Administration of the Privacy Act - Annual Report to Parliament 2016-2017

Administration of the Privacy Act - Annual Report to Parliament 2016-2017

Catalogue no. En104-12/2-2016E-PDF

Canadian Environmental Assessment Agency
Access to Information and Privacy Coordinator

Physical/mailing address:
160 Elgin St.
Ottawa, ON K1A 0H3

Telephone: 613-948-1362
Email: atip-aiprp@ceaa-acee.gc.ca

This document is also available in Adobe's Portable Document Format [PDF - 1.8 MB].

Table of Contents

Introduction

The Privacy Act (the Act) gives Canadian citizens and people present in Canada the right to have access to information about them that is held by the federal government. It also protects against unauthorized disclosure of that personal information. In addition, it strictly controls how government will collect, use, store, disclose, and dispose of any personal information.

Section 72 of the Act requires that the head of every government institution submit an annual report to Parliament on the administration of the Act during each fiscal year. The Canadian Environmental Assessment Agency (the Agency) is pleased to table in Parliament its 2016-2017 Annual Report on the Administration of the Act.

About the Canadian Environmental Assessment Agency

Led by the President, who reports to the Minister of Environment and Climate Change, the Agency delivers its mandate within the framework of the following instruments:

  • The Canadian Environmental Assessment Act, 2012 (CEAA 2012) and its accompanying regulations;
  • The Canada-Wide Accord on Environmental Harmonization, including the Sub-Agreement on Environmental Assessment, and bilateral agreements with provincial governments that establish arrangements for cooperative environmental assessments; and
  • International agreements containing environmental assessment provisions to which Canada is a party, principally the United Nations Economic Commission for Europe's Convention on Environmental Impact Assessment in a Transboundary Context.

Consistent with the Cabinet Directive on the Environmental Assessment of Policy, Plan and Program Proposals, the Agency also supports the Minister of Environment and Climate Change in promoting the application of environmental assessment processes in strategic-level decision-making, by providing training and guidance to federal authorities.

The Agency is responsible for conducting federal environmental assessments for most major resource projects, as mandated under CEAA 2012. The Agency also integrates the Government of Canada's Aboriginal engagement and consultation activities into the environmental assessment process for these projects, in accordance with the Cabinet Directive on Improving the Performance of the Regulatory System for Major Resource Projects and its Memorandum of Understanding. The Agency is the Crown Consultation Coordinator for Aboriginal Consultation, with the exception of projects under the authority of the National Energy Board and the Canadian Nuclear Safety Commission.

The President of the Agency is designated by an Order in Council as the federal administrator of the environmental and social protection regimes set out in Chapters 22 and 23 of the 1975 James Bay and Northern Quebec Agreement.

Delegation of authority

For the purposes of the Act, the Agency’s “head of the institution” as defined in section 3 of the Act is the President of the Agency.

The responsibilities associated with the administration of the Act are delegated to the senior executive officers reporting directly to the President (Vice-presidents and General Counsel), as well as the Access to Information and Privacy Coordinator as deemed appropriate by the President for the effective administration of the program. The decision-making responsibility for the application of the various provisions of the Act is formally established and outlined in the departmental Delegation of Authority Instrument which can be found under Appendix A.

About Access to Information and Privacy

The administration of the Act at the Agency is delegated to the Access to Information and Privacy (ATIP) Division. Their provision of ATIP services is included under the general responsibility of the Information Services Division, reporting to the Vice-President and Chief Security Officer, Corporate Services.

The Information Services Division is sub-divided into an Information Management (IM) unit, an ATIP unit, and an Information Technology (IT) unit. The ATIP function is the direct responsibility of the ATIP Coordinator and a team of three ATIP Officers.

The ATIP team administers the Act by:

  • Receiving requests under the Act, creating Privacy request files and tracking the processing of Privacy requests using AccessPro Case Management software;
  • Sending statutory notices to applicants, to third parties, and to the Information and Privacy Commissioners;
  • Conducting consultations;
  • Processing records for disclosure under the Act, in response to requests;
  • Responding to requests for correction of personal information held by the Agency;
  • Providing advice and training to Agency officials on interpretation and application of the legislation;
  • Negotiating the resolution of formal complaints;
  • Advising applicants, third parties and complainants of their rights and obligations under the legislation;
  • Managing and reporting on privacy breaches;
  • Annually updating and publicly reporting the Personal Information Banks under the Agency’s control;
  • Conducting/securing Privacy Impact Assessments in support of the Act and associated Regulations, Policies and Directives of Justice Canada and the Treasury Board Secretariat (TBS);
  • Compiling statistics; and
  • Preparing the Agency’s annual report on the administration of the Act.

Statistical report – Interpretation and analysis

Appendix B provides a summarized statistical report on Privacy Act requests processed by the Agency from April 1, 2016, to March 31, 2017.

Privacy Act requests received

As indicated in the statistical report, the Agency received no requests under the Act during the 2016-2017 fiscal year. The table below demonstates that the Agency has received a declining number of Privacy requests over the past few fiscal years.

 

2013-2014

2014-2015

2015-2016

2016-2017

Number of Requests Received

3

2

0

0

Disclosures under paragraphs 8(2)(e), (f), (g), and (m) of the Privacy Act

There were no disclosures pursuant to paragraphs 8(2)(e), (f), (g), and (m) of the Act during the 2016-2017 reporting period.

Complaints / Investigations / Appeals to the Court

There were no complaints filed with the Office of the Privacy Commissioner of Canada during the reporting period. As well, there were no investigations and no appeals to the Federal Court of Appeal.

Privacy impact assessments

One Privacy Impact Assessment (PIA) for the Environmental Assessment Delivery, Facilitated by the Environmental Assessment Management System (EAMS) was completed on January 25, 2017.

The Risk Analysis for this PIA identified five medium and two high risks related to the management of personal information through EAMS. These risks have been addressed by a mitigation strategy involving the following:

  • Augmentation of the Agency’s Privacy Management. This includes updating the following documents: The Privacy Notice, the Privacy Impact Assessment Directive, the Privacy Breach Policy, and the Privacy Protocol. Final approval is ongoing for the implementation of some of these policy instruments.
  • Training. The Agency is developing a communication strategy to promote staff awareness of the importance of the above mentioned policy instruments. The Agency is also developing a training strategy for the implementation of EAMS. Both strategies will enhance observance of the privacy protection requirements within the Agency and surrounding the use of EAMS.
  • Protected B certification of the EAMS hosted platform. The Agency has secured certification that the platform is cleared for Protected B.
  • Establishment of Records Disposition Authorities (RDAs). The Agency is working towards establishing RDAs with Library and Archives Canada.
  • Registration of a new Personal Information Bank (PIB) to replace an existing Class of Records. A new PIB has been included in this PIA, and has been submitted to the Treasury Board Secretariat of Canada (TBS) for registration.

It was posted to the Agency’s external website on February 9, 2017 and more information can be found at https://www.canada.ca/en/impact-assessment-agency/corporate/transparency/pia/executive-summary-eams.html

Data matching and sharing activities

There was no data matching or sharing activities undertaken during this reporting period.

Policies, guidelines and procedures

There were no policies, guidelines or procedures implemented during this reporting period.

Training and awareness

Agency employees are provided with training and guidance to assist them in fulfilling their duties under the Privacy Act. The ATIP Coordinator provides advice and support on an as-needed basis.

Employees have been directed to take the Privacy-related training offered by the Canada School of the Public Service. Training and reference materials are also made available to employees on the Agency’s Intranet site.

Monitoring and reporting

The Agency continues to ensure compliance with the Act through effective reporting and monitoring mechanisms. Weekly ATIP reports are tabled by the Vice-President Corporate Services at the President’s Management Committee meetings. These reports include depersonalized status of any individual requests, as well as compliance statistics. Special reports are also submitted to provide justification for any time extensions.

Privacy breaches

The Agency had three (3) privacy incidents during the reporting period. These breaches were not significant and therefore were not reported to the Office of the Privacy Commissioner (OPC).

To mitigate the effects of these breaches and to prevent recurrence, the employees were reminded and referred to of the the Agency’s Privacy Policy as well as the TBS Policy on Government Security.

Appendix A: Designation order

Designation order

(Privacy Act)

As head of the Canadian Environmental Assessment Agency for purposes of the Privacy Act, I hereby designate, under section 73 of that Act, the officers and employees of the Canadian Environmental Assessment Agency, who hold the positions set out in the attached Annex, to exercise or perform all of the powers, duties or functions that are conferred upon me by the provisions of the Privacy Act specified in the aforementioned Annex.

Original signed July 23, 2017 by Ron Hallman, President, Canadian Environmental Assessment Agency.

Annex to Designation Order (Privacy Act) Dated – July 2014

The Access to Information and Privacy Coordinator and the Senior Executive Officers reporting directly to the President of the Canadian Environmental Assessment Agency are designated to exercise or perform all powers, duties or functions of the President as the head of the Canadian Environmental Assessment Agency under the provisions of the Privacy Act listed below. This designation replaces all previous delegation orders.

8(2)(e)

Disclose personal information for law enforcement or investigation

8(2)(m)

Disclose personal information in the public interest or in the interest of the individual

8(4)

Retain copy of 8(2)(e) requests and disclosed records

8(5)

Notify Privacy Commissioner of 8(2)(m) disclosures

9(1)

Retain record of use

9(4)

Notify Privacy Commissioner of consistent use and amend index

10(1)

Include personal information in personal information banks

14(a)

Provide notice when access is requested

14(b)

Provide access to the information or part thereof

15

Extend time limit

17(2)(b)

Cause translation or interpretation to be made

18(2)

Apply exemption - Personal information contained in an exempt bank

19(1)

Apply exemption - Personal information obtained in confidence from other governments

19(2)

Apply exemption - Personal information if the other government, organization or institution consents to the disclosure or makes the information public

20

Apply exemption - Personal information injurious to the conduct of federal-provincial affairs

21

Apply exemption - Personal information injurious to international affairs or defense

22(1)

Apply exemption - Personal information injurious to law enforcement or investigation

22(2)

Apply exemption - Personal information obtained or prepared by the RCMP while performing policing services for a province or municipality

22 (3)

Apply exemption - Personal information requested under subsection 12(1) that was created for the purpose of making a disclosure under the Public Servants Disclosure Protection Act or in the course of an investigation into a disclosure under that Act.

23

Apply exemption - Personal information prepared by an investigative body for security clearances

24

Apply exemption - Personal information collected by the Canadian Penitentiary Service, the National Parole Service or the National Parole Board while individual was under sentence

25

Apply exemption - Personal information which could threaten the safety of individuals

26

Apply exemption - Personal information about another individual

27

Apply exemption - Personal information subject to solicitor-client privilege

28

Apply exemption - Personal information relating to the individual’s physical or mental health

31

Receive notice of intention of investigation by the Privacy Commissioner

33(2)

Make representations to the Privacy Commissioner in the course of an investigation

35

Give notice to the Information Commissioner of action taken/to be taken to implement recommendations and provide access to complainant after 35(1)(b) notice

36(3)

Receive Privacy Commissioner’s report of findings of investigation of exempt bank

37(3)

Receive report of Privacy Commissioner’s findings after compliance investigation

51(2)(b)

Request that hearing be held in the National Capital Region

51(3)

Request and be given opportunity to make representations in section 51 hearings

70(1)

Exclusion - Confidences of the Queen’s Privy Council for Canada

72(1)

Prepare annual report to Parliament

77

Fulfill any responsibilities that are conferred upon the head of the institution by the regulations made under section 77 and are not included above

Appendix B: Statistical Report on the Privacy Act

Name of institution: Canadian Environmental Assessment Agency
Reporting period: 2016-04-01 to 2017-03-31

Part 1: Requests Under the Privacy Act

 

Number of Requests

Received during reporting period

0

Outstanding from previous reporting period

0

Total

0

Closed during reporting period

0

Carried over to next reporting period

0

Part 2: Requests Closed During the Reporting Period

2.1 Disposition and completion time

Disposition of Requests

Completion Time

1 to 15 Days

16 to 30 Days

31 to 60 Days

61 to 120 Days

121 to 180 Days

181 to 365 Days

More Than 365 Days

Total

All disclosed

0

0

0

0

0

0

0

0

Disclosed in part

0

0

0

0

0

0

0

0

All exempted

0

0

0

0

0

0

0

0

All excluded

0

0

0

0

0

0

0

0

No records exist

0

0

0

0

0

0

0

0

Request abandoned

0

0

0

0

0

0

0

0

Neither confirmed nor denied

0

0

0

0

0

0

0

0

Total

0

0

0

0

0

0

0

0

2.2 Exemptions

Section

Number of Requests

18(2)

0

19(1)(a)

0

19(1)(b)

0

19(1)(c)

0

19(1)(d)

0

19(1)(e)

0

19(1)(f)

0

20

0

21

0

22(1)(a)(i)

0

22(1)(a)(ii)

0

22(1)(a)(iii)

0

22(1)(b)

0

22(1)(c)

0

22(2)

0

22.1

0

22.2

0

22.3

0

23(a)

0

23(b)

0

24(a)

0

24(b)

0

25

0

26

0

27

0

28

0

2.3 Exclusions

Section

Number of Requests

69(1)(a)

0

69(1)(b)

0

69.1

0

70(1)

0

70(1)(a)

0

70(1)(b)

0

70(1)(c)

0

70(1)(d)

0

70(1)(e)

0

70(1)(f)

0

70.1

0

2.4 Format of information released

Disposition

Paper

Electronic

Other formats

All disclosed

0

0

0

Disclosed in part

0

0

0

Total

0

0

0

2.5 Complexity

2.5.1 Relevant pages processed and disclosed

Disposition of Requests

Number of Pages Processed

Number of Pages Disclosed

Number of Requests

All disclosed

0

0

0

Disclosed in part

0

0

0

All exempted

0

0

0

All excluded

0

0

0

Request abandoned

0

0

0

Neither confirmed nor denied

0

0

0

Total

0

0

0

2.5.2 Relevant pages processed and disclosed by size of requests

Disposition

Less Than 100 Pages Processed

101-500 Pages Processed

501-1000 Pages Processed

1001-5000 Pages Processed

More Than 5000 Pages Processed

Number of Requests

Pages Disclosed

Number of Requests

Pages Disclosed

Number of Requests

Pages Disclosed

Number of Requests

Pages Disclosed

Number of Requests

Pages Disclosed

All disclosed

0

0

0

0

0

0

0

0

0

0

Disclosed in part

0

0

0

0

0

0

0

0

0

0

All exempted

0

0

0

0

0

0

0

0

0

0

All excluded

0

0

0

0

0

0

0

0

0

0

Request abandoned

0

0

0

0

0

0

0

0

0

0

Neither confirmed nor denied

0

0

0

0

0

0

0

0

0

0

Total

0

0

0

0

0

0

0

0

0

0

2.5.3 Other complexities

Disposition

Consultation Required

Legal Advice Sought

Interwoven Information

Other

Total

All disclosed

0

0

0

0

0

Disclosed in part

0

0

0

0

0

All exempted

0

0

0

0

0

All excluded

0

0

0

0

0

Request abandoned

0

0

0

0

0

Neither confirmed nor denied

0

0

0

0

0

Total

0

0

0

0

0

2.6 Deemed refusals

2.6.1 Reasons for not meeting statutory deadline

Number of Requests Closed Past the Statutory Deadline

Principal Reason

Workload

External Consultation

Internal Consultation

Other

0

0

0

0

0

2.6.2 Number of days past deadline

Number of Days Past Deadline

Number of Requests Past Deadline Where No Extension Was Taken

Number of Requests Past Deadline Where An Extension Was Taken

Total

1 to 15 days

0

0

0

16 to 30 days

0

0

0

31 to 60 days

0

0

0

61 to 120 days

0

0

0

121 to 180 days

0

0

0

181 to 365 days

0

0

0

More than 365 days

0

0

0

Total

0

0

0

2.7 Requests for translation

Translation Requests

Accepted

Refused

Total

English to French

0

0

0

French to English

0

0

0

Total

0

0

0

Part 3: Disclosures Under Subsections 8(2) and 8(5)

Paragraph 8(2)(e)

Paragraph 8(2)(m)

Subsection 8(5)

Total

0

0

0

0

Part 4: Requests for Correction of Personal Information and Notations

Disposition for Correction Requests Received

Number

Notations attached

0

Requests for correction accepted

0

Total

0

Part 5: Extensions

5.1 Reasons for extensions and disposition of requests

Disposition of Requests Where an Extension Was Taken

15(a)(i)
Interference With Operations

15(a)(ii)
Consultation

15(b)
Translation or Conversion

Section 70

Other

All disclosed

0

0

0

0

Disclosed in part

0

0

0

0

All exempted

0

0

0

0

All excluded

0

0

0

0

No records exist

0

0

0

0

Request abandoned

0

0

0

0

Total

0

0

0

0

5.2 Length of extensions

Length of Extensions

15(a)(i)
Interference with operations

15(a)(ii)
Consultation

15(b)
Translation purposes

Section 70

Other

1 to 15 days

0

0

0

0

16 to 30 days

0

0

0

0

Total

0

0

0

0

Part 6: Consultations Received From Other Institutions and Organizations

6.1 Consultations received from other Government of Canada institutions and other organizations

Consultations

Other Government of Canada Institutions

Number of Pages to Review

Other Organizations

Number of Pages to Review

Received during the reporting period

0

0

0

0

Outstanding from the previous reporting period

0

0

0

0

Total

0

0

0

0

Closed during the reporting period

0

0

0

0

Pending at the end of the reporting period

0

0

0

0

6.2 Recommendations and completion time for consultations received from other Government of Canada institutions

Recommendation

Number of Days Required to Complete Consultation Requests

1 to 15 Days

16 to 30 Days

31 to 60 Days

61 to 120 Days

121 to 180 Days

181 to 365 Days

More Than 365 Days

Total

All disclosed

0

0

0

0

0

0

0

0

Disclosed in part

0

0

0

0

0

0

0

0

All exempted

0

0

0

0

0

0

0

0

All excluded

0

0

0

0

0

0

0

0

Consult other institution

0

0

0

0

0

0

0

0

Other

0

0

0

0

0

0

0

0

Total

0

0

0

0

0

0

0

0

6.3 Recommendations and completion time for consultations received from other organizations

Recommendation

Number of days required to complete consultation requests

1 to 15 Days

16 to 30 Days

31 to 60 Days

61 to 120 Days

121 to 180 Days

181 to 365 Ddays

More Than 365 Days

Total

All disclosed

0

0

0

0

0

0

0

0

Disclosed in part

0

0

0

0

0

0

0

0

All exempted

0

0

0

0

0

0

0

0

All excluded

0

0

0

0

0

0

0

0

Consult other institution

0

0

0

0

0

0

0

0

Other

0

0

0

0

0

0

0

0

Total

0

0

0

0

0

0

0

0

Part 7: Completion Time of Consultations on Cabinet Confidences

7.1 Requests with Legal Services

Number of Days

Fewer Than 100 Pages Processed

101-500 Pages Processed

501-1000 Pages Processed

1001-5000 Pages Processed

More than 5000 Pages Processed

Number of Requests

Pages Disclosed

Number of Requests

Pages Disclosed

Number of Requests

Pages Disclosed

Number of Requests

Pages Disclosed

Number of Requests

Pages Disclosed

1 to 15

0

0

0

0

0

0

0

0

0

0

16 to 30

0

0

0

0

0

0

0

0

0

0

31 to 60

0

0

0

0

0

0

0

0

0

0

61 to 120

0

0

0

0

0

0

0

0

0

0

121 to 180

0

0

0

0

0

0

0

0

0

0

181 to 365

0

0

0

0

0

0

0

0

0

0

More than 365

0

0

0

0

0

0

0

0

0

0

Total

0

0

0

0

0

0

0

0

0

0

7.2 Requests with Privy Council Office

Number of Days

Fewer Than 100 Pages Processed

101-500 Pages Processed

501-1000 Pages Processed

1001-5000 Pages Processed

More than 5000 Pages Processed

Number of Requests

Pages Disclosed

Number of Requests

Pages Disclosed

Number of Requests

Pages Disclosed

Number of Requests

Pages Disclosed

Number of Requests

Pages Disclosed

1 to 15

0

0

0

0

0

0

0

0

0

0

16 to 30

0

0

0

0

0

0

0

0

0

0

31 to 60

0

0

0

0

0

0

0

0

0

0

61 to 120

0

0

0

0

0

0

0

0

0

0

121 to 180

0

0

0

0

0

0

0

0

0

0

181 to 365

0

0

0

0

0

0

0

0

0

0

More than 365

0

0

0

0

0

0

0

0

0

0

Total

0

0

0

0

0

0

0

0

0

0

Part 8: Complaints and Investigations Notices Received

Section 31

Section 33

Section 35

Court action

Total

0

0

0

0

0

Part 9: Privacy Impact Assessments (PIAs)

Number of PIA(s) completed: 1

Part 10: Resources Related to the Privacy Act

10.1 Costs

Expenditures

Amount

Salaries

$6,935

Overtime

$0

Goods and Services

  • Professional services contracts = $0
  • Other = $0

$0

Total

$6,935

10.2 Human Resources

Resources

Person Years Dedicated to Privacy Activities

Note: Enter values to two decimal places.

Full-time employees

0.01

Part-time and casual employees

0.00

Regional staff

0.00

Consultants and agency personnel

0.00

Students

0.00

Total

0.01

Report a problem or mistake on this page
Please select all that apply:

Thank you for your help!

You will not receive a reply. For enquiries, contact us.

Date modified: