Access to Information Act, Privacy Act, Annual Report 2018-2019

PDF version: Privacy Act, Access to Information Act, Annual Report 2018-2019 (PDF, 1.3 MB)

On this page

• Executive summary
  • IRCC ATIP at a glance
• Introduction
• Purpose of the Acts
  • Access to Information Act
  • Privacy Act
• About Immigration, Refugees and Citizenship Canada
• Delegation order
• Organizational structure
• Highlights of the statistical report for 2018-2019
  • Requests received and completed
  • Pages processed
  • Sources of requests under the Access to Information Act
  • Informal access requests under the Access to Information Act
  • Exemptions
  • Exclusions
  • Consultations
  • Extensions
  • Completion times
  • Complaints
  • Audits
  • Appeal to the Federal Court
• Reporting on access to information fees for the purposes of the Services Fees Act
• Reporting requirements specific to the Privacy Act
  • Privacy Impact Assessments
  • Disclosure of personal information under paragraphs 8(2)(e) and 8(2)(m)
  • Material privacy breaches
• Monitoring Compliance
• Policies, Guidelines and Procedures
  • Access to Information Act and the Privacy Act
  • Privacy Act only
• Training and awareness
  • Access to information and privacy training
  • Privacy-only training
• Annex A: Signed Delegation
• Annex B: Delegation Order under the Access to Information Act
• Annex C: Delegation Order under the Privacy Act
• Annex D: Statistical Report on the Access to Information Act
• Annex E: Statistical Report on the Privacy Act
• Annex F: New Exemptions Table for 2018-2019

Executive summary

Annually, through its key lines of business, Immigration Refugees and Citizenship Canada (IRCC) interacts with millions of individuals, including those seeking temporary or permanent resident entry into Canada and subsequently settling into Canadian society, and those pursuing Canadian citizenship. The Department is also responsible for passport services in support of individuals seeking to obtain or renew a Canadian passport or other travel document such as a certificate of identity or a refugee travel document.

IRCC manages a considerable volume of personal information as part of delivering these programs and services, and remains committed to ensuring that the personal information held by IRCC is safeguarded, used and disclosed responsibly. During the reporting period, commencing April 1, 2018, and ending March 31, 2019, IRCC completed Privacy Impact Assessments exploring privacy risks in new departmental initiatives. In addition, the Access to Information and Privacy (ATIP) Division provided privacy policy advice on over 485 requests concerning information sharing, consent, surveys, contracts, privacy notices, and other matters.

In recent years, the Department has experienced significant increases in some of its most important lines of business as many around the world seek to enter Canada temporarily or permanently, and as increasing numbers of eligible permanent residents seek to become Canadian citizens. IRCC’s challenge is to effectively manage these requests to enter and remain in Canada, while working with stakeholders to ensure that newcomers have the best opportunities to succeed and that the Canadian economy and society reap the benefits of newcomer success.

Increases in volume in other IRCC business lines are correlated with significant increases in ATIP request volumes. In 2018-2019, IRCC received 50% of all ATIP requests submitted to federal government institutions, and has experienced unprecedented growth in the number of ATIP requests over the past several years.

IRCC is unique in that most of the requests it receives under the Access to Information Act are for the personal information of its clients. This is because the majority of its requests concern IRCC clients who are foreign nationals that rely on representatives to submit an Access to Information Act request on their behalf and with their consent to seek information about their IRCC immigration file.

To manage these volumes effectively, the ATIP Division within IRCC has two teams that process ATIP requests:

• One team manages Access to Information Act requests for corporate records, and personal information requests concerning IRCC employees. This team’s ATIP request process involves branch ATIP Liaison Officers to coordinate the retrieval of records and identification of release sensitivities responsive to ATIP requests.
• The other team manages all ATIP requests that relate to IRCC client files.

The Department is committed to ensuring that its requesters receive timely access to the records they request, and undertook a number of initiatives to improve its performance and address a backlog of requests. Despite a 26 per cent increase over the previous fiscal year, IRCC managed to close 40 per cent more requests than the previous fiscal year.

IRCC ATIP at a glance

Text version: IRCC ATIP at a glance

• 50% of all ATIP requests in federal government institutions were submitted to IRCC in 2018/19
• 26% increase in requests (+20K) in 2018/2019 from 2017/2018
• 150% growth in requests (+59K) since 2013/2014

IRCC ATIP growth

Text version: IRCC ATIP growth

Year	Percent annual growth	ATIP request volumes	Percent growth since 2013/2014
2013/2014	N/A	39,200	N/A
2014/2015	+22%	47,800	+22%
2015/2016	+19%	57,000	+45%
2016/2017	+11%	63,300	+61%
2017/2018	+23%	77,600	+98%
2018/2019	+26%	98,000	+150%

As evidenced in this report, numerous efforts have been made by IRCC to strengthen its ATIP program, including stabilizing its workforce, refining procedures and tools, improved stakeholder engagement, and community outreach. Transformation of the ATIP program will be a continued theme in 2019-2020, and IRCC will continue to support the broader ATIP community through participation in discussions concerning reforms of the Acts, ATIP community software needs, and other related Government of Canada initiatives.

Introduction

IRCC is pleased to present to Parliament its consolidated annual report on the administration of the Access to Information Act and the Privacy Act. The report describes the activities that support compliance with both Acts for the fiscal year commencing April 1, 2018, and ending March 31, 2019.

Section 94 of the Access to Information Act and section 72 of the Privacy Act require that the head of every federal government institution submit an annual report to Parliament on the administration of those Acts during the fiscal year.

As described in the executive summary, IRCC is unique in that most of its ATIP requests relate to requests for personal information, which creates a stronger relationship between the two Acts at IRCC than at other departments. The ATIP Division within the Corporate Management Sector, responsible for administering the ATIP program at IRCC, is organized such that each team supports or administers both Acts. The Department has prepared a single, integrated report that outlines IRCC’s accomplishments in carrying out its ATIP responsibilities during the 2018-2019 reporting period.

Purpose of the Acts

Access to Information Act

The purpose of the Access to Information Act is to provide a right of access to records under the control of a government institution. The Act maintains that government information should be available to the public, that necessary exceptions to the right of access should be limited and specific, and that decisions on the disclosure of government information should be reviewed independently of the government.

Privacy Act

The purpose of the Privacy Act is to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution and to provide individuals with a right of access to that information. The Act protects an individual’s privacy by preventing others from having unlawful access to personal information. It also permits an individual specific rights regarding the collection, use and disclosure of this information.

About Immigration, Refugees and Citizenship Canada

IRCC selects and welcomes, as permanent and temporary residents, foreign nationals whose skills contribute to Canadian prosperity. It also reunites family members.

The Department maintains Canada's humanitarian tradition by welcoming refugees and other people in need of protection, thereby upholding its international obligations and reputation.

IRCC, in collaboration with its partners, conducts the screening of potential permanent and temporary residents to protect the health, safety and security of Canadians. IRCC is also responsible for the issuance and control of Canadian passports and other documents that facilitate the travel of Canadian citizens and residents.

Lastly, the Department builds a stronger Canada by helping all newcomers settle and integrate into Canadian society and the economy, and by encouraging, granting and providing proof of Canadian citizenship.

IRCC’s mandate comes from the Department of Citizenship and Immigration Act. The Minister of IRCC is responsible for the Citizenship Act of 1977 and shares responsibility with the Minister of Public Safety for the Immigration and Refugee Protection Act (IRPA). Jurisdiction over immigration is shared between the federal and the provincial and territorial governments under section 95 of the Constitution Act of 1867.

Effective July 2, 2013, primary responsibility for Passport Canada and the administration of the Canadian Passport Order and the Order Respecting the Issuance of Diplomatic and Special Passports moved from the Department of Foreign Affairs and International Trade to Immigration, Refugees, and Citizenship Canada.

Delegation order

The Minister of Immigration, Refugees and Citizenship is responsible for dealing with requests under the Access to Information Act and the Privacy Act. The Minister delegates his authority to members of departmental senior management, including the ATIP Departmental Coordinator (ATIP Director), to carry out his powers, duties, or functions under the Acts, in relation to ATIP requests. Certain authorities are delegated to particular positions in the ATIP Division at National Headquarters as shown in Annex B and Annex C of this report.

Organizational structure

The ATIP Division is part of the ATIP & Accountability Branch, which is overseen by a Director General, and is situated in the Corporate Management Sector at IRCC. The Division administers the Access to Information Act and the Privacy Act for IRCC and is led by a Director, who acts as the ATIP Coordinator for the Department. Four units carry out the Division’s work in addition to 35 Liaison Officers who are responsible for coordinating the ATIP activities of IRCC branches. Each unit has shared responsibilities for the administration of both the Access to Information Act and the Privacy Act.

Structure of the ATIP Division at IRCC

Text version: Structure of the ATIP Division at IRCC

ATIP Operations
Carries out administrative functions and processes the bulk of ATIP requests for client records
(65 Employees)

ATIP Complex and Sensitive Issues
Processes complex and sensitive ATIP requests, and manages ATIP request-related complaints
(21 Employees)

ATIP Privacy, Policy and Governance
Develops ATIP policies, provides ATIP advice, guidance and support, delivers ATIP training and promotes awareness
(10 Employees)

Technology, Transformation, and Analytics
Conducts statistical analysis and trend monitoring, and leads ATIP technology and transformation efforts
(3 Employees)

ATIP Director’s Office
(3 Employees)

Highlights of the statistical report for 2018-2019

Requests received and completed

Access to information requests received and completed

Text version: Access to information requests received and completed

Year	Requests received	Requests completed
2012-2013	25,010	26,020
2013-2014	29,281	27,407
2014-2015	34,066	33,524
2015-2016	41,660	40,107
2016-2017	50,728	48,733
2017-2018	64,234	59,021
2018-2019	82,387	83,895

IRCC continues to receive more Access to Information Act requests than any other federal government institution. Specifically, the Department received a total of 82,387 requests in the 2018-2019 reporting period, which represents an increase of 28 per cent from the previous year. Due to the growth of requests, the compliance rate was 71.61 per cent for the reporting period.

The majority of Access to Information Act requests received were for information relating to client records.

Privacy requests received and completed

Text version: Access to information requests received and completed

Year	Requests received	Requests completed
2012-2013	5,114	5,486
2013-2014	9,961	9,225
2014-2015	13,778	13,082
2015-2016	15,292	15,077
2016-2017	12,605	11,808
2017-2018	13,368	12,698
2018-2019	15,655	16,846

IRCC remains one of the most accessed federal institutions, receiving a total of 15,655 requests submitted under the Privacy Act in the 2018-2019 reporting period. This represents an increase of 17 per cent from the previous year. Given the volume of Privacy requests to process, the Department’s compliance rate was 63.04 per cent.

The majority of Privacy Act requests received were for information relating to client records.

Pages processed

Access to information and privacy pages reviewed

Text version: Access to information and privacy pages reviewed

Year	Pages reviewed
2014-2015	2,227,317
2015-2016	2,923,225
2016-2017	3,579,498
2017-2018	4,548,653
2018-2019	7,255,790

As the number of requests continues to increase, the volume of pages continues to rise also. In 2018-2019, IRCC processed 7,255,790 pages.

This is a 58 per cent increase from last fiscal year, which equates to over 2 million more pages that the ATIP Division reviewed.

Access to Information Act

IRCC processed 6,058,588 pages during the 2018-2019 reporting period, an increase of 63 per cent over the previous fiscal year.

Privacy Act

IRCC processed 1,197,202 pages during the 2018-2019 reporting period, an increase of 37 per cent over the previous fiscal year.

Sources of requests under the Access to Information Act

The business sector (mainly immigration lawyers and consultants) remains the largest source of requests, accounting for 57.7 per cent of all requests. The general public accounts for 28.1 per cent, and media, organizations and academia comprise 7.5 per cent of requests. The remaining 6.7 per cent represents requesters who decline to identify themselves.

Sources of access to information requests

Text version: Sources of access to information requests

Sources	Requests
Business	47,543
Public	23,143
Media, academia and organizations	6,215
Decline to identify	5,486

Informal access requests under the Access to Information Act

IRCC posts summaries of completed access to information requests pertaining to corporate records on the Open Government portal. In 2018-2019, IRCC closed 1,254 informal requests (copies of previously released requests).

Exemptions

Access to Information Act

The Department invoked some exemptions on 51,262 requests (61.1 per cent), and all information was provided in 25,194 of its requests (30 per cent). The remaining 7,413 requests (8.8 per cent) were transferred, abandoned, no record existed or the Department could neither confirm nor deny the existence of these records, as doing so could reveal information that is protected under the Act.

The majority of exemptions invoked by IRCC fell under three sections of the Act:

• Subsection 19(1), which protects personal information, was used in 38,816 cases (76 per cent);
• Subsection 16(1), which addresses law enforcement and criminal investigations, was used in 16,369 cases (32 per cent); and
• Subsection 15(1), which covers international relations, defence and subversive activities, was used in 13,721 cases (27 per cent).

More than one section can be applied to a specific request.

Privacy Act

The Department invoked some exemptions on 10,154 requests (60 per cent), and all information was provided in 3,183 requests (19 per cent). The remaining 3,509 requests (21 per cent) were either transferred, abandoned or no record existed.

The majority of exemptions invoked by IRCC fell under three sections of the Act:

• Section 26, which protects personal information, was used in 7,744 cases (76 per cent);
• Section 21, which covers international relations, defence and subversive activities, was used in 6,311 cases (62 per cent); and
• Paragraph 22(1)(b), which addresses law enforcement and criminal investigations, was used in 2,787 cases (27 per cent).

More than one section can be applied to a specific request.

Exclusions

Access to Information Act

The Access to Information Act does not apply to records that are already available to the public (section 68) and confidences of the Queen’s Privy Council (section 69). IRCC excluded records based on section 68 in 25 instances, and on section 69 in 37 instances.

Privacy Act

The Privacy Act does not apply to records that are already available to the public (section 69) and confidences of the Queen’s Privy Council (section 70). IRCC did not apply any exclusions under the Privacy Act during the reporting period.

Consultations

Access to Information Act

Other federal government institutions consulted IRCC for records related to IRCC in 298 cases under the Access to Information Act, and IRCC was able to respond to 68 per cent of those consultations within 30 days.

Privacy Act

Other federal government institutions consulted IRCC for records related to IRCC in 31 cases under the Privacy Act, and was able to respond to 80 per cent of those consultations within 30 days.

Extensions

Access to Information Act

Section 9 of the Access to Information Act permits the statutory time limits to be extended if consultations are necessary or if the request is for a large volume of records, and processing it within the original time limit would unreasonably interfere with the operations of the Department.

IRCC invoked a total of 2,729 extensions during the 2018-2019 reporting period. Extensions were required in 2,570 instances when IRCC consulted with other federal institutions prior to responding. Extensions were required in 121 instances to search through a large volume of records or to respond to the influx of requests, or both, which interfered with operations. The Department also invoked 38 extensions to conduct third-party notifications.

Privacy Act

Section 15 of the Privacy Act permits the statutory time limits to be extended if consultations are necessary, if translation is required or if the request is for a large volume of records and processing it within the original time limit would unreasonably interfere with the operations of the Department.

IRCC invoked a total of 199 extensions during the 2018-2019 reporting period. Of these, 168 were deemed necessary as IRCC needed to consult with other federal institutions prior to responding. Extensions were required in a further 31 instances to search for or through a large volume of records or to respond to the influx of requests, or both, which interfered with operations. The Department did not invoke any extensions for translation purposes.

Completion times

Text version: Completion times

Access to information requests

Completion Time	Number of requests	Percentage of requests
30 days or less	48,754	58%
31 to 60 days	24,757	30%
61 to 120 days	3,613	4%
121 days or more	6,771	8%

Privacy requests

Completion Time	Number of requests	Percentage of requests
30 days or less	9,306	55%
31 to 60 days	5,359	32%
61 to 120 days	368	2%
121 days or more	1,813	11%

Complaints

Both the Office of the Information Commissioner (OIC) and the Office of the Privacy Commissioner (OPC) will work with institutions to resolve complaints in the early resolution process (when possible) without opening a formal investigation. If that is not an option, or if the matter is not resolved in early resolution, the OIC and the OPC will open a formal investigation.

During the reporting period, the Department received 164 informal complaints through the early resolution process, and closed 154 complaints in early resolution.

Access to Information Act

During the 2018-2019 reporting period, the Department was notified of 544 access complaints received by the OIC. This represents 0.66 per cent of all requests completed during this period. The majority of complaints were related to processing times.

During the reporting period, ATIP processed and closed 579 complaint investigations. Of these, 95 complaints were abandoned, discontinued or deemed to be unfounded. The remaining 484 complaints were resolved to the satisfaction of the requester.

Privacy Act

During the 2018-2019 fiscal year, the Department was notified of 11 privacy complaints received by the OPC. This represents 0.07 per cent of all requests completed during this period. The majority of the OPC complaints were related to processing times.

During the reporting period, ATIP processed and closed 15 complaint investigations. Of these, 4 were deemed not well-founded, while 11 were resolved to the satisfaction of the requester.

Complaints of note

In March 2018, the Department updated its form for Consent for an Access to Information and Personal Information Request (IMM 5744). One of the primary changes was the introduction of mandatory consent of both parents for information about a minor child. Previously, only the consent of one parent of a minor child was required, but increasing concerns about illegal immigration, child abduction and abuse, and identity fraud prompted the ATIP Division to review and reconsider its consent policy for ATIP requests for information about a minor child.

The process now requires a requester to include consent from both parents of the child, or they must provide proof that there is only one custodian. This change to the consent form safeguards the disclosure of a minor’s information to a party that should not have access.

The requirement for dual signatures was introduced to ensure that the release of information contained in records does not compromise the safety of the minor and other parties that may be present. It also ensures the requester has a right of access to the information found in the records.

A complaint was received about the new consent requirement. Based on the Department’s representations, the OPC determined in the early resolution process that there was no need to complete a formal investigation.

Actions taken under both Acts

The Department has taken diverse actions aimed at reducing the number of complaints received. For instance, ATIP actively engages with the OIC at regular meetings to discuss and resolve complaints. The Division is continuing to seek ways to improve its performance in an effort to reduce response times for ATIP requests, with the end goal of decreasing complaints.

ATIP has two dedicated officers dealing with complaint resolution. IRCC works closely in conjunction with both the OIC and the OPC to ensure expectations are met and to ensure that ATIP Analysts and the Offices of Primary Interest have a clear understanding of the complaint process.

There was a 174 per cent increase in complaints this year over the previous fiscal year. Of those, 266 came from a single requester and 362 came from 5 complainants. Of these 362, 322 were resolved without formal investigation by the OIC, as the ATIP response had been sent before the requester made the complaint.

During the reporting period, the ATIP Division made a concerted effort to clear old complaints and ensure that all complaints are actioned in a timely manner. New processes were implemented to reduce response time to complaints by having a better distribution of work, holding regular meetings to discuss issues and all ongoing files, and routine statistical reports to ensure that all work has been actioned. As a result of the new processes, the ATIP Division closed 196 per cent more complaints than the previous fiscal year, and its complaint backlog is at its lowest since 2013-2014.

Complaint Volumes: 2013-2014 to 2018-2019

Text version: Complaint Volumes: 2013-2014 to 2018-2019

Year	Complaints received	Complaints closed
2013-2014	351	177
2014-2015	265	333
2015-2016	199	127
2016-2017	140	204
2017-2018	227	201
2018-2019	555	594

Audits

The audit of Access to Information and Privacy Management was included in the Department’s 2018‑2020 risk-based audit plan, and was completed in February 2019. The audit objective was to assess the effectiveness of the current governance and control framework to manage ATIP requests in the Department to ensure compliance with legislative, Treasury Board and departmental requirements.

The audit scope covered the governance framework, reporting and monitoring capabilities, resource management, compliance, and operating effectiveness of the ATIP management process within the Department. The audit scope did not include Privacy Act requirements related to Privacy Impact Assessments, privacy breaches, or complaints from the OPC that relate to departmental privacy practices. The audit covered the time period from April 1, 2016 to June 30, 2018.

The audit concluded that the Department has a governance and control framework in place to support the management of ATIP requests; however, opportunities for improvement were identified to strengthen the current framework to better support the management of ATIP requests so that compliance with legislative, Treasury Board and departmental requirements is ensured.

The Department will be addressing the audit recommendations through 2019-2020 and the following years.

Appeal to the Federal Court

There were no appeals to the Federal Court filed against IRCC regarding the Access to Information Act and the Privacy Act during the 2018-2019 reporting period.

Reporting on access to information fees for the purposes of the Service Fees Act

The Service Fees Act requires a responsible authority to report annually to Parliament on the fees collected by the institution.

With respect to fees collected under the Access to Information Act, the information below is reported in accordance with the requirements of section 20 of the Service Fees Act.

• Enabling authority: Access to Information Act
• Fee amount: $5.00 application fee for access to information requests
• Total revenue: IRCC collected $409,745 on 81,949 requests
• Fees waived: In accordance with the Interim Directive on the Administration of the Access to Information Act, issued on May 5, 2016, IRCC waives all fees prescribed by the Act and Regulations, other than the $5.00 application fee set out in paragraph 7(1)(a) of the Regulations. For 2018-2019, IRCC waived $1,715.00
• Cost of operating the program: $4,847,695

Reporting requirements specific to the Privacy Act

The following section contains highlights from the statistical reports that are only reported for the Privacy Act, and not the Access to Information Act. That includes privacy impacts assessments, disclosures of personal information under 8(2)(e) and 8(2)(m) of the Privacy Act, and privacy breaches.

Privacy Impact Assessments

To fulfil its mandate and effectively deliver its programs and services, IRCC collects, uses and discloses personal information. In accordance with Treasury Board of Canada Secretariat (TBS) policy, the Department undertakes Privacy Impact Assessments (PIAs) to ensure compliance with the Privacy Act and identify privacy risks present in new or existing departmental programs, initiatives or projects that collect and use personal information.

Descriptions of PIAs completed during the 2018-2019 fiscal year are found below. For each of the PIA description, we have provided the hyperlink to the related PIA summaries, except for three of the PIA summaries that are still being prepared for online publication.

Analytics

The PIA summary is currently under development and will be posted later in the fiscal year.

In 2018, IRCC launched a pilot project using computer analytics to help officers triage online Temporary Resident Visa applications from China. The pilot project’s goal is to improve client service and make processing more efficient, while continuing to protect the safety and security of Canadians. The computer analytics help officers to identify applications that are routine and straightforward for streamlined processing and to triage files that are more complex for a more thorough review. In all cases, officers must still screen for security and criminality for all applications.

The objective of the PIA Report was to assess privacy risks associated with the implementation of computer analytics in the processing of online Temporary Resident Visa applications from China.

Disclosure of citizenship data to Elections Canada for updating the National Register of Electors

The PIA summary can be found here: /content/canadasite/en/immigration-refugees-citizenship/corporate/transparency/access-information-privacy/privacy-impact-assessment/national-registers-electors-ircc-citizenship-data-transfers.html.

The Elections Canada (EC) National Register of Electors (NROE) is the continually updated database of Canadians who are qualified to vote in federal elections and referendums and is used by EC to create preliminary lists of electors (voters’ lists) at the beginning of federal elections and referendums.

Transfers of new citizen data have occurred from IRCC to EC NROE since 1997, when the NROE was created. Canadian citizenship applicants aged 18 and over can consent on IRCC’s Application for Canadian Citizenship to transfer personal information associated with citizenship status upon citizenship conferral to EC to be added to the NROE and subsequently to federal voters’ lists. In May 2017, EC and IRCC updated their Memorandum of Understanding to include additional data elements, and to address changes made to IRCC’s Citizenship Regulations in 2014 that allow IRCC to disclose information on citizenship revocations, recalls and renunciations (collectively called ‘loss citizenships’).

The objective of the multi-institutional PIA Report was to assess privacy risks associated with the disclosure of personal information from IRCC to EC concerning new citizens, and information on citizenship revocations, recalls and renunciations.

Disclosure of immigration data to Elections Canada for updating the National Register of Electors

The PIA summary is currently under development and will be posted later in the fiscal year.

The EC NROE is the permanent database of Canadians who are qualified to vote in federal elections and referendums and is used by EC to create preliminary lists of electors (voters’ lists) at the beginning of federal elections and referendums.

Citizenship status is one of the criteria associated with determining an individual’s qualification to vote in Canada. Foreign Nationals (FN) and Permanent Residents (PR) are categories of individuals who are not citizens of Canada, and therefore are not qualified to vote in Canadian federal elections and referendums.

Since 1997, EC has relied on information disclosed by IRCC as the authoritative source for new citizen data to ensure that the NROE is as complete, accurate and as up-to-date as possible. The subject of this PIA involves a new data transfer that extends this data sharing relationship by requesting that IRCC transfer to EC selected personal information associated with FNs and PRs. EC intends to use this information to ensure that information associated with individuals who are FNs or PRs do not appear as active electors in the NROE.

The objective of the multi-institutional PIA Report was to assess privacy risks associated with the disclosure of personal information from IRCC to EC concerning FNs and PRs.

Entry Exit initiative

The PIA summary can be found here: /content/canadasite/en/immigration-refugees-citizenship/corporate/transparency/access-information-privacy/privacy-impact-assessment/entry-exit-executive-summary-website.html.

Once fully implemented, the Entry/Exit initiative will allow the Canada Border Services Agency (CBSA) to collect biographic information on all travelers to and from Canada at the land border and in air mode. As a project partner, IRCC uses entry/exit information to assist with the administration of the Immigration and Refugee Protection Act, the Citizenship Act, and the Passport Order. The sharing of information between the Agency and the Department is authorized by the Customs Act and governed by a Memorandum of Understanding and four appendices.

The objective of the PIA Report was to assess privacy risks associated with IRCC’s collection and use of traveller personal information from CBSA.

Integrated Payment and Revenue Management System

The PIA summary is currently under development and will be posted later in the fiscal year.

As part of the department’s modernization agenda, a new fee management system called the Integrated Payment and Revenue Management System (IPRMS) was designed to replace existing systems involved in the handling of cost recovery fees.

IPRMS will use the Receiver General Buy Button to collect fees through the internet, the Bill Payment Service to collect payments made at a Canadian Financial Institution and the Secure File Transfer infrastructure managed by Public Services and Procurement Canada (PSPC) to ensure secure transmission of payment data between PSPC and IRCC.

The objective of the PIA Report was to assess privacy risks associated with the implementation of IPRMS at IRCC.

Interim Federal Health Program

The PIA summary can be found here: /content/canadasite/en/immigration-refugees-citizenship/corporate/transparency/access-information-privacy/privacy-impact-assessment/executive-summary-ifhp.html.

The Migration Health Branch is responsible for the administration and delivery of the Interim Federal Health Program (IFHP), which provides limited, temporary coverage of health care benefits to resettled refugees, refugee claimants and certain other groups who are not eligible for provincial or territorial health insurance and do not have private insurance. These responsibilities include establishing requirements for eligibility, developing a schedule of benefits, identifying and registering health professionals‎ affiliated with the program, and managing and monitoring the delivery of the program through a third-party claims administrator.

The objective of the PIA Report was to assess privacy risks associated with the management of personal information under the IFHP as they relate to the third party claims administrator.

Provincial Nominee Program

The PIA summary can be found here: /content/canadasite/en/immigration-refugees-citizenship/corporate/transparency/access-information-privacy/privacy-impact-assessment/2018-information-sharing-provincial-nominee-program.html.

The Provincial Nominee Program, established in 1997, has three objectives: to meet provincial and territorial labour market and economic development needs; to promote immigration to areas of Canada that are not traditional destinations for immigrants; and to encourage economic development of minority official language communities. To achieve these objectives, provinces and territories nominate for permanent residence individuals who possess the skills necessary to address specific labour market demands and who demonstrate the ability and intent to economically establish in the nominating province or territory.

In 2014, as the Department began renegotiating provincial and territorial bilateral agreements, measures were taken to expand on program integrity provisions in the Provincial Nominee bilateral agreements as a result of ongoing program integrity issues. A dedicated section on program integrity was added to the agreements which assigned responsibility for program integrity to provinces and territories in the administration of their programs. Clauses were also added to the agreements to coordinate activities between the Department and provinces and territories to improve the identification and addressing of incidents of misrepresentation and fraud, through information sharing.

This privacy impact assessment examined how the Department shares personal information with, and treats personal information received from, its provincial and territorial partners for the purpose of administering and monitoring the Provincial Nominee Program.

Application Support Centers

The PIA summary can be found here: /content/canadasite/en/immigration-refugees-citizenship/corporate/transparency/access-information-privacy/privacy-impact-assessment/application-support-centers.html.

The U.S. Service Channel Arrangement refers to the biometrics collection services offered by U.S. Application Support Centers (ASCs) under the provisions of a Memorandum of Understanding (MOU) between Immigration Refugees and Citizenship Canada (IRCC) and U.S. Citizenship and Immigration Services (USCIS). This MOU allows biometric-required applicants who have submitted an application to Canada, and who are physically present in the U.S., to provide their biometrics at ASCs.

This PIA Annex has assessed the privacy impacts related to the use of an appointment scheduling system, which will be used by IRCC applicants to make their biometrics appointment at ASCs in the U.S. and by USCIS to record, track, and display to their internal users and report to IRCC appointment information obtained from the appointment scheduling system.

Youth Advisory Group

The PIA summary can be found here: /content/canadasite/en/immigration-refugees-citizenship/corporate/transparency/access-information-privacy/privacy-impact-assessment/2018-youth-advisory-group.html.

IRCC has created a departmental Youth Advisory Group (YAG). Several IRCC branches, other federal departments, and external stakeholders were engaged extensively to inform the YAG’s design, scope, mandate, and intake process.

The YAG will serve as an ongoing forum for engagement between youth and IRCC officials, including the Minister of IRCC.

The objective of the PIA Report was to assess privacy risks associated with the management of personal information from potential members to assess applicants, facilitate their participation in YAG activities, engage with members on feedback on immigration-related topics and create communications products.

Disclosure of personal information under paragraphs 8(2)(e) and 8(2)(m)

In accordance with subsection 8(2) of the Privacy Act, under certain circumstances, a government institution may disclose personal information under its control without the consent of the individual to whom the information relates.

Paragraph 8(2)(e) provides that personal information may be disclosed to an investigative body specified in the regulations on the written request of the body for the purpose of enforcing any law of Canada or any province or carrying out a lawful investigation. The request must specify the purpose and describe the information to be disclosed.

During this reporting period, IRCC disclosed personal information under subsection 8(2) in responding to 4,233 requests from investigative bodies under paragraph 8(2)(e).

Paragraph 8(2)(m) provides that personal information may be disclosed for any purpose where, in the opinion of the head of an institution, (i) the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure, or (ii) disclosure would clearly benefit the individual to whom the information relates.

During this reporting period, IRCC disclosed personal information in 15 instances under paragraph 8(2)(m) of the Privacy Act:

• Ten requests were received from the Public Health Agency of Canada. In each case, the agency requested the contact information (such as address, phone number or any other method of contact) of individuals who had been in close proximity to a person with a communicable disease. The OPC was notified after the release of the information due to the urgency of the cases.
• In two cases, disclosures were made to the appropriate child protection authorities to report suspected child abuse. The OPC was notified after the release of the information due to the urgency of the cases.
• In one case, a recent photograph of a wanted and dangerous individual was disclosed to a domestic police force to provide to the media to seek the public’s assistance in locating the individual. The OPC was notified after the release of the information due to the urgency of the case.
• In one case, contact information was disclosed to a domestic police force to contact next of kin and notify them of the death of an individual. The OPC was notified after the release of the information due to the urgency of the case.
• In one case, information was disclosed to identify the human remains of the Canadian victims following an airplane crash. The OPC was notified after the release of the information due to the urgency of the case.

Material privacy breaches

A privacy breach refers to the improper or unauthorized creation, collection, use, disclosure, retention or disposition of personal information. A material privacy breach is a privacy breach that involves sensitive personal information and could reasonably be expected to cause injury or harm to the individual.

In 2018-2019, IRCC notified the OPC and TBS of six material privacy breaches. IRCC monitors all privacy breaches closely and has established notifications and remedial measures to address each situation.

• Four (4) breaches involved client files that were lost, or went missing during shipment from a Case Processing Centre to one of the regional offices.
• Two (2) breaches involved inadvertent disclosures of information to the wrong individual.

In all cases, the program areas sent apology letters to the affected individuals. The ATIP Division provided advice and guidance to departmental staff on containment and mitigation strategies to improve the protection of personal information. In addition, senior officials were notified of all material breaches to facilitate communication within the Department and raise awareness of issues that could hinder the public’s right to privacy.

The ATIP Division monitors all privacy breaches reported at IRCC. The Division also reviews how and where they are occurring within the Department. ATIP addresses trends and provides tailored privacy breach training sessions to raise awareness and increase privacy breach prevention.

Monitoring compliance

The ATIP Division has established internal procedures to help facilitate the timely and efficient processing and monitoring of ATIP requests. The Division prepares three weekly reports pertaining to ATIP requests for senior management, which are disseminated at the Assistant Deputy Minister, Deputy Minister and Ministerial levels. There is a ‘snapshot’ report that contains various statistics, including the number of requests received and processed, as well as the current compliance rate under both Acts. There is also a summary report of upcoming requests soon to be disclosed under the Access to Information Act and a compliance report for Assistant Deputy Ministers in relation to their sector’s ability to provide requested documents to ATIP in a timely manner. Finally, there is a weekly summary report of late files to be processed in priority. It is important to note that no personal information is disclosed to senior management in these reports.

In addition, senior management is provided with a status update on material breaches twice per year.

Policies, guidelines, procedures and initiatives

Access to Information Act and the Privacy Act

IRCC undertook several projects related to the improvement of its ATIP requests processes which affect the administration of requests under the Access to Information Act and Privacy Act:

• A task force was created to evaluate the IRCC ATIP request process, identify challenges and make recommendations to improve the process. The task force completed its evaluation in 2018-2019, and efforts will be taken in 2019-2020 to address the recommendations.
• Some ATIP Division employees were cross-trained on various functions and temporarily reassigned to a special project focused on substantially reducing the older ATIP request backlog.
• A new complaints team was created to better manage a growing volume of incoming complaints.
• A new unit was created to lead transformation efforts in the ATIP Division and conduct more comprehensive statistical analysis and trend monitoring.
• A new backlog team was created to focus on reducing backlog and establish a strategy on an ongoing basis.
• Ongoing collaboration with key IRCC stakeholders to assess and potentially mitigate the impacts of changes to IRCC programs on ATIP request volumes.
• Further to the LEAN review completed in 2017-2018, a new ATIP request retrieval process has been successfully implemented in one sector and reduced turnaround time for providing records responsive to an ATIP request. It will gradually be rolled out to the rest of the Department in 2019-2020. The new process includes new templates, instructions and communications material.
• Implementation of a new procedure to better monitor validation efforts and assess training needs for employees processing ATIP requests.
• Presentation at the ETHI committee on Bill C-58 concerning proposed reforms of the Access to Information Act.
• A new macro was developed to improve the triage process for information that is responsive to ATIP requests.
• Participated in ATIP community discussions concerning Bill C-58, Privacy Act reform, the European Union General Data Protection Regulations, and ATIP software needs.
• Engaged internal stakeholders on implementing Bill C-58 open government requirements.
• IRCC worked with the Canada Revenue Agency, Employment and Social Development Canada, and Transport Canada to assess the feasibility of creating an ATIP Community Office that would support the broader ATIP community through information sharing, recruitment initiatives, and professional development. IRCC will continue to support and engage on this initiative, as it will provide opportunities for greater collaboration and the development of the community.

Privacy Act only

IRCC undertook several projects related to the improvement of the management of personal information at IRCC in accordance with the Privacy Act:

• Implemented a new briefing document that summarizes PIAs to facilitate approval by senior management.
• Substantial changes were made to the process for capturing privacy breach data in its case management system to improve the process and quality of reports related to privacy breaches.

Training and awareness

Through its training delivery and awareness activities, IRCC continues to work towards developing an institution-wide culture of respect for access to information alongside a strong commitment to increased privacy vigilance.

During the reporting period, 3,251 employees participated in ATIP Division training sessions, representing an 18 per cent increase from the previous fiscal year.

Access to information and privacy training

The ATIP Division offers three core training courses that address both access to information and privacy requirements:

1. Understanding and Managing ATIP Requests is designed to provide a greater understanding of the roles and responsibilities of the ATIP Division, the Liaison Officers and other departmental officials in the processing of an ATIP request. A total of 79 employees attended 9 sessions.
2. ATIP Training for Middle Managers and Executives provides an overview of key ATIP principles and practices, and a greater understanding of the roles and responsibilities of managers and employees. A total of 22 managers and executives attended 2 sessions.
3. Protecting and Giving Access to Information at IRCC is a mandatory online course for all employees. It provides a brief overview of key ATIP principles and practices and fosters a greater understanding of the roles and responsibilities of all employees. During the year, 1,250 employees took the online training session.

The ATIP Division also provides ad hoc and tailored training sessions and workshop presentations to reinforce and increase knowledge and understanding of access to information, privacy and personal information. These sessions are independent of mandatory courses and are given by request in response to a group’s specific needs. A total of 1,116 employees were provided tailored ATIP training over 98 sessions last fiscal year.

IRCC Comprehensive New User Training

IRCC also introduced mandatory in-person training for new employees that includes security, information management and ATIP considerations. A total of 98 employees attended 10 sessions.

Privacy-only training

Privacy breach training

Privacy breach training sessions are designed to provide a greater understanding of what a privacy breach is, the roles and responsibilities of employees and awareness of emerging trends in privacy breaches.

These sessions are focused not only on how to contain a breach, but also how to evaluate it, notify internal and external stakeholders, mitigate the impact and reduce the probability of a recurrence. They provide an opportunity for program areas to ask questions pertaining to real scenarios and receive practical advice from the ATIP staff.

A total of 402 employees received privacy breach training in 2018-2019 over 24 sessions.

Tailored privacy training

Tailored privacy training sessions are designed to provide a more in-depth look at specific privacy policy issues, such as information sharing or privacy impact assessments.

A total of 284 employees received tailored privacy training over 17 sessions.

IRCC Privacy Day

On December 3, 2018, IRCC celebrated its 3^rd Annual Privacy Day. This initiative is a large-scale, department-wide event created to bolster privacy awareness and to champion the protection of personal information at IRCC.

Privacy Day challenges employees to think differently about privacy and the implications it may have for the delivery of the Department’s programs and services. It underscores that privacy is a shared responsibility.

As Privacy Day is held each year, it provides a forum to spotlight key issues in privacy in an often complex and rapidly changing technological environment.

On Privacy Day, IRCC organized three seminars dealing with automated vehicles and ethics, the future of the public service and artificial intelligence, and the privacy challenges involved with technological change. The ATIP Division ran a kiosk to answer questions about the protection of privacy in daily work. The event was promoted on Today@IRCC, the Department’s internal electronic newsletter. Accepting ATIP’s invitation, various government institutions were in attendance at various seminars.

Data Privacy Day

On January 28, 2019, IRCC observed Data Privacy Day as part of its commitment to raise awareness about the importance of privacy and the protection of personal information. Data Privacy Day is an internationally recognized event. It is an excellent opportunity to empower and educate employees on how to manage and control their digital footprint as well as highlight the privacy risks associated with changes in technology. The ATIP Division, in collaboration with Information Management Services, Information Sharing and Information Technology Security, hosted a joint information kiosk to answer questions from employees and provide informative materials.

Annex A: Signed Delegation

Text version: Signed Delegation

Official Document

Department of Immigration, Refugees and Citizenship of Canada

Delegation of Authority

Access to Information Act and Privacy Act

I, Minister of Immigration, Refugees and Citizenship, pursuant to Section 73 of the Access to Information Act and of the Privacy Act, hereby authorize the officer and employee of Immigration, Refugees and Citizenship whose position or classification is set out in the attached Schedule to carry out those of my power, duties or functions under the Acts that are set in the Schedule in relation to that officer and employee.

Dated at Ottawa

This 20 day of June 2016

John McCallum, P.C., M.P.
Minister of Immigration, Refugees and Citizenship

Annex B: Delegation Order under the Access to Information Act

Official Document

Delegation of Authority under the Access to Information Act and the Access to Information Regulations

Legend

DM / DMA

Deputy Minister / Associate Deputy Minister

ADM-CS / DG-CA

ADM, Corporate Services / Director General, Corporate Affairs

ATIP / DIRECTOR

Director, Access to Information and Privacy (EX-01)

ATIP / ASSISTANT DIRECTORS

Assistant Director, ATIP Operations (OPS) (PM-06) / Assistant Director, Complex and Sensitive Issues (CSI) (PM-06)

ATIP / PM-05 OPS

Senior ATIP Administrators, ATIP Operations (OPS)

ATIP / PM-05 CSI

Senior ATIP Administrators, ATIP Complex and Sensitive Issues (CSI)

ATIP / PM-04 OPS

ATIP Administrators, ATIP Operations (OPS)

ATIP / PM-04 CSI

ATIP Administrators, ATIP Complex and Sensitive Issues (CSI)

ATIP / PM-03 OPS

ATIP Officers, ATIP Operations (OPS)

ATIP / PM–03 CSI

ATIP Officers, ATIP Complex and Sensitive Issues (CSI)

Annex C: Delegation Order under the Privacy Act

Official Document

Delegation of Authority under the Privacy Act and the Privacy Regulations

Legend

DM / DMA

Deputy Minister / Associate Deputy Minister

ADM-CS / DG-CA

ADM, Corporate Services / Director General, Corporate Affairs

ADM-SPP / DG-RE

Associate ADM, Strategic and Program Policy / Director General, Research and Evaluation

ATIP / DIRECTOR

Director, Access to Information and Privacy (EX-01)

ATIP / ASSISTANT DIRECTOR CSI

Assistant Director, Complex and Sensitive Issues, CSI (PM-06)

ATIP /ASSISTANT DIRECTOR OPS
ATIP / PM-05 OPS

Assistant Director, ATIP Operations, OPS (PM-06)
Senior ATIP Administrator, ATIP Operations (OPS

ATIP / PM-05 CSI

Senior ATIP Administrators, Complex and Sensitive Issues (CSI)

ATIP / PM-04 OPS

ATIP Administrators, ATIP Operations (OPS)

ATIP / PM-04 CSI

ATIP Administrators, Complex and Sensitive Issues (CSI)

ATIP / PM-03 OPS

ATIP Officers, ATIP Operations (OPS)

ATIP / PM-03 CSI

ATIP Officers, ATIP Complex and Sensitive Issues (CSI)

Annex D: Statistical Report on the Access to Information Act

Name of institution: Immigration, Refugees and Citizenship Canada

Reporting period: 2018-04-01 to 2019-03-31

Part 1: Requests Under the Access to Information Act

1.1 Number of requests

1.2 Sources of requests

1.3 Informal requests

Note: All requests previously recorded as “treated informally” will now be accounted for in this section only.

Part 2: Requests Closed During the Reporting Period

2.1 Disposition and completion time

2.2 Exemptions

2.3 Exclusions

2.4 Format of information released

2.5 Complexity

2.5.1 Relevant pages processed and disclosed

2.5.2 Relevant pages processed and disclosed by size of requests

2.5.3 Other complexities

2.6 Deemed refusals

2.6.1 Reasons for not meeting statutory deadline

2.6.2 Number of days past deadline

2.7 Requests for translation

Part 3: Extensions

3.1 Reasons for extensions and disposition of requests

3.2 Length of extensions

Part 4: Fees

Part 5: Consultations Received From Other Institutions and Organizations

5.1 Consultations received from other Government of Canada institutions and organizations

5.2 Recommendations and completion time for consultations received from other Government of Canada institutions

5.3 Recommendations and completion time for consultations received from other organizations

Part 6: Completion Time for Consultations on Cabinet Confidences

6.1 Requests with Legal Services

6.2 Requests with Privy Council Office

Part 7: Complaints and Investigations

Part 8: Court Action

Part 9: Resources Related to the Access to Information Act

9.1 Costs

9.2 Human Resources

Annex E: Statistical Report on the Privacy Act

Name of institution: Immigration, Refugees and Citizenship Canada

Reporting period: 2018-04-01 to 2019-03-31

Part 1: Requests Under the Privacy Act

Part 2: Requests Closed During the Reporting Period

2.1 Disposition and completion time

2.2 Exemptions

2.3 Exclusions

2.4 Format of information released

2.5 Complexity

2.5.1 Relevant pages processed and disclosed

2.5.2 Relevant pages processed and disclosed by size of requests

2.5.3 Other complexities

2.6 Deemed refusals

2.6.1 Reasons for not meeting statutory deadline

2.6.2 Number of days past deadline

2.7 Requests for translation

Part 3: Disclosures Under Subsections 8(2) and 8(5)

Part 4: Requests for Correction of Personal Information and Notations

Part 5: Extensions

5.1 Reasons for extensions and disposition of requests

5.2 Length of extensions

Part 6: Consultations Received From Other Institutions and Organizations

6.1 Consultations received from other Government of Canada institutions and other organizations

6.2 Recommendations and completion time for consultations received from other Government of Canada institutions

6.3 Recommendations and completion time for consultations received from other organizations

Part 7: Completion Time of Consultations on Cabinet confidences

7.1 Requests with Legal Services

7.2 Requests with Privy Council Office

Part 8: Complaints and Investigations Notices Received

Part 9: Privacy Impact Assessments (PIAs)

Part 10: Resources Related to the Privacy Act

10.1 Costs

10.2 Human Resources

Annex F: New Exemptions Table for 2018-2019

Access to Information Act

Privacy Act