IRCC Minister Transition Binder 2025-05

Access to Information and Privacy

Access and Privacy Management Branch
May 2025

Overview

• ATIP Program
• IRCC ATIP by Numbers
• Delegation of Authority
• Roles and Responsibilities
• ATIP Program Structure
• Ministerial Records
• Support to the Minister’s Office
• Limitations under the Acts
• Privacy Breaches

ATIP Program

• Access to Information and Privacy (ATIP) is a program that administers the following acts:
• The Access to Information Act (ATIA) provides access to information under the control of a government institution
• The Privacy Act (PA) protects the privacy of individuals and provides individuals with the right to access their personal information^{Note *}
• Both acts are subject to limitations in terms of information that may be disclosed.
• The Office of the Information Commissioner (OIC) and the Office of the Privacy Commissioner (OPC) are responsible for overseeing compliance with the acts.
• The OIC can order an institution to release records following a complaint investigation.

IRCC ATIP by Numbers

The growth in the number of Access to Information and Privacy (ATIP) requests submitted to Immigration, Refugees and Citizenship Canada (IRCC) over the past several years has been unprecedented, and this growth is projected to continue. Projects are currently being evaluated to help reduce the number of ATIP requests, such as Digital Platform Modernization, the Client Experience Platform and the proactive release of officers' decision notes. The implementation date is on hold due to budget restrictions and the workforce adjustment.

62% In 2023–2024, IRCC received over 62% of all ATIP requests made to federal institutions.
158% Since 2018–2019, IRCC’s ATIP volumes increased 158%.
99% Over 99% of IRCC’s ATIP requests are for information pertaining to clients’ immigration applications.

Delegation of Authority

It is standard practice for ministers to delegate their authority under the Access to Information Act and the Privacy Act.

• Delegations of authority assist the Department in meeting legislated deadlines for processing formal ATIP requests by assigning specific powers, functions, and duties to designated employees, commensurate with their level of responsibility. The delegation order is a public document.
• These authorities are essential to maintain the efficiency and effectiveness of the ATIP program’s day-to-day operational activities.
• Under the current delegation order, the Deputy Minister has full authority for the administration of both acts. 
• Under the legislation, only employees of the Department can be named in the delegation order.

Roles and Responsibilities

Delegated Departmental Officials

• The Deputy Minister and Associate Deputy Minister are responsible, as required, for making decisions and exercising discretion under the acts in a fair, reasonable, impartial manner and providing managers and employees with consistent, objective, and expert guidance.
• The Director General of Corporate Secretariat, who also serves as the ATIP Coordinator and the Chief Privacy officer, is responsible for providing functional guidance and oversight on departmental access to information and privacy matters and is the focal point for the application of the ATIA and PA in IRCC, serving as its center of expertise in enabling it to meet its statutory obligations under both acts.
• The ATIP Program is structured around its main lines of business. The program is administered by three divisions under two distinct sectors: the Corporate Secretariat, which includes the ATIP Corporate Records Division and the Privacy Program Management Division, and the ATIP Client Records Division, which now falls under the Service Delivery Sector.

ATIP Program Structure

Corporate Secretariat Director General’s Office, ATIP Coordinator & Chief Privacy Officer

Provides streamlined functional direction for the ATIP Program, including corporate planning and reporting.

Privacy Program Management Division

• Manages reported privacy breaches and inquiries.
• Manages complaints from the OPC regarding the improper management of personal information.
• Develops privacy policy and provides advice to program areas in meeting privacy requirements and departmental use of privacy by design.
• Disclosures under 8(2)(m) of the Privacy Act.

ATIP Corporate Records Division

• Processes corporate requests and complaints from the OIC and OPC.
• Provides ATIP training and policy guidance.
• Leads policy and training on ATIA and PA requests and the ATIA in general.
• Provides statistical and data analytics related to ATIP.

Director General’s Office, Client Support & Engagement

Processes all requests from clients seeking the status of their immigration/citizenship program applications.

ATIP Client Records Division

• Processes ATIP requests from clients seeking information on their IRCC applications.
• Input on modernization initiatives of the ATIP programs.

Ministerial Records

• The office of a minister is not part of the department over which the minister presides, and, generally, records held exclusively in a minister’s office are not subject to the ATIA.
• However, a document held exclusively in a minister’s office could be deemed to be under the control of a government institution if the following two-step test is satisfied:
  • Do the contents of the record relate to a departmental matter?
  • If so, could a senior official of the government institution reasonably expect to obtain a copy of the record upon request?
• A separate presentation has been prepared with guidance about information management in the Minister’s office.

Reference: Guidelines on Managing Records in a Minister’s Office and Bill C-58

Support to the Minister’s Office

To support the Minister and her office, the Department provides regular reports to ensure that the Minister can prepare for questions pertaining to document releases from the public, media, or parliamentarians.

Reports include:

• Weekly ATIP Release Notification (ARN) Report
• Bi-weekly List of New Requests (Corporate Records Requests)
• Access to Information Annual Report to Parliament
• Privacy Annual Report to Parliament

The IRCC Communications team reviews the reports for releases that may generate questions and supports the Minister and his or her team in preparing to respond.

Limitations:

• The Minister or Minister’s office cannot delay or deny the release of information under the Act that is not subject to an exemption or counsel a delegated official to do so.
• The Minister or the Minister's team cannot withhold documents that meet the test of Ministerial records that should be disclosed.

Limitations under the Acts

Under the ATIA and the PA, certain information must be withheld to protect specific public or private interests. These are known as mandatory exemptions.

Other types of information may be withheld on a discretionary basis if the injury that could result from disclosure outweighs the benefit of release. These are known as discretionary exemptions.

Mandatory Exemptions

• Information obtained in confidence from another government
• Policing services for provinces and municipalities
• Records relating to investigations, examinations, and audits
• Personal information
• Third-party information
• Statutory prohibitions

Discretionary Exemptions

• Federal-provincial affairs
• International affairs and defence
• Law enforcement and investigations, security
• Safety of individuals
• Economic interests of Canada
• Operations of government
• Protected information (solicitors, advocates, notaries)

ATIA Exclusions

S.68 - Published material or material available for purchase by the public
S.69 - Cabinet Confidences

The application of all exemptions must be limited and specific.

Privacy Breaches

Top five Government of Canada institutions with the most privacy breaches^{Table footnote *}: