2024-2025 Annual Report on the administration of the Privacy Act
Published by: National Film Board of Canada
© National Film Board of Canada, 2025
ISSN 2816-2633
Cat.No. NF1-9E-PDF
1. INTRODUCTION
The Privacy Act (the “Act”) gives Canadian citizens, permanent residents and individuals present in Canada the right to access their personal information held by the Government of Canada. It also protects against unauthorized disclosure of that personal information. In addition, it strictly controls how the federal government will collect, use, store, disclose and dispose of any personal information.
Section 72 of the Act requires the head of every federal government institution to submit a report to Parliament on the administration of the Act at their institution each fiscal year.
This report was prepared pursuant to section 72 of the Act and describes how the National Film Board of Canada (the “NFB”) administered the Act in fiscal year 2024–2025.
The NFB’s mandate is to create relevant and innovative audiovisual content that interprets Canada and its diversity to Canadians and people around the world. The NFB works with filmmakers and artists from every region of Canada to produce exceptional documentaries and animation films rooted in Canadian experiences and realities. The NFB has long been a champion of technological and film innovation, both nationally and internationally. The NFB seeks to reflect the perspectives and experiences of communities that are underrepresented in the media and to develop innovative new storytelling forms and approaches.
2. ORGANIZATIONAL STRUCTURE
In accordance with section 73 of the Act, the Government Film Commissioner appoints the following individuals to administer the Act:
- the Senior Privacy Coordinator;
- the Senior Legal Counsel.
The NFB has no official entity tasked with processing access to personal information requests. The requests are forwarded to the Senior Privacy Coordinator, who is part of the Business Affairs and Legal Services department.
The Senior Privacy Coordinator is also responsible for coordination pursuant to the Access to Information Act. There are no other ATIP (Access to Information and Privacy) officers at the NFB.
The NFB was not party to any service agreement under section 73.1 of the Act during the period covered by this report.
3. DELEGATION ORDER
A copy of the Delegation Order is attached as Appendix A.
4. 2024–2025 PERFORMANCE
The 2024-2025 Statistical Report on the Privacy Act and the Supplemental ATIP Statistical Report for 2024-2025 were submitted to the Treasury Board of Canada Secretariat.
Percentage of requests responded to within legislated timelines
From April 1, 2024, to March 31, 2025, the NFB did not receive any requests for personal information.
Release of records
No records released.
Number of active requests that are outstanding from previous reporting periods
There are no active requests outstanding from previous reporting periods.
Number of active complaints that are outstanding from previous reporting periods
There are no active complaints outstanding from previous reporting periods.
Consultations
In 2024-2025, the NFB did not receive any consultation requests from other Government of Canada institutions or organizations.
5. TRAINING AND AWARENESS
During the reporting period, the Senior Privacy Coordinator emphasized on practical, team-based discussions to support employees in understanding how privacy principles apply to their specific responsibilities. Instead of formal training sessions, the approach prioritized direct conversations and informal briefings focused on workplace situations. These exchanges addressed privacy concerns and cybersecurity risks relevant to the NFB’s operations. Meetings were notably held with the Information Technology (IT) and IT Security teams to review privacy considerations in system design and incident response. Additional sessions were conducted with production and other internal teams to address specific concerns, including data-handling practices, policy compliance, and risk mitigation in daily workflows.
All new NFB employees are required to take the online course “Access to Information and Privacy Fundamentals” (COR502), from the Canada School of Public Service.
6. POLICIES, GUIDELINES, PROCEDURES AND INITIATIVES
During the reporting period, the NFB developed and finalized several institution-specific privacy policies and procedures, most notably its general privacy policy, which was published on the institutional website to provide clear guidance on the handling of personal information across all activities. Furthermore, a clause on the sharing of personal information for inclusion in new employment contracts was drafted, as well as a privacy protection clause for the workplace accommodation policy. A protocol was also developed to govern the use of personal information for non-administrative purposes.
The NFB is working to improve consent mechanisms, particularly in the digital realm, to ensure that individuals have a clear understanding of how their personal information will be used and to have the ability to provide informed consent.
The NFB has improved its security measures to protect personal information, including encryption, anonymization and access controls.
Furthermore, we have updated our privacy policy to reflect our ongoing efforts to protect personal information collected through equity, diversity and inclusion (EDI) self-declaration questionnaires.
7. INITIATIVES AND PROJECTS TO IMPROVE PRIVACY
The NFB implemented a range of initiatives aimed at improving access to personal information and strengthening privacy practices. These included internal consultations on privacy-related matters, the development of tools to support responsible use of emerging technologies, and the management of requests for the deletion of personal information from internal systems.
8. SUMMARY OF KEY ISSUES AND ACTIONS TAKEN ON COMPLAINTS
The NFB was not the subject of any complaints to the Office of the Privacy Commissioner of Canada during the period covered by this report.
9. MATERIAL PRIVACY BREACHES
One material privacy breach was reported to the Office of the Privacy Commissioner and the Treasury Board of Canada Secretariat during the reporting period.
The breach involved unauthorized access to a user account following a phishing incident. Limited personal information was exposed through email attachments. Immediate containment and mitigation measures were implemented, including enhanced monitoring, system security updates, and notification to affected individuals. Identity protection services were also offered as a precautionary measure.
10. PRIVACY IMPACT ASSESSMENTS (PIA)
During the reporting period, no Privacy Impact Assessments (PIAs) were completed.
11. PUBLIC INTEREST DISCLOSURES
No personal information was disclosed in compliance with clause 8(2)m) of the Act.
12. MONITORING COMPLIANCE
To ensure compliance with privacy obligations, the NFB integrated privacy considerations into its internal processes and contractual arrangements. This included reviewing and advising on access to institutional systems, addressing privacy concerns in various operational contexts, and ensuring that published data respects privacy principles. The Senior Privacy Coordinator also collaborated with IT teams to assess and classify sensitive information within data sources, supporting a culture of privacy awareness and accountability.
APPENDIX A
DELEGATION ORDER
PRIVACY ACT
