandoned’ is in light red (12%). The percent of requests for which 'no records exist' is in red (11%). Records that are ‘request transferred’, 'all exempted', 'all excluded', 'neither confirmed nor denied' or 'decline to act with the approval of the Information Commissioner' are in grey (2%).

Exemptions Invoked

Sections 13 to 24 of the ATIA provides specific legislated exemptions intended to protect information from disclosure, while section 26 provides a temporary exemption relating to information that will soon be published. In some instances, records may have multiple exemptions applied to them to appropriately safeguard information.

The majority (1,062) of exemptions applied were for section 19(1), a mandatory exemption that safeguards personal information. The application of section 20 (to protect third party information) in 399 requests required consultations in many cases to ensure that only proprietary and commercially sensitive information is protected. Section 21 (the protection of information related to government operations) was applied to 113 requests. For a detailed breakdown of exemptions see table 4.2 Exemptions.

Exclusions Cited

The ATIA does not apply to published material, material available to the public for purchase, or for public reference (section 68), nor does it apply to confidences of the Privy Council (section 69). Requests containing proposed exclusions under section 69 require consultation with the Department of Justice and, in some cases, the Privy Council Office.

In 2023-2024, 18 requests contained exclusions for publicly available material and 50 requests had records pursuant to confidences of the Privy Council.

Decline to Act

In 2023-2024, two applications were made to the Information Commissioner, requesting to decline to act on requests. Of these two applications, one was approved within the fiscal year, while the other one was carried forward to the 2024-2025 reporting period.

In October 2023, Health Canada submitted an application to decline to act, citing that the access request was an abuse of the right to make a request. The Information Commissioner granted approval after reviewing the case and the department’s attempts to assist the requester in refining the request. Health Canada closed the request and informed the requester of this decision in writing. Although there is a right to access that right must not be abused. For more information on the Information Commissioner’s decision, refer to Decision pursuant to 6.1,2023 OIC 47.

Translations

No translations were required to respond to requests in 2023-2024.

Format of Information Released

Of the requests that were fully or partially disclosed, 1,127 were released as electronic copies, 53 were released in paper format, and nine were released as a data set. Health Canada releases records in the preferred format of the requestor while encouraging the use of the Government of Canada’s ATIP Online Request Service platform to receive timely and secure access to the records.

Privacy Act

Informal Requests

No informal requests were made in 2023-2024.

Caseload and Carry forward and Outstanding Active Requests

In 2023-2024, Health Canada managed 251 active privacy requests. Of this, 208 were privacy requests received in 2023-2024 while 43 were outstanding requests from previous reporting periods.

A total of 198 privacy requests were closed and 53 privacy requests were carried forward to the 2024-2025 fiscal year. Of the 53 privacy requests carried forward to 2024-2025, 19 were carried forward within legislated timelines while 34 were carried over beyond the legislated timelines. For detailed information about outstanding requests from previous fiscal years, please see section 1 of Appendix C.

Many of the requests received are for access to public servants’ medical records, as the Public Service Occupational Health Program is operated by Health Canada. In addition, requests are received from current and former Health Canada employees who want to obtain their personal information, and from people who have applied for employment at Health Canada or the Public Health Agency of Canada, seeking the details of their applications.

Processing Time for Requests

In 2023-2024 Health Canada closed a total of 198 privacy requests. Below is a breakdown of the time taken to process these requests:

• 107 were closed within 1 to 15 days
• 46 were closed within 16 to 30 days
• 17 were closed within 31 to 60 days
• 13 were closed within 61 to 120 days
• 6 were closed within 121 to 180 days
• 6 were closed within 181 to 365 days
• 3 took more than 365 days

Of the 198 requests that Health Canada closed in 2023-2024, 153 (77%) privacy requests were closed within legislated timelines (30 days plus applicable extensions) while 45 (23%) were closed beyond legislated timelines.

The breakdown of the time taken to process the 45 requests closed past legislated timelines (including any extensions taken) is as follows:

• 10 were closed 1 to 15 days past legislated timelines
• 9 were closed 16 to 30 days past legislated timelines
• 8 were closed 31 to 60 days past legislated timelines
• 8 were closed 61 to 120 days past legislated timelines
• 4 were closed 121 to 180 days past legislated timelines
• 4 were closed 181 to 365 days past legislated timelines
• 2 were closed more than 365 days past legislated timelines

Requests are closed past the legislated timelines for a number of reasons:

• 26 were closed past the legislated timelines due to ‘interference with operations/ workload’
• 0 were closed past the legislated timelines due to ‘internal consultations’
• 0 were closed past the legislated timelines due to ‘external consultations’
• 19 were closed past the legislated timelines for reasons ‘other’ than those specified above

In accordance with the Treasury Board of Canada Secretariat Directive on Personal Information Requests and Correction of Personal Information, Health Canada continues to notify requesters in writing of anticipated delays.

Extensions

Nine extensions were taken in 2023-2024. Seven extensions were taken as the documents were difficult to obtain, and two extensions were taken for internal consultation. Under the Privacy Act, 30 days is the longest extension that can be taken.

Privacy Requests Received and Completed

Figure 3 - Text description

The graph shows the number of Privacy requests received and completed each fiscal year from 2019-2020 to 2023-2024.

• For 2019-2020, 235 requests were received; 236 requests were completed.
• For 2020-2021, 139 requests were received; 144 requests were completed.
• For 2021-2022, 219 requests were received; 212 requests were completed.
• For 2022-2023, 208 requests were received; 221 requests were completed.
• For 2023-2024, 208 requests were received; 198 requests were completed.

Consultations Completed from Other Institutions

Health Canada received no consultations from other Government of Canada institutions in 2023-2024.

Disposition of Completed Requests

Approximately 40% of the privacy requests completed in 2023-2024 were either disclosed in part (33%

of requests) or all disclosed (8% of requests). The breakdown of the remaining files is as follows:

• 48% request abandoned
• 11% no records exist
• 0% all exempted
• 0% all excluded
• 1% neither confirmed nor denied

Numbers may not add up due to rounding.

Figure 4 - Text description

The doughnut chart shows the disposition of completed privacy requests by percent and color. The percent of requests 'disclosed in part' is in dark blue (33%). The percent of requests 'all disclosed' is in red (8%). The percent of 'requests abandoned' is in light blue (48%). The percent of requests for which 'no records exist' is in light red (11%). The percent of requests 'neither confirmed nor denied'  is in grey (1%).

Exemptions Invoked

Of the 73 exemptions applied to privacy requests in 2023-2024, 65 (89%) were to protect the personal information of individuals other than the requester, six exemptions (8%) were invoked due to solicitor-client privilege and the two (3%) remaining exemptions were related to investigations.

Exclusions Cited

No exclusions were applied to privacy request releases made in 2023-2024.

Translations

No translations were required to respond to requests in 2023-2024.

Format of Information Released

Of the requests that were fully or partially disclosed, 71 were released as electronic copies, and nine in paper format.

Privacy Management Division Advisory Services

During 2023-2024, the Privacy Management Division received a total of 913 requests for privacy advice from Health Canada program clients. In the previous fiscal year, the Privacy Management Division received 590 requests. The significant increase in the number of files can be attributed to a large volume of new privacy work (102 requests received) to support the development of the Canadian Dental Care Plan. Year after year, the volume and complexity of files continues to increase, requiring in-depth privacy analysis, on an expanding range of topics.

In 2023-2024, the Privacy Management Division provided privacy advice to Health Canada program clients on contracts, digital solutions, the handling of personal information, use and disclosure of personal information, and privacy risk assessments of programs, activities and research projects.

Health Canada is committed to properly handling personal information under its control and ensuring that privacy requirements and risks are considered when new initiatives are developed and deployed.

Reporting on Fees for the Service Fees Act

The Service Fees Act requires a responsible authority to report annually to Parliament on the fees collected by the institution.

With respect to fees collected under the ATIA, the information below is reported in accordance with the requirements of section 20 of the Service Fees Act.

Enabling authority: Access to Information Act

Fee amount: The $5.00 application fee is the only fee charged for an access to information request.

Total Revenue: The total fee revenue for 2023-­2024 was $6,955.

Fees waived: In accordance with the changes to the ATIA that came into force on June 21, 2019, Health Canada may only charge an application fee of $5, as set out in paragraph 7(1)(a) of the Regulations. Pursuant to section 11 of the Access to Information Act, institutions can waive this application fee as deemed appropriate.

A total of $1,205 was waived or refunded by Health Canada in 2023-2024.

In February 2024, Treasury Board Secretariat issued an Implementation Notice regarding waiving the $5 application fee in support of advancing Indigenous Reconciliation. Health Canada has implemented a process to align with this direction.

Costs for Administering the Access to Information Act

Health Canada spent a total of $7,022,062 on ATI functions in 2023-2024. Of this total, salaries and overtime costs represent $5,036,367 and goods and services costs were $1,985,695. Most of the goods and services costs ($1,867,002) were used to retain temporary resources to address outstanding active requests.

Costs for Administering the Privacy Act

Health Canada spent a total of $2,567,349 on privacy functions in 2023-2024. Of this total, salaries and overtime costs were $2,102,486. Temporary resources to support the processing of privacy requests accounted for $405,005 and other goods and services costs were $59,858.

Training and Awareness

Access to Information Training

An online ATIP Fundamentals course, offered by the Canada School of Public Service, is available to all staff and is recommended as a foundation for all departmental employees. A total of 845 Health Canada employees completed this course in 2023-2024.

Health Canada also offers targeted training specific to the department and its processes. This includes a one-hour course, ATIP for Branch Single Window Contacts, which is offered to all new Single Windows. Additionally, a facilitated course, Introduction to ATIP Requests at Health Canada, is available to all employees. Training is promoted at all Single Window working group meetings, at the ATIP Executive Leaders Committee, through Broadcast News messages, and on Health Canada’s intranet site.

Access to Information Awareness

In 2023, Canada celebrated Right to Know Week from September 25^th to October 1^st. Health Canada kicked off the event with a message from the Assistant Deputy Minister of the Corporate Services Branch, marking 40 years of ATIP legislation and highlighting that the right to privacy and the right for individuals to access information under the government’s control are fundamental in an open, free, and democratic society. Health Canada promoted the online ATIP courses offered by the Canada School of Public Service and shared resources on how to respond to ATIP requests and manage information. 

During the 2023-2024 fiscal year, communications were sent to all employees promoting access to information training and emphasizing its importance. In addition, information was provided to all employees addressing common questions, such as how to conduct record searches and what types of records need to be provided. The goal is to foster a culture of transparency while also promoting the timely provision of high-quality information.

Privacy Training

During 2023-2024, the Privacy Management Division delivered several virtual privacy training sessions to various groups within Health Canada. In total, 140 Health Canada employees attended the Privacy Management Division's virtual training sessions.

The Privacy Management Division’s online privacy training is available to all Health Canada employees. Approximately, 698 Health Canada employees completed the training in 2023-2024.

Privacy Awareness

In 2023, Canada celebrated Privacy Awareness Week from May 8^th to 12^th, and in 2024, Canada celebrated Data Privacy Week from January 22^nd to 26^th. 2023 also marked the 40^th anniversary of the entering into force of the Privacy Act. Health Canada commemorated each event with a message from the Assistant Deputy Minister of Corporate Services Branch, highlighting key privacy messages such as the importance of appropriate safeguards to protect personal information. Health Canada shared several privacy resources with its employees, such as responsibly managing Personal Information Banks and preventing privacy breaches.

Throughout the year, regular communications are sent to all employees' privacy-related matters with the aim of supporting a culture of strong privacy awareness within the department.

Policies, Guidelines, Procedures and Initiatives

Betterment Solutions Working Group

The ATIP Operations Division’s Betterment Solutions Working Group continued to meet regularly throughout 2023-2024 to foster a culture of innovation by promoting employee-led improvements. At this working group, ATIP Analysts and support staff from a variety of levels identify and prioritize operational issues, in an effort to find and implement solutions. The working group also provides horizontal input in response to policy consultations from Treasury Board Secretariat.

ATIP Operations Division’s Professional Development Program

The ATIP Operations Division’s Professional Development Program was launched in January 2017. This program allows employees to progress based on performance, without the need of a competitive hiring process. In 2023-2024, 40 analysts were enrolled in the program and 15 advanced in level. The Professional Development Program helps increase ATIP capacity within the Government of Canada.

Privacy Breach Reporting Portal

The Privacy Management Division launched a new privacy breach reporting portal in January 2024. The interactive portal is available to all Health Canada employees on the Department’s intranet to use to report a potential privacy breach. The portal is easy to use and helps employees to provide the Privacy Management Division with the right information that it needs to analyse the potential breach.

Privacy Act Modernization 

Health Canada continues to participate in Privacy Act modernization efforts led by the Department of Justice Canada. In 2023-2024, the Privacy Management Division provided feedback on the unique health-related aspects of the amendments being considered for a modernized Act. 

Summary of Key Issues and Actions Taken on Complaints and Audits

Privacy Management Audit

An internal privacy audit was concluded during fiscal year 2019-2020 on the management of privacy practices at Health Canada and the Public Health Agency of Canada. The audit made four recommendations to further strengthen the management of privacy practices. 

The Privacy Management Division completed all remaining recommendations and formally closed the Management Response and Action Plan in 2023-2024. A copy of the full audit report can be found at: Audit of the Management of Privacy Practices at Health Canada and the Public Health Agency of Canada

Complaints Management

Individuals and organizations who believe federal institutions have not respected their rights under the ATIA may ask the Office of the Information Commissioner to investigate within 60 days of receiving a response from a federal institution or if they have no received a response within the legislated timeline.

Individuals and organizations who think their personal information has been mishandled have the right to file a complaint to the Privacy Commissioner of Canada.

Complaints to the Information Commissioner of Canada

In 2023–2024, 85 complaints under the ATIA were filed with the Office of the Information Commissioner for Health Canada's requests, representing an increase from the 60 filed in 2022-2023. Of these 85 complaints, 59 were discontinued. Health Canada received 28 final investigation reports from the Office of the Information Commissioner. Nine of the 28 final reports contained recommendations, while 19 contained orders issued by the Information Commissioner. 

Areas of complaint include deemed refusal (late), time extensions taken, and exemptions applied, in particular related to personal information and third party information.

Health Canada supports the Office of the Information Commissioner during investigations by providing details on the way a file was or is being processed, providing evidence of the search that was undertaken, explaining key considerations in applying exemptions, conducting new searches, providing rationales, etc. Health Canada reviews the outcomes of all Office of the Information Commissioner investigations, ensures follow-up on recommendations or orders is completed, and where appropriate, incorporates lessons learned into business processes.

Outstanding Number of Access to Information Complaints

 There are 68 open complaints with the Information Commissioner of Canada. The following table lists the number of open complaints that are with the Information Commissioner of Canada by year.

Health Canada communicates and collaborates with the Office of the Information Commissioner to ensure the effective handling and resolution of complaints.

Complaints to the Privacy Commissioner of Canada

During 2023-2024, 14 complaints related to the handling of personal information by Health Canada were received under Section 31 of the Privacy Act. Eight were regarding unauthorized disclosures of personal information, and were resolved using the Office of the Privacy Commissioner of Canada’s early resolution process. Six of the complaints were for deemed refusal in responding to requests of personal information with four being closed within the fiscal year. Five representations were provided under Section 33 of the Privacy Act. Five letters of findings were received under Section 35 from the Office of the Privacy Commissioner relating to complaints received in the previous year.

Health Canada supports the Privacy Commissioner during investigations by providing details on the way a file was or is being processed, providing rationales, etc. Health Canada reviews the outcomes of all investigations, and where appropriate, incorporates lessons learned into business processes.

Outstanding Number of Privacy Complaints

The following table lists the number of open complaints with the Privacy Commissioner of Canada by year.

Health Canada communicates and collaborates with the Office of the Privacy Commissioner to ensure the effective handling and resolution of complaints.

Federal Court Cases

Applications & Appeals Submitted to the Federal Court

Access to Information Act

In 2023–2024, no new applications or appeals were made and a total of four court cases were active during the year. These cases are summarized in Appendix E.

Privacy Act

No applications or appeals were made to the Federal Court or the Federal Court of Appeal during the 2023–2024 fiscal year.

Monitoring Compliance

ATIP Operations Division generates weekly, monthly and semi-annual reports for senior management in order to monitor performance within Health Canada. These reports outline the incoming volume of requests, the number of closed requests, and the timelines of retrieval of records. Additionally, the ATIP Operations Division encourages branches to identify common request types and explore alternative methods for disclosing such information.

The Privacy Management Division produces semi-annual reports to senior management on privacy breaches and training as well as requests for privacy analysis. The Privacy Management Division supports compliance by periodically reviewing its privacy policies, procedures and practices.

In response to the 2019-2020 Audit on the Management of Privacy Practices at Health Canada and the Public Health Agency of Canada, the Privacy Management Division implemented a monitoring and follow-up process for Privacy Impact Assessments and Privacy Protocol recommendations in 2023-2024.

The Privacy Management Division assists programs, ensuring the appropriate privacy protections are included in contracts, agreements and arrangements (e.g., review contracts and information-sharing agreements).

Other Reporting Requirements Specific to the Privacy Act

Material Privacy Breaches

During 2023-2024, Health Canada reported one material privacy breach to the Office of the Privacy Commissioner and the Treasury Board Secretariat.

Privacy Impact Assessments

During 2023-2024, four Privacy Impact Assessments were completed.

1. Monitoring of Medical Assistance in Dying (MAID) Program - Privacy Impact Assessment Update

The MAID program creates a strict framework in maintaining transparency and public trust by monitoring and reporting data related to gender, race, Indigenous identity, and disability of persons requesting MAID. The necessity for this updated Privacy Impact Assessment arose from the 2023 amendments to the Regulations for the Monitoring of Medical Assistance in Dying, as a substantial modification to an existing program activity. The Privacy Impact Assessment Update identified mitigation actions in the following risk area: updating the program’s Personal Information Bank, reviewing the existing retention and disposal schedules, and reassessing safeguards of collection systems. A summary of this Privacy Impact Assessment has not yet been published.

2. Online Staffing Expansion: Sidetracking, VidTesting and VidReferencing - Virtuated

The Privacy Impact Assessment was undertaken for the Online Staffing Expansion using VidCruiter technology—specifically its VidTracking, VidTesting, and VidReferencing processes. Health Canada’s Human Resources Services Directorate (HRSD) integrates these automated tools to enhance the efficiency of tracking candidate applications, scheduling and performing tests, and conducting reference checks within Health Canada and the Public Health Agency of Canada. The Privacy Impact Assessment recommended mitigation actions in the following risk areas: retention and safeguards. A summary of this Privacy Impact Assessment has not yet been published. 

3. Canadian Dental Care Program (CDCP) – Phase #1 Privacy Impact Assessment

The Canadian Dental Care Plan is a collaborative effort among several institutions, including Health Canada, the Canada Revenue Agency, Employment and Social Development Canada and a third-party contractor. This preliminary assessment was mandated by the Treasury Board Directive on Privacy Impact Assessments due to the decision-making process involving personal information and significant modifications in program activities through third-party administration. The Privacy Impact Assessment recommended mitigation actions at that time in the following risk areas: collection, use, disclosure and retention of personal information by Health Canada. A summary of this Privacy Impact Assessment has not yet been published.

4. Canadian Dental Care Program (CDCP) – Phase #2 Privacy Impact Assessment

The Canadian Dental Care Plan phase 2’s Privacy Impact Assessment focused on Health Canada’s and Sun Life’s handling of personal information related to the CDCP. This Privacy Impact Assessment recommended mitigation actions in the following risk areas: collection, use, disclosure and retention of personal information by Health Canada. A summary of this Privacy Impact Assessment has not yet been published. 

Public Interest Disclosures

During 2023-2024, there were no disclosures made under section 8(2)(m) of the Privacy Act and no section 8(5) written notifications were provided to the Office of the Privacy Commissioner of Canada.

Appendix A: Access to Information Act and Privacy Act – Delegation Order

Document: Text description

On May 24, 2023, the Minister of Health, Jean-Yves Duclos, signed a delegation order. The order stipulates the following:

Delegation Order

Access to Information Act and Privacy Act

I, the Minister of Health, pursuant to section 95 of the Access to Information Act and section 73 of the Privacy Act, hereby delegate the persons holding the positions set out in the Delegation of Authority Schedule attached hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Minister as head of the Public Health Agency of Canada, under the provisions of the Act and related regulations set out in the schedule opposite each position.  This delegation supersedes all previous delegation orders.

Delegation of Authority Schedule

Access to Information Act

Part 1 and 3

Privacy Act

Legend

Yes	Delegated
No	No Delegation

Appendix B: Statistical Report on the Access to Information Act

Reporting period: 2023-04-01 to 2024-03-31. Data extracted on April 15, 2024.

Section 1: Requests Under the Access to Information Act

Section 2: Informal Requests

Section 3: Applications to the Information Commissioner on Declining to Act on Requests

Section 4: Requests Closed During the Reporting Period

4.5 Complexity

4.6 Closed Requests

4.7 Deemed Refusals

Section 5: Extensions

Section 6: Fees

Section 7: Consultations Received From Other Institutions and Organizations

Section 8: Completion Time of Consultations on Cabinet Confidences

Section 9: Investigations and Reports of finding

Section 10: Court Action

Section 11: Resources Related to the Access to Information Act

Appendix C: Statistical Report on the Privacy Act

Reporting period: 2023-04-01 to 2024-03-31. Data extracted on April 15, 2024.

Section 1: Requests Under the Privacy Act

Section 2: Informal Requests

Section 3: Requests Closed During the Reporting Period

3.5 Complexity

3.6 Closed Requests

3.7 Deemed Refusals

3.8 Requests for Translation

Section 4: Disclosures under Subsections 8(2) and 8(5)

Section 5: Requests for Correction of Personal Information and Notations

Section 6: Extensions

Section 7: Consultations Received From Other Institutions and Organizations

Section 8: Completion Time of Consultations on Cabinet Confidences

Section 9: Complaints and Investigation Notices Received

Section 10: Privacy Impact Assessments (PIA) and Personal Information Banks (PIB)

Section 11: Privacy Breaches

Section 12: Resources Related to the Privacy Act

Appendix D: Supplemental Statistical Report on the ATIA and Privacy Act

In addition to completing the forms for the Statistical Reports on the ATIA and Privacy Act for 2023-2024, institutions were asked to complete a supplemental report. The data requirements are set out in the tables below.

Section 1: Open Requests and Complaints under the Access to Information Act

The following table reports the number of open requests that are outstanding from previous reporting periods.

The following table reports the number of open complaints with the Information Commissioner of Canada that are outstanding from previous reporting periods.

Section 2: Open Requests and Complaints Under the Privacy Act

The following table reports the number of open requests that are outstanding from previous reporting periods.

The following table reports the number of open complaints with the Privacy Commissioner of Canada that are outstanding from previous reporting periods.

Section 3: Social Insurance Number (SIN)

Health Canada did not receive authority for a new collection or new consistent use of the SIN in 2023-2024.

Section 4: Universal Access Under the Privacy Act

Health Canada received four requests confirmed from foreign nationals outside of Canada in 2023-2024.

Appendix E: Federal Court Review

Actial Farmaceutical S.R.L. v. Minister of Health (dismissed)

In January 2020, Actial Farmaceutical filed for judicial review of a Health Canada decision issued to Ferring Inc. to partially release records related to the natural health products VSL#3®. This application raises the issues of whether Actial has standing to bring the application given the decision was issued to Ferring Inc. and whether the disputed information is exempt from disclosure.

The case was dismissed in June 2022. Actial filed an appeal in October 2022. An appeal hearing was held in November 2023 and dismissed with costs.

Apotex Inc. v. Minister of Health and Attorney General of Canada (discontinued)

In August 2019, Apotex filed for judicial review of the decision to release records related to a drug product that had been withdrawn from assessment. The fact that it was withdrawn impacts the records that may already publicly exist.

A motion for an Order for production of documents under Rules 317 and 318 of the  Federal Courts Rules, S.O.R. /98-106 was scheduled to be heard on December 18, 2020, however the Court adjourned the motion and ordered this matter to be held in abeyance pending a decision being rendered in another case concerning a similar request.

On September 6, 2022 the Federal Court of Appeal issued its decision in Preventous (see below) and held that the applicants could not receive the documents from Health Canada.

Apotex discontinued the Application in August 2023.

On January 25, 2022, the Applicant filed for judicial review in the Federal Court. The Applicant is challenging the decision of the Minister of Health dated January 6, 2022 to release records and documents with respect to certain drug products in response to an access to information request.

The Applicant opposes the disclosure of information it considers confidential and has also alleged that the Minister lacked procedural fairness in rendering the decision.

A motion for an Order for production of documents under Rules 317 and 318 of the Federal Courts Rules, S.O.R. /98-106 was filed. This motion was held in abeyance pending a decision being rendered in another case. On September 6, 2022 the Federal Court of Appeal issued its decision in Preventous (see below) and held that the applicants could not receive the documents from Health Canada.

Apotex discontinued the Application in September 2023.

Bayer Inc. v. Minister of Health and Attorney General of Canada (discontinued)

On December 15, 2021, the Applicant filed for judicial review challenging the decision of the Minister of Health dated November 25, 2021 to release records in response to an access to information request. The Applicant opposes the disclosure of information it considers confidential and alleges the disclosure could harm its r competitive position.

A motion for an Order for production of documents under Rules 317 and 318 of the Federal Courts Rules, S.O.R. /98-106 was filed. This motion was held in abeyance pending a decision being rendered in another case. On September 6, 2022 the Federal Court of Appeal issued its decision in Preventous (see below) and held that the applicants could not receive the documents from Health Canada.

A hearing was scheduled for October 2023 however Bayer discontinued the Application just days before it took place.

Elanco Canada Limited v. Canada (Minister of Health)

Elanco sought review of a decision by the Minister of Health, to disclose information related to Fortekor Flavour Tabs, that Elanco considered to be confidential. On November 19, 2019 the Federal Court found the Minister of Health’s decision to disclose the records was invalid and costs were awarded against Canada. Canada appealed the decision, and the Federal Court of Appeal has set aside the original judgement, which it found was worded too broadly, contrary to section 25 of the Access to Information Act.

The matter was remitted back to the Federal Court for review. A hearing was held in November 2023 and the Court’s decision was reserved. The case remains ongoing.

Jamp Pharma Corporation v. Minister of Health et al (discontinued)

A judicial review application was filed on March 30, 2023 by Jamp Pharma following a decision by the Minister of Health to release records related to Jamp’s drug product that it considers to be confidential. On July 4, 2023 Jamp Pharma discontinued the matter without costs.

Provital Health v. Canada (Minister of Health), Preventous Collaborative Health v. Canada (Minister of Health), Copeman Healthcare v. Canada (Minister of Health)

In January 2019, three private medical clinics (the Applicants) filed individual applications for judicial review of the federal Minister of Health’s decision to release part of their audit reports to a requester under the Access to Information Act. Health Canada obtained the audit reports from Alberta Health, which did not request that the audit reports be kept confidential. The audit reports relate to the annual enrollment and membership fees charged by the Applicants.

Following an appeal, the Federal Court granted the Applicants’ request for documents held by Health Canada under Rule 317 of the Federal Court Rules. In April 2021, Canada appealed this decision and on September 6, 2022 the Federal Court of Appeal decided that the applicants could not receive the documents from Health Canada. Further procedural motions filed by the applicants to obtain the records have been denied by the courts.

In February 2024, the Applicants filed for leave to appeal the issue of production of documents held by Health Canada to the Supreme Court of Canada. A hearing on the Minister of Health’s decision to release part of their audit reports is scheduled for May 2024.