Access to Information Act, Privacy Act, Annual Report 2016-2017

On this page

• Introduction
• About IRCC
• Delegation Order
• Purpose of the Acts
  • Access to Information Act
  • Privacy Act
• Organizational Structure
• Highlights of the Statistical Report, 2016-2017
  • Requests Received Under Both Acts
  • Sources of Requests Under the Access to Information Act
  • Exemptions Invoked Under Both Acts
  • Completion Time Under Both Acts
  • Complaints and Audits Under Both Acts
• Monitoring Compliance Under Both Acts
• Appeal to the Federal Court Under Both Acts
• Privacy Impact Assessments
• Material Privacy Breaches
• Initiatives
• Policies, Guidelines and Procedures Under Both Acts
• Training and Awareness
• Annex A: Signed Delegation
• Annex B: Delegation Order Under the Access to Information Act
• Annex C: Delegation Order Under the Privacy Act
• Annex D: Statistical Report on the Access to Information Act
• Annex E: Statistical Report on the Privacy Act

Introduction

Immigration, Refugees and Citizenship Canada (IRCC) is pleased to present to Parliament its 23^rd annual report on the administration of the Access to Information Act and the Privacy Act. The report describes the activities that support compliance with both Acts for the fiscal year commencing April 1, 2016, and ending March 31, 2017.

Section 72 of each Act requires that the head of every federal government institution submit an annual report to Parliament on the administration of the Access to Information Act and the Privacy Act during the fiscal year. This report outlines IRCC’s accomplishments in carrying out its Access to Information and Privacy (ATIP) responsibilities during the 2016-2017 reporting period.

About IRCC

IRCC’s work encompasses a broad range of activities such as:

• facilitating the arrival of people and their integration into Canadian life in a way that maximizes their contribution to the country while protecting the health, safety and security of Canadians;
• maintaining Canada’s humanitarian tradition by protecting refugees and other people in need of protection;
• enhancing the values and promoting the rights and responsibilities of Canadian citizenship;
• administering the Canadian Passport Order;
• reaching out to all Canadians and fostering intercultural understanding and an integrated society with equal opportunity for all, regardless of race, ethnicity and religion; and
• advancing global migration policies in a way that supports Canada’s immigration and humanitarian objectives.

Our mandate comes from the Department of Citizenship and Immigration Act. The Minister for IRCC is responsible for the Citizenship Act and shares responsibility with the Minister of Public Safety for the Immigration and Refugee Protection Act (IRPA).

Delegation Order

The Minister of IRCC (or delegate) is responsible for dealing with requests under the Access to Information Act and the Privacy Act. The Minister delegates his authority to members of senior management and the ATIP Departmental Coordinator (ATIP Director) to carry out his powers, duties, or functions under the Acts, in relation to ATIP requests. Certain authorities are delegated to particular positions in the ATIP Division at National Headquarters.

Purpose of the Acts

Access to Information Act

The purpose of the Access to Information Act is to provide a right of access to records under the control of a government institution. The Act maintains that government information should be available to the public, that necessary exceptions to the right of access should be limited and specific, and that decisions on the disclosure of government information should be reviewed independently of the government.

Privacy Act

The purpose of the Privacy Act is to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution and to provide individuals with a right of access to that information. The Act protects an individual’s privacy by preventing others from having unlawful access to personal information. It also permits an individual specific rights regarding the collection, use and disclosure of this information.

Organizational Structure

The ATIP Division is part of the Corporate Affairs Branch in the Corporate Services Sector at IRCC. The Division administers the Access to Information Act and the Privacy Act for IRCC and is led by a Director, who acts as the ATIP Coordinator for the Department. Three units carry out the Division’s work in addition to 34 Liaison Officers who, though not ATIP employees, coordinate ATIP activities of IRCC branches.

ATIP Divisional Structure at IRCC

Highlights of the Statistical Report, 2016-2017

Requests Received Under Both Acts

Sources of Requests Under the Access to Information Act

The business sector (primarily immigration consultants and lawyers) is still the largest source of requests, accounting for 56 per cent of all requests. The general public accounts for 32 per cent, and the media, organizations and academia account for 8 per cent of requests. The remaining 4 per cent represents requesters who decline to identify themselves.

Sources of Access to Information Requests

Exemptions Invoked Under both Acts

Access to Information Act

The majority of exemptions invoked by IRCC fell under three sections of the Access to Information Act:

• Subsection 19(1), which protects personal information, was used in 22,526 cases (46 per cent);
• Subsection 15(1), which covers international relations, defence and subversive activities, was used in 9,573 cases (20 per cent); and
• Subsection 16(1), which addresses law enforcement and criminal investigations, was used in 20,034 cases (41 per cent).

More than one section can be applied to a specific request.

Privacy Act

The majority of exemptions invoked by IRCC fell under three sections of the Privacy Act:

• Section 26, which protects personal information, was used in 5,155 cases (43 per cent);
• Section 21, which covers international relations, defence and subversive activities, was used in 4,388 cases (37 per cent); and
• Paragraph 22(1)(b), which addresses law enforcement and criminal investigations, was used in 3,086 cases (26 per cent).

More than one section can be applied to a specific request.

Completion Time Under Both Acts

IRCC completed the majority of its requests within 30 days.

Complaints and Audits Under Both Acts

Access to Information Act

During the 2016-2017 reporting period, the Department was notified of 115 access complaints received by the Office of the Information Commissioner of Canada. This represents 0.24 per cent of all requests completed during this period. The majority of complaints were related to processing times or exemptions.

During the reporting period, ATIP processed and closed 191 complaint investigations. Of these, 127 complaints were abandoned, discontinued or deemed to be unfounded, and the remaining 64 complaints were resolved to the satisfaction of the requester.

During the 2016-2017 reported period, no audits were undertaken under the Access to Information Act.

Privacy Act

During the 2016-2017 reporting period, the Department was notified of 25 privacy complaints received by the Office of the Privacy Commissioner (OPC). This represents 0.22 per cent of all requests completed during this period. The majority of the OPC complaints were related to processing times.

During the reporting period, ATIP processed and closed 13 complaint investigations. Of these, three were deemed not well-founded or discontinued, while 10 were resolved to the satisfaction of the requester.

During the 2016-2017 reported period, no audits were undertaken under the Privacy Act.

Actions Taken Under Both Acts

To reduce the processing times of requests that are overly broad, analysts contact requesters to try to determine exactly what information they are seeking to obtain. This enables ATIP to narrow the scope of the request. Additionally, it enables the ATIP Division to respond in a timely manner while ensuring that the requester receives relevant records.

Another action taken by the ATIP Division was to implement a requirement for analysts to document extension rationales to ensure that all extensions taken can be reviewed and justified.

Informal Access Requests Under the Access to Information Act

IRCC posts summaries of completed access to information requests pertaining to corporate records on the Open Information website. In 2016-2017, IRCC closed 492 requests for copies of some of these previously released requests.

Monitoring Compliance Under Both Acts

The ATIP Division prepares two weekly reports for senior management. First, a ‘snapshot’ report that contains various statistics, including the number of requests received and processed, as well as the current compliance rate under both Acts. Second, a summary report of upcoming requests soon to be disclosed under the Access to Information Act.

Appeal to the Federal Court Under Both Acts

No appeals to the Federal Court were filed against IRCC regarding the Access to Information Act or the Privacy Act during the 2016-2017 reporting period.

Privacy Impact Assessments

To fulfil its mandate and effectively deliver its programs and services, IRCC collects, uses and discloses personal information. In accordance with the Treasury Board of Canada Secretariat policy, the Department undertakes Privacy Impact Assessments (PIAs) to determine whether privacy risks are present in all new or existing departmental programs, initiatives or projects that collect and retain personal information.

Privacy Impact Assessment Summaries

During the 2016-2017 fiscal year, IRCC completed six PIAs. The PIAs are briefly described below.

Information Sharing on a Case-By-Case Basis with Australia and New Zealand

The PIA report examined the authority under which IRCC undertakes case-by-case information exchanges with counterpart organizations in Australia and New Zealand, the types of information that may be exchanged and the measures and safeguards being adopted to ensure exchanges meet modern privacy standards.

Information exchange on a case-by-case basis may only be undertaken by a designated official for a specific reason related to the purpose of administering or enforcing immigration and citizenship laws. Case-by-case exchanges may include the exchange of both biographic and biometric information. Exchanges must always be necessary, relevant and proportionate.

Annexes concerning the exchange of information on a case-by-case basis with Australia and New Zealand (operating under the bilateral Memoranda Regarding the Exchange of Information with Australia and New Zealand respectively)

Enrolment of Biometric Information of Overseas Refugee Resettlement Applicants

The PIA report is an addendum to the PIA for the Temporary Resident Biometrics Project, a joint project conducted by IRCC, the Canada Border Services Agency (CBSA) and the Royal Canadian Mounted Police (RCMP).

The objectives of the report are to:

• determine key areas where the collection of biometrics from overseas refugee resettlement applicants differs from the previously assessed collection of biometrics from temporary residents;
• determine if privacy risks exist in these key areas; and
• provide recommendations on measures to mitigate or eliminate identified risks.

As part of this project, the collection of biometric information from overseas refugee resettlement applicants began in November 2014. It involves sharing the information with the RCMP for verification against the immigration and Canadian criminal fingerprint repository, the results of which are communicated to IRCC’s Global Case Management System. The verification results support the decision-making process for overseas refugee resettlement applications.

Privacy Impact Assessment Summary: Enrolment of the Biometric Information of Overseas Refugee Resettlement Applicants

iCARE Pre-Arrival Services Modules

The PIA report was conducted to assess the privacy impacts emanating from the integration of Pre-Arrival Services Modules within the Immigration Contribution Agreement Reporting Environment (iCARE), which captures settlement program data from service provider organizations offering services to clients who are outside of Canada. It builds upon the core privacy analysis conducted by IRCC, with respect to iCARE’s introduction, as reported in IRCC’s iCARE PIA completed in February 2014.

IRCC is responsible for facilitating the integration of newcomers into Canada through the funding and administration of settlement and resettlement services. These services include information and orientation sessions, mentoring and employment advice, or language assessments and training. Some of these services are provided to eligible clients before they come to Canada.

While settlement and resettlement services are delivered through third-party service provider organizations, IRCC plays a leading role in settlement and resettlement assistance programming and development.

Privacy Impact Assessment Summary: iCARE Pre-Arrival Services Modules

Information Collection Arrangement with the Canada Revenue Agency – Citizenship Grants

The PIA report examined the privacy impacts of changes introduced by Bill C-24: the Strengthening Canadian Citizenship Act, which includes a requirement that adults who are applying for a grant of Canadian citizenship must file Canadian income taxes, if required under the Income Tax Act, in order to be eligible. In addition, adult applicants seeking a grant of citizenship are also required to meet physical presence requirements.

The collection of taxpayer information from the Canada Revenue Agency enables IRCC to verify whether an applicant has filed their tax return(s), and to determine whether the applicant’s taxpayer information is consistent with other information submitted to demonstrate that physical presence/residence obligations have been met.

While these elements of the Strengthening Canadian Citizenship Act came into force as of June 11, 2015, most of the regulations related to information sharing required updating or new agreements or arrangements with partner departments. This includes updates to the information sharing arrangements between the Canada Revenue Agency and IRCC to facilitate the new requirement for citizenship applicants to file income taxes, for those required to do so under the Income Tax Act; and strengthened information sharing authorities, the subject of the PIA.

Privacy Impact Assessment Summary - Information Collection Arrangement with the Canada Revenue Agency – Citizenship Grants

Randomized Selection Intake Management Process for Parents and Grandparents Program

The PIA report was conducted to assess the potential privacy impacts of using a randomized selection process to manage intake into the Parents and Grandparents Program. The Department already collects information from sponsors and principal applicants as part of the Parents and Grandparents Program application process. The PIA covers the random selection process itself and the information collected as part of this process in the “Interest to Sponsor” web form.

To ensure greater fairness and transparency, and to improve access to the application process for the Parents and Grandparents Program, the Government of Canada introduced a randomized selection process, effective January 1, 2017. The randomized selection process requires individuals to submit basic personal information to the Department via a web form to signal their interest to sponsor in the Parents and Grandparents Program.

The personal information required to complete the web form includes the name, date of birth, country of birth and mailing and email addresses. This personal information is automatically populated into a database. Once the 30-day period for indicating an interest to sponsor has closed, the Department removes duplicate entries and then randomly select 10,000 persons, which is the limit on the number of complete applications accepted for processing in any year, to submit an application to sponsor their parents or grandparents.

Privacy Impact Assessment Summary: Randomized Selection Intake Management Process for Parents and Grandparents Program

Medical Surveillance and the Sharing of Information with Provincial and Territorial Public Health Authorities

The PIA report assessed the sharing of information with provincial or territorial public health authorities as it relates to those foreign nationals ordered to comply with the medical surveillance condition, as well as the sharing of HIV data with those public health authorities. Additionally, the PIA assessed the privacy risks related to the new Global Case Management System functionality and the secure web portal.

As part of the immigration process, IRCC’s Migration Health Branch provides medical screening and medical assessment services throughout Canada and around the world, pursuant to paragraph 16(2)(b) of the IRPA.

IRCC has established policies and procedures in line with the protection of public health to prevent individuals who are inadmissible under health grounds from entering Canada. This includes medical surveillance whereby an individual who is found to have inactive pulmonary tuberculosis, or latent pulmonary tuberculosis, is required to report for a medical follow-up (and possibly treatment requirements) by the provincial or territorial public health authority where the foreign national resides while in Canada.

Medical Surveillance

Material Privacy Breaches

In 2016-2017, IRCC notified the OPC and the Treasury Board of Canada Secretariat of nine material privacy breaches. IRCC monitors all privacy breaches closely and puts in place notification and remedial measures to address each situation.

The program area sent apology letters to the affected individuals. The ATIP Division provided advice and guidance on containment and mitigation strategies to improve the protection of personal information. In addition, senior officials are notified of all material breaches to facilitate communication within the Department and raise awareness of issues that could hinder the public’s right to privacy.

The ATIP Division continually monitors all privacy breaches reported at IRCC. We also review how and where they are occurring within the Department. The ATIP Division addresses trends and provides tailored privacy breach training sessions to raise awareness and increase privacy breach prevention.

Initiatives

To improve internal processes and client service under the Privacy Act, IRCC undertook the following initiatives:

• The ATIP unit on Complex Cases and Sensitive Issues launched a Lean Review of the Department-wide ATIP process in order to improve its efficiency.
• ATIP reached out to work collaboratively with stakeholders to clarify the IRCC ATIP process with the goal of improving ATIP services.
• ATIP engaged program areas throughout IRCC to assess client service practices that may be causing unnecessary increases in ATIP requests, as well as to improve client service correspondence and the client portal.

Policies, Guidelines and Procedures Under Both Acts

The ATIP Operations Unit created three teams of analysts who review files due within two weeks, as well as a fourth team that reviews files due within 72 hours. This process enables the unit to minimize the number of late files.

In addition, the Operations Unit created an informal developmental program for the unit’s new clerks. This program allows them to progress from simple tasks to more complex ones, resulting in a reduction of the number of errors made during the initial stages of the file life cycle.

An assessment was conducted of the ATIP case management software to locate gaps and inefficiencies pertaining to the administration of requests. As a result, the Division implemented a new process to improve the effectiveness of the software to obtain data that is more accurate, reducing redundant procedures.

Training and Awareness

Privacy issues continue to grow in significance, especially in the face of burgeoning information technologies. During the reporting period, the ATIP Division continued to promote ATIP awareness and to conduct bilingual training sessions through a variety of approaches.

IRCC Privacy Day

The Department has developed, over the years, comprehensive privacy policies, procedures and guidelines to meet its privacy obligations and establish a coherent approach to privacy protection. The Privacy Framework is one such tool created to strengthen privacy at IRCC.

ATIP held its first Privacy Day in 2016. This initiative was launched to raise awareness of the importance of safeguarding personal information. As the Department is responsible for vast amounts of clients’ personal information, IRCC continues to encourage employees to utilize privacy best practices in all aspects of their work. This is important because Canadians expect that the personal information they entrust to us will be properly handled and protected.

The IRCC Privacy Day will be celebrated annually to serve as a reminder to protect personal information across all business lines.

In addition, ATIP distributed promotional messages on a regular basis throughout the Department via Today@IRCC, the Department’s internal electronic newsletter.

Mandatory Training

The ATIP Division is pleased to report that more than 1,400 employees participated in its training sessions last year. ATIP gives three important sessions throughout the year:

• Understanding and Managing ATIP Requests is designed to provide a greater understanding of the roles and responsibilities of the ATIP Division, the liaison officers and other departmental officials in the processing of an ATIP request. Six sessions were given throughout the year. A total of 74 employees attended.
• ATIP Training for Middle Managers and Executives is for middle managers and executives. The course provides an overview of key ATIP principles and practices, and a greater understanding of the roles and responsibilities of managers and employees. A total of 22 managers and executives completed the course.
• Protecting and Giving Access to Information at IRCC is a mandatory online course for all employees. It provides a brief overview of key ATIP principles and practices and fosters a greater understanding of the roles and responsibilities of all employees. During the year, 869 employees took the online training session.

IRCC ATIP also gives tailored training sessions and workshop presentations to reinforce and increase knowledge and understanding of privacy and personal information. These sessions are independent of mandatory courses and are given in response to a group’s specific interests. A total of 196 employees were provided tailored ATIP training in six sessions last year.

Privacy Breach Training

Privacy breach training sessions are designed to provide a greater understanding of what a privacy breach is, the roles and responsibilities of employees, and awareness of emerging trends of privacy breaches.

Privacy breach training sessions are focused not only on how to contain a breach, but also how to evaluate it, notify internal and external stakeholders, mitigate the impact and reduce the probability of a recurrence. The sessions provide an opportunity for program areas to ask questions pertaining to real scenarios and receive practical advice from ATIP staff.

A total of 255 employees received privacy breach training in 2016-2017.

Annex A: Signed Delegation

Annex B: Delegation Order Under the Access to Information Act

Official Document

Delegation of Authority Under the Access to Information Act and the Access to Information Regulations

Legend

DM

Deputy Minister

ADM-CS / DG-CA

ADM, Corporate Services / Director General, Corporate Affairs

ATIP / DIRECTOR

Director, Access to Information and Privacy (EX-01)

ATIP / Assistant Director

Assistant Director, ATIP Operations (OPS) (PM-06) / Assistant Director, Complex and Sensitive Issues (CSI) (PM-06)

ATIP / PM-05 OPS

Senior ATIP Administrators, ATIP Operations (OPS)

ATIP / PM-05 CSI

Senior ATIP Administrators, ATIP Complex and Sensitive Issues (CSI)

ATIP / PM-04 OPS

ATIP Administrators, ATIP Operations (OPS)

ATIP / PM-04 CSI

ATIP Administrators, ATIP Complex and Sensitive Issues (CSI)

ATIP / PM-03 OPS

ATIP Officers, ATIP Operations (OPS)

ATIP / PM–03 CSI

ATIP Officers, ATIP Complex and Sensitive Issues (CSI)

Annex C: Delegation Order Under the Privacy Act

Official Document

Delegation of Authority Under the Privacy Act and the Privacy Regulations

Legend

DM

Deputy Minister

ADM-CS / DG-CA

ADM, Corporate Services / Director General, Corporate Affairs

ADM-SPP / DG-RE

Associate ADM, Strategic and Program Policy / Director General, Research and Evaluation

ATIP / DIRECTOR

Director, Access to Information and Privacy (EX-01)

ATIP / ASSISTANT DIRECTOR CSI

Assistant Director, Complex and Sensitive Issues, CSI (PM-06)

ATIP /ASSISTANT DIRECTOR OPS
ATIP / PM-05 OPS

Assistant Director, ATIP Operations, OPS (PM-06)
Senior ATIP Administrator, ATIP Operations (OPS)

ATIP / PM-05 CSI

Senior ATIP Administrators, Complex and Sensitive Issues(CSI)

ATIP / PM-04 OPS

ATIP Administrators, ATIP Operations (OPS)

ATIP / PM-04 CSI

ATIP Administrators, Complex and Sensitive Issues (CSI)

ATIP / PM-03 OPS

ATIP Officers, ATIP Operations (OPS)

ATIP / PM-03 CSI

ATIP Officers, ATIP Complex and Sensitive Issues (CSI)

ANNEX D: Statistical Report on the Access to Information Act

Name of institution Immigration, Refugees and Citizenship Canada

Reporting period: 2016-04-01 to 2017-03-31

Part 1: Requests under the Access to Information Act

1.1 Number of requests

1.2 Sources of requests

1.3 Informal requests

Note: All requests previously recorded as “treated informally” will now be accounted for in this section only.

Part 2: Requests closed during the reporting period

2.1 Disposition and completion time

2.2 Exemptions

2.3 Exclusions

2.4 Format of information released

2.5 Complexity

2.5.1 Relevant pages processed and disclosed

2.5.2 Relevant pages processed and disclosed by size of requests

2.5.3 Other complexities

2.6 Deemed refusals

2.6.1 Reasons for not meeting statutory deadline

2.6.2 Number of days past deadline

2.7 Requests for translation

Part 3: Extensions

3.1 Reasons for extensions and disposition of requests

3.2 Length of extensions

Part 4: Fees

Part 5: Consultations received from other institutions and organizations

5.1 Consultations received from other Government of Canada institutions and organizations

5.2 Recommendations and completion time for consultations received from other Government of Canada institutions

5.3 Recommendations and completion time for consultations received from other organizations

Part 6: Completion time for consultations on Cabinet confidences

6.1 Requests with Legal Services

6.2 Requests with Privy Council Office

Part 7: Complaints and investigations

Part 8: Court action

Part 9: Resources related to the Access to Information Act

9.1 Costs

9.2 Human Resources

ANNEX E: Statistical Report on the Privacy Act

Name of institution Immigration, Refugees and Citizenship Canada

Reporting period: 2016-04-01 to 2017-03-31

Part 1: Requests under the Privacy Act

Part 2: Requests closed during the reporting period

2.1 Disposition and completion time

2.2 Exemptions

2.3 Exclusions

2.4 Format of information released

2.5 Complexity

2.5.1 Relevant pages processed and disclosed

2.5.2 Relevant pages processed and disclosed by size of requests

2.5.3 Other complexities

2.6 Deemed refusals

2.6.1 Reasons for not meeting statutory deadline

2.6.2 Number of days past deadline

2.7 Requests for translation

Part 3: Disclosures Under Subsections 8(2) and 8(5)

Part 4: Requests for Correction of Personal Information and Notations

Part 5: Extensions

5.1 Reasons for extensions and disposition of requests

5.2 Length of extensions

Part 6: Consultations received from other institutions and organizations

6.1 Consultations received from other Government of Canada institutions and other organizations

6.2 Recommendations and completion time for consultations received from other Government of Canada institutions

6.3 Recommendations and completion time for consultations received from other organizations

Part 7: Completion time for consultations on Cabinet confidences

7.1 Requests with Legal Services

7.2 Requests with Privy Council Office

Part 8: Complaints and Investigations Notices received

Part 9: Privacy Impact Assessments (PIAs)

Part 10: Resources related to the Privacy Act

10.1 Costs

10.2 Human Resources