2024-2025 Annual Report to Parliament on the Privacy Act

Introduction

Privacy Act

The purpose of the Privacy Act (PA) is to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution and that provide individuals with a right of access to that information.

Mandate of the Privy Council Office

The Privy Council Office (PCO) reports directly to the Prime Minister and is headed by the Clerk of the Privy Council and Secretary to the Cabinet. PCO is both the Cabinet secretariat and the Prime Minister’s source of public service advice across the entire spectrum of policy questions and operational issues facing the Government. As the hub of non-partisan public service support to the Prime Minister, Cabinet and its decision-making structures, PCO ensures that the Government and Canadians are served by the highest quality public service.

PCO provides support to the Prime Minister, as well as to the Leader of the Government in the House of Commons, Minister of Transport and Internal Trade, the President of the King’s Privy Council for Canada and Minister responsible for Canada-U.S. Trade, Intergovernmental Affairs, and One Canadian Economy, and the Minister of Canadian Culture and Identity and Minister responsible for Official Languages in his capacity as Quebec Lieutenant.

PCO’s three (3) main roles are to:

1. Provide professional non-partisan advice to the Prime Minister, portfolio ministers, Cabinet and Cabinet committees on matters of national and international importance.
2. Ensure that the Cabinet decision-making process runs smoothly and help implement the Government’s agenda.
3. Foster a high-performing and accountable Public Service.

This is the 42nd Annual Report to Parliament on the administration of the PA by PCO, submitted as required by section 72 of the PA. This report covers the reporting period of April 1, 2024, to March 31, 2025. PCO is not reporting on behalf of wholly owned subsidiaries or non-operational institutions.

Additional copies of this report may be obtained from:

• Access to Information and Privacy Division
  Privy Council Office
  11 Metcalfe Street
  Ottawa, Ontario K1A 0A3

Highlights

1. In the 2024-2025 fiscal year, twenty-two (22) privacy requests were received, which is an increase compared to the nineteen (19) requests received in 2023-2024.
2. During the reporting period, PCO worked with the Office of the Privacy Commissioner (OPC) on several files across the department dealing with personal information. PCO did not complete any Privacy Impact Assessments (PIAs) in 2024-2025.

Access to Information and Privacy division – organizational structure

The ATIP division within PCO is responsible for managing requests for departmental or personal information, ensuring corporate understanding and compliance with the Access to Information Act (ATIA) and the PA, and fostering corporate awareness of access and privacy rights and responsibilities. On matters of access and privacy, the ATIP division also acts as a primary liaison with the Office of the Information Commissioner (OIC), the Office of the Privacy Commissioner (OPC), the Access to Information Policy and Performance Division (AIPPD) of Treasury Board of Canada Secretariat (TBS), and partner departments.

PCO did not provide services as defined by section 73.1 of the PA to another government institution during this reporting period. PCO also did not receive these types of services.

While exact staffing and distribution of tasks fluctuate, over the reporting period, The ATIP division has a personnel complement of 28.2 full-time equivalents (FTEs), 0.8 part-time and casual employees and 6.3 students. Staff are organized into two (2) areas of responsibility as follows:

1. ATIP operations (25.2 FTEs, 0.8 part-time and casual and 4.3 students)
   • Processes ATIP requests;
   • Oversees the collection and release of personal and/or business information;
   • Provides expertise in ATIP policy;
   • Researches trends and best practices in ATIP;
   • Develops and delivers ATIP training programs; and
   • Proactively discloses and publishes briefing note titles, transition material, Question Period cards and committee binders.
2. Client services (3 FTEs and 2 students)
   • Coordinates training and prepares promotional products;
   • Processes responses to parliamentary questions and petitions on behalf of PCO; and,
   • Provides database administration.

While exact distribution of tasks fluctuate, of the personnel complement of 28.2 FTEs in 2024-2025, 24.2 FTEs were dedicated to activities related to the administration of the Access to Information Act and one (1) FTE was dedicated to activities related to the administration of the PA.

Monitoring compliance

In order to meet the legislative deadlines for privacy requests, the timelines of individual requests are strictly monitored. Regular meetings and various reports are used to ensure all requests are on track to meet the deadlines. Given our delegation orders (described in the next section), the ATIP division works very closely with our Offices of Primary Interest (OPIs) to ensure tasking and signoff timelines are respected.

Privy Council Office delegation orders

The Minister heading each government institution is responsible for the implementation of the PA within his or her institution. The Prime Minister, as the Minister responsible for the Privy Council Office (PCO) and pursuant to section 73 of the PA, is responsible for the implementation of the PA within PCO. By virtue of PCO’s delegation order, the Prime Minister designated the Executive Director, ATIP, as the individual within PCO to perform the powers, duties, functions, or administrative tasks pertaining to the PA. PCO Secretariats, or OPIs, holders of the information identified in a privacy request, approve the release of information to requesters and the application of exemptions or exclusions and supporting rationales. This shared delegation of authority for the disposition of information is exercised diligently within PCO and recorded formally at appropriate stages in the process. PCO delegation orders which were in effect in 2024-2025 are attached at Appendix A.

Summary of key issues and actions taken on complaints or audits

PCO collaborates regularly with the OPC with the intended purpose of resolving complaints in a timely manner. Throughout 2024-2025, PCO received two (2) complaints, both related to delays in processing requests for personal information under the PA. PCO worked to resolve these complaints by providing responses to the applicants.

Education and training activities

Within the ATIP division, meetings are held on a weekly basis to ensure all requests meet the legislated due dates, as well as to review legislated extensions and discuss any new procedures. PCO provides information on ATIP requirements and best practices through learning products, special events in the branch and/or the department, as well as on the intranet.

In 2024-2025, PCO provided ATIP training or awareness sessions to approximately forty (40) employees through five (5) training events during the reporting period. These sessions consisted of an overview of ATIP to internal secretariats to deliver insight on the ATIP process, related information management topics, and the application of exemptions.

PCO senior officials were provided with a summary of the access and privacy statistics on performance and compliance to promote understanding of access and privacy responsibilities. The Executive Director of ATIP maintained regular contact with senior staff in the department, and ATIP senior staff met with senior officials in PCO secretariats to clarify the roles and enhance working relationships. Throughout the 2024-2025 reporting period, ATIP analysts liaised with clients to explain the five-stage request timeline and their working role, as well as train them on processes such as the search for records.

PCO personnel have access to key information on access and privacy. This information is readily available as instructional ATIP handouts, an email box for questions, takeaway learning tools, as well as comprehensive and educational electronic content on PCO’s intranet.

Other activities

a) General operations

The ATIP division provides support to requesters not captured by statistics. For example, routine inquiries about privacy and personal information matters are received which, whenever possible, are treated informally and to the satisfaction of the requesters. Further, ATIP provides advice and guidance on privacy matters and activities across the department. The ATIP division conducts PIAs and assists officials in various areas of the department to ensure that any activity related to personal information complies with PCO’s responsibilities under the PA.

b) Data matching and sharing

For the 2024-2025 reporting period, PCO did not establish any new systems or processes that led to data matching or sharing of personal information, either within the department or with any external sources. The department was not involved in any data matching activities.

Privacy-related policies, guidelines, and procedures

PCO did not implement any new privacy policies, guidelines, or procedures during the 2024-2025 reporting period. Due to changes in TBS’ policies and directives, PCO is developing a process for the implementation of privacy protocol.

PCO took steps to replace its legacy case management software. Deployment of the new solution is anticipated for fiscal year 2026-2027. This will leverage new technologies to increase efficiencies in our processes, thereby improving service delivery.

Interpretation of the Statistical report

The 2024-2025 Statistical Report on the Privacy Act can be found at Appendix B.

Part 1 − Number of requests received

Between April 1, 2024, and March 31, 2025, PCO received twenty-two (22) requests for personal information under the PA, compared to nineteen (19) received the previous year.

A total of twenty-five (25) requests were carried over to the 2025-2026 reporting period, while twenty-one (21) requests were carried into 2024-2025 from the previous fiscal year. At the end of 2024-2025, the due date of 92% of the twenty-five (25) active requests had passed, meaning that 8% of them were carried over to the next reporting period within legislative timelines. The breakdown of when these requests were received and their status on the last day of the reporting period is as follows:

• Seven (7) received in 2024-2025 (14.3% on time, 85.7% late); 
• Six (6) received in 2023-2024 (16.7% on time, 83.3% late); 
• Zero (0) received in 2022-2023; 
• Three (3) received in 2021-2022 (0% on time, 100% late); 
• Seven (7) received in 2020-2021 (0% on time, 100% late); 
• One (1) received in 2019-2020 (0% on time, 100% late); 
• One (1) received in 2018-2019 (0% on time, 100% late); and
• Zero (0) received in 2017-2018 or earlier.

Part 2 – Informal requests

PCO did not receive any informal requests under the PA in 2024-2025.

Part 3 − Requests closed during the reporting period

3.1 Disposition and completion time during the reporting period

In 2024-2025, PCO completed eighteen (18) requests for personal information under the PA. The disposition of the completed privacy requests was as follows:

• Seven (7) (38.9%) were abandoned;
• Six (6) (33.3%) yielded no records;
• Four (4) (22.2%) were disclosed in part; and
• One (1) (5.6%) was fully disclosed.

There were twenty-five (25) requests that remained active and carried over into 2025-2026. At the beginning of 2024-2025, PCO had twenty-one (21) outstanding privacy requests.

A privacy request may require more than 30 days to complete, under certain circumstances, such as the necessity to consult with external organizations or due to the volume of pages to review. In 2024-2025, eleven (11) requests were completed within a 30-day timeframe, two (2) requests were completed within 31 to 60 days, two (2) were completed within 61 to 120 days, and three (3) requests were completed within 181 to 365 days.

3.2 Exemptions

There are instances where information qualifies for necessary protection under the PA. In 2024-2025, exemptions were invoked for the following number of requests:

• Three (3) requests under section 26 – information about another individual;
• One (1) request under section 27 – information subject to solicitor-client privilege.

3.3 Exclusions

The PA does not apply to certain publicly available information described by subsection 69(1) and subsection 69(2) of the PA, nor to Confidences of the King’s Privy Council for Canada pursuant to subsection 70(1). During this reporting period, s. 69 was not cited, while paragraph 70(1)(c) was cited in one (1) request.

3.4 Format of information released

In 2024-2025, PCO provided electronic copies of responsive records to requesters in all five (5) instances.

3.5 Complexity

3.5.1 Relevant pages processed and disclosed for paper and e-formats

In 2024-2025, 1,734 relevant pages were processed in response to twelve (12) completed requests where records were found, of which 1,117 pages were disclosed.

3.5.2 Relevant pages processed and disclosed for paper and e-record format by size of requests

Of the five (5) requests for which records existed and were disclosed in part or in full: two (2) had less than 100 pages to process; two (2) had between 100-500 pages; and one (1) had between 1001-5000 pages.

3.5.3 Relevant minutes processed and disclosed for audio formats

PCO did not process any audio records in 2024-2025.

3.5.4 Relevant minutes processed per request disposition for audio formats by size of requests

PCO did not process any audio records in 2024-2025.

3.5.5 Relevant minutes processed per request disposition for video formats

PCO did not process any records in video format during the reporting period.

3.5.6 Relevant minutes processed per request disposition for video formats by size of requests

PCO did not process any records in video format during the reporting period.

3.5.7 Other complexities

Of the privacy requests closed in 2024-2025, one (1) was identified as containing interwoven personal information of multiple individuals, requiring a more thorough line by line review.

3.6 Closed requests

3.6.1 Number of requests closed within legislated timelines

In the 2024-2025 reporting period, eleven (11) requests (61.1%) were closed within legislated timelines, compared to four (4) requests (33.3%) in 2023-2024.

3.7 Deemed refusals

3.7.1 Reasons for not meeting legislated timelines

During the 2024-2025 fiscal year, seven (7) requests were closed past the statutory deadline. Of those requests, five (5) were closed outside the legislated timelines due to interferences with operations and workload. The remaining two (2) requests were not completed within the legislated timelines due to internal consultations.

3.7.2 Requests closed beyond legislated timelines (including any extension taken)

Of the seven (7) requests closed beyond legislated timelines: three (3) were closed within 30 days after the legislated timeline; one (1) was closed within 31 to 60 days; two (2) were closed within 121 to 180 days; and one (1) was closed within 181 to 365 days.

3.8 Requests for translation

The PA states at subsection 17(2) that “where access to personal information is to be given under this Act and the individual to whom access is to be given requests that access be given in one of the official languages of Canada, (a) access shall be given in that language, if the personal information already exists under the control of a government institution in that language; and (b) where the personal information does not exist in that language, the head of the government institution that has control of the personal information shall cause it to be translated or interpreted for the individual if the head of the institution considers a translation or interpretation to be necessary to enable the individual to understand the information.”

No translations were requested during the reporting period.

Part 4 – Disclosure under subsections 8(2) and 8(5)

The PA sets out specific circumstances at subsection 8(2) in which government institutions may disclose personal information without the individual’s consent. Paragraph 8(2)(e) of the PA permits the disclosure of personal information “to an investigative body specified in the regulations, on the written request of the body, for the purpose of enforcing any law of Canada or a province or carrying out a lawful investigation, if the request specifies the purpose and describes the information to be disclosed.” Paragraph 8(2)(m) of the PA permits the disclosure of personal information when “(i) the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure, or (ii) disclosure would clearly benefit the individual to whom the information relates”.

No disclosures were made under subsection 8(2)(e) or subsection 8(2)(m) of the PA during the 2024-2025 reporting period.

In addition, subsection 8(5) of the PA indicates that the government institution “shall notify the Privacy Commissioner in writing of any disclosure of personal information under paragraph (2)(m) prior to the disclosure where reasonably practicable or in any other case forthwith on the disclosure, and the Privacy Commissioner may, if the Commissioner deems it appropriate, notify the individual to whom the information relates of the disclosure”.

During the 2024-2025 reporting period, no disclosures were made under subsection 8(5) of the PA.

Part 5 - Requests for correction of personal information and notations

The PA specifies at subsection 12(1) that any Canadian citizen or permanent resident of Canada has a right to and shall, on request, be given access to any personal information about the individual found in a personal information bank and personal information under the control of a government institution. An individual should be entitled to correction of personal information where there is an error or omission, a request that a notation be attached, and assurance that any party who has requested the information within the last two (2) years be notified of the correction and make changes to their copies.

There were no requests for correction of personal information and notations made during the reporting period.

Part 6 − Extensions

6.1 Reasons for extensions

The PA provides for extensions to the legislated 30-day time limit, for consultations or if meeting the original time limit would unreasonably interfere with the operations of the government institution. During the processing of the requests closed in 2024-2025, five (5) extensions were taken to accommodate operations under s. 15(a)(i).

6.2 Length of extensions

For the requests closed during the 2024-2025 reporting period, all five (5) extensions were taken for an additional 16 to 30 days.

Part 7 − Consultations received from other institutions and organizations

7.1 Consultations received from other Government of Canada institutions and other organizations

PCO received two (2) privacy consultations from other government institutions in the 2024-2025 fiscal year, totaling 127 pages. This volume is consistent with the previous fiscal years, as shown in the chart below. The processing of consultation requests requires resources at a level similar to the level of resources involved in the processing of privacy requests.

7.2 Recommendations and completion time for consultations received from other Government of Canada institutions

Of the two (2) consultations received during the 2024-2025 fiscal year, one (1) was closed in 2024-2025 and completed between 16 and 30 days. The other was carried over into 2025-2026.

7.3 Recommendations and completion time for consultations received from other organizations

During the 2024-2025 reporting period, no consultations were received from other organizations.

Part 8 − Completion time of consultations on Cabinet confidences

8.1 Requests with legal services

Note that in regard to ATIP, PCO consults only with the PCO Legal Services Sector (PCO LSS). Therefore, no data appears in the table entitled “Completion Time of Consultations on Cabinet Confidences - Requests with Legal Services.”

8.2 Requests with Privy Council Office

Like in 2023-2024, the ATIP Division consulted PCO LSS on two (2) of the requests that were closed during the reporting period.

Part 9 – Complaints and investigations notices received

In 2024-2025, two (2) complaints were submitted to the Office of the Privacy Commissioner. One (1) of those complaints was still active at the end of the reporting period.

Part 10 − Privacy Impact Assessments and Personal information Banks

10.1 Privacy Impact Assessments

PCO did not complete any PIAs in 2024-2025.

10.2 Personal Information Banks

PCO currently has six (6) active Personal Information Banks (PIBs) in 2024-2025.

Part 11 – Material privacy breaches

In the 2024-2025 reporting period, no material privacy breaches occurred or were reported to TBS or the OPC.

Part 12 – Resources related to the Privacy Act

12.1 Allocated costs

In the 2024-2025 reporting period, the total salary cost associated with administering the PA was $103,471. There were no overtime or specific goods and services costs attributed to the application of the PA.

12.2 Human resources

In 2024-2025, ATIP had a personnel complement of 28.2 FTEs. Of those, approximately one (1) FTE was dedicated to activities related to the administration of the PA. This is consistent with the previous three (3) years.

Appendices

Appendix A: Delegation orders

Privacy Act

The Prime Minister, as head of the Privy Council Office and pursuant to section 73(1) of the Privacy Act^a, hereby designates the officers or employees holding the positions set out in the schedule hereto, and any persons acting in those positions, to exercise or perform the powers, duties and functions of the Prime Minister as the head of a government institution under the sections of the Act and the regulations opposite each position in the schedule.

This delegation order supercedes all previous delegation orders.

Prime Minister
Justin Trudeau

October 2, 2020

^a R.S. 1985, c. P-21

Schedule

Appendix B: 2024-2025 Statistical report on the Privacy Act

Name of institution: Privy Council Office

Reporting period: 2024-04-01 to 2025-03-31

Section 1 - Requests under the Privacy Act

1.1 Number of requests received

1.2 Channels of requests

Section 2 - Informal requests

2.1 Number of informal requests

2.2 Channels of informal requests

2.3 Completion time of informal requests

2.4 Pages released informally

Section 3 - Requests closed during the reporting period

3.1 Disposition and completion time

3.2 Exemptions

3.3 Exclusions

3.4 Format of information released

3.5 Complexity

3.5.1 Relevant pages processed and disclosed for paper, e-record and dataset formats

3.5.2 Relevant pages processed per request disposition for paper, e-record and dataset formats by size of request

3.5.3 Relevant minutes processed and disclosed for audio formats

3.5.4 Relevant minutes processed per request disposition for audio formats by size of requests

3.5.5 Relevant minutes processed and disclosed for video formats

3.5.6 Relevant minutes processed per request disposition for video formats by size of requests

3.5.7 Other complexities

3.6 Closed requests

3.6.1 Number of requests closed within legislated timelines

3.7 Deemed refusals

3.7.1 Reasons for not meeting legislated timelines

3.7.2 Requests closed beyond legislated timelines (including any extension taken)

3.8 Requests for translation

Section 4 - Disclosures under subsection 8(2) and 8(5)

Section 5 - Requests for correction of personal information and notations

Section 6 - Extensions

6.1 Reasons for extensions

6.2 Length of extensions

Section 7 - Consultations received from other institutions and organizations

7.1 Consultations received from other Government of Canada institutions and other organizations

7.2 Recommendation and completion time for consultations received from other Government of Canada institutions

7.3 Recommendation and completion time for consultations received from other organizations outside the Government of Canada

Section 8 - Completion time of consultations on Cabinet confidences

8.1 Requests with Legal Services

8.2 Requests with Privy Council Office

Section 9 - Complaints and investigations notices reveived

Section 10 - Privacy Impact Assesments (PIA) and Personal Information Banks (PIB)

10.1 Privacy Impact Assesments

10.2 Institution-specific and central personal information banks

Section 11 - Privacy breaches

11.1 Material privacy breaches reported

11.2 Non-material privacy breaches

Section 12 - Human resources related to the Privacy Act

12.1 Allocated costs

12.2 Human resources

Appendix C: Supplemental Statistical Report on the Access to Information Act and Privacy Act

Name of institution: Privy Council Office

Reporting period: 2024-04-01 to 2025-03-31

Section 1: Requests carried over and active complaints under the Access to Information Act

1.1 Requests carried over to next reporting period, broken down by reporting period received

1.2 Active complaints with the Information Commissioner of Canada, broken down by reporting period received

Section 2: Requests carried over and active complaints under the Privacy Act

2.1 Requests carried over to next reporting period, broken down by reporting period received

2.2 Active complaints with the Privacy Commissioner of Canada, broken down by reporting period received

Section 3: Social insurance number

Section 4: Universal access under the Privacy Act