Parole Board of Canada Annual Report to Parliament on the Privacy Act 2022-2023

About this publication

Author: Parole Board of Canada
ISSN 2564-0224

Introduction

In accordance with section 72 of the Privacy Act, an annual report to Parliament on the administration of the Privacy Act is prepared each fiscal year and tabled in Parliament. This report covers the period from April 1, 2022 to March 31, 2023.

Purpose of the Privacy Act

The Privacy Act provides citizens or permanent residents of Canada with the right of access to personal information held by the government and the protection of that information against unauthorized use and disclosure. The Privacy Act has provisions on the collection, retention and disposal of personal information. Under the Privacy Act, access is given to any personal information about the individual contained in a personal information bank, and any other personal information about the individual under the control of a government institution that is reasonably retrievable by the government institution. The Privacy Act allows for the correction of personal information where the individual believes there is an error or an omission. This may require that a notation be attached to the information reflecting any correction requested but not made.

Mandate of the Parole Board of Canada

The Parole Board of Canada (PBC) is an independent administrative tribunal. The PBC is headed by a Chairperson who reports to Parliament through the Minister of Public Safety.

The Parole Board of Canada, as part of the criminal justice system, contributes to the protection of society by facilitating, as appropriate, the timely reintegration of offenders and the sustained rehabilitation of individuals into society as law-abiding citizens. The Board makes independent, quality conditional release, record suspension and expungement decisions, as well as clemency recommendations, in a transparent and accountable manner, while respecting diversity and the rights of offenders and victims.

The PBC has exclusive authority under the Corrections and Conditional Release Act (CCRA) to grant, deny, cancel, terminate or revoke day parole and full parole. The Board may order certain offenders to be detained in prison until the end of their sentence. The Board makes conditional release decisions for federal offenders as well as for provincial offenders in provinces and territories that do not have their own provincial boards. The provinces of Ontario, Quebec and Alberta have their own parole boards.

The PBC is responsible for making decisions to order, refuse to order and revoke record suspensions (pardons) under the Criminal Records Act (CRA) and the Criminal Code. A record suspension is a formal attempt to remove the stigma of a criminal record for people who, having been convicted of an offence, have satisfied the sentence and remained crime-free for a prescribed number of years. The PBC also has legislated responsibility to order or refuse to order expungement of a conviction under the Expungement of Historically Unjust Convictions Act (Expungement Act). The Board also makes recommendations for the exercise of clemency through the Royal Prerogative of Mercy.

The PBC is comprised of full-time employees as well as Board members appointed by the Governor-in-Council. The PBC's National Office is located in Ottawa and there are six regional offices located in: Moncton (Atlantic), Montreal (Quebec), Kingston (Ontario), Saskatoon and Edmonton (Prairies), and Abbotsford (Pacific). The Appeal Division of the Board is located in Ottawa.

Organizational Structure of the PBC to Fulfill its Privacy Act Responsibilities

The Access to Information and Privacy (ATIP) Unit is led by the Director of Public Affairs and Partnerships, who reports to the Deputy Chairperson of the PBC. The ATIP Unit is responsible for:

• processing and responding to all formal requests under the Privacy Act;
• answering interdepartmental consultations;
• handling complaints from the Office of the Privacy Commissioner;
• advising senior officials and employees on privacy-related issues;
• producing the Annual Report to Parliament;
• updating Info Source;
• training employees;
• replying to informal inquiries; and
• coordinating and implementing policies, guidelines and procedures to ensure compliance with the Privacy Act.

The Director, Public Affairs and Partnerships, and the Manager, ATIP are responsible for administering the legislation and signing exemptions within their delegated authority. They are also responsible for giving advice and guidance to departmental officials on matters involving the Privacy Act. In 2022-2023, ATIP staff consisted of one Director, one ATIP Manager, one Senior ATIP Analyst, one ATIP Analyst and one ATIP Clerk. All ATIP staff are located at National Office, however most ATIP staff telework several times a week, in accordance with the PBC’s Telework Policy.

Requests are processed as follows: completeness of the request is determined; the ATIP Manager and the ATIP Analysts ensure the signature from the records is the same as the signature on the privacy request form; and if in doubt, the requestor is contacted concerning the validity of their identity. For individuals making a request on behalf of another individual, we ensure a signed consent form is obtained and the signature from the records is the same as the signature on the consent form. The request is acknowledged; a search for relevant records is conducted; records are analyzed under the provisions of the legislation, and other agencies/ministries and policing services are consulted where appropriate; any necessary exemptions are applied; and, the applicant is provided with non-exempted material.

A tracking system is used to log all actions taken. Consultations (mainly with policing services) take place in most cases when other institutions' information is found in the PBC’s files, and their recommendations are normally followed.

Reading rooms are available in each of the six regional offices of the PBC as well as at National Office.

Delegation Order

Some powers, duties and functions for the administration of the Privacy Act have been delegated to the Chairperson, Executive Vice-Chairperson, Deputy Chairperson, Director of Public Affairs and Partnerships, and to the ATIP Manager. For a copy of the signed delegation order, please refer to Annex A.

Interpretation of the Statistical Report for the 2022-2023 Reporting Period

For a copy of the Statistical Report, please refer to Annex B.

PART 1 – Requests under the Privacy Act

1.1 Number of requests received

Two hundred and fifty-seven (257) requests were received in 2022-2023 and twelve (12) requests were outstanding from the previous reporting period, 2021-2022. Two hundred and forty-nine (249) requests were completed during the 2022-2023 reporting period.

Twenty (20) requests received in 2022-2023 were carried over to fiscal year 2023-2024 and processed within legislated timelines as of March 31, 2023.

Requests under the Privacy Act are highlighted in the graph below for the past four fiscal years.

1.2 Channels of requests

Of the requests received, 81% were received by email, 4% by mail and 15% online.

PART 2 – Informal Requests

There were no informal requests. This is consistent with past trends at the PBC.

PART 3 – Requests Closed During the Reporting Period

3.1 Disposition and Completion Time

Of the two hundred and forty-nine (249) requests completed, information was disclosed in part in response to one hundred and seventy-four (174) requests and disclosed in full for thirty-four (34) requests. The PBC had no records for twenty-eight (28) requests, nine (9) requests were abandoned, two (2) were neither confirmed nor denied and two (2)requests were all exempt. The PBC routinely receives many requests from members of the public that should have been submitted to other Federal Government departments. When such requests are received, the requesters are notified on how and where they should submit their Privacy request.

Of these 249 requests, 52% were processed within 15 days, 29% were processed from 15-30 days, and 19% of requests were processed within 31-60 days.

3.2 Exemptions

Sections 19(1)(c) & (d) (Personal information obtained in confidence) were the exemptions invoked the most, followed by Section 26 (Personal Information) and 22(1)(b) (Law enforcement and investigations).

3.3 Exclusions

No exclusions were cited this reporting period.

3.4 Format of Information Released

The format of information released was electronic for the majority of the requests (73%), paper format (15%), and the balance of the requests disclosed in other format (12%).

3.5 Complexity

3.5.1 Relevant Pages Processed and Disclosed for paper and e-record formats

Overall, 50,085 pages were processed this past fiscal year from 221 requests, which represents an increase of 28% for pages processed and a decrease of 34% in requests processed during the last fiscal year.

3.5.2 Relevant Pages Processed by request disposition for paper and e-records formats by size of requests

One hundred and twenty-four (124) requests had 100 pages or fewer processed. Sixty-five (65) had between 101-500 pages processed. Twenty-two (22) had between 501-1,000 pages processed. Ten (10) had between 1,001 and 5,000 pages processed.

3.5.3 Relevant minutes processed and disclosed for audio formats

Two (2) audio requests were received.

3.5.4 Relevant minutes processed per request disposition for audio formats by size of requests

A total of 304 minutes were processed and fully released.

3.5.5 Relevant minutes processed and disclosed for video formats

There were no requests for videos.

3.5.6 Relevant minutes processed per request disposition for video formats by size of requests

There were no requests for videos.

3.5.7 Other complexities

PBC files remain relatively complex. Of the 249 requests processed with records, 32 had complexities.

3.6 Closed Requests

3.6.1 Number of Requests Closed within Legislated Timeframes

100% of the requests closed during 2022-2023 were closed within the legislated timeframes.

3.7 Deemed Refusals

3.7.1 Reasons for not meeting legislated timelines

There were no deemed refusals during this reporting period.

3.7.2 Requests closed beyond legislation timelines (including any extension taken)

There were no deemed refusals during this reporting period.

3.8 Requests for Translations

There were no requests for translations. This is consistent with past trends at the PBC.

PART 4 – Disclosures Under Subsection 8(2) and 8(5)

There were two (2) disclosures made under 8(2)(e) this past fiscal. There were no disclosures made under 8(2)(m) and 8(5) during this reporting period.

PART 5 – Requests for Correction of Personal Information and Notations

There were no requests for correction of Personal Information during this period.

PART 6 – Extensions

6.1 Reasons for Extensions and Disposition of Requests

Consistent with past trends at the PBC, the majority of the 76 extensions taken were for consultation purposes listed in the other category, and had files with a disposition of disclosed in part. A comparison of the types of extensions taken is shown below.

6.2 Length of extensions

All extensions taken were for between 16-30 days.

PART 7 – Consultations Received from Other Institutions and Organizations

7.1 Consultation received from other Government of Canada Institutions and other Organizations

Four (4) consultations from other Government institutions and organizations were processed.

7.2 Recommendations and Completion Time for Consultations Received from other Government of Canada Institutions

One (1) consultation received was completed within 1-15 days and had a recommendation of disclosed in part. The remaining three (3) consultations received were completed within 1-15 days and were disclosed entirely.

7.3 Recommendations and Completion Time for Consultations Received from other Organizations

There were no consultations received from other organizations.

PART 8 – Completion Time of Consultations on Cabinet Confidences

8.1 Requests with Legal Services

There was no consultation on Cabinet Confidences with Legal Services this past fiscal year.

8.2 Requests with Privy Council Office

There was no consultation on Cabinet Confidences with the Privy Council Office this past fiscal year.

PART 9 – Complaints and Investigations Notices Received

No complaints were received for this reporting period.

Two (2) complaints (Refusal – General) were carried over from the reporting period 2020-2021 and 2021-2022 and have been carried over into 2023-2024.

PART 10 – Privacy Impact Assessments (PIA) and Personal Information Banks (PIB)

10.1 Privacy Impact Assessments

No Privacy Impact Assessments were completed or modified during this reporting period.

10.2 Institution-specific and Central Personal Information Banks

No new Personal Information Banks were created or modified during this reporting period. Seven (7) institutional Personal Information Banks exist.

PART 11 – Material Privacy Breaches

11.1 Material Privacy Breaches reported

There were no Material Privacy Breaches reported during this reporting period.

11.2 Non-Material Privacy Breaches reported

There were eighteen (18) non-material privacy breaches reported during this reporting period.

PART 12 – Resources Related to the Privacy Act

Total salary costs associated with the Privacy Act activities were $275,084 for 2022-2023. Goods and services costs were $3,456. The associated full-time equivalency (FTE) human resources were 3.10. Included in the salary costs attributable to the Privacy Act are the costs associated with the administration of the Act. These are the salary costs of individuals working on privacy activities such as processing privacy requests, assisting the Office of the Privacy Commissioner in complaint investigations, processing consultation requests from other government institutions, preparing reports, maintaining statistics and working on privacy policy initiatives. A comparison of costs associated with the Privacy Act is shown below.

Formal/Informal Interface

The PBC shares a great deal of file information with offenders in contexts other than the processing of requests under the Privacy Act. For example, information is shared during hearings with offenders and when notifying them of its decisions. In carrying out such duties, the Board must comply with the Corrections and Conditional Release Act (CCRA). Section 141 of the CCRA states that at least 15 days before the review date of an offender, the PBC shall provide or cause to be provided to the offender, in writing, the information that is to be considered in the review of the case or a summary of that information. This process, therefore, may allow for the sharing of more information than would be otherwise permitted under the provisions of the Privacy Act.

Furthermore, the CCRA gives Canadian citizens greater access to information about offenders. The CCRA provides for:

1. A Decision Registry containing all conditional release decisions made by the PBC since November 1992, and which is accessible to anyone who demonstrates an interest in a specific case or group of cases, by written request;
2. Access by victims to some offender-related information, and
3. Members of the public to attend PBC hearings.

This law has an important impact on the disclosure of offender-related personal information to third parties.

Impacts of COVID-19

For the current reporting period, the ATIP Unit did not experience any impacts related to COVID-19 and it continued to complete all existing and new requests within legislative timeframes. ATIP Unit employees have worked a blend of in-office and remote work throughout the pandemic, which has provided for a flexible work environment that has allowed the Unit to effectively adapt to the pandemic as it has continued to evolve.

Training Activities

The PBC requires all of its public service staff to complete the online course “Access to Information and Privacy Fundamentals” as part of their Collective Learning Roadmap. One (1) training session on the Access and Privacy Act was also delivered to new Board members and employees by the ATIP Manager. Some examples of the types of information provided to Board members and employees this past fiscal year include: information regarding the collection, correction, use and disclosure of personal information; writing privacy notice statements; and handling privacy breaches. These training sessions were given to approximately nineteen (19) Board members and employees.

The PBC continues to have an ATIP training tool on its internal website. The training tool provides information to staff about the roles and responsibilities of each Parole Board employee in relation to the Privacy Act and emphasizes that all employees have a role to play when it comes to the collection, retention, disposal and protection of personal information. In addition, the PBC continued to expand privacy training by finalizing and posting the privacy principles on its internal website.

Revised PBC-related Policies, Guidelines and Procedures

The ATIP Unit will continue to be involved in the creation and revision of forms throughout the PBC. During the reporting period, PBC also began conducting privacy verifications on the shared drives in order to ensure that employees’ access to personal information respects the need-to-know principle.

The PBC did not receive authority for a new collection or new consistent use of the SIN in 2022-2023.

Initiatives and Projects to Improve Privacy

In order to improve access to personal information and privacy within the Parole Board of Canada, we have been working on implementing the following activities:

• Looking at improvements to modernize the delivery of services by promoting the ATIP Online to requesters.
• Updating our current ATIP digital software.

Key Issues and Actions Taken on Complaints

No complaints were received for this reporting period.

Two (2) complaints (Refusal – General) were carried over from the reporting period 2020-2021 and 2021-2022 and have been carried over into 2023-2024.

Monitoring the Time to Process Privacy requests and Requests for Correction

The PBC monitors the time to process all privacy requests and requests for correction through the use of a computerized tracking system. Monitoring is done on a weekly basis by the ATIP Manager and reported to the Director, Public Affairs and Partnerships. As all Privacy requests were processed within the legislative timeframes for the current reporting period, no additional monitoring is required.

Material Privacy Breaches

There were no material privacy breaches during this reporting period.

Privacy Impact Assessments

No Privacy Impact Assessments were completed during this reporting period.

Public Interest Disclosures

There were no disclosures made under 8(2)(m) and 8(5) during this reporting period.

ANNEX A: Delegation - Privacy Act

Privacy Act Delegation Order

By this order made pursuant to section 73(1) of the Privacy Act, I hereby authorize those officers and employees of the Parole Board of Canada occupying, on an acting basis or otherwise, the positions identified within the attached schedule to perform on my behalf any of the powers, duties or functions specified therein.

This delegation replaces and repeals all previous orders.

Dated at the City of Ottawa,
this 28^th, day of Feb, 2022

Marco E. L. Mendicino, P.C.,M.P.
Public Safety Canada