Annual Report to Parliament 2021 to 2022: Administration of the Privacy Act

PDF version - 1,435 kB

Catalogue Number: En104-21/2E-PDF
ISSN 2562-7686

Impact Assessment Agency of Canada
Access to Information and Privacy Coordinator

Physical/mailing address:
160 Elgin St. 22^nd Floor
Ottawa, ON K1A 0H3

Telephone: 613.297.2320
Email: atip-aiprp@iaac-aeic.gc.ca

On this page

• Introduction
• Organizational Structure
• Impact of COVID-19
• Delegation Order
• Statistical Report – Interpretation and Analysis
  • Privacy Act Requests Received
  • Multi-year Trends
  • New Exemptions Table
• Training and Awareness
• Policies, Guidelines and Procedures
• Complaints, Audits and Investigations
• Monitoring and Reporting
• Privacy Breaches
• Privacy Impact Assessments
• Disclosures under Paragraphs 8(2)(m) of the Privacy Act
• Data Matching and Sharing Activities
• Appendices
  • Appendix A: Designation Order
  • Appendix B: Statistical Report on the Privacy Act

Introduction

The Privacy Act (the Act) provides Canadian citizens and people present in Canada the right to have access to information about them that is held by the federal government. It also protects against unauthorized disclosure of that personal information. In addition, it strictly controls how government will collect, use, store, disclose, and dispose of any personal information.

This report is submitted in accordance with Section 72(1) of the Act, which requires every head of a federal government institution to submit a report to Parliament on the administration of the Act within their institution during the reporting period. It presents an overview of the Privacy Act activities carried out within the Impact Assessment Agency of Canada (formerly known as the Canadian Environmental Assessment Agency and further referred to in this report as “the Agency”) during the reporting period of April 1, 2021 to March 31, 2022.

The Agency is a federal body that reports to the Minister of Environment and Climate Change Canada. Under the Impact Assessment Act (IAA), the Agency is the lead federal organization responsible for conducting and administering environmental and impact assessments. The Agency is also the Crown coordinator for Indigenous consultation on designated projects. In leading these assessments, the Agency is responsible for assessing the positive and negative environmental, economic, social, health, and gender effects of designated projects.

Organizational Structure

The provision of Access to Information and Privacy (ATIP) services in the Agency is the responsibility of the Manager of Information Management, ATIP & GCdocs who reports to the President through the Vice-President, Corporate Services, to fulfill the Agency’s Access to Information Act responsibilities. The Impact Assessment Agency was not party to any service agreement pursuant to section 96 of the Act during the reporting period of April 1, 2021 to March 31, 2022.

The ATIP function is the direct responsibility of the ATIP Coordinator and a team of three ATIP Analysts.

The ATIP Team administers the Act by:

• Receiving Privacy requests under the Act, creating request files and tracking the processing of requests using AccessPro Case Management software;
• Sending statutory notices to applicants, third parties, and the Privacy Commissioner;
• Conducting necessary consultations;
• Processing Privacy records for disclosure under the Act, in response to requests;
• Responding to Privacy requests for correction of personal information held by the Agency;
• Providing training and advice to Agency officials on interpretation and application of the legislation;
• Negotiating the resolution of formal complaints;
• Advising applicants, third parties and complainants of their rights and obligations under the legislation;
• Managing and reporting on privacy breaches;
• Annually updating and publicly reporting the Personal Information Banks under the Agency’s control;
• Conducting/securing Privacy Impact Assessments in support of the Act and associated Regulations, Policies and Directives of Justice Canada and the Treasury Board of Canada Secretariat (TBS);
• Responding to Parliamentary Questions related to the administration of the Act;
• Compiling statistics; and
• Preparing, submitting and posting the Agency’s annual report to Parliament on the administration of the Act.

Impact of COVID-19

In March 2021, the World Health Organization declared COVID-19 to be a pandemic. The ATIP Team was able to move to a 100% remote work model, in large part due to the Agency’s ongoing transformation of the ATIP process to paperless, and previously established remote work capabilities. The ATIP Team has provided uninterrupted service to all its clients and stakeholders.

Delegation Order

For the purposes of the Act, the Agency’s “head of the institution” as defined in Section 3 of the Act is the President of the Agency.

The responsibilities associated with the administration of the Act are delegated to the senior executive officers reporting directly to the President (Vice-presidents and General Counsel), as well as the Access to Information and Privacy Coordinator by the President for the effective administration of the program. The decision-making responsibility for the application of the various provisions of the Act is formally established and outlined in the departmental Delegation of Authority Instrument, which can be found under Appendix A.

Statistical Report – Interpretation and Analysis

The Statistical Report on Privacy requests processed by the Agency from April 1, 2021 to March 31, 2022 is included in Appendix B of this report. The following sections provide an overview of key data on the Agency’s performance for the year with explanations, interpretations and analysis of the Statistical Report for 2021-2022.

Privacy Act Requests Received

The Agency received six requests under the Privacy Act during the 2021-2022 reporting period, closed four requests, and did not bring any requests forward from the previous year. This information is reflected in Table 3.1 of the Statistical Report in Appendix B.

Multi-year Trends

Figure 2 demonstrates the number of Privacy requests the Agency received over the past four reporting periods.

New Exemptions Table

Figure 3 demonstrates that the Agency has not invoked any new privacy exemptions in the 2021-2022 reporting period.

Training and Awareness

Agency employees are provided with training and guidance to assist them in fulfilling their duties under the Privacy Act. The ATIP Team is currently developing anew training to reflect the changes arising from Bill C-58: An Act to amend the Access to Information Act and the Privacy Act and to make consequential amendments to other Acts, which came into force in June 2019. The ATIP Team has led a series of training sessions to raise general ATIP awareness and to inform Agency staff of changes to policies and guidelines issues by the Office of the Privacy Commissioner.

Employees have been informed of the privacy-related training offered by the Canada School of Public Service. Training and reference materials are also made available to employees on the Agency’s Intranet site.

Policies, Guidelines and Procedures

There were no new policies, guidelines or procedures implemented during this reporting period.

Complaints, Audits and Investigations

There were no complaints filed with the Office of the Privacy Commissioner of Canada during the reporting period. As well, there were no investigations and no appeals have been filed with the Federal Court of Appeal.

Monitoring and Reporting

The Agency continues to ensure compliance with the Privacy Act through effective reporting and monitoring mechanisms. Weekly ATIP reports are prepared for the Vice-President, Corporate Services, and the Agency’s senior leadership. These reports include detailed status of individual requests, compliance statistics, and any complaint investigations.

Special reports are also submitted to provide justifications for any time extensions or sensitive requests.

Privacy Breaches

No material privacy breaches occurred during the 2021-2022 reporting period.

Privacy Impact Assessments

No Privacy Impact Assessments (PIA) were completed during the 2021-2022 reporting period.

Disclosures under Paragraphs 8(2)(m) of the Privacy Act

There were no disclosures pursuant to paragraphs 8(2)(m) of the Privacy Act during the 2021-2022 reporting period.

Data Matching and Sharing Activities

There was no data matching or sharing activities undertaken during this reporting period.

Appendices

Appendix A: Designation Order

Designation order

(Privacy Act)

As head of the Canadian Environmental Assessment Agency for purposes of the Privacy Act, I hereby designate, under section 73 of that Act, the officers and employees of the Canadian Environmental Assessment Agency, who hold the positions set out in the attached Annex, to exercise or perform all of the powers, duties or functions that are conferred upon me by the provisions of the Privacy Act specified in the aforementioned Annex.

Original signed July 23, 2017 by Ron Hallman, President, Canadian Environmental Assessment Agency.

Annex to Designation Order (Privacy Act) Dated – July 2014

The Access to Information and Privacy Coordinator and the Senior Executive Officers reporting directly to the President of the Canadian Environmental Assessment Agency are designated to exercise or perform all powers, duties or functions of the President as the head of the Canadian Environmental Assessment Agency under the provisions of the Privacy Act listed below. This designation replaces all previous delegation orders.

Appendix B: Statistical Report on the Privacy Act

Name of institution: Impact Assessment Agency of Canada

Reporting period: 2021-04-01 to 2022-03-31

Section 1: Requests Under the Privacy Act

1.1 Number of requests received

1.2 Channels of requests

Section 2: Informal requests

2.1 Number of informal requests

2.2 Channels of informal requests

2.3 Completion time of informal requests

2.4 Pages released informally

Section 3: Requests Closed During the Reporting Period

3.1 Disposition and completion time

3.2 Exemptions

3.3 Exclusions

3.4 Format of information released

3.5 Complexity

3.5.1 Relevant pages processed and disclosed for paper and e-record formats

3.5.2 Relevant pages processed by request disposition for paper and e-record formats by size of requests

3.5.3 Relevant minutes processed and disclosed for audio formats

3.5.4 Relevant minutes processed per request disposition for audio formats by size of requests

3.5.5 Relevant minutes processed and disclosed for video formats

3.5.6 Relevant minutes processed per request disposition for video formats by size of requests

3.5.7 Other complexities

3.6 Closed requests

3.6.1 Number of requests closed within legislated timelines

3.7 Deemed refusals

3.7.1 Reasons for not meeting legislated timelines

3.7.2 Request closed beyond legislated timelines (including any extension taken)

3.8 Requests for translation

Section 4: Disclosures Under Subsections 8(2) and 8(5)

Section 5: Requests for Correction of Personal Information and Notations

Section 6: Extensions

6.1 Reasons for extensions

6.2 Length of extensions

Section 7: Consultations Received From Other Institutions and Organizations

7.1 Consultations received from other Government of Canada institutions and other organizations

7.2 Recommendations and completion time for consultations received from other Government of Canada institutions

7.3 Recommendations and completion time for consultations received from other organizations outside the Government of Canada

Section 8: Completion Time of Consultations on Cabinet Confidences

8.1 Requests with Legal Services

8.2 Requests with Privy Council Office

Section 9: Complaints and Investigations Notices Received

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

10.1 Privacy Impact Assessments

10.2 Institution-specific and Central Personal Information Banks

Section 11: Privacy Breaches

11.1 Material Privacy Breaches reported

11.2 Non-Material Privacy Breaches

Section 12: Resources Related to the Privacy Act

12.1 Allocated Costs

12.2 Human Resources

Note: Enter values to three decimal places.