2024-2025 Annual Report on the Privacy Act

PDF version: Annual report on the Privacy Act, 2024-2025 (PDF, 659 KB)

Table of Contents

• Introduction
• I. Overview of IRCC’s ATIP Program
  • Organizational structure
  • Client Records Division
  • Corporate Records, Complaints and Informals Division
  • Privacy Program Management Division
  • Delegation order
• II. Performance
  • Compliance rate and completion times
  • Active requests from previous reporting periods
  • Reasons for extensions
  • Disposition of completed requests
  • Consultations received from other government departments and institutions
  • Summary of key issues and actions taken on complaints
  • Active complaints from previous reporting periods
• III. Training programs and awareness initiatives
  • Privacy course catalogue and sessions given
  • ATIP course catalogue and sessions given
• IV. Material privacy breaches
• V. Privacy Impact Assessments (PIAs)
  • IRCC Learning Management System
  • Administration and verification of Letters of Acceptance and provincial or territorial Attestation Letters
• VI. Public interest disclosures
• VII. Policies, guidelines, and procedures
  • Privacy Breach Reporting
  • Privacy Impact Assessment (PIA) Review Process
  • Annual review of the IRCC Privacy Policy Suite
  • Guidelines for Obtaining Consent
• VIII. Monitoring compliance
  • Time taken to process PA requests
  • Privacy protections in contracts, agreements and arrangements
  • Contracts
  • Information-sharing agreements and arrangements
• IX. Initiatives and projects to improve privacy
  • Privacy Risk Assessment (PRA)
  • IRCC’s new Online Account
  • Proactive release of Officer Decision Notes (ODN)
  • Client correspondence project
  • TBS ATIP Online Request Service (ATIP Online)
  • Technological assistance and upgrades
• Moving forward
• Annex A: Copy of the signed delegation order in effect March 31, 2025
• Annex B: Copy of the delegation of authority under the Privacy Act and the Privacy Regulations in effect March 31, 2025
• Annex C: Statistical Report on the Administration of the Privacy Act
• Annex D: Supplemental Statistical Report on the Access to Information Act and the Privacy Act

Introduction

Immigration, Refugees and Citizenship Canada (IRCC) is pleased to present to Parliament its annual report on the administration of the Privacy Act (PA).

The purpose of the PA is to safeguard individuals’ personal information held by federal institutions, and to provide them with the right to access that information. This report, submitted to Parliament in accordance with section 72 of the PA, outlines how IRCC fulfilled its responsibilities during the reporting period from April 1, 2024, to March 31, 2025.

IRCC was created to facilitate the entry of temporary residents, manage the selection, settlement integration of newcomers, grant citizenship and issue passports to eligible citizens. IRCC’s mandate is derived from the Department of Citizenship and Immigration Act. The Minister of IRCC is responsible for the Citizenship Act of 1977 and shares responsibility with the Minister of Public Safety for the Immigration and Refugee Protection Act. Effective July 2, 2013, the primary responsibility for Passport Canada and the administration of the Canadian Passport Order and the Order Respecting the Issuance of Diplomatic and Special Passports moved from the Department of Foreign Affairs and International Trade to IRCC.

IRCC does not have non-operational (“paper”) subsidiaries at the end of the reporting period.

I. Overview of IRCC’s ATIP program

During the 2024-2025 reporting period, the IRCC ATIP program received a total of 270,528 ATIP requests. This includes 101,541 requests submitted under the PA, representing a 45% increase compared to the previous reporting period. Despite the substantial growth in PA requests, the program continued to improve its processes by building upon and refining existing strategies, which contributed to an overall improvement in its compliance rate.

Organizational structure

The IRCC ATIP program is structured around its main lines of business. As shown in Figure 1 below, the program is administered by three divisions: the Client Records Division, the Corporate Records, Complaints and Informals Division, and the Privacy Program Management Division. The Director of the Corporate Records, Complaints, and Informals Division also holds the title of ATIP Coordinator.

These three divisions report directly to the Director General of the Access and Privacy Management Branch within the Corporate Services and Chief Human Resources Officer Sector. The Director General also fulfills the role of Chief Privacy Officer (CPO) and provides strategic leadership and guidance on privacy initiatives across IRCC. This includes advising senior management on complex privacy issues, promoting privacy awareness throughout the Department, and reporting to senior leadership on the overall privacy program and compliance status.

At the end of the reporting period, the IRCC ATIP program had a total of 170 full-time employees.

Text version: Structure of the ATIP Program

• Corporate Services and Chief Human Resources Officer Sector

  • Access and Privacy Management Branch

    • Client Records Division
    • Corporate Records, Complaints and Informals Division
      • Innovation and Support Unit
    • Privacy Program Management Division
      • Privacy Policy and Planning Unit
      • Privacy Guidance and Assessments Unit
      • Incident Management Unit

Client Records Division

The Client Records Division consists of 96 employees responsible for managing all requests for client immigration records at IRCC. This includes overseeing the entire process from initial receipt to the issuance of final responses. Additionally, the division manages disclosures under paragraphs 8(2)(d), (e), and (f) of the PA. The majority of access to information and privacy requests received by IRCC relate to client records and are processed within this division.

Corporate Records, Complaints and Informals Division

The Corporate Records, Complaints, and Informals Division is responsible for processing requests for departmental records. Supported by a team of 40 employees, the division also handles informal requests for information and oversees ATIP corporate reporting within IRCC. Additionally, it manages complaints submitted to the Offices of the Information Commissioner and the Privacy Commissioner, with the objective of ensuring timely and effective resolution of the issues raised.

• The Innovation and Support Unit within the Corporate Records, Complaints and informals Division comprises 7 employees. The unit develops departmental training programs and conducts training sessions for both ATIP and non-ATIP employees. It ensures that training materials are regularly reviewed and updated to meet the needs of different audiences and leadership levels within IRCC. Additionally, the division supports the Department’s operational efficiency initiatives by providing ATIP-related insights on proposed new or revised internal procedures and processes.

Privacy Program Management Division

The Privacy Program Management Division (PPMD) has a total of 27 employees and is tasked with overseeing all facets of IRCC’s privacy program. This includes developing privacy policies, tools, and guidance documents, as well as providing expertise and insights on privacy-related issues. The division conducts privacy assessments, offers support, manages and reports on privacy breaches, and handles disclosures under paragraph 8(2)(m) of the PA. Furthermore, it is responsible for governance planning and reporting related to the privacy program.

The Division consists of three distinct teams:

• The Privacy Policy and Planning Unit develops, implements and maintains privacy policies, guidance and tools to assist employees in managing personal information. The unit develops privacy training, coordinates departmental responses to public consultations, reviews departmental policy papers and provides program officials with high-level privacy policy advice.
• The Privacy Guidance and Assessments Unit manages the privacy impact assessment (PIA) process by reviewing departmental PIAs, assessing privacy risks and recommending mitigation strategies. The unit also provides senior management with privacy advice, guidance and recommendations on identified privacy issues, and it routes and manages all proposed public interest disclosures for decision within the Department.
• The Incident Management Unit manages the life cycle of all privacy breaches. The unit assess the risk of harm to affected individuals and to the Department as a result of a privacy breach and provides guidance and direction to program areas on containment, notification and prevention of breaches. Additionally, they report material breaches to the Office of the Privacy Commissioner (OPC) and the Treasury Board of Canada Secretariat (TBS), and respond to official complaints submitted by the OPC as a result of privacy incidents.

In addition to these designated employees responsible for implementing ATIP legislation, approximately 550 ATIP liaison officers across the Department support the program’s operations by coordinating record collection, reviewing materials, and offering branch-specific recommendations. While these officers are integral to the program’s operations, their funding is managed through their respective program areas.

During the reporting period, IRCC had no service agreements under section 73.1 of the PA.

Delegation order

The Minister of IRCC is responsible for administering requests made to the Department under the Access to Information Act (ATIA) and the PA. In accordance with section 95(1) of the ATIA and section 73 of the PA, the Minister delegates authority to departmental senior management, including the ATIP Coordinator to carry out the Minister’s powers, duties, or functions under the Acts.

For more information, refer to “Annex A: Copy of the signed delegation order in effect  March 31, 2025”, and “Annex B: Copy of the Delegation of Authority under the Access  to Information Act and Regulations in effect March 31, 2025”.

II. Performance

During this reporting year, IRCC received 101,541 requests under the PA, an increase from 69,720 requests in the previous year. This significant rise reflects an ongoing upward trend in the number of individuals seeking access to their immigration records under the PA. This trend correlates with the coming into force of the Privacy Act Extension Order, No. 3, in 2022, which expanded the right of access to personal information under the PA to individuals outside of Canada.

To maintain consistent service standards and fulfill program commitments, the IRCC ATIP program adjusted its processes to review 2.1 million pages of documents under the PA. These efforts resulted in the successful processing of 98,367 requests, representing a 45% increase compared to the previous period, in line with the higher volume of new PA requests received.

Compliance rate and completion times

The compliance rate for PA requests, measured as the proportion of requests responded to within the legislated timeframes, was 87%. This indicates an improvement from the previous reporting period’s rate of 82%. As illustrated in Table 1, more than 75% of IRCC’s PA requests were processed and completed within 30 days.

Active requests from previous reporting periods

At the end of the reporting period, IRCC was managing a total of 19,698 open requests carried over from prior periods. Of these, 18,154 requests (92%) were received during the last two reporting periods. This further highlights the impact of the Extension Order on the number of PA requests received in recent years.

Reasons for extensions

Section 15 of the PA allows for the extension of statutory time limits when consultations are required, or the request involves a substantial volume of records that cannot be processed within the original timeframe without reasonably interfering with the operations of the Department.

When necessary, IRCC carries out internal consultations to ensure the proper exercise of discretion, particularly for, but not limited to, requests that may involve litigation, investigations, or security concerns. IRCC claimed the following extensions in accordance with section 15:

• 15(a)(i) for interference with government operations: 2 times
• 15(a)(ii) to undertake internal consultations: 142 times

Disposition of completed requests

As Table 3 shows, IRCC released records in their entirety for 37% of all completed requests and applied one or more exemptions to 54% of the completed requests. The remaining requests were abandoned, had no existing records, or the existence of records could neither be confirmed nor denied as doing so could reveal information that is protected under the PA.

The following exemptions were most frequently used by IRCC:

• Section 26 – Personal Information, invoked 36,300 times
• Section 21 – International relations, invoked 18,253 times
• Section 22(1)(b) – Law enforcement criminal investigations, invoked 12,386 times

Consultations received from other government departments and institutions

Other government departments and institutions consulted IRCC 37 times under the PA. Of these, 35 consultations were completed during the reporting period. The number of days IRCC took to complete these consultations is detailed in Table 4 below; overall, the IRCC ATIP program responded to 32 consultation requests (91%) within 30 days.

Summary of key issues and actions taken on complaints

IRCC received a total of 132 notices of new complaints during the 2024-2025 reporting period. Compared to the number of new PA requests received, the volume of complaints represents approximately 0.13%. The majority of these complaints (80%) pertain to processing delays.

The IRCC ATIP program completed the processing of 99 complaints. 93 cases were recorded as discontinued, abandoned, or resolved. 2 complaints related to processing delays were well-founded, and the IRCC ATIP program addressed these concerns by finalizing the processing and providing responses to the requesters.

Active complaints from previous reporting periods

The number of active complaints from prior reporting periods remained stable. At the end of the current reporting period, IRCC was managing 55 active PA complaints compared to 47 outstanding PA complaints at the conclusion of the previous reporting period.

III. Training programs and awareness initiatives

IRCC is dedicated to promoting continuous learning and professional development among its employees. Through comprehensive training programs and awareness initiatives, the Department aims to cultivate an organizational culture that prioritizes and demonstrates a strong commitment to privacy protection.

Privacy course catalogue and sessions given

PPMD’s training curriculum is currently under review as the Division continues to solidify its role within the Department. As a result, some training courses were not offered this reporting year. The updated curriculum will feature enhanced content with a stronger focus on proactive privacy management, the principles of privacy by design, fundamental privacy principles for safeguarding personal information, and the roles and responsibilities related to the handling of personal information.

The Privacy Breaches at IRCC (CC4540) e-module was included in the training sessions delivered during this reporting year and will remain available throughout the transition period. Additionally, all employees responsible for completing PIAs were required to complete a new Privacy Impact Assessment (PIA) training course prior to initiating any drafting activities. Currently in its pilot phase, this training provides an overview of the IRCC PIA process, key expectations, roles and responsibilities, and guides participants through the completion of the new mandatory TBS PIA template. These training courses were attended by 1,079 non-ATIP participants.

In addition to PPMD’s standard training program, the Incident Management Unit within PPMD continues to offer targeted in-person sessions for program officials, particularly in areas with high demand or in response to specific privacy concerns. The Division also publishes articles on the IRCC internal webpage to keep Department employees informed of Privacy Implementation Notices issued by TBS.

ATIP course catalogue and sessions given

The specialized Training Project and ATIP Support Team within the Innovation and Support Unit has developed a comprehensive training and awareness curriculum that covers various aspects of the access to information and privacy regimes. Certain courses and modules address responsibilities related to protecting personal information, including the collection and responsible use of this type of information. As detailed in Table 8, the ATIP program conducted 152 training sessions, reaching to 4,016 employees, the majority of whom were non-ATIP employees.

IV. Material privacy breaches

The Policy on Privacy Protection defines a privacy breach as “the improper or unauthorized collection, use, disclosure, retention or disposition of personal information.” A material privacy breach is a privacy breach that could reasonably be expected to create a real risk of significant harm to an individual. Significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record and damage to or loss of property.

PPMD monitors all privacy breaches closely and has established notification protocols and remedial measures to effectively address each situation. Additionally, PPMD:

• Analyzes the sources and patterns of privacy breaches within the Department.
• Identifies emerging trends and delivers targeted privacy breach training sessions to raise awareness and strengthen preventive measures.
• Conducts preliminary risk assessments on all privacy breaches to determine risk and materiality level.
• Provides advice and guidance to departmental staff on containment and mitigation strategies to improve the protection of personal information.

This reporting period, IRCC notified the OPC and TBS of 12 material privacy breaches. Senior officials were frequently engaged in addressing material breaches to facilitate communication within the Department, raise awareness of relevant issues, and strengthen the departmental response to serious breaches. The majority of the incidents had a minor impact and affected a limited number of individuals.

• Six (6) material breaches involved the loss or misplacement of personal information. Despite extensive searches, the information could not be located. Where possible, the affected individuals were notified.
• Five (5) material breaches involved the improper disclosure of personal information belonging to some IRCC clients. All affected individuals were notified.
• One (1) material breach occurred due to unauthorized access to personal information. The affected individuals were notified.

V. Privacy Impact Assessments (PIAs)

To fulfil its mandate and effectively deliver its programs, activities and services, IRCC collects, uses, retains and discloses personal information. In accordance with the “Appendix C: Standard on Privacy Impact Assessment” in the Directive on Privacy Practices, the Department undertakes PIAs to ensure compliance with the PA, its Regulations and related policy instruments. These assessments also serve to identify potential privacy risks in both new and existing departmental programs, initiatives, or projects involving personal information.

Summaries of PIAs conducted during the 2024-2025 reporting period are provided below; for comprehensive summaries, refer to Privacy Impact Assessment Summaries.

IRCC Learning Management System

This PIA assesses a substantial modification to the management of employee personal information related to training and development activities. The change involves the implementation of a cloud-based Learning Management System and associated database. The objective of this modification is to standardize departmental tools and processes for delivering training programs and to consolidate learning data to support more effective reporting. Risks associated with this change were identified, and corresponding mitigation strategies were recommended to the responsible program officials.

Administration and verification of Letters of Acceptance and provincial or territorial Attestation Letters

This PIA evaluates a substantial modification to the International Students Program for the implementation of a new intake cap for international Study Permit applications. This modification seeks to establish an information sharing process with Designated Learning Institutions for the purpose of validating letters of acceptance, thereby supporting accurate tracking and management of intake limits. Associated risks were identified, and appropriate mitigation recommendations were provided to the responsible program officials.

VI. Public interest disclosures

Paragraph 8(2)(m) of the PA states that personal information may be disclosed when, in the opinion of the head of an institution, the public interest in disclosure clearly outweighs any potential invasion of privacy that could result from the disclosure or when such disclosure would clearly benefit the individual to whom the information relates.

IRCC authorized the disclosure of personal information in 19 instances under paragraph 8(2)(m) of the PA during the reporting period, as outlined in Table 9 below.

VII. Policies, guidelines, and procedures

The guidance, feedback, and recommendations provided by PPMD during this reporting period primarily focused on ensuring compliance with the PA and promoting the adoption of best practices in these specific areas:

• Policies concerning new or substantially revised programs, activities, and internal services that involve the processing of personal information.
• Information Sharing Agreements and Arrangements.
• Development and revision of departmental policy instruments.
• Management of contracts involving the handling of personal information.

To effectively support these objectives, the following measures were implemented or have been planned by PPMD.

Privacy Breach Reporting

Following an internal audit conducted by IRCC’s Internal Audit and Evaluations branch, a Management Response and Action Plan was developed to strengthen internal procedures for handling privacy breaches.

In response, PPMD updated its “Privacy Breach Report Form” to improve clarity, offer more detailed guidance within the instructions section, and specify additional information required from the reporting program officials. Additionally, PPMD simplified the reporting process for program officials by streamlining the notification process for suspected privacy breaches. An accessible feature, referred to as the “easy button,” was incorporated into IRCC’s intranet page to enhance visibility and provide convenient access to PPMD’s privacy incident notification form. These updates will facilitate the Incident Management Unit in developing a thorough understanding of each potential or confirmed breach, allowing them to provide appropriate expertise and targeted support to the branches.

Privacy Impact Assessment (PIA) Review Process

PPMD created a new PIA review process intended to improve both the quality and timeliness of the assessments. The new process divides the assessment into three phases, each with specified minimum review timeframes and expectations:

• Kick-off Meetings – This phase involves defining the scope of the PIA, identifying necessary supporting documentation and relevant stakeholders, and providing mandatory PIA training for the designated program officials.
• Review (Phase 1) – This phase focuses on identifying compliance gaps, incomplete information, and missing documentation, as well as offering targeted, constructive feedback to the responsible program officials to enhance the quality and accuracy of the draft PIA content prior to the final review.
• Review (Phase 2) – This phase encompasses the evaluation of any remaining privacy concerns or risks, as well as the development of suitable mitigation strategies. The review process is conducted concurrently by IRCC Legal Services and PPMD. Upon completion, the PIA is submitted for approval and signatures.

Annual review of the IRCC Privacy Policy Suite

The IRCC Privacy Policy Suite comprises a set of privacy policy documents developed in accordance with TBS’s Access to Information and Privacy Policy Suite. This collection includes a Privacy Framework, Privacy Policy, Mandatory Procedures for Managing Privacy Breaches, and a Privacy Toolkit, which provides various tools, guidelines, procedures, and checklists to support privacy compliance and management.

An annual review of the content within the IRCC Privacy Policy Suite was scheduled for this reporting period; however, the review was postponed due to competing priorities, operational demands, and ongoing departmental reorganization. A thorough review of IRCC’s privacy policy instruments is scheduled to take place during the 2025-2026 period.

Guidelines for Obtaining Consent

PPMD is developing new Guidelines for Obtaining Consent, that will provide detailed guidance on seeking consent from individuals under the PA. These guidelines aim to ensure compliance with IRCC’s obligations while incorporating relevant best practices for privacy protection. IRCC anticipates publishing these guidelines as part of its Privacy Toolkit in fiscal year 2025-2026.

VIII. Monitoring compliance

IRCC employs standardized and comprehensive reporting and monitoring methods to ensure compliance, foster accountability, and facilitate continuous process improvement.

Time taken to process PA requests

All requests and complaints are systematically documented to monitor processing times, and the intake data is closely monitored by program officials. IRCC Managers and Team Leaders within the IRCC ATIP program routinely oversee responses to internal taskings, monitor extensions claimed for processing requests, and track ongoing internal and external consultations to proactively address potential issues.

Relevant data is collected from the ATIP case management system on a daily, weekly, biweekly, and quarterly basis. This data encompasses request volumes and processing outcomes, compliance rates, backlog levels, and other key performance indicators. The information is integrated into various reports tailored for different leadership levels: daily updates for managers, weekly reports for directors and the Director General and Chief Privacy Officer, and biweekly reports for Deputy Ministers. Additionally, quarterly reports are provided to Assistant Deputy Ministers, along with a monthly compliance report outlining sector and branch responses to internal ATIP taskings. A quarterly privacy breach dashboard, summarizing breach volumes and trends across IRCC, is also shared with all Assistant Deputy Ministers within the Department.

While the primary purpose of the IRCC ATIP program’s statistical reporting is to ensure compliance, the program utilizes this data to analyze workflow efficiency, address ongoing challenges, and identify emerging trends in ATIP requests.

Privacy protections in contracts, agreements and arrangements

IRCC contracts include key provisions, and its information-sharing agreements and arrangements are designed to ensure robust protection of individuals’ personal information.

Contracts

IRCC contracts and contractual agreements incorporate a clause emphasizing the contractor’s obligation to adhere to the requirements of the PA, as outlined in the Contract General Terms and Conditions:

“ Canada has an obligation to ensure that Canadian statutes, regulations and Treasury Board policies on privacy protection are respected by contractors when Canada contracts out parts of its activities, including mail services. These obligations, known as the Code of Fair Conduct, are contained in sections 4 to 7 of the Privacy Act, Revised Statutes of Canada 1985, chapter P-21. Organizations collecting, using or disclosing personal information in carrying out commercial activities are also under the obligation to ensure that personal information is protected in accordance with Canada’s own obligation and, in addition, the Personal Information Protection and Electronic Documents Act, Statutes of Canada 2000, chapter 5.”

Contractors are required to certify that they have reviewed the applicable requirements for personal information protection and will handle all personal data in a manner consistent with, and that does not impede the application of the PA and TBS policies on privacy protection. Contractors are expected to supply accurate certification information, as IRCC depends on this documentation when awarding contracts.

Failure to adhere to these contractual obligations, including certification requirements, or the discovery of misrepresentations during IRCC’s verification process, may lead the Department to determine that the contract is in default, potentially resulting in termination of the contract in accordance with the applicable default provisions.

Information-sharing agreements and arrangements

IRCC’s Departmental “Directive on Information Sharing for ISAs” mandates that all information sharing activities comply with the requirements of the ATIA and the PA, ensuring a balanced approach between transparency, public accessibility, and the safeguarding of personal information.

• Summaries of ISAs must be made publicly accessible in accordance with section 4.2.36 of TBS’s Directive on Privacy Practices.
• The development of ISAs should include consultation of the TBS Guidance on Preparing Information Sharing Arrangements Involving Personal Information and its associated templates, which provide sample provisions to ensure that privacy considerations are appropriately addressed in the agreements.

Once drafted, ISAs undergo a thorough review process prior to signature. Any necessary revisions are subsequently incorporated to ensure full compliance with the requirements specified in sections 4.2.33 to 4.2.37 of the TBS Directive.

IX. Initiatives and projects to improve privacy

The majority of IRCC’s ATIP requests, including an increasing number submitted under the PA, pertain to client immigration records. The initiatives listed below, whether underway or completed, aim to enhance information accessibility for clients, optimize service delivery through technological advancements and system upgrades, and reinforce privacy protections for both internal and external services.

Privacy Risk Assessment (PRA)

IRCC completed its first Privacy Risk Assessments (PRAs) in relation to the development and deployment of new technologies and systems as part of the Digital Platform Modernization (DPM) initiative.

PRAs are conducted to integrate a “privacy by design” approach into the development and design of systems, technologies, and data models. This process is initiated during the early stages of project development and is revisited with each significant release to ensure ongoing compliance and proactive privacy protection. These assessments function as a technology-focused complement to ongoing program-level Privacy Impact Assessments, aiming to identify potential risks associated with the management of personal information prior to deployment. During this reporting year, 2 Privacy Risk Assessments were completed for the first two releases of the new online account.

IRCC’s new Online Account

As part of an enhanced online experience for clients being gradually rolled out through IRCC’s Digital Platform Modernization (DPM) initiative, a new online account is being implemented that includes functionality to allow clients to have increased access to information.

Enhancements include near real-time application status updates, access to officer decision notes, and summarized communications of information and documents received at the time of submission of clients’ application. Clients will also have the ability to view and update details of their profile information through this secure account, as well as access a message centre that maintains a record of correspondences and communications exchanged with IRCC.

During the reporting period, IRCC introduced its new online account to subset of eligible temporary resident visa (TRV) clients in June 2024, and then to Canadians wishing to renew their passports online in December 2024. Between launch and the end of the reporting period, approximately 43,000 clients have used the new online account to apply for a service.

The Department recognizes that all IRCC clients, and their representatives, will benefit from the new online account and the functionality it brings. Roll-out to additional client groups is continuing throughout 2025 and 2026.

Proactive release of Officer Decision Notes (ODN)

The Officer Decision Notes (ODN) initiative directly supports IRCC’s strategy to make it easier for clients to access information about their immigration application by eliminating the need for clients to submit an ATIP request to obtain officer notes related to the refusal of an application. This is a key initiative to improve openness and transparency for our clients, and responds directly to feedback from clients, immigration representatives, and parliamentarians, who have consistently identified the need for greater clarity, timely information, and faster access to refusal explanations.

Starting in 2025-2026, ODNs will gradually become available to select Temporary Resident (Study Permit/Work Permit/Temporary Residence Visa) applicants. The release of ODNs will incrementally be rolled out to additional lines of businesses.

Client correspondence project

The Client Correspondence Unit (CCU) was created to review IRCC’s written correspondence in order to provide more clear, concise and simple language that will better meet client needs. All revisions to client-facing communications are informed by usability testing feedback obtained from both clients and officers, as well as inputs from Subject Matter Experts and IRCC Legal Services.

The CCU has supported the review and improvement of over 50 written communications, with the majority of these revised documents now implemented and actively in circulation. To date, 3 key pieces of client correspondence often sought after by ATIP clients have been revised: the Temporary Resident Refusal Letter, the Study Permit Refusal Letter, and the Work Permit refusal Letter. Additionally, the top 14 refusal grounds for Study Permits and the top 15 refusal grounds for Work Permits have also been revised and drafted with an emphasis on reducing complex legal language. The revised Study Permit and Work Permit Refusal Letters are scheduled to be launched in 2025-2026.

TBS ATIP Online Request Service (ATIP Online)

During this reporting period, the IRCC ATIP program migrated requests for corporate records from IRCC’s internal platform to the TBS ATIP Online platform. This platform streamlines the process for submitting ATIP requests and facilitates timely responses from the federal government. IRCC’s objective is to reduce the volume of outstanding requests before onboarding requests for immigration records—the largest category of requests received by IRCC—onto the TBS platform.

Since the migration, requests under the ATIA and the PA have been received through both the TBS ATIP Online platform and the IRCC departmental platform, depending on the nature of the records requested. This transition has presented some operational challenges, including cases where requesters have inadvertently submitted requests to the incorrect platform or to both platforms concurrently. Additional efforts have been undertaken to redirect requests to the appropriate channels and to ensure timely processing. While the transition to the ATIP Online platform is still in progress, requesters will continue submitting their requests for client immigration records via the IRCC ATIP online request portal.

Technological assistance and upgrades

IRCC is utilizing emerging technologies to supports its ATIP processing activities. This includes the deployment of automated solutions to handle routine tasks, allowing the Department to extend operational hours beyond traditional business times. These systems facilitate strategic resource allocation for decision-making processes, enhance data accuracy and timeliness, and minimize disruptions to ongoing operations.

In prior reporting periods, the Department successfully implemented Robotic Process Automation (RPA) to manage high-volume, routine tasks such as data entry and file management. As part of this initiative, a Bot was developed to streamline the processing of informal requests, specifically for previously released documents. The Bot monitors a designated email inbox and automatically processes requests upon receipt. During this reporting period, the RPA has significantly increased the capacity of the ATIP program, allowing for the automatic processing of over 12,000 informal requests, with many requesters receiving documents within minutes.

The IRCC ATIP program is also evaluating the potential for replacing its case management software. The objective is to improve the program’s operational effectiveness while ensuring seamless integration with existing systems and processes, including the RPA.

Moving forward

During the reporting period, IRCC focused on developing new reporting tools and internal notification procedures for privacy breaches and suspected privacy incidents. PPMD also reviewed the IRCC Digital Platform Modernization (DPM) Privacy Risk Assessments to oversee the integration of personal information protection into project planning and implementation phases.

Looking ahead, PPMD plans to conduct a thorough review and update of the IRCC Privacy Policy Suite and revise its training program, ensuring the effective delivery of all required departmental training. The Department will also continue to advance ongoing initiatives and support new efforts aimed at improving service delivery and ensuring compliance with the PA.

IRCC aligns its funding with the targets in the Immigration Levels Plan, including adjusting staffing levels and processing capacity accordingly. In consideration of the reduction to the Immigration Levels Plan as of 2025-2026, as well as in alignment with the Government of Canada’s Budget Rationalization exercise, over the next three years, IRCC will reduce its current and projected workforce by approximately 3,300 positions; it is estimated that about 80% of these reductions can be achieved by reducing staffing commitments and our temporary workforce. This will have varying impacts across all sectors and branches of IRCC, including to the ATIP program, which has a significant proportion of temporary resources supporting the program. IRCC takes its responsibilities under the Access to Information and Privacy legislations seriously, and we remain committed to openness, transparency, and accountability to the public.

Annexes

Annex A: Copy of the signed delegation order in effect March 31, 2025

Annex B: Copy of the Delegation of Authority under the Privacy Act and the Privacy Regulations in effect March 31, 2025

Annex C: Statistical Report on the Administration of the Privacy Act

Annex D: Supplemental Statistical Report on the Access to Information Act and the Privacy Act

Annex A: Copy of the signed delegation order in effect March 31, 2025

Text version: Delegation of Authority

Official Document

Immigration, Refugees and Citizenship of Canada

Delegation of Authority

Access to Information Act and Privacy Act

I, Minister of Immigration, Refugees and Citizenship, pursuant to section 95 of the Access to Information Act and section 73 of the Privacy Act, hereby authorize the officer and employee of Immigration, Refugees and Citizenship whose position or classification is set out in the attached Schedule to carry out those of my powers, duties or functions under the Acts that are set in the Schedule in relation to that officer and employee.

Dated at Ottawa

This 14 day of May 2024

Marc Miller, P.C., M.P.
Minister of Immigration, Refugees and Citizenship

Annex B: Copy of the Delegation of Authority under the Privacy Act and the Privacy Regulations in effect March 31, 2025

Delegation of Authority under the Privacy Act and the Privacy Regulations

Legend

ATIP OPS

ATIP Operations Division

(client)

Client records

(corp.)

Corporate records

PM-05

Senior ATIP & Privacy Advisor positions

PM-04

ATIP & Privacy Advisor positions

PM-03

ATIP & Privacy Analyst positions

lim.

Authority limited to the Senior ATIP & Privacy Advisor, Complaints Team Leader

Annex C: Statistical Report on the Administration of the Privacy Act

Name of institute: Immigration, Refugees and Citizenship Canada
Reporting period: 2024-04-01 to 2025-03-31

Section 1: Requests under the Privacy Act

1.1 Number of requests received

Section 2: Informal requests

2.1 Number of informal requests

2.3 Completion time of informal requests

2.4 Pages released informally

Section 3: Requests closed during the reporting period

3.1 Disposition and completion time

3.2 Exemptions

3.3 Exclusions

3.4 Format of information released

3.5 Complexity

3.6 Closed requests

3.7 Deemed refusals

3.8 Requests for translation

Section 4: Disclosures under subsections 8(2) and 8(5)

Section 5: Requests for correction of personal information and notations

Section 6: Extensions

6.1 Reasons for extensions

6.2 Length of extensions

Section 7: Consultations received from other institutions and organizations

7.1 Consultations received from other Government of Canada institutions and other organizations

7.2 Recommendations and completion time for consultations received from other Government of Canada institutions

7.3 Recommendations and completion time for consultations received from other organizations outside the Government of Canada

Section 8: Completion time of consultations on cabinet confidences

8.1 Requests with Legal Services

8.2 Requests with Privy Council Office

Section 9: Complaints and investigations notices received

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

10.1 Privacy Impact Assessments

10.2 Institution-specific and Central Personal Information Banks

Section 11: Privacy breaches

11.1 Material privacy breaches

11.2 Non-material privacy breaches

Section 12: Resources related to the Privacy Act

12.1 Allocated costs

12.2 Human resources

Annex D: Supplemental Statistical Report on the Access to Information Act and the Privacy Act

Name of institute: Immigration, Refugees and Citizenship Canada
Reporting period: 2024-04-01 to 2025-03-31

Section 1: Requests carried over and active complaints under the Access to Information Act

1.1 Requests carried over to the next reporting period

1.2 Open complaints with the Information Commissioner of Canada

Section 2: Requests carried over and active complaints under the Privacy Act

2.1 Requests carried over to the next reporting period

2.2 Active complaints with the Privacy Commissioner of Canada

Section 3: Social Insurance Number

Section 4: Universal access under the Privacy Act