Administration of the Privacy Act: Annual Report 2024-2025

July 2025

© His Majesty the King in Right of Canada, as represented by the Minister of Environment and Climate Change, 2025.

This publication may be reproduced for personal or internal use without permission, provided the source is fully acknowledged. However, multiple copy reproduction of this publication in whole or in part for purposes of redistribution requires the prior written permission from the Impact Assessment Agency of Canada, Ottawa, Ontario K1A 0H3, or information@iaac-aeic.gc.ca.

Catalogue Number: En14-12/1E-PDF
ISSN 2562-766X

This document has been issued in French under the title: Application de la Loi sur la protection des renseignements personnels

On this page

• 1. Introduction
• 2. About the Impact Assessment Agency of Canada
• 3. Organizational Structure
• 4. Delegation of Authority
• 5. Performance for the 2024-2025 Fiscal Year
• 6. Training and Awareness
• 7. Policies, Guidelines, and Procedures
• 8. Initiatives and Projects to Improve Privacy
• 9. Summary of Complaints and Actions Taken
• 10. Material Privacy Breaches
• 11. Privacy Impact Assessments
• 12. Public Interest Disclosures
• 13. Monitoring Compliance
• 14. Looking Ahead
• 15. Appendices
  • Appendix A: Delegation Order
  • Appendix B: Statistical Report on the Privacy Act

1. Introduction

The Privacy Act provides individuals with the right to access and request corrections to their personal information held by federal institutions. It also establishes rules for how federal institutions collect, use, disclose, retain, and protect personal information.

This annual report outlines how the Impact Assessment Agency of Canada (IAAC) administered the Privacy Act during the 2024-2025 fiscal year. It is submitted in accordance with section 72 of the Privacy Act, which requires federal institutions to prepare and table a report in Parliament each year.

IAAC is committed to transparency and accountability while safeguarding the privacy rights of individuals. IAAC confirms it does not oversee any non-operational institutions or paper-based subsidiaries for the purposes of Privacy Act reporting.

2. About the Impact Assessment Agency of Canada

IAAC is the federal body accountable to the Minister of Environment and Climate Change that leads and manages the impact assessment process for all federally designated major projects. Its mandate is to help Canada achieve sustainable development by evaluating the environmental, economic, social, and health effects of proposed projects and recommending measures to enhance benefits and mitigate adverse impacts. Through these assessments, IAAC ensures projects are designed and carried out in a way that protects the environment and upholds Indigenous rights while providing clarity and predictability for proponents and investors.

To deliver on this mandate, IAAC coordinates Crown consultation with Indigenous Peoples, offers public participation opportunities and funding, and works closely with provinces, territories, regulators, and international partners to promote a “one-project, one-review” approach. IAAC also monitors compliance with federal conditions of approval, supports research and guidance on best practices, and continually refines its processes to provide transparent, science-based, and timely decisions.

3. Organizational Structure

The Access to Information and Privacy Office (the ATIP Office) is housed within IAAC’s Corporate Services Sector. It is responsible for administering both the Access to Information Act and the Privacy Act. The ATIP Coordinator leads the privacy function and is supported by one ATIP Analyst. The ATIP Coordinator reports directly to the Head of Information and Data Governance, ATIP and Litigation.

During the reporting period, no service agreements under section 73.1 of the Privacy Act were established or maintained.

4. Delegation of Authority

Pursuant to section 73 of the Privacy Act, IAAC’s President delegated responsibilities under the Act to Vice-Presidents, General Counsel, the ATIP Coordinator, and the Head of Information and Data Governance, ATIP and Litigation. The ATIP Coordinator is responsible for operational functions including processing requests, conducting consultations, monitoring compliance, and preparing reports.

A copy of the Delegation of Authority Instrument in effect during the reporting period is provided in Appendix A.

5. Performance for the 2024-2025 Fiscal Year

During the 2024-2025 reporting period, IAAC received four requests under the Privacy Act. No requests were carried over from the previous fiscal year. Of the four requests received, three (75%) were completed within legislated timelines, and one (25%) was carried forward into the next reporting period. As of March 31, 2025, the request that was carried over was still within legislated timelines. Among the completed requests, one (33%) resulted in a partial disclosure, while two (67%) were abandoned. All requests were processed electronically. IAAC did not receive any consultations from other federal institutions and did not receive or conclude any complaints through the Office of the Privacy Commissioner. Of the three completed requests, two (67%) were completed within 1 to 30 days, and one (33%) was completed within 31 to 60 days.

A detailed statistical report for this period is available in Appendix B.

6. Training and Awareness

To support compliance with the Privacy Act, IAAC continued to promote awareness across the organization. On an ad hoc basis, certain employees were reminded to complete the mandatory privacy training offered through the Canada School of Public Service. The ATIP Coordinator also provided guidance and tailored support to program areas handling personal information.

7. Policies, Guidelines, and Procedures

During the 2024-2025 fiscal year, IAAC did not implement or revise any policies, guidelines, or procedures specific to the Privacy Act. No new collections or consistent uses of Social Insurance Numbers were introduced.

8. Initiatives and Projects to Improve Privacy

IAAC continued to strengthen internal processes by promoting privacy best practices through initiatives such as an Information Management Clean-Up Day. Messaging emphasized the proper handling and secure disposal of personal information. These efforts supported greater awareness and reinforced the importance of protecting personal information across IAAC.

9. Summary of Complaints and Actions Taken

IAAC did not receive or conclude any complaints under the Privacy Act during the reporting period.

10. Material Privacy Breaches

No material privacy breaches were reported to the Office of the Privacy Commissioner or to the Treasury Board Secretariat.

11. Privacy Impact Assessments

IAAC did not conduct any Privacy Impact Assessments during the reporting period as no new or substantially modified programs met the criteria.

12. Public Interest Disclosures

IAAC did not make any disclosures of personal information under paragraph 8(2)(m) of the Privacy Act.

13. Monitoring Compliance

All request deadlines under the Privacy Act were tracked using IAAC’s secure case management system. The ATIP Coordinator monitored performance weekly and discussed any concerns with the Head of Information and Data Governance, ATIP, and Litigation as needed.

In addition, privacy requirements were embedded into operational tools such as procurement templates, onboarding forms, and standard operating procedures to ensure the appropriate handling of personal information.

14. Looking Ahead

IAAC is committed to continuously improving its privacy practices. In the next reporting year, the ATIP Office will focus on providing refresher training, raising awareness in sectors managing personal information, and reviewing privacy protocols to align with evolving Government of Canada standards.

15. Appendices

• Appendix A: Delegation Order
• Appendix B: Statistical Report on the Privacy Act

Appendix A: Delegation Order

Privacy Act

Pursuant to section 73 of the Privacy Act, as the head of the Impact Assessment Agency of Canada, I hereby designate the officers and employees of the Impact Assessment Agency of Canada who hold the positions specified in the attached Schedule to exercise or perform any of the powers, duties, or functions vested in me under the provisions of the Privacy Act as specified in the Schedule.

This Delegation Order is issued in accordance with the authority conferred by the Privacy Act and shall take effect immediately upon issuance.

Original signed July 17, 2025 by Terence Hubbard, President, Impact Assessment Agency of Canada.

Schedule - Delegation Order (Privacy Act)

The Head of Information and Data Governance, ATIP and Litigation, the Access to Information and Privacy Coordinator, the Vice-Presidents, and the General Counsel who report directly to the President of the Impact Assessment Agency of Canada are hereby designated to exercise or perform any of the powers, duties, or functions of the President as head of the Impact Assessment Agency of Canada under the provisions of the Privacy Act listed below. This Delegation replaces all previous delegation orders.

Privacy Act

Appendix B: Statistical Report on the Privacy Act

Name of institution: Impact Assessment Agency of Canada

Reporting period: 2024-04-01 to 2025-03-31

Section 1: Requests under the Privacy Act

1.1a Number of requests received

1.1b Number of requests carried into next reporting period

1.2 Channels of requests

Section 2: Informal requests

2.1a Number of informal requests received

2.1b Number of informal requests carried into next reporting period

2.2 Channels of informal requests

2.3 Completion time of informal requests

2.4 Pages released informally

Section 3: Requests closed during the reporting period

3.1 Disposition and completion time

3.2 Number of exemptions per section of the Privacy Act

3.3 Number of exclusions per section of the Privacy Act

3.4 Format of information released

3.5 Complexity

3.5.1 Relevant pages processed and disclosed for paper and e-record formats

3.5.2 Relevant pages processed per request disposition for paper and e-record formats by size

3.5.3 Relevant minutes processed and disclosed for audio formats

3.5.4 Relevant minutes processed per request disposition for audio formats for all sizes of requests

3.5.5 Relevant minutes processed and disclosed for video formats

3.5.6 Relevant minutes processed per request disposition for video formats for all sizes of requests

3.5.7 Other complexities

3.6 Closed requests

3.6.1 Requests closed within legislated timelines

3.7 Deemed refusals

3.7.1 Reasons for not meeting legislated timelines

3.7.2 Requests closed beyond legislated timelines (including any extension taken)

3.8 Requests for translation

Section 4: Disclosure under Subsection 8(2) and 8(5)

4.1 Disclosure

Section 5: Requests for correction of personal information and notations

5.1 Disposition for correction requests received

Section 6: Extensions

6.1a Reasons for extensions under 15(a)(i) interference with operations

6.1b Reasons for extensions under 15(a)(ii) consultations

6.1c Reasons for extensions under 15(b) translation purposes or conversion

6.2a Length of extensions under 15(a)(i) interference with operations

6.2b Length of extensions under 15(a)(ii) consultations

6.2c Length of extensions under 15(b) translation purposes or conversion

Section 7: Consultations received from other institutions and organizations

7.1a Consultations received from other Government of Canada institutions

7.1b Number of consultation requests from other Government of Canada institutions carried into next reporting period

7.1c Consultations received from other organizations

7.1d Number of consultation requests from other organizations carried into next reporting period

7.2 Recommendations and completion time for consultations received from other Government of Canada institutions

7.3 Recommendations and completion time for consultations received from other organizations outside Government of Canada

Section 8: Completion time of consultations on Cabinet confidences

8.1 Requests with Legal Services for all sizes

8.2 Requests with Privy Council Office

Section 9: Complaints and investigation notices received

9.1 Investigations

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks

10.1 Privacy Impact Assessments

10.2 Institution-specific and Central Personal Information Banks

Section 11: Privacy breaches

11.1 Material privacy breaches reported

11.2 Non-material privacy breaches

Section 12: Resources related to the Privacy Act

12.1 Allocated costs

12.2 Human resources