Parole Board of Canada Annual Report to Parliament on the Privacy Act 2017-2018

Introduction

In accordance with section 72 of the Privacy Act, an annual report to Parliament on the administration of the Privacy Act is prepared each fiscal year. This report covers the period from April 1, 2017 to March 31, 2018. This Annual Report is tabled in Parliament in accordance with section 72 of the Privacy Act.

Purpose of the Privacy Act

The Privacy Act provides citizens or permanent residents of Canada with the right of access to personal information held by the government and the protection of that information against unauthorized use and disclosure. The Privacy Act has provisions on the collection, retention and disposal of personal information. Under the Privacy Act, access is given to any personal information about the individual contained in a personal information bank, and any other personal information about the individual under the control of a government institution that is reasonably retrievable by the government institution. The Privacy Act allows for the correction of personal information where the individual believes there is an error or an omission. This may require that a notation is attached to the information reflecting any correction requested but not made.

Mandate of the Parole Board of Canada

The PBC is an agency that reports to Parliament through the Minister of Public Safety.

The Board is an independent administrative tribunal that has exclusive authority under the Corrections and Conditional Release Act (CCRA) to grant, deny, cancel, terminate or revoke day parole and full parole. The Board may order certain offenders to be held in prison until the end of their sentence. This is called detention during the period of statutory release. The PBC contributes to the protection of society by facilitating, as appropriate, the timely reintegration of offenders as law-abiding citizens. The Board makes parole decisions for federal offenders serving sentences of two years or more and for provincial offenders serving six months to two years less a day in provinces and territories outside Ontario and Quebec where there are no provincial parole boards.

The PBC is also responsible for making decisions to order, refuse to order and revoke record suspensions under the Criminal Records Act (CRA) and the Criminal Code. A record suspension is a formal attempt to remove the stigma of a criminal record for people who, having been convicted of an offence, have satisfied the sentence and remained crime-free. The Board also makes recommendations for the exercise of clemency through the Royal Prerogative of Mercy.

The Board is comprised of full-time employees as well as Board members appointed by the Governor-in-Council. The PBC's national office is located in Ottawa and there are six regional offices located in: Moncton (Atlantic), Montreal (Quebec), Kingston (Ontario), Saskatoon and Edmonton (Prairies), and Abbotsford (Pacific). The Appeal Division of the Board is located in Ottawa.

Organizational structure of the PBC to fulfill its Privacy Act responsibilities

The Access to Information and Privacy (ATIP) Division is led by the Director of Public Affairs, who reports directly to the Executive Director General of the PBC. ATIP is responsible for:

• processing and responding to all formal requests under the Privacy Act;
• answering interdepartmental consultations;
• handling complaints from the Office of the Privacy Commissioner;
• advising senior officials and employees on privacy-related issues;
• producing the Annual Report to Parliament;
• updating Info Source;
• training employees;
• replying to informal inquiries; and
• coordinating and implementing policies, guidelines and procedures to ensure compliance with the Privacy Act.

The Director and Team Leaders are responsible for administering the legislation and signing exemptions within their delegated authority. They are also responsible for giving advice and guidance to departmental officials on matters involving the Privacy Act. In 2017-2018, ATIP staff consisted of: one Director, two Team Leaders, one Analyst and one ATIP Clerk. All ATIP staff is located at National Office.

Requests are processed as follows: completeness of the request is determined; ATIP analysts ensure the signature from the records is the same as the signature on the privacy request form; if in doubt the requestor is contacted concerning the validity of their identity. For individuals making a request on behalf of another individual we ensure a signed consent form is obtained and the signature from the records is the same as the signature on the consent form; the request is acknowledged; search for relevant records is conducted; records are analysed under the provisions of the legislation, other agencies/ministries and policing services are consulted where appropriate; any necessary exemptions are applied and the applicant is provided with non-exempted material.

A tracking system is used to log all actions taken. Consultations (mainly with policing services) take place in most cases when other institutions' information is found in the Board’s files and their recommendations are normally followed.

Reading rooms are in operation in each of the five regional offices of the Board as well as at National Office.

Delegation Order

Some powers, duties and functions for the administration of the Privacy Act have been delegated to the Chairperson, the Executive Vice-Chairperson, the Director of Public Affairs, and to the Team Leaders. For a copy of the signed delegation order, please refer to Appendix A.

Interpretation of the Statistical Report for the 2017- 2018 reporting period

For a copy of the Statistical Report, please refer to Appendix B.

Part 1 – Requests under the Privacy Act

Three hundred sixty-five (365) requests were received and 356 requests were completed during the 2017-2018 reporting period. Twenty-eight (28) requests will be carried over to fiscal year 2018-2019 and 19 were outstanding from fiscal year 2016-2017. Requests under the Privacy Act are highlighted in the graph below for the past four fiscal years.

Part 2 – Requests Closed During the Reporting Period

2.1 Disposition and Completion Time

Of the 356 requests completed, information was disclosed in part in response to 201 requests and in full for 111 requests. The Board had no records for 38 requests and 6 requests were abandoned. The Board routinely receives many privacy requests from members of the public who do not have a file with the Board.

The majority of requests (42%) were processed within 15 days, 31% were processed from 15-30 days and 27% of requests were processed within 31-60 days.

2.2 Exemptions

Consistent with past fiscal years, Section 26 was the exemption invoked the most, followed by 19(1)(c), 19(1)(d) and 22(1)(c). A comparison chart of all exemptions invoked over the past two fiscal years is shown below.

2.3 Exclusions

No exclusion was cited this reporting period. 

2.4 Format of Information Released

The format of information released was paper for 60% of requests processed. This is a decrease in comparison with last fiscal year at the Board.

2.5.1 Relevant Pages Processed and Disclosed

Overall, 81,086 pages were processed this past fiscal year from 312 requests with records, an increase of 4,548 pages over last fiscal year.

2.5.2 Relevant Pages Processed and Disclosed by Size of Request

One hundred ninety (190) requests had 100 pages or fewer. Eighty-four (84) had between

101-500 pages processed. Twenty-one (21) had between 501-1,000 pages and twenty-three (23) had between 1,001 and 5,000 pages processed.

2.5.3 Other Complexities

Board files remain relatively complex. Of the 312 requests processed with records, 107 required consultations and 156 requests had interwoven information.

2.6 Deemed Refusals

No deemed refusals were recorded this past fiscal year.

2.7 Requests for Translations

There were no requests for translations. This is consistent with past trends at the Board.

Part 3 – Disclosures under Subsection 8(2) and 8(5)

Subsection 8(2)(m) provides that personal information may be disclosed for any purpose where, in the opinion of the head of an institution, the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure, or where the disclosure would clearly benefit the individual to whom the information relates. In general, disclosures under 8(2)(m) are assessed on a case-by-case basis and in accordance with Treasury Board guidelines. No disclosures were made under 8(2)(m) (public interest) or 8(5) this past fiscal.

Part 4 – Requests for Correction of Personal Information and Notations

There were no requests for correction of Personal Information during this period.  Generally, offenders use the Corrections and Conditional Release Act to request a correction of their personal information.

Part 5 – Extensions

Consistent with past trends at the Board, the majority of the 111 extensions were taken for consultation purposes listed in the other category, had files with a disposition of disclosed in part and the extensions taken were for between 16-30 days. A comparison of the types of extensions taken is shown below.

Part 6 – Consultations received from other Institutions and Organizations

Six (6) consultations from other institutions were processed. All six were completed within 1-15 days. Sixty-seven percent (67%) of the consultations had a recommendation of all disclosed. No consultations were received from other organizations. This is consistent with past trends at the Board.

Part 7 – Completion time of Consultations on Cabinet Confidences

There was no consultation on Cabinet Confidences with Legal Services or Privy Council Office this past fiscal year.

Part 8 – Complaints and Investigations Notices received

There was one complaint received from the Office of the Privacy Commissioner during this reporting period and no investigations were concluded. The privacy complaint is still open.

Part 9 – Privacy Impact Assessments (PIAs)

One Privacy Impact Assessment regarding Victim’s Access to Audio Recording of Parole Board of Canada Hearing was completed during this reporting period.

Part 10 – Resources Related to the Privacy Act

Total salary costs associated with the Privacy Act activities were $282,862 for 2017-2018. Goods and services costs were $5,557. The associated full-time equivalency (FTE) human resources were 3.80 same as last fiscal year. Included in the salary costs attributable to the Privacy Act are the costs associated with the administration of the Act. These are the salary costs of individuals working on privacy activities such as processing privacy requests, assisting the Office of the Privacy Commissioner in complaint investigations, processing consultation requests from other government institutions, preparing reports, maintaining statistics and working on privacy policy initiatives. A comparison of costs associated with the Privacy Act is shown below.

Formal/informal interface

The Parole Board shares a great deal of file information with offenders in contexts other than the processing of requests under the Privacy Act. For example, information is shared during hearings with offenders and when notifying them of its decisions. In carrying out such duties, the Board must comply with the Corrections and Conditional Release Act (CCRA). Section 141 states that at least 15 days before the review date of an offender, the Board shall provide or cause to be provided to the offender, in writing, the information that is to be considered in the review of the case or a summary of that information. This process, therefore, may allow for the sharing of more information than would be otherwise permitted under the provisions of the Privacy Act.

Furthermore, the CCRA gives Canadian citizens greater access to information about offenders.  The CCRA provides for:

1. A decision registry containing all conditional release decisions made by the PBC since November 1992 and which is accessible to anyone who demonstrates an interest in a specific case or group of cases;
2. Access by victims to some offender-related information, and;
3. Members of the public to attend PBC hearings.

This law has an important impact on the disclosure of offender-related personal information to third parties.

Training Activities

Five (5) informal sessions on the Privacy Act including training for the new Board Members were performed by the Team Leader. Some examples of the type of information provided to Board employees this past fiscal year include: information regarding the collection, correction, use and disclosure of personal information, writing privacy notice statements, and handling privacy breaches. These training sessions were given to approximately 50 Board employees. There were no formal sessions provided.

The Board continues to have a training tool on its internal website. The training informs staff about the roles and responsibilities of each Parole Board employee in relation to the Privacy Act and emphasizes that all have a role to play when it comes to the collection, retention, disposal and protection of personal information. In addition, the Board continued to expand privacy training by finalizing and posting the privacy principles on its internal website.

Revised PBC-related policies, guidelines and procedures

The ATIP office will continue to be involved in the creation and revision of forms throughout the Board. PBC began privacy verifications on the shared drives in order to ensure that employee’s access to personal information respects the need-to-know principle.

Monitoring the time to process Privacy requests and requests for correction

The Board monitors the time to process all privacy requests and requests for correction through the use of a computerized tracking system. Monitoring is done by the analyst responsible for the request and does not involve advising other officials. As the Board is 100% compliant with the legislated timelines set out in the Act, additional monitoring is not required.

Material privacy breaches

There were no material privacy breaches during this reporting period.

Appendix A - Delegation Order Privacy Act

By this order made pursuant to section 73 of the Privacy Act, I hereby authorize those officers and employees of the Parole Board of Canada occupying, on an acting basis or otherwise, the positions identified within the attached schedule to perform on behalf any of the powers, duties or functions specified therein.

This delegation replaces and repeals all previous orders.

Original signed by
The Honourable Ralph Goodale, P.C., M.P.
Minister of Public Safety and Emergency Preparedness
Date: July 11, 2017.

Schedule 1

Delegation Order – Privacy Act

Delegation Order – Privacy Regulations

Appendix B - Statistical Report on the Privacy Act

Name of Institution: Parole Board of Canada

Reporting period: 2017-04-01 to 2018-03-31

Part 1 – Requests under the Privacy Act

Part 2 – Requests closed during the reporting period

2.1 Disposition and completion time

2.2 Exemptions

2.3 Exclusions

2.4 Format of information released

2.5 Complexity

2.5.1 Relevant pages processed and disclosed

2.5.2 Relevant pages processed and disclosed by size of requests

2.5.3 Other complexities

2.6 Deemed refusals

2.6.1 Reasons for not meeting statutory deadline

2.6.2 Number of days past deadline

2.7 Requests for translation

Part 3 – Disclosures under Subsections 8(2) and 8(5)

Part 4 – Requests for Correction of Personal Information and Notations

Part 5 – Extensions

5.1 Reasons for extensions and disposition of requests

5.2 Length of extensions

Part 6 – Consultations received from other institutions and organizations

6.1 Consultations received from other Government of Canada institutions and other organizations

6.2 Recommendations and completion time for consultations received from other Government of Canada institutions

6.3 Recommendations and completion time for consultations received from other organizations

Part 7 – Completion Time of Consultations on Cabinet Confidences

7.1 Requests with Legal Services

7.2 Requests with Privy Council Office

Part 8 – Complaints and Investigations notices received

Part 9 – Privacy Impact Assessments (PIAs)

Part 10 – Resources related to the Privacy Act

10.1 Costs

10.2 Human Resources