2018-2019 Annual Report to Parliament on the Privacy Act

[ PDF version ]

Introduction

The Privy Council Office (PCO) reports directly to the Prime Minister and is headed by the Clerk of the Privy Council and the Secretary to the Cabinet. PCO is both the Cabinet secretariat and the Prime Minister’s source of public service advice across the entire spectrum of policy questions and operational issues facing the Government. As the hub of non-partisan, public service support to the Prime Minister, Cabinet and its decision-making structures, PCO ensures that the Government and canadians are served by the highest quality public service.

PCO also provides support to the Prime Minister in his capacity as Minister of Youth, as well as to the Minister of Intergovernmental and Northern Affairs and Internal Trade, the Leader of the Government in the House of Commons and the Minister of Democratic Institutions.

PCO has three main roles:

This is the 36th Annual Report to Parliament on the administration of the Privacy Act (PA) by PCO, submitted as required by section 72 of the PA and section 20 of the Service Fees Act. This report covers the reporting period of April 1, 2018 to March 31, 2019.

Additional copies of this report may be obtained from:

Highlights

  1. In the 2018-2019 fiscal year, nine (9) privacy requests were received, a volume of requests consistent with the 12 received in 2017-2018.
  2. PCO completed two (2) Privacy Impact Assessments in 2018-2019 and worked with the Office of the Privacy Commissioner on several files across the department dealing with personal information.

Access to Information and Privacy (ATIP) division – organizational structure

The Privacy Act (PA) protects the privacy of personal information held by the Government of Canada. The PA ensures the protection of that information against unauthorized use and disclosure, and provides individuals with the right of access to, and a means to correct, their personal information.

The ATIP division is the focal point for access to information and privacy within PCO. The division is responsible for managing requests for departmental or personal information, ensuring corporate understanding and compliance with the Access to Information Act (ATIA) and the PA, and fostering corporate awareness of access and privacy rights and responsibilities. On matters of access and privacy, the ATIP division also acts as a primary liaison with the Office of the Information Commissioner (OIC), the Office of the Privacy Commissioner (OPC), the Treasury Board of Canada Secretariat (TBS), and partner departments. 

The ATIP division has a personnel complement of approximately 30 full-time equivalents (FTEs) that are organized into two areas of responsibility. The two areas of responsibility are organized as follows:

  1. ATIP operations (24 FTEs)
    • Processes access to information and privacy requests;
    • Oversees the collection and release of personal and/or business information;
    • Provides expertise in access to information and privacy policy;
    • Researches trends and best practices in access to information and privacy; and
    • Develops and delivers ATIP training programs.
  2. Client services (6 FTEs)
    • Organizes training and develops promotional products;
    • Coordinates responses to parliamentary questions and petitions on behalf of PCO; and
    • Provides database administration.

Monitoring compliance

In order to meet the legislative deadlines for privacy requests, the timelines of individual requests are strictly monitored. Regular meetings and various reports are used to ensure all requests are on track to meet the deadlines. Given our delegation orders (described in the next section), PCO ATIP works very closely with our Offices of Primary Interest (OPIs) to ensure tasking and signoff timelines are respected.

Privy Council Office delegation orders

The Minister heading each government institution is responsible for the implementation of the PA within his or her institution. The Prime Minister, as the Head of the Privy Council Office and pursuant to s. 73 of the PA, is responsible for the implementation of the PA within PCO. Through PCO’s delegation order, the Prime Minister designated the Director, ATIP, as the individual within PCO to perform the powers, duties, functions, or administrative tasks pertaining to the PA. PCO Secretariats, or OPIs, holders of the information identified in a privacy request, approve the release of information to requesters and application of exemptions or exclusions and supporting rationales. This shared delegation of authority for the disposition of information is exercised diligently within PCO, and recorded formally at appropriate stages in the process. The PCO delegation orders are shown at Appendix A.

Education and training activities

PCO promotes ATIP requirements and best practices in face-to-face meetings, presentations, special events, learning products, on the intranet and through its training program. It fosters strong working relationships with clients, and operates under clearly established timelines and procedures.

In 2018-2019, PCO delivered ATIP training or awareness sessions to 114 employees through 13 training events during the reporting year. The majority of these training sessions provided an overview of ATIP to internal secretariats, as well as delivering insight on the process and the application of exemptions.

To promote understanding of access and privacy responsibilities, PCO senior officials were provided with a summary of access and privacy statistics, performance and compliance. The Director of ATIP maintained regular contact with senior staff in the department, and ATIP senior staff met with departmental officials to clarify roles and strengthen working relationships. Throughout 2018-2019, PCO ATIP analysts liaised with clients to explain the five-stage request timeline, provide training on processes such as the search for records, assist with records review, and explain their working role. 

PCO personnel are provided with multiple channels to information on access and privacy, such as instructional ATIP handouts, an email box for questions, takeaway learning tools, as well as comprehensive and educational electronic content on PCO’s intranet.

Other activities

a) General operations

PCO ATIP provides support to requesters not captured by statistics. For example, routine inquiries about privacy and personal information matters are received which, whenever possible, are treated informally and to the satisfaction of the requesters. Further, PCO ATIP provides advice and guidance on privacy matters and activities across the department. PCO ATIP conducts Privacy Impact Assessments and assists officials in various areas of the department to ensure that any activity related to personal information was in compliance with our responsibilities under the PA.

b) Data matching and sharing

For the 2018-2019 reporting period, PCO did not establish any new systems or processes that led to data matching or sharing of personal information, either within the department or with any external sources. The department was not involved in any data matching activities.

Privacy-related policies, guidelines, and procedures

a) Transitioning to an electronic office

As part of the Beyond 2020 plan, which advocates for green government operations and a paperless office, PCO began the process of transforming into a paperless office. In 2016-2017, we introduced electronic tasking and notification of releases. These two processes alone have proven to be very successful and have greatly reduced the number of pages being printed on a daily basis. In 2018-2019, PCO was part of the first wave of institutions brought on by Treasury Board Secretariat to accept requests through the online portal. Currently, PCO ATIP is working with IT to develop an electronic approval process and record retrieval process.

Material privacy breaches

No material privacy breaches occurred during the 2018-2019 reporting period.

Interpretation of the statistical report

The 2018-2019 Statistical report on the Privacy Act can be found at Appendix B.

Part 1− Requests under the Privacy Act

Between April 1, 2018 and March 31, 2019, PCO received nine (9) requests for personal information under the PA, compared to 12 received the previous year. 

Volume of requests by year

Volume of requests by year
Text version - Volume of requests by year
2015-2016 2016-2017 2017-2018 2018-2019
15 43 12 9

Part 2 − Requests closed during the reporting period

2.1 Disposition and completion time

In 2018-2019, PCO completed seven (7) requests for personal information under the PA. The disposition of completed privacy requests was as follows:

Only seven (7) requests remained active and were carried over into 2019-2020.   

There are certain circumstances in which a privacy request may require more than 30 days to complete, such as the necessity to consult with external organizations or due to volume of pages to review. In 2018-2019, three (3) requests were completed in 30 days or less, three (3) requests were completed in the 31 to 60 day timeframe, and one (1) request took 121 to 180 days.

2.2 Exemptions

There are instances where information qualifies for necessary protection under the PA. In 2018-2019, exemptions were invoked for the following number of requests:

2.3 Exclusions

The PA does not apply to certain publicly available information described by s. 69(1) and s. 69(2) of the PA, nor to Confidences of the Queen’s Privy Council for Canada pursuant to s. 70(1). During this reporting period, no exclusions were cited.

2.4 Format of information released

In 2018-2019, PCO provided electronic copies of responsive records to requesters in all six (6) instances. No requesters elected to receive their information in paper format. 

2.5 Complexity

2.5.1 Relevant pages processed and disclosed

In 2018-2019, 1,141 pages were processed in response to the six (6) completed requests where records were found, of which, 447 pages were disclosed.

2.5.2 Relevant pages processed and disclosed by size of requests

Of the six (6) requests for which records existed and were disclosed in part, five (5) had less than 100 pages to process and one (1) request contained between 501 and 1000 pages.

2.5.3 Other complexities

The complex interdepartmental nature of information in many records under the control of PCO often necessitates external consultations and legal advice. This requirement is the principal reason why some requests take an extended length of time to process. During the reporting year, one (1) completed request involved personal information about another individual that was blended or interwoven with the personal information of the requester. Legal advice was required for one (1) completed request.  

2.6 Deemed refusals

During the 2018-2019 fiscal year, two (2) requests were closed past the statutory deadline. Both requests were closed past the deadline due to workload pressures.

2.7 Requests for translation

The PA states at s. 17(2) that “where access to personal information is to be given under this Act and the individual…requests that access be given in a particular one of the official languages of Canada access shall be given in that language”: if the personal information already exists or where the personal information does not exist in that language, the head of the government institution…shall cause it to be translated or interpreted… if it would enable the individual to understand the information. During this reporting period, there were no translations requested.

Part 3 − Disclosures under s. 8(2)

The PA sets out specific circumstances at subsection 8(2) in which government institutions may disclose personal information without the individual’s consent. Paragraph 8(2)(e) of the PA permits the disclosure of personal information “to an investigative body specified in the regulations, on the written request of the body, for the purpose of enforcing any law of Canada or a province or carrying out a lawful investigation, if the request specifies the purpose and describes the information to be disclosed.” Paragraph 8(2)(m) of the PA permits the disclosure of personal information when the public interest clearly outweighs any invasion of privacy or when the disclosure would benefit the individual involved. No disclosures were made under paragraphs 8(2)(e) or 8(2)(m) of the PA during the 2018-2019 reporting period.

Part 4 − Requests for correction of personal information and notations

The PA specifies at s. 12(1) that any canadian citizen or permanent resident of Canada has a right to and shall, on request, be given access to any personal information about the individual found in a personal information bank and personal information under the control of a government institution. An individual should be entitled to correction of personal information where there is an error or omission, a request that a notation be attached, and assurance that any party who has requested the information within the last two years be notified of the correction and make changes to their copies. There were no requests for correction of personal information and notations made during the reporting period. 

Part 5 − Extensions

5.1 Reasons for extensions and disposition of requests

The PA provides for extensions to the legislated 30-day time limit, for consultations or if meeting the original time limit would unreasonably interfere with the operations of the government institution. In the 2018-2019 fiscal year, PCO took two (2) extensions to accommodate operations under s. 15(a)(i). Of these two (2) cases where extensions were taken, all requests were disclosed in part.

5.2 Length of extensions

Both of the extensions taken by PCO were for a period of 16 to 30 days.

Part 6 − Consultations received from other institutions and organizations

PCO received two (2) privacy consultations from other government institutions in the 2018-2019 fiscal year, totalling 113 pages. This number is in line with the quantity of consultations received the last six fiscal years, as shown in the chart below. The processing of consultation requests requires resources at a level similar to the processing of privacy requests. No consultations were received from other organizations.

Privacy Consultations Received by Year

Text version - Privacy Consultations Received by Year
2009-2010 2010-2011 2011-2012 2012-2013 2013-2014 2014-2015 2015-2016 2016-2017 2017-2018 2018-2019
12 9 10 7 1 2 5 5 4 2

Of the two (2) consultations received in 2018-2019, both were completed in 31 to 60 days, as well as disclosed in part.

Part 7 − Completion time of consultations on Cabinet confidences

As reported in Part 2.3, no exclusions were cited in 2018-2019.

Part 8 – Complaints and investigations

No complaints were received for Privacy files in 2018-2019. One (1) investigation carried over from 2016-2017 is still ongoing.

Part 9 − Privacy Impact Assessments (PIAs)

PCO completed two (2) Privacy Impact Assessments (PIA) during the 2018-2019 reporting period. One (1) PIA was in regard to online youth consultations. The other was related to consultation on the Leaders’ Debates Commission.

Part 10 − Resources related to the Privacy Act (PA)

In the 2018-2019 reporting period, the total salary costs associated with administering the PA were $86,788, up $11,035 from the previous year. There were no overtime costs, down from $1,048 last fiscal year. No specific goods and services costs were attributed to the application of the PA. Total cumulative costs amounted to $86,788, an increase of $9,987 from 2017-2018.

The associated person-year resource utilization for the 2018-2019 reporting period was approximately one (1) full-time equivalent (FTE).

FTEs by Year

FTEs by Year
Text version - FTEs by Year
2016-2017 2017-2018 2018-2019
0.19 1 1

Appendices

Appendix A: Delegation orders

Privacy Act

The Prime Minister, as head of the Privy Council Office and pursuant to section 73 of the Privacy Acta, hereby designates the officers or employees holding the positions set out in the schedule hereto, and any persons acting in those positions, to exercise or perform the powers, duties and functions of the Prime Minister as the head of a government institution under the sections of the Act and the regulations opposite each position in the schedule.

This delegation order supercedes all previous delegation orders.

Prime Minister
Justin Trudeau

December 23, 2015

a R.S. 1985, c. P-21

Schedule

Position Sections of the Privacy Acta Sections of the Privacy Regulationsb
1. Clerk of the Privy Council and Secretary to the Cabinet. Full delegation. Full delegation.
2. Any senior management position within the Privy Council Office that reports directly to the position set out in paragraph 1 above. Full delegation. Full delegation.
3. All Assistant Secretaries and Assistant Deputy Ministers within the Privy Council Office. Full delegation. Full delegation.
4. Any management position that is responsible for a unit within the Privy Council Office and that reports directly to a position covered by paragraph 2 above other than the Assistant Deputy Minister of Corporate Services Branch. Full delegation. Full delegation.
5. Coordinator of Access to Information within the Privy Council Office. 8(4); 8(5); 9(1); 9(4); 10(1); 14; 15; 16; 17; 19; 35(4). 7; 9; 11(2); 11(4).

a R.S 1895, c. P-21
b SOR/83-508

Appendix B: 2018-2019 Statistical Report on the Access to Information Act

Reporting period: 2018-04-01 to 2019-03-31

Part 1 - Requests under the Privacy Act

Requests Number of requests
Received during reporting period 9
Outstanding from previous reporting period 5
Total 14
Closed during reporting period 7
Carried over to next reporting period 7

Part 2 - Requests closed during the reporting period

2.1 Disposition and completion time
Disposition of requests Completion Time
1 to 15 days 16 to 30 days 31 to 60 days 61 to 120 days 121 to 180 days 181 to 365 days More than 365 days Total
All disclosed 0 2 0 0 0 0 0 2
Disclosed in part 0 1 2 0 1 0 0 4
All exempted 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0
No records exist 0 0 1 0 0 0 0 1
Request abandoned 0 0 0 0 0 0 0 0
Neither confirmed or denied 0 0 0 0 0 0 0 0
Total 0 3 3 0 1 0 0 7
2.2 Exemptions
Section Number of requests
18(2) 0
19(1)(a) 0
19(1)(b) 0
19(1)(c) 0
19(1)(d) 0
19(1)(e) 0
19(1)(f) 0
20 0
21 2
22(1)(a)(i) 0
22(1)(a)(ii) 0
22(1)(a)(iii) 0
22(1)(b) 0
22(1)(c) 0
22(2) 0
22.1 0
22.2 0
22.3 0
23(a) 0
23(b) 0
24(a) 0
24(b) 0
25 0
26 1
27 0
28 0
2.3 Exclusions
Section Number of requests
69(1)(a) 0
69(1)(b) 0
69.1 0
70(1)(a) 0
70(1)(b) 0
70(1)(c) 0
70(1)(d) 0
70(1)(e) 0
70(1)(f) 0
70.1 0
2.4 Format of information released
Disposition Paper Electronic Other formats
All disclosed 0 2 0
Disclosed in part 0 4 0
Total 0 6 0

2.5 Complexity

2.5.1 Relevant pages processed and disclosed
Disposition of requests Number of pages processed Number of pages disclosed Number of requests
All disclosed 9 9 2
Disclosed in part 1,132 438 4
All exempted 0 0 0
All excluded 0 0 0
Request abandoned 0 0 0
Neither confirmed nor denied 0 0 0
Total 1,141 447 6
2.5.2 Relevant pages processed and disclosed by size of requests
Disposition Less than 100 pages processed 101-500 pages processed 501-1000 pages processed 1001-5000 pages processed More than 5000 pages processed
Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed
All disclosed 2 9 0 0 0 0 0 0 0 0
Disclosed in part 3 35 0 0 1 403 0 0 0 0
All exempted 0 0 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0 0 0
Request abandoned 0 0 0 0 0 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0 0 0 0 0 0
Total 5 44 0 0 1 403 0 0 0 0
2.5.3 Other complexities
Disposition Consultation required Legal Advice Sought Interwoven Information Other Total
All disclosed 0 0 0 0 0
Disclosed in part 0 1 1 0 2
All exempted 0 0 0 0 0
All excluded 0 0 0 0 0
Request abandoned 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0
Total 0 1 1 0 2
2.6 Deemed refusals
2.6.1 Reasons for not meeting statutory deadline
Number of requests closed past the statutory deadline
Principal Reason
Workload
External consultation
Internal consultation
Other
2 2 0 0 0
2.6.2 Number of days past deadline
Number of days past deadline Number of requests past deadline where no extension was taken Number of requests past deadline where an extension was taken Total
1 to 15 days 1 0 1
16 to 30 days 0 0 0
31 to 60 days 0 0 0
61 to 120 days 1 0 1
121 to 180 days 0 0 0
181 to 365 days 0 0 0
More than 365 days 0 0 0
Total 2 0 2
2.7 Requests for translation
Translation Requests Accepted Refused Total
English to French 0 0 0
French to English 0 0 0
Total 0 0 0

Part 3 – Disclosures under subsection 8(2) and 8(5)

Paragraph 8(2)(e) Paragraph 8(2)(m) Subsection 8(5) Total
0 0 0 0

Part 4 – Requests for correction of personal information and notations 

Disposition for Correction Requests Received Number
Notations attached
0
Requests for correction accepted
0
Total
0

Part 5 – Extensions

5.1 Reasons for extensions and disposition of requests
Disposition of requests where an extension was taken 15(a)(i)
Interference with operations
15(a)(ii)
Consultation
15(b)
Translation or conversion
Section 70 Other
All disclosed 0 0 0 0
Disclosed in part 2 0 0 0
All exempted 0 0 0 0
All excluded 0 0 0 0
No records exist 0 0 0 0
Request abandoned 0 0 0 0
Total 2 0 0 0
5.2 Length of extensions
Length of extensions 15(a)(i)
Interference with operations
15(a)(ii)
Consultation
15(b)
Translation purposes
Section 70 Other
1 to 15 days 0 0 0 0
16 to 30 days 2 0 0 0
Total 2 0 0 0

Part 6 – Consultations received from other institutions and organizations

6.1 Consultations received from other Government of Canada institutions and other organizations
Consultations Other government of Canada institutions Number of pages to review Other organizations Number of pages to review
Received during the reporting period 2 113 0 0
Outstanding from the previous reporting period 0 0 0 0
Total 2 113 0 0
Closed during the reporting period 2 113 0 0
Pending at the end of the reporting period 0 0 0 0
6.2 Recommendations and completion time for consultations received from other government institutions
Recommendation Number of days required to complete consultation requests
1 to 15 days 16 to 30 days 31 to 60 days 61 to 120 days 121 to 180 days 181 to 365 days More than 365 days Total
All disclose 0 0 0 0 0 0 0 0
Disclose in part 0 0 2 0 0 0 0 2
All exempted 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0
Consult other institution 0 0 0 0 0 0 0 0
Other 0 0 0 0 0 0 0 0
Total 0 0 2 0 0 0 0 2
6.3 Recommendations and completion time for consultations received from other organizations
Recommendation Number of days required to complete consultation requests
1 to 15 days 16 to 30 days 31 to 60 days 61 to 120 days 121 to 180 days 181 to 365 days More than 365 days Total
All disclose 0 0 0 0 0 0 0 0
Disclose in part 0 0 0 0 0 0 0 0
All exempted 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0
Consult other institution 0 0 0 0 0 0 0 0
Other 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0

Part 7 – Completion time of consultations on Cabinet confidences

7.1 Requests with Legal Services
Number of Days
Less than 100 pages processed
101-500 pages processed
501-1000 pages processed
1001-5000 pages processed
More than 5000 pages processed
Number of requests
Pages disclosed
Number of requests
Pages disclosed
Number of requests
Pages disclosed
Number of requests
Pages disclosed
Number of requests
Pages disclosed
1 to 15
0
0
0
0
0
0
0
0
0
0
16 to 30
0
0
0
0
0
0
0
0
0
0
31 to 60
0
0
0
0
0
0
0
0
0
0
61 to 120
0
0
0
0
0
0
0
0
0
0
121 to 180
0
0
0
0
0
0
0
0
0
0
181 to 365
0
0
0
0
0
0
0
0
0
0
More than 365
0
0
0
0
0
0
0
0
0
0
Total
0
0
0
0
0
0
0
0
0
0
7.2 Requests with Privy Council Office
Number of Days
Less than 100 pages processed
101-500 pages processed
501-1000 pages processed
1001-5000 pages processed
More than 5000 pages processed
Number of requests
Pages disclosed
Number of requests
Pages disclosed
Number of requests
Pages disclosed
Number of requests
Pages disclosed
Number of requests
Pages disclosed
1 to 15
0
0
0
0
0
0
0
0
0
0
16 to 30
0
0
0
0
0
0
0
0
0
0
31 to 60
0
0
0
0
0
0
0
0
0
0
61 to 120
0
0
0
0
0
0
0
0
0
0
121 to 180
0
0
0
0
0
0
0
0
0
0
181 to 365
0
0
0
0
0
0
0
0
0
0
More than 365
0
0
0
0
0
0
0
0
0
0
Total
0
0
0
0
0
0
0
0
0
0

Part 8 - Complaints and investigations notices received

Section 31
Section 33
Section 35
Court Action
Total
0
0
0
0
0

Part 9 – Privacy Impacts Assessments (PIAs)

Number of PIAs completed
2

Part 10 – Resources related to the Privacy Act

10.1 Costs
Expenditures Amount
Salaries $86,788
Overtime $0
Goods and Services $0
• Professional services contracts $0  
• Other $0  
Total $86,788
10.2 Human resources
Resources
Persons Years Dedicated to Privacy Activities
Full-time employees
1.00
Part-time and casual employees
0.00
Regional staff
0.00
Consultants and agency personnel
0.00
Students
0.00
Total
1.00
Note: Enter values to two decimal places.
Report a problem or mistake on this page
Please select all that apply:

Thank you for your help!

You will not receive a reply. For enquiries, contact us.

Date modified: