2023-2024 Annual Report on the Privacy Act

PDF version: Privacy Act, Annual Report 2023-2024 (PDF, 848 KB)

Table of Contents

• Introduction
• I. Overview of IRCC’s ATIP Program
  • Organizational structure
  • Delegation order
• II. Performance
  • Compliance rate and completion times
  • Active requests from previous reporting periods
  • Active complaints from previous reporting periods
  • Reasons for extensions
  • Consultations received from other government departments and institutions
  • Disposition of completed requests
• III. Initiatives to promote awareness, training and policies in relation to the Privacy Act
  • Training and awareness
  • Policies, guidelines, procedures, and initiatives
  • Initiatives and projects to improve privacy
  • Summary of key issues and actions taken on complaints
  • Material privacy breaches
  • Privacy Impact Assessments (PIAs)
  • Summary of PIAs completed in 2023-2024
  • Public interest disclosures
  • Monitoring compliance
  • Privacy protections in contracts, agreements and arrangements
• Moving forward
• Annex A: Copy of the signed delegation order in effect March 31, 2024
• Annex B: Copy of the delegation of authority under the Privacy Act and the Privacy Regulations in effect March 31, 2024
• Annex C: Statistical Report on the Administration of the Privacy Act
• Annex D: Supplemental Statistical Report on the Access to Information Act and the Privacy Act

---

Introduction

Immigration, Refugees and Citizenship Canada (IRCC) is pleased to present to Parliament its annual report on the administration of the Privacy Act (PA).

The purpose of the PA is to protect the personal information of individuals under the responsibility and control of federal institutions, and to provide individuals with a right of access to that information.

This report is tabled in Parliament in accordance with section 72 of the PA. It outlines how IRCC administered its obligations under the PA during the reporting period beginning on April 1, 2023, and ending on March 31, 2024. IRCC does not have any non-operational (“paper”) subsidiaries during this reporting period.

IRCC was created to facilitate the entry of temporary residents, manage the selection, settlement integration of newcomers, grant citizenship and issue passports to eligible citizens. IRCC’s mandate comes from the Department of Citizenship and Immigration Act. The Minister of IRCC is responsible for the Citizenship Act of 1977 and shares responsibility with the Minister of Public Safety for the Immigration and Refugee Protection Act (IRPA). Effective July 2, 2013, the primary responsibility for Passport Canada and the administration of the Canadian Passport Order and the Order Respecting the Issuance of Diplomatic and Special Passports moved from the Department of Foreign Affairs and International Trade to IRCC.

This report comprises of three sections:

1. Overview of IRCC’s Access to Information and Privacy (ATIP) program, including organizational structure and delegation order
2. Outline of IRCC’s overall performance on the administration of the PA
3. Description of IRCC’s initiatives to promote training and awareness, improve its policies related to privacy, and to ensure monitoring and compliance of its obligations under the PA.

I. Overview of IRCC’s ATIP program

The IRCC ATIP program continues to be one of the most solicited ATIP programs in the Government of Canada. During the reporting period, IRCC received 252,627 ATIP requests including 69,720 requests under the PA. Most requests received under the PA pertain to clients’ immigration applications.

This reporting year, the IRCC ATIP program implemented new strategies to address the large volume of incoming requests that resulted in marked increases in compliance. Considerable progress was achieved in processing and responding to requests within the legislated timelines and resolving old and new complaints filed by or on behalf of requesters. In parallel, the ATIP program continued to advance previous initiatives aimed at improving client experience and using technological improvements to enhance service delivery and increase processing efficiencies.

This year also marked IRCC’s adoption of a new organizational structure that seeks to replace the previous functional framework with a dynamic and client-focused integrated business approach. As part of this notable change, new sectors and branches were created, and some existing programs and areas of responsibilities were moved under different lines of business. During the implementation phase, the ATIP program closely monitored its tasking sheets to ensure that all information pertaining to ATIP liaison officers and coordinators was updated and all appropriate changes were accurately reflected in the ATIP case management software. Throughout the process, the IRCC ATIP program maintained contact with the Offices of Primary Interest (OPIs), upheld mandatory training for ATIP liaison officers, and continued to fulfill ongoing requests with minimal disruption.

Organizational structure

The ATIP program is structured around its main lines of business. As shown in Figure 1, the program is administered by three divisions: the ATIP Operations Division, the Innovation and Support Division and the Privacy Program Management Division. The Director of the ATIP Operations Division also holds the title of ATIP Coordinator.

The three divisions report directly to the Director General Access and Privacy Management branch (APMB) and Chief Privacy Officer within the Corporate Services and Chief Human Resources Officer Sector.

Text version: Structure of the ATIP Program

Access and Privacy Management Branch

ATIP Operations Division

• 147 employees

Responsibilities

• ATIP requests for client records
• ATIP requests for corporate records
• Informal access to information requests
• Complaints from the Information Commissioner and Privacy Commissioner
• Disclosures under 8(2)(d, e, f) of the Privacy Act
• Robotic process automation
• ATI Corporate Reporting

Innovation and Support Division

• 10 employees

Responsibilities

• ATIP processing efficiencies and technologies
• Departmental ATIP Training

Privacy Program Management Division

• 24 employees

Responsibilities

• Privacy policy, advice and guidance
• Privacy awareness
• Management of privacy breaches and complaints
• Disclosures under 8(2)(m) of the Privacy Act
• Privacy corporate reporting

Proactive Disclosure Unit, Corporate Secretariat, DM Office

• 2 employees

Responsibilities

• Proactive publication of ministerial briefing products pursuant to ATIA, Part II, s. 74 and 88

At the end of the reporting period, the ATIP program comprised of 181 full-time employees. In addition to the employees who are responsible for applying the ATIP legislation, there are 268 ATIP liaison officers throughout the Department who support the ATIP program by gathering records and providing recommendations. While these officers are essential to the administration of the program, they are funded by other program areas.

Privacy at IRCC

The Privacy Program Management Division (PPMD) is responsible for communicating the roles and responsibilities of all employees with respect to the administration of the PA, for helping to ensure compliance with Treasury Board Secretariat privacy policies and directives, and for managing the lifecycle of privacy breaches. At the end of this reporting period, the division is comprised of three teams:

1. The Privacy Policy and Planning Unit develops, implements, and maintains privacy policies, guidance, and tools to assist employees in managing personal information. This unit develops privacy training, coordinates departmental responses to public consultations, reviews departmental policy papers and provides program areas with high-level privacy advice.
2. The Privacy Guidance and Assessments Unit manages the privacy impact assessment process by reviewing departmental privacy impact assessments, assessing privacy risks, and recommending mitigation strategies. This unit also provides senior management with privacy advice, guidance, and recommendations on privacy issues. In addition, they manage all public interest disclosures for the department.
3. The Incident Management Unit manages the life cycle of all privacy breaches. They assess the risk of harm to the affected individual(s) and to the department as a result of a privacy breach. This unit also provides guidance and direction to program areas on containment, notification, and prevention of breaches. Furthermore, they report material breaches to the Office of the Privacy Commissioner (OPC) and Treasury Board Secretariat and respond to official complaints submitted by the OPC.

The Director General of the Access and Privacy Management Branch fulfills the role of Chief Privacy Officer (CPO). The CPO provides executive-level strategic leadership and direction on privacy at IRCC, including the provision of policy and/or operational advice and recommendations to senior management on complex privacy issues, the promotion of privacy awareness throughout the Department, and reporting to senior management on the state of privacy.

While PPMD is responsible for overseeing the privacy guidance program at IRCC, the ATIP Operations Division is responsible for processing requests for personal information, as well as disclosures under paragraphs 8(2)(d), (e) and (f) of the PA.

During the reporting period, IRCC had no service agreements under section 73.1 of the PA.

Delegation order

The Minister of IRCC is responsible for administering requests made to the Department under the ATIA and the PA. In accordance with section 95(1) of the ATIA and section 73 of the PA, the Minister delegates authority to departmental senior management, including the ATIP Coordinator to carry out the Minister’s powers, duties, or functions under the Acts in relation to ATIP requests.

For more information, refer to Annex A: Copy of the signed delegation order in effect March 31 2024, and Annex B: Copy of the Delegation of Authority under the Privacy Act and the Privacy Regulations in effect March 31, 2024.

II. Performance

This reporting year, IRCC received 69,720 requests under the PA, which represents a substantial increase of 188% from the previous year where 24,164 request were received. The Department could be experiencing the first effects of the Privacy Act Extension Order, No. 3, which came into force on July 13, 2022, as public awareness of the Order increases. The Order extends the right of access to personal information under subsection 12(1) of the PA to all individuals outside Canada. This enables foreign nationals, the majority of IRCC’s clients, to request personal information themselves instead of requiring a Canadian representative to make the request on their behalf.

The IRCC ATIP program completed 67,168 requests and processed 1,466,740 pages under the PA during the reporting period.

Compliance rate and completion times

In response to increasing demands for its services, the IRCC ATIP program realigned its structure and implemented new strategies for processing requests. In addition, the program continued to leverage technological improvements, as well as train and retain human resources in a highly competitive environment. This approach resulted in marked increases in compliance.

The compliance rate (percentage of all requests responded to within legislated timelines) for PA requests was 82%. This rate represents a significant increase from the 20.14% obtained in 2022-2023. As illustrated in Table 1, over 75% of IRCC’s PA requests were processed and completed within 30 days.

Active requests from previous reporting periods

As shown in Table 2, IRCC had 16,520 open requests from previous reporting periods. This table also illustrates the impact of the coming into force of the Privacy Act Extension Order, with 11,471 outstanding requests having been received in the last two years (78%).

Active complaints from previous reporting periods

Although the number of requests under the PA significantly increased, the number of active complaints from previous reporting periods remained stable. As Table 3 demonstrates, at the end of the reporting period, IRCC carried 47 active PA complaints.

Reasons for extensions

Section 15 of the PA permits the statutory time limits to be extended if consultations are necessary, translation is required, or the request involves a large volume of records that cannot be processed within the original time limit without unreasonably interfering with the operations of the Department.

When necessary, IRCC conducts internal consultations to ensure the proper exercise of discretion, particularly for (but not limited to) requests that may involve litigation, investigations, or security concerns. The details of extensions claimed by IRCC in accordance with section 15 are as follows:

• 15(a)(i) for interference with government operations: 194 times
• 15(a)(ii) to undertake internal consultations: 3,413 times

Consultations received from other government departments and institutions

Other government departments (OGDs) and organizations consulted IRCC 53 times under the PA. Table 4 provides the number of days IRCC took to complete OGD consultations. Overall, the IRCC ATIP program responded to 45 consultation requests (84.9%) within 30 days.

Disposition of completed requests

As shown in Table 5, IRCC released records in their entirety for 34% of all completed personal information requests. The Department claimed one or more exemptions on 55% of completed requests. The remaining requests were abandoned, had no existing records, or the existence of records could neither be confirmed nor denied as doing so could reveal information that is protected under the PA.

The following exemptions were most frequently used by IRCC:

• Section 26 – Personal Information (invoked 25,117 times)
• Section 21 – International relations (invoked 15,243 times)
• Section 22(1)(b) – Law enforcement criminal investigations (invoked 8,571 times)

III. Initiatives to promote awareness, training and policies in relation to the Privacy Act

IRCC continues to prioritize learning as a valuable tool for retaining and renewing its workforce and ensuring that the organization can fulfill its mandate while adapting to change. The specialized Training Project and ATIP Support Team within the Access and Privacy Management Branch (APMB) fosters a culture of continuous learning by offering a wide variety of training opportunities to both ATIP and non-ATIP officials.

Training and awareness

The ATIP training and awareness curriculum covers various aspects of the access to information and privacy regimes with an emphasis on security and best practices for handling sensitive information. Specific courses and modules focus on responsibilities for safeguarding and managing information, as well as collecting and using personal information.

ATIP course catalogue and sessions given

As shown in Table 6, the ATIP program delivered 133 training sessions to 4,705 employees (including 4,615 non-ATIP employees) via a combination of formal and informal, self-directed and instructor-led sessions. There was an increase in demand for customized trainings tailored for specific units, divisions and areas of responsibility this reporting year.

In addition, PPMD regularly publishes articles on its IRCC internal webpage to keep all employees informed of the Department of the Treasury Board Secretariat’s Privacy Implementation Notices, as well as privacy activities for Data Privacy Day.

This year, PPMD also worked jointly with IRCC’s Learning Academy, a Team responsible for course coordination and registration, data entry and training record keeping, to create a self-paced online training module that will ensure that current and new employees comply with Appendix B of the Directive on Personal Information Requests and Correction of Personal Information.

Security and privacy awareness

The IRCC Protect, Secure, and Manage Information (CC4416) course is comprised of three modules from IT Security, Information Management and ATIP that intertwine and complement each other. This training was dispensed jointly by the ATIP program and Information Management and Security experts at IRCC. It highlights various aspects of the risk and responsibilities in managing information of business value, as well as client and government information.

Additionally, all ATIP staff requiring access to classified information while performing their duties were mandated to complete the Government of Canada Secret Infrastructure course (CC4417) developed by the IT Operations Branch prior to being granted access to the secure network. The Training Projects and ATIP Support Team coordinated and facilitated the successful delivery of this training to ATIP employees.

Policies, guidelines, procedures, and initiatives

During the reporting period, PPMD developed new procedures and created new tools to assist the Department in its efforts to protect personal information, promote privacy awareness and support the privacy policy.

Privacy Work Plan

In the Fall 2023, PPMD conducted an annual department-wide consultative exercise with all IRCC director generals to update its inventory of planned activities that may require review. This consultation led to the creation of a privacy work plan that includes all upcoming departmental initiatives involving personal information for the next three years.

The goal of the privacy work plan is to organize upcoming initiatives based on several criteria: Digital Platform Modernization onboarding, implementation date, and funding, in order to group multiple privacy impact assessments (PIAs) into program-level PIAs. The work plan aims to prioritize these initiatives in a way that facilitates and monitors the departmental need for privacy assessments. The plan allows PPMD to improve the level of support provided to program areas by planning and coordinating resources to maintain the delivery of services while fulfilling the requirements of the privacy assessment process.

Risk Register

PPMD created a risk register of privacy risks and corresponding mitigation strategies that are identified through privacy impact assessments. This risk register will enable the division to monitor compliance and promote program accountability. Once established, its contents will be used for follow-up discussions with program decision-makers on the implementation of identified strategies, residual risks and changes to the operating environment.

Dedicated mailbox

To assist IRCC employees and encourage knowledge acquisition, PPMD created a general mailbox specifically dedicated for employee enquiries. This new inbox is meant to provide a channel to request and obtain assistance from the division. Specifically, it is meant to provide guidance to program areas and facilitate the interpretation of IRCC’s privacy policies, Treasury Board Secretariat’s Privacy Policy Suite, and interpretations of the PA. It provides a direct contact to the division and allows for more timely and effective responses to privacy needs across the Department.

Annual Review of the IRCC Privacy Policy Suite

The Privacy Policy Suite is a collection of mandatory policy instruments based on the Treasury Board Secretariat’s (TBS) privacy policy suite. The IRCC policy suite includes a Privacy Framework and Privacy Policy alongside various tools, guidelines, procedures and checklists.

This reporting year, PPMD developed standard operating procedures for the annual review of the IRCC Privacy Policy Suite. The first official annual review is scheduled for fiscal year 2024-2025.

Initiatives and projects to improve privacy

In addition to the privacy policy, guidelines and tools described above, IRCC is furthering its initiatives to modernize the delivery of services within the ATIP program, including the expansion of Robotic Process Automation (RPA), migration to the mandated ATIP Online Request Service (i.e., Treasury Board Secretariat’s online platform for the public to file ATIP requests with the Government of Canada) and replacement of the ATIP case management software.

Robotic Process Automation (RPA)

The RPA performs low-complexity/high-volume tasks such as data entry, file and folder operations, and other non-decision-making processes, allowing IRCC to reallocate resources to focus on decision-based work, while also improving data integrity, timeliness, and endto- end business processes with minimal disruption in the operations processing.

TBS ATIP Online Request Service (ATIP Online)

The Treasury Board Secretariat’s ATIP Online Request Service (ATIP Online) was launched in 2018 to streamline the procedure of submitting ATIP requests to, and obtaining responses from, the federal government. Onboarding to ATIP Online significantly enhances efficiency and accessibility in handling ATIP requests within the federal government.

This reporting year, IRCC ATIP has worked collaboratively with TBS Office of the Chief Information Officer to begin transitioning ATIP requests for corporate records to ATIP Online by April 2, 2024.

To ensure operational efficiency, efforts are underway to reduce ATIP request volumes prior to completing the onboarding of requests for client records to the TBS platform. Until the migration is complete, requesters will continue to submit ATIP requests to IRCC via the IRCC ATIP online request portal.

Replacement of the ATIP case management software

IRCC is diligently advancing the replacement of its current ATIP case management software. Following a thorough assessment of the ATIP Division’s unique business needs and requirements, the Department has opted for the adoption of a TBS-approved modern platform with several upgrades and features.

The new software will interface directly with ATIP Online and it features advanced functionalities that will significantly increase efficiency by reducing the time necessary to complete the review and release of records. Along with improvements in request processing, the new software supports built-in artificial intelligence that can be trained to automate repetitive tasks and has modern business analytics capabilities to enable IRCC to create various reports more effectively. These improvements will mean faster, real-time decisions in response to emerging ATIP trends, faster workflow adjustment, and the development of more in-depth performance management tools.

IRCC ATIP is also collaborating strategically with Shared Services Canada’s Digital Enablement Group to ensure the seamless deployment of the software within a cloud-based environment. This collaboration is part of the Government of Canada’s Application Platform as a Service initiative that aims to deliver common Government of Canada applications using a “Cloud Smart” approach. The Department aims to procure, test, and deploy the new software by late fall 2025.

Summary of key issues and actions taken on complaints

This reporting year, the IRCC ATIP program took concrete measures aimed at ensuring a better synergy between the request processing and complaint processing teams, which improved tracking and client service.

To ensure a more streamlined and consistent approach, the complaint process for client records and corporate records was merged to improve efficiency within the ATIP program. The new Complaints Team performed a comparative analysis and reconciliation of complaint files opened in IRCC’s systems with complaints registered and deemed active by the Office of the Information Commissioner (OIC). Thereafter, working collaboratively with the OIC, the Complaints Team put in place a Complaints Triage and Early Resolution process where each complaint, regardless of the age of the file, was reviewed and all cases identified as having the potential to be resolved in a reasonably short period of time were processed. Delay complaints represent the vast majority of complaints IRCC receives.

In addition, the ATIP case management software was updated to better track complaint correspondence, file status, follow-ups and discussions held with Offices of Primary Interests and external stakeholders.

The IRCC ATIP program also allocated resources to create a dedicated Client Service Team in an effort to keep the lines of communication with requesters open, identify issues or needs that could be proactively addressed, and possibly limit future ATIP complaints being lodged against IRCC. Although the team does not yet have an official service standard in place, the vast majority of inquiries were responded to within 48 hours, and the ATIP phone line voice messages were retrieved on a daily basis.

Despite an increase of 188% in new requests under the PA, IRCC received 106 notices of new complaints this reporting year of which 60 were related to processing delays. By comparison, IRCC received 289 complaints in the previous period. At the end of the reporting period, 47 complaints remained outstanding: 22 complaints from 2023-2024, 24 from 2022-2023, and 1 from 2021-2022 or earlier.

Together, all the measures and initiatives described above contributed to the reduction in the number of complaints in inventory.

Material privacy breaches

The Policy on Privacy Protection defines a privacy breach as “the improper or unauthorized collection, use, disclosure, retention or disposition of personal information.” A material privacy breach is a privacy breach that could reasonably be expected to create a real risk of significant harm to an individual. Significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record and damage to or loss of property.

In 2023-2024, IRCC notified the Office of the Privacy Commissioner and the Treasury Board Secretariat of seven material privacy breaches. Of the seven material privacy breaches, the majority of the incidents had a minor impact and affected a limited number of individuals.

PPMD monitors all privacy breaches closely and has established notifications and remedial measures to address each situation. The Division also:

• reviews how and where breaches are occurring within the Department
• addresses trends and provides tailored privacy breach training sessions to raise awareness and increase privacy breach prevention
• conducts preliminary risk assessments on all privacy breaches to determine risk and materiality level
• provides advice and guidance to departmental staff on containment and mitigation strategies to improve the protection of personal information.

A summary of the seven material breaches can be found below. Senior officials were notified of all material breaches to facilitate communication within the Department, raise awareness of issues and to bolster departmental response to serious privacy breaches.

• Four material breaches involved personal information that had gone missing or lost. Despite extensive searches, the information could not be located. The affected individuals were notified.
• Two material breaches involved a location being improperly accessed, and personal information of some IRCC clients was disclosed. The affected individuals were notified.
• One material breach involved IRCC working closely with TBS on a multi-institutional incident which involved relocation services. The affected individuals were notified.

Privacy Impact Assessments (PIAs)

To fulfil its mandate and effectively deliver its programs and services, IRCC collects, uses and discloses personal information. In accordance with the Directive on Privacy Impact Assessment, the Department undertakes PIAs to ensure compliance with the PA and to identify privacy risks present in new or existing departmental programs, initiatives or projects that involve personal information.

Summary of PIAs completed 2023-2024

Descriptions of PIAs completed during the 2023-2024 fiscal year are found below and full summaries can be found here: Privacy Impact Assessment Summaries.

Rural Northern Immigration Pilot (RNIP)

This privacy impact assessment assesses the Rural Northern Immigration Pilot (RNIP), established in 2019 to offer a pathway to permanent residency for skilled foreign workers who wish to live and work in one of 11 Canadian communities. Foreign nationals must obtain a recommendation from an Economic Development Organization (EDO) within their chosen community to participate in the RNIP. The EDO may then provide a recommendation and information on the foreign nationals to IRCC, who remains the final decision-making authority on the application for permanent residency. Risks were identified and mitigation recommendations were provided.

Council of Newcomers

This privacy impact assessment assesses the Council of Newcomers that will bring together recent immigrants to share their views, ideas and lived experiences related to Canada’s immigration system directly with senior IRCC officials through both in-person and virtual meetings. Personal information may be collected both formally and informally through the application process, council activities and administrative processes, such as travel and accommodation. Risks were identified and mitigation recommendations were provided.

Canada – Ukraine Transitional Assistance Initiative (CUTAI)

This privacy impact assessment assesses the business processes of IRCC in their part to deliver the Canada-Ukraine Transitional Assistance Initiative (CUTAI). The CUTAI provided a one-time (non-taxable) payment for eligible Ukrainians and their family members arriving under the Canada-Ukraine Authorization for Emergency Travel (CUAET) measures to ensure their basic needs were met upon arrival in Canada. Minimal personal information from CUTAI applications submitted to Service Canada were matched against IRCC’s CUAET data to confirm eligibility for the financial assistance. Risks were identified and mitigation recommendations were provided.

Temporary Asylum Accommodations for COVID-19 Quarantine

This privacy impact assessment assesses IRCC’s agreement to provide temporary accommodations to unvaccinated asymptomatic asylum claimants without a suitable quarantine plan in support of the Government of Canada’s coordinated response to the COVID-19 pandemic. Personal information of asylum claimants was collected to establish quarantine requirements and facilitate temporary accommodations. Risks were identified and mitigation recommendations were provided.

International Student Program – Letter of Acceptance (LOA) Verification Tool

This privacy impact assessment is an addendum to the 2014 PIA on the International Student Program (ISP). It focuses on the transition from case-by-case to systematic sharing of personal information with post-secondary Designated Learning Institutions (DLIs) via online channels. The information exchange is used in support of the administrative decision to accept applications for processing, or to not accept applications for processing if there is no confirmation from the DLI that the LOA is authentic. Risks were identified and mitigation recommendations were provided.

Public interest disclosures

Paragraph 8(2)(m) of the Privacy Act provides that personal information may be disclosed for any purpose where, in the opinion of the head of an institution, (i) the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure, or (ii) disclosure would clearly benefit the individual to whom the information relates.

As shown in Table 7, IRCC authorized disclosure of personal information in 36 instances under paragraph 8(2)(m) of the Privacy Act during the reporting period.

Monitoring compliance

The ATIP program makes use of frequent and comprehensive reporting tools to monitor compliance and maintain accountability, as well as to identify process improvements.

Time taken to process requests for personal information

IRCC monitors the time taken to process personal information requests by retrieving statistics from the ATIP case management software on a daily, weekly, biweekly, and quarterly basis. These statistics provide information on ATIP request volumes received and processed, compliance rates, backlog volumes, and feed into various reports intended for various levels of officials: daily updates are shared with managers, weekly reports with directors and the APMB Director General & Chief Privacy Officer and biweekly reports with the Deputy Ministers. The ATIP program also produced a quarterly report shared with all Assistant Deputy Ministers this reporting year.

As shown in Table 8, the ATIP program created monthly reports on sectors’ compliance for providing responsive records to the ATIP Divisions, for privacy breaches and public disclosures pursuant to paragraph 8(2)(m) of the PA (none of these reports disclose personal information). Report Audience Frequency

Although the primary goal of the ATIP program’s statistical reporting is to monitor compliance, IRCC ATIP also relies on these statistics to monitor workflows, address current challenges, and identify trends in ATIP requests.

Inter-institutional consultations

Team leaders and managers within the ATIP program regularly monitor extensions taken, responses to internal tasking reports, and complaints that do, in turn, identify areas in need of improvement, including consultations, to ensure the proper exercise of discretion.

Frequently requested types of Information

The vast majority of IRCC’s ATIP requests are for client immigration records. IRCC is currently developing initiatives to improve clients’ access to their own information through means other than the ATIP program. See the Policies, guidelines, procedures and initiatives section above.

The following initiatives aim to anticipate stakeholder needs by providing access, via online platforms and tools, to information IRCC clients most often request through the ATIP system such as application status updates and officers’ notes. Providing direct access to useful and efficient platforms is expected to reduce ATIP volumes and workloads and decrease processing times:

Privacy protections in contracts, agreements, and arrangements

IRCC’s Departmental Directive on Information Sharing Applicable to the use of ISAs (Information Sharing Arrangements) requires summaries of ISAs to be made available to the public, as per section 4.2.26 and 4.2.27 of the Directive on Privacy Practice. ISA drafters are also required to consult the TBS Guidance on Preparing Information Sharing Arrangements Involving Personal Information and to refer to its accompanying templates which include sample provisions that ensure privacy protection information is reflected in the ISAs.

This reporting year, PPMD advised various partners within IRCC of TBS requirements for contracts, information sharing agreements and information sharing arrangements as published in the Directive on Privacy Practices. PPMD will be working on engagement with relevant program officials during the coming year to ensure our collective processes align and satisfy those requirements. The division also intends to assess if tools need to be developed to assist program officials to better facilitate compliance with ISA’s and contract requirements.

Moving forward

During the reporting period, the IRCC continued to provide more focused attention to its lines of business within the ATIP program through three dedicated divisions. This year, the focus was creating a work plan to help better identify and organize all initiatives that require PIAs, creating standard processes and tools to improve compliance and monitoring, and increasing the level of assistance in privacy matters provided to branches.

Moving forward, IRCC will continue improving services to provide clients with better access to their own immigration information through other means than the ATIP program and advance the migration to the TBS ATIP Online Request Service as well as the procurement of the ATIP case management software.

PPMD will conduct its first annual review of the IRCC Privacy Suite and will advance compliance monitoring activities with the use of the newly created risk register. The IRCC privacy division will also engage with IRCC officials to assess the need to develop new and effective tools to increase its guidance and branch services.

IRCC recognizes the right to access to one’s personal information to promote openness and transparency. The Department is committed to continuing its efforts to improve how it upholds its responsibilities under the PA.

Annex A: Copy of the signed delegation order in effect March 31, 2024

Annex B: Copy of the Delegation of Authority under the Privacy Act and the Privacy Regulations in effect March 31, 2024

Annex C: Statistical Report on the Administration of the Privacy Act

Annex D: Supplemental Statistical Report on the Access to Information Act and the Privacy Act

Annex A: Copy of the signed delegation order in effect March 31, 2024

Text version: Signed Delegation

Official Document

Department of Immigration, Refugees and Citizenship of Canada

Delegation of Authority

Access to Information Act and Privacy Act

I, Minister of Immigration, Refugees and Citizenship, pursuant to section 95 of the Access to Information Act and section 73 of the Privacy Act, hereby authorize the officer and employee of Immigration, Refugees and Citizenship whose position or classification is set out in the attached Schedule to carry out those of my power, duties or functions under the Acts that are set in the Schedule in relation to that officer and employee.

Dated at Ottawa

This 30 day of August 2019

Ahmed Hussen, P.C., M.P.
Minister of Immigration, Refugees and Citizenship

Annex B: Copy of the Delegation of Authority under the Privacy Act and the Privacy Regulations in effect March 31, 2024

Delegation of Authority under the Privacy Act and the Privacy Regulations

The delegation includes acting appointments and assignments to these positions made pursuant to the Public Service Employment Act and regulations.

Legend:

ATIP / PM-05 OPS

Senior ATIP Administrator, ATIP Operations (OPS)

ATIP / PM-05 CRCI

Senior ATIP Administrators, Corporate Records, Complaints and Informals (CRCI)

ATIP / PM-04 OPS

ATIP Administrators, ATIP Operations (OPS)

ATIP / PM-04 CRCI

ATIP Administrators, Corporate Records, Complaints and Informals (CRCI)

ATIP / PM-03 OPS

ATIP Officers, ATIP Operations (OPS)

ATIP / PM-03 CRCI

ATIP Officers, Corporate Records, Complaints and Informals (CRCI)

Annex C: Statistical Report on the Administration of the Privacy Act

Statistical Report on the Privacy Act

Name of institute: Immigration, Refugees and Citizenship Canada
Reporting period: 2023-04-01 to 2024-03-31

Section 1: Requests under the Privacy Act

1.1 Number of requests received

1.2 Channels of requests

Section 2: Informal requests

2.1 Number of informal requests

2.2 Channels of informal requests

2.3 Completion time of informal requests

2.4 Pages released informally

Section 3: Requests Closed During the Reporting Period

3.1 Disposition and completion time

3.2 Exemptions

3.3 Exclusions

3.4 Format of information released

3.5 Complexity

3.6 Closed requests

3.7 Deemed refusals

3.8 Requests for translation

Section 4: Disclosures under Subsections 8(2) and 8(5)

Section 5: Requests for Correction of Personal Information and Notations

Section 6: Extensions

6.1 Reasons for extensions

6.2 Length of extensions

Section 7: Consultations Received from Other Institutions and Organizations

7.1 Consultations received from other Government of Canada institutions and other organizations

7.2 Recommendations and completion time for consultations received from other Government of Canada institutions

7.3 Recommendations and completion time for consultations received from other organizations outside the Government of Canada

Section 8: Completion Time of Consultations on Cabinet Confidences

8.1 Requests with Legal Services

8.2 Requests with Privy Council Office

Section 9: Complaints and Investigations Notices Received

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

10.1 Privacy Impact Assessments

10.2 Institution-specific and Central Personal Information Banks

Section 11: Privacy Breaches

11.1 Material privacy breaches

11.2 Non-material privacy breaches

Section 12: Resources Related to the Privacy Act

12.1 Allocated costs

12.2 Human resources

Annex D: Supplemental Statistical Report on the Access to Information Act and the Privacy Act

Supplemental Statistical Report on the Access to Information Act and the Privacy Act

Name of institute: Immigration, Refugees and Citizenship Canada
Reporting period: 2023-04-01 to 2024-03-31

Section 1: Open Requests and Complaints under the Access to Information Act

1.1 Number of open requests that are outstanding from previous reporting periods

1.2 Number of open complaints with the Information Commissioner of Canada that are outstanding from previous reporting periods

Section 2: Open Requests and Complaints under the Privacy Act

2.1 Number of open requests that are outstanding from previous reporting periods

2.2 Number of open complaints with the Privacy Commissioner of Canada that are outstanding from previous reporting periods

Section 3: Social Insurance Number

Section 4: Universal Access under the Privacy Act