Public Health Agency of Canada Annual report on the Access to Information Act and the Privacy Act 2022-2023

Table of Contents

• Introduction
  • About the Public Health Agency of Canada
  • Purpose of the Acts
• Organizational Structure
  • Shared Services Partnership Agreement
  • Access to Information and Privacy Operations Division
  • Privacy Management Division
  • Total FTEs supporting the ATIA and the Privacy Act
  • Governance
• Delegation of authority
• Openness and transparency
  • Part 2 of the Access to Information Act and proactive publication of information
• Capacity to receive and process records in 2022-2023
• Performance for 2022-2023
  • Access to Information Act
  • Privacy Act
• Reporting on fees for the Service Fees Act
• Cost for administering the Access to Information Act
• Costs for administering the Privacy Act
• Awards and recognition
• Training and awareness
  • Access to Information training
  • Privacy training
  • Right to Know Week
• Policies, guidelines, procedures and initiatives
  • Treasury Board of Canada Secretariat: Access to Information Review
  • Privacy compliance evaluations, privacy impact assessments and COVID-19
  • The Public Health Agency of Canada's access to information and privacy action plan
  • Betterment Solutions working group
  • ATIP Coordinators' working group
  • ATIP Operations Division's professional development program
  • Post-secondary recruitment campaign
• Summary of key issues and actions taken on complaints and audits
  • Privacy management audit
  • Complaints management
• Federal court cases
  • Applications and appeals submitted to the Federal Court
• Monitoring compliance
• Other reporting requirements specific to the Privacy Act
  • Material privacy breaches
  • Privacy impact assessments
  • Public interest disclosures
• Appendix A: Access to Information Act and Privacy Act – Delegation Order
  • Delegation of authority schedule
• Appendix B: Statistical Report on the Access to Information Act
  • Section 1: Requests under the Access to Information Act
  • Section 2: Informal requests
  • Section 3: Applications to the Information Commissioner on declining to act on requests
  • Section 4: Requests closed during the reporting period
  • Section 5: Extensions
  • Section 6: Fees
  • Section 7: Consultations received from other institutions and organizations
  • Section 8: Completion time of consultations on Cabinet Confidences
  • Section 9: Investigations and reports of finding
  • Section 10: Court action
  • Section 11: Resources related to the Access to Information Act
• Appendix C: Statistical Report on the Privacy Act
  • Section 1: Requests under the Privacy Act
  • Section 2: Informal requests
  • Section 3: Requests closed during the reporting period
  • Section 4: Disclosures under subsections 8(2) and 8(5)
  • Section 5: Requests for correction of personal information and notations
  • Section 6: Extensions
  • Section 7: Consultations received from other Institutions and Organizations
  • Section 8: Completion time of consultations on Cabinet Confidences
  • Section 9: Complaints and investigation notices received
  • Section 10: Privacy Impact Assessments (PIA) and Personal Information Banks (PIB)
  • Section 11: Privacy breaches
  • Section 12: Resources related to the Privacy Act
• Appendix D: Supplemental Statistical Report on the ATIA and Privacy Act
  • Section 1: Capacity to receive requests under the Access to Information Act and Privacy Act
  • Section 2: Capacity to process records under the Access to Information Act and Privacy Act
  • Section 3: Open requests and complaints under the Access to Information Act
  • Section 4: Open requests and complaints under the Privacy Act
  • Section 5: Social Insurance Number (SIN)
  • Section 6: Universal access under the Privacy Act

Introduction

The Public Health Agency of Canada is pleased to present to Parliament its consolidated annual report on the administration of Access to Information and Privacy (ATIP) services, in accordance with section 94 of the Access to Information Act (ATIA) and section 72 of the Privacy Act and section 20 of the Service Fees Act. The report describes activities that support compliance with these laws for the fiscal year beginning April 1, 2022 and ending March 31, 2023.

About the Public Health Agency of Canada

The Public Health Agency of Canada's mission is to promote and protect the health of Canadians through leadership, partnership, innovation and action in public health.

The role of the Public Health Agency of Canada is to:

• Promote health
• Prevent and control chronic diseases and injuries
• Prevent and control infectious diseases
• Prepare for and respond to public health emergencies
• Serve as a central point for sharing Canada's public health expertise with the rest of the world
• Apply international research and development to Canada's public health programs
• Strengthen intergovernmental collaboration on public health and facilitate national approaches to public health policy and planning

For more information about the Public Health Agency of Canada, please visit our website.

Purpose of the Acts

The ATIA gives Canadian citizens and permanent residents of Canada the right to access information contained in federal government records, subject to certain specific and limited exceptions. The ATIA complements, but does not replace, other means of obtaining government information.

The Privacy Act protects an individual's privacy by setting out provisions related to the collection, retention, accuracy, disposal, use and disclosure of personal information. It also gives Canadian citizens and permanent residents of Canada the right of access to information about themselves held by the federal government, with certain specific and limited exceptions.

Organizational Structure

Shared Services Partnership Agreement

ATIP Operations Division and the Privacy Management Division provide services to both the Public Health Agency of Canada and Health Canada and do so as part of the Shared Services Partnership Agreement. These divisions are housed under the Policy, Planning and Management Strategies Directorate of Health Canada's Corporate Services Branch. ATIP Operations Division manages the processing of requests under both the ATIAand the Privacy Act, while the Privacy Management Division is responsible for privacy policy and providing guidance to programs. Although ATIP services are provided to both institutions, the statistics and financial data provided in this report are only for the Public Health Agency of Canada.

Access to Information and Privacy Operations Division

The primary function of the ATIP Operations Division is to ensure compliance of the Public Health Agency of Canada's program delivery with the provisions of the ATIA and Privacy Act, along the policies and directives of the Treasury Board of Canada Secretariat.

The ATIP Operations Division is responsible for responding to Access to Information and Privacy requests. It reviews information to support various disclosures including the appropriate sharing of investigation reports, proactive publication under Part 2 of the ATIA, as well as supporting Parliamentary Affairs in responding to Parliamentary motions. In addition, ATIP Operations Division promotes awareness of ATIP obligations and provides ATIP training to staff.

The ATIP Operations Division was fully operational throughout 2022-2023. Many of the measures implemented during the COVID-19 pandemic are still in place, including the increased reliance on digital systems, as they have improved the efficiency and effectiveness of the Division.

In 2022-2023, there were 30.95 full-time equivalents within the ATIP Operations Division supporting the Public Health Agency of Canada's administration of both the ATIA and the Privacy Act. A breakdown of the different types of full-time equivalents is provided in the table below.

Privacy Management Division

The primary functions of the Privacy Management Division include supporting compliance of the Public Health Agency of Canada's program delivery with the provisions of the Privacy Act and the policies and directives of the Treasury Board of Canada Secretariat. Responsibilities include:

• The development of privacy policies, procedures and practices
• The delivery of privacy training and awareness programs to staff
• Assessing and reporting on privacy breaches
• Coordinating the Agency's input of InfoSource
• Providing privacy analysis and advice using a number of tools including Privacy Impact Assessments (PIA) and Privacy Protocols

Throughout 2022-2023, the Privacy Management Division was fully operational and comprised 6.87 full-time equivalents. A breakdown of the different types of full-time equivalents is provided in the table below.

Total FTEs supporting the ATIA and the Privacy Act

In 2022-2023, there were a total of 37.82 full-time equivalents supporting the administration of the ATIA and the Privacy Act. This comprised 20.89 full-time equivalents supporting the ATIA and 16.93 full-time equivalents supporting the Privacy Act.

For clarity and greater accountability, the following table illustrates the total resources from the ATIP Operations Division and the Privacy Management Division supporting the administration of the ATIA and the Privacy Act.

Governance

Initiatives related to access to information and privacy are governed through the Public Health Agency of Canada's Policy and Operations Committees. ATI and privacy matters requiring a higher level of oversight or strategic direction are also brought forward to the Public Health Agency of Canada's Executive Committee.

Delegation of Authority

In keeping with Treasury Board of Canada Secretariat recommendations on best practices, the Delegation Order extends authorities to multiple positions including the President, the Corporate Services Branch's Assistant Deputy Minister, the Director General of the Policy, Planning and Management Services Directorate, and the ATIP Coordinator. As appropriate, certain administrative authorities are delegated to various senior levels within the ATIP Operations Division and Privacy Management Division to support the effective and efficient administration of the ATIA and the Privacy Act. The delegation order that was in effect at the end of 2022-2023 is included in this report (Appendix A).

Openness and Transparency

The Public Health Agency of Canada is committed to being open and transparent and continues to make more information available to Canadians. The Agency continues to publish information in accordance with Part 2 of the ATIA including briefing note titles, travel and hospitality expenses, reclassification of positions, and contracts over $10,000.

Part 2 of the Access to Information Act and proactive publication of information

The Public Health Agency of Canada is a government institution that is listed in Schedule I.1 of the Financial Administration Act for the purposes of Part 2 of the ATIA.

The ATIP Operations Division worked with the Strategic Policy Branch, Chief Financial Officer Branch, Corporate Services Branch and the Communications and Public Affairs Branch to ensure that records identified under Part 2 of the Access to Information Act are proactively published. Existing procedures were leveraged to facilitate the proactive publication of information.

The processing of records for proactive publication involves several steps. Many of these steps are automated and an efficient approval process was implemented. A front-end approach for translation and ATI review has been established. Branches proactively identify information that may be subject to valid exceptions and ensure that briefing materials are prepared such that they can be readily published on the website.

The Strategic Policy Branch is responsible for proactively publishing the records listed in the table below for the Ministers Office and on behalf of the Public Health Agency of Canada. In 2022-2023, the Strategic Policy Branch proactively published all applicable proactive requirements within legislated timelines. Please see the following table for the details.

The Chief Financial Officer Branch is responsible for proactively publishing the records listed in the table below for the Ministers Office and on behalf of the Public Health Agency of Canada. In 2022-2023, the Chief Financial Officer Branch proactively disclosed all applicable proactive requirements within legislated timelines.  Please see the following table for the details.

The Corporate Services Branch is responsible for proactively publishing records related to the reclassification of positions. In 2022-2023, the Corporate Services Branch published all notices for reclassification of position within legislated timelines. Please see the following table for the details.

The Communications and Public Affairs Branch is responsible for publishing records to the Government of Canada's Open Government website. Records that have been proactively published can be found on Canada.ca.

Capacity to receive and process records in 2022-2023

The Public Health Agency of Canada was able to receive and process ATIP requests at all classification levels throughout the year. The Agency received requests by mail, email, and through the digital request service.

Detailed information about the Public Health Agency of Canada's capacity to receive and process records can be found in the Supplemental Statistical Report on the Access to Information Act and Privacy Act (Appendix D).

Performance for 2022-2023

In 2022-2023, the Public Health Agency of Canada received 628 requests (Access to Information, Access Informal and Privacy) and closed 884. When compared to the previous fiscal year, the Public Health Agency of Canada received 56% fewer requests and closed 41% more requests.

The following section of the report includes an interpretation and explanation of the data contained in Public Health Agency of Canada's Statistical Report, which summarizes Access to Information (ATI) and Privacy-related activity for the period between April 1, 2022 and March 31, 2023 (Appendix B – ATI and Appendix C – Privacy).

Access to Information Act

Access Informal Requests

Requests can be made for records previously released under the ATIA, which are referred to as 'Access Informal Requests'. Summaries of previously released ATI requests are posted monthly on the Open Government website, as part of the Government of Canada's commitment to openness and transparency.

The Public Health Agency of Canada received 185 Access Informal requests and processed 352 in 2022-2023. The total number of requests closed in 2022-2023 increased by 20% when compared to the previous fiscal year. Only one request was carried over to the next reporting period.

Caseload and carry forward and outstanding active ATI requests

In 2022-2023, the Public Health Agency of Canada managed 1,092 active ATI requests. Of this total, 373 were new requests received in 2022-2023, a decrease from the 757 received in 2021-2022. Of the 1,092 active ATI requests, 719 were outstanding from previous fiscal years with 501 from 2021-2022 and 218 from earlier periods.

The Public Health Agency of Canada closed 453 ATI requests and carried forward 639 to the 2023-2024 fiscal year. Of the 639 files carried forward, 151 were carried over within legislated timelines while 488 were carried over beyond legislated timelines.

The Public Health Agency of Canada received fewer (68%) and closed more (13%) ATI requests in 2022-2023 when compared to the previous fiscal year. Although fewer ATI requests were received than in 2021-2022, the Agency continues to experience a surge in requests when compared to pre-pandemic years. This is mainly due to its central role in responding to the COVID-19 pandemic and Canadian citizens' interest in obtaining the associated information held by the Agency.

Processing times for requests

In 2022-2023, the Public Health Agency of Canada closed a total of 453 requests. Below is the breakdown of the time taken to process these requests.

• 54 were closed 1 to 15 days past legislated timelines
• 56 were closed 16 to 30 days past legislated timelines
• 62 were closed 31 to 60 days past legislated timelines
• 56 were closed 61 to 120 days past legislated timelines
• 36 were closed 121 to 180 days past legislated timelines
• 74 were closed 181 to 365 days past legislated timelines
• 115 were closed more than 365 days past legislated timelines

Of the 453 requests that the Public Health Agency of Canada closed in 2022-2023, 122 requests (27%) were closed within legislated timelines (30 days plus applicable extension) while 331 (73%) were closed past the legislated timelines. Of the 331 requests closed past legislated timelines (including any extensions taken):

• 35 were closed 1 to 15 days past legislated timelines
• 26 were closed 16 to 30 days past legislated timelines
• 24 were closed 31 to 60 days past legislated timelines
• 46 were closed 61 to 120 days past legislated timelines
• 35 were closed 121 to 180 days past legislated timelines
• 59 were closed 181 to 365 days past legislated timelines
• 106 were closed more than 365 days past legislated timelines

Requests are closed past the legislated timelines for a number of reasons:

• 193 were closed past the legislated timelines due to 'interference with operations/ workload'
• 21 were closed past the legislated timelines due to 'external consultations'
• 12 were closed past the legislated timelines due to 'internal consultations'
• 105 were closed past the legislated timelines for reasons 'other' than those specified above.

Data quality

Please note that small data variances may exist from year to year, including in the previously reported number of outstanding requests carried forward into the current fiscal year. Several reasons contribute to inevitable shifts in data, including requests by the Office of the Information Commissioner to re-open ATI requests in the context of complaint resolution, and requesters seeking to divide one incoming request into several files while retaining the initial date received.

Figure 1 - Text Description

The graph shows the ATI requests received and completed each fiscal year from 2018-2019 to 2022-2023.

For 2018-2019, the blue column shows that 99 requests were received; the green column shows that 109 requests were completed.

For 2019-2020, the blue column shows that 138 requests were received; the green column shows that 130 requests were completed.

For 2020-2021, the blue column shows that 501 requests were received; the green column shows that 209 requests were completed.

For 2021-2022, the blue column shows that 757 requests were received; the green column shows that 397 requests were completed.

For 2022-2023, the blue column shows that 373 requests were received; the green column shows that 453 requests were completed.

Source of requests under the Access to Information Act

The Public Health Agency of Canada's requests mostly came from the public (35%) and the media (23%) in 2022-2023. Only a small number of requests came from academia (4%), businesses (1.3%) and organizations (0.5%), while 36% declined to identify which category they associate with.

*Numbers may not add up due to rounding.

Extensions

Most of extensions 24 (47%) invoked under the ATIA were to conduct consultations with institutions other than third parties, 18 (35%) were taken to conduct consultations with third parties, while 9 (18%) were due to interference with operations for requests involving a large volume of records.

Completing third party consultations is a necessary step in the process, enabling the Public Health Agency of Canada to release as much information as possible. Over the last several years, the Public Health Agency of Canada has made more information accessible, continuously reassessing the balance between its commitment to openness and transparency, with the need to safeguard confidential business information.

Consultations completed from other institutions

In addition to processing its own requests, the Public Health Agency of Canada also completes consultations received from other institutions and organizations.

In 2022-2023, the Public Health Agency of Canada managed 241 consultations from other Government of Canada institutions (187 received in the 2022-2023 fiscal year and 54 received in 2021-2022). A total of 58 requests were from other organizations (45 received in the 2022-2023 fiscal year and 13 received in 2021-2022).

The Public Health Agency of Canada closed 275 consultations having reviewed 25,018 pages of records. In most cases, the Public Health Agency of Canada consented to full disclosure of the records.

Disposition of completed requests

Of the ATI requests completed in 2022-2023, 50% were disclosed in part and 19% were all disclosed. No records existed for 13% of requests while 13% of ATI requests were abandoned.  Five percent of requests were transferred and 0.4% were all exempted.

Figure 2 - Text Description

The doughnut chart shows the disposition of completed ATI requests by percent and color. The percent of requests 'disclosed in part' is in green (50%). The percent of requests 'all disclosed' is in orange (19%). The percent of ‘requests abandoned’ is in red (13%). The percent of requests for which 'no records exist' is in yellow (13%). Records that are ‘transferred’ or 'all exempted' are in grey (5%).

*Numbers may not add up due to rounding.

Exemptions invoked

Sections 13 to 24 of the ATIA provide specific legislated exemptions intended to protect information from disclosure, while section 26 provides a temporary exemption relating to information that will soon be published. In some instances, records may have multiple exemptions applied to them to appropriately safeguard information.

An exemption was applied for section 19(1) 165 times; this is a mandatory exemption that safeguards personal information. The application of section 20 (to protect third party information) in 164 requests required consultations to ensure that only proprietary and commercially sensitive information is protected. Section 21 (the protection of information related to government operations) was applied to 74 requests.  For a detailed breakdown of exemptions see table 4.2 Exemptions.

Exclusions cited

The Access to Information Act does not apply to published material, material available to the public for purchase, or for public reference (section 68), nor does it apply to confidences of the King's Privy Council of Canada (section 69). Requests containing proposed exclusions under section 69 require consultation with the Department of Justice, and in some cases, the Privy Council Office.

In 2022-2023, two requests contained exclusions for publicly available material and 15 requests had records pursuant to confidences of the King's Privy Council of Canada.

Translations

No translations were required to respond to requests in 2022-2023.

Format of Information Released

Of the requests that were fully or partially disclosed, 264 were released as electronic copies, 39 were released in paper format, and eight as a data set. The Public Health Agency of Canada releases records in the preferred format of the requestor while encouraging the use of the Government of Canada's ATIP Online Request Service platform to receive timely and secure access to the records.

Privacy Act

Informal requests

No informal requests were made in 2022-2023.

Caseload and carry forward

In 2022-2023, the Public Health Agency of Canada managed 91 active privacy requests. Of these, 70 were new privacy requests and 21 were outstanding from previous reporting periods.

A total of 79 privacy requests were closed and 12 were carried forward to the 2023-2024 fiscal year. Of the 12 privacy requests carried forward to 2023-2024, six were carried over within legislated timelines while six were carried over beyond legislated timelines. For detailed information about outstanding requests from previous fiscal years, please see the section 1 of Appendix C.

Requests for personal information under the Privacy Act are generally received from current and former Public Health Agency of Canada employees who want to obtain their personal information, and from people who have applied for employment at the Public Health Agency of Canada, seeking management's consideration of their applications.

Human resource services for the Public Health Agency of Canada are delivered by Health Canada, and associated records therefore are legally held by that institution. As a result, requests for personal information relating to Agency employees and staffing processes may be opened by both the Public Health Agency of Canada and Health Canada in order to identify all records to support an individual's right of access.

Figure 3 - Text Description

The graph shows the number of Privacy requests received and completed each fiscal year from 2018-2019 to 2022-2023.

For 2018-2019, the blue column shows that 28 requests were received; the green column shows that 25 requests were completed.

For 2019-2020, the blue column shows that 19 requests were received; the green column shows that 23 requests were completed.

For 2020-2021, the blue column shows that 51 requests were received; the green column shows that 40 requests were completed.

For 2021-2022, the blue column shows that 78 requests were received; the green column shows that 69 requests were completed.

For 2022-2023, the blue column shows that 70 requests were received; the green column shows that 79 requests were completed.

Processing time for requests

In 2022-2023, the Public Health Agency of Canada closed a total of 79 privacy requests. Below is a breakdown of the time taken to process these requests.

• 50 were closed within 1 to 15 days
• 10 were closed within 16 to 30 days
• 7 were closed within 31 to 60 days
• 6 were closed within 61 to 120 days
• 2 were closed within 121 to 180 days
• 2 were closed within 181 to 365 days
• 2 took more than 365 days

Of the 79 requests that the Public Health Agency of Canada responded to 63 (80%) of privacy requests within legislated timelines (30 days plus applicable extension) while 16 (20%) were closed beyond legislated timelines.

Of the 16 requests closed past legislated timelines (including any extensions taken):

• 3 were closed within 1 to 15 days
• 3 were closed within 16 to 30 days
• 2 were closed within 31 to 60 days
• 4 were closed within 61 to 120 days
• 1 were closed within 121 to 180 days
• 3 were closed within 181 to 365 days
• 0 took more than 365 days

Requests are closed past the legislated timelines for a number of reasons:

• 8 were closed past the legislated timelines due to 'interference with operations/ workload'
• 2 were closed past the legislated timelines due to 'external consultations'
• 0 were closed past the legislated timelines due to 'internal consultations'
• 6 were closed past the legislated timelines for reasons 'other' than those specified above

In accordance with the Treasury Board of Canada Secretariat's Directive on Personal Information Requests and Correction of Personal Information, the Public Health Agency of Canada continues to notify requesters in writing of anticipated delays.

Extensions

Of the eight requests where extensions were taken, six were due to interference with operations while two requests required internal consultation. Under the Privacy Act, 30 days is the longest extension that can be taken.

Consultations completed from other institutions

The Public Health Agency of Canada did not receive consultations from other Government of Canada institutions or other organizations.

Disposition of completed requests

Of the Privacy requests completed in 2022-2023, 19% were disclosed in part and 19% were all disclosed. The breakdown of the remaining completed files is as follows:

• 39% request abandoned
• 22% no records exist
• 1.3% all excluded
• 0% all exempted
• 0% neither confirmed nor denied

Figure 4 - Text Description

The doughnut chart shows the disposition of completed privacy requests by percent and color. The percent of requests 'disclosed in part' is in green (19%). The percent of requests 'all disclosed' is in orange (19%). The percent of 'requests abandoned' is in red (39%). The percent of requests for which 'no records exist' is in yellow (22%). Records that are 'all exempted', 'all excluded', and 'neither confirmed nor denied' are in grey (1%).

Exemptions Invoked

Of the 19 exemptions applied to privacy requests in 2022-2023, 15 were to protect the personal information of individuals other than the requester, and four were to provide notice to third parties.

Exclusions Cited

No exclusions were applied to privacy requests in 2022-2023 for records pursuant to confidences of the King's Privy Council.

Translations

No translations were required to respond to requests in 2022-2023.

Format of information released

Of the requests that were fully or partially disclosed, 26 were released as electronic copies, while the remaining four were released as paper copies.

Privacy Management Division Advisory Services

During 2022-2023, the Privacy Management Division received 375 requests for privacy advice from the Public Health Agency of Canada clients. This represents a slight decrease in the overall number of requests from the previous year (385), with the number of COVID-19 specific files being significantly lower (226 in 2021-2022 and 87 in 2022-2023). Year after year, the complexity of files continues to increase, requiring in-depth privacy analysis, on an expanding range of topics.

In the 2022-2023, the Privacy Management Division provided advisory services to the Public Health Agency of Canada. This included privacy advice on matters such as contracts, digital solutions, the handling of personal information, use and disclosure of personal information, and privacy risk assessments on programs, activities and research projects.

The Public Health Agency of Canada is committed to properly handling the personal information under its control and ensuring that privacy requirements and risks are considered when new initiatives were developed and deployed.

Reporting on fees for the Service Fees Act

The Service Fees Act requires a responsible authority to report annually to Parliament on the fees collected by the institution.

With respect to fees collected under the Access to Information Act, the information below is reported in accordance with the requirements of section 20 of the Service Fees Act.

Enabling authority: Access to Information Act

Fee amount: The $5.00 application fee is the only fee charged for an ATI request.

Total Revenue: The total fee revenue for 2022-­2023 was $985.00.

Fees waived: In accordance with the changes to the Access to Information Act that came into force on June 21, 2019, The Public Health Agency of Canada may only charge an application fee of $5, as set out in paragraph 7(1)(a) of the Regulations. Pursuant to section 11 of the Access to Information Act, institutions can waive this application fee as deemed appropriate.

A total of $870.00 was waived or refunded by the Public Health Agency of Canada in 2022-2023.

Cost for administering the Access to Information Act

The Public Health Agency of Canada spent a total of $2,020,599 on ATI functions in 2022-2023. Of this total, salaries and overtime costs represent $1,417,900 and goods and services costs were $602,699. Most of the goods and services costs ($570,039) were used to retain temporary resources to address larger and more complex requests.

Costs for administering the Privacy Act

The Public Health Agency of Canada spent a total of $1,049,958 on privacy functions in 2022-2023. Of this total, salaries and overtime costs represent $852,347. Temporary resources to support the processing of privacy requests accounted for $188,086 and other goods and services costs were $9,525.

Awards and recognition

On September 28, 2022, the ATIP Operations Division was honored with the Information Commissioner of Canada's Award. The Information Commissioner's Award recognized the ATIP Operations Division for its leadership and innovation.

Training and Awareness

Access to information training

An online 'Introduction to ATIP' course is available to all staff via the Canada School of Public Service, and was made mandatory as a foundation for all Public Health Agency of Canada employees. A total of 1,334 employees completed this course in 2022-2023 (1,100 more employees when compared to the previous year). In addition, in 2022-2023 the Public Health Agency of Canada conducted virtual Access to Information and Privacy Request training for 586 employees.

Training is available to groups by request and is tailored for each session to include examples that are relevant to the nature of work of the participants. The Public Health Agency of Canada also provides training related to proactive publication as needed. Training is promoted at all Single Window working group meetings and on the Public Health Agency of Canada's intranet site.

Privacy Training

During 2022-2023, the Privacy Management Division delivered several in-person and virtual privacy training sessions to support the Agency's privacy management. In November 2022, the Privacy Management Division conducted training sessions for the International Health Regulations Ambassador Group, Research Ethics Board, and the Office of Biosecurity. In total, 170 Public Health Agency Canada employees attended the Privacy Management Division's virtual training sessions.

The Privacy Management Division's online privacy training is available to all Public Health Agency of Canada employees. Approximately, 520 Public Health Agency of Canada employees completed the online training in 2022-2023. Throughout the year, regular communications are sent to all employees on privacy-related matters with the aim of supporting a culture of strong privacy awareness within the agency.

Right to Know Week

In 2022, Canada celebrated Right to Know Week from September 26th to October 2nd. The Public Health Agency of Canada kicked off the event with a message from the President, highlighting the importance of preserving the "public's right to access to government information as a fundamental pillar of our democracy". The Public Health Agency of Canada promoted the online ATIP courses offered by the Canada School of Public Service, shared resources on responding to ATIP requests, and highlighted Duty to Assist.

Policies, guidelines, procedures and initiatives

Treasury Board of Canada Secretariat: Access to Information Review

The Treasury Board of Canada Secretariat finalized the Government of Canada's report on the review of Access to Information in Canada and presented it to Parliament in 2022. The ATIP Operations Division supported this review by consulting with branches, identifying key issues and proposing potential solutions. In the report, three main goals were identified:

1. Improving Service to Canadians
2. Enhancing trust and transparency
3. Advancing reconciliation with Indigenous peoples

The ATIP Operations Division is committed to supporting these goals.

Privacy compliance evaluations, privacy impact assessments and COVID-19

In 2022-2023, workload related to COVID-19 began to taper off, but the overall workload remains high. While the Public Health Agency of Canada's exception to the requirements of undertaking Privacy Impact Assessments for urgent COVID-19 related initiatives expired on September 30, 2022, the Privacy Management Division was able to complete four Privacy Compliance Evaluations as well as five Privacy Impact Assessments.

The Public Health Agency of Canada's access to information and privacy action plan

The COVID-19 pandemic increased public interest in the Public Health Agency of Canada, leading to a surge in ATIP requests. In 2022, an ATIP action plan was developed and implemented. The purpose of this action plan was to identify ATIP challenges and improve performance within the Agency.

A range of challenges were identified and three key areas were targeted for improvement: strengthening accountability, enhancing infrastructure and tools, and optimizing file management. The majority of the action plan activities are either complete or on track for completion.

Betterment Solutions working group

The ATIP Betterment Solutions Working Group was launched in April 2022. At this working group, ATIP Analysts identify and prioritize issues, identify solutions, and prepare tools for employees and Single Windows. This working group fosters a culture of innovation by promoting employee participation.

ATIP Coordinators' working group

The ATIP Coordinator's Working Group was launched in October 2018 and comprised of ATIP Coordinators representing 30 institutions. The ATIP Coordinator continued to co-chair the working group. This working group fosters open communication and knowledge sharing across institutions, meeting monthly to discuss common and emerging issues, and to share best practices and tools.

ATIP Operations Division's professional development program

The ATIP Operations Division's Professional Development Program was launched in January 2017. This program allows employees to progress based on performance, without the need of a competitive hiring process. In 2022-2023, 21 analysts were enrolled in the program and 12 advanced to the next level. The Professional Development Program helps increase ATIP capacity within the Government of Canada.

Post-secondary recruitment campaign

The ATIP Coordinator's Working Group was launched in October 2018 comprised of ATIP Coordinators representing 30 institutions. The Executive Director of the ATIP Operations Division continued to co-chair the working group, which meets monthly to discuss common and emerging issues and share best practices, strategies and tools.

Summary of key issues and actions taken on complaints and audits

Privacy management audit

An internal privacy audit was concluded during fiscal year 2019-2020 on the management of privacy practices at Health Canada the Public Health Agency of Canada. The audit made four recommendations to further strengthen the management of privacy practices.

The recommendation to incorporate Sex and Gender-Based Analysis Plus (SGBA+) considerations into the Privacy Management Division processes is complete. The Privacy Management Division is working to complete the remaining recommendations in 2023-2024.

A copy of the full audit report can be found at https://www.canada.ca/en/public-health/corporate/transparency/corporate-management-reporting/internal-audits/reports/management-privacy-practices-2019.html

Complaints management

Complaints to the Information Commissioner

In 2022–2023, 24 complaints under the ATIA were filed with the Office of the Information Commissioner for the Public Health Agency of Canada's requests, a decrease (-12%) from the 27 received in 2021-2022. The Public Health Agency of Canada received 15 final reports from the Office of the Information Commissioner with one containing an order.

Areas of complaint include deemed refusal (late) and exemptions applied to personal information and third party information. The Agency reviews the outcomes of all investigations conducted by the Office of the Information Commissioner, and where appropriate, incorporates lessons learned into business processes.

Outstanding number of ATI complaints

Individuals and Organizations who believe federal institutions have not respected their rights under the ATIA, may ask the Office of the Information Commissioner to investigate within 60 days of receiving a release package from a federal institution. There are 17 open complaints with the Information Commissioner of Canada. The following table lists the number of open complaints with the Information Commissioner of Canada by year.

The Public Health Agency of Canada actively communicates and collaborates with the Office of the Information Commissioner to ensure the effective handling and resolution of complaints.

Complaints to the Privacy Commissioner

During 2022-2023, eight complaints related to the handling of personal information by the Public Health Agency of Canada were received under Section 31 of the Privacy Act. The Public Health Agency of Canada provided representations to the Office of the Privacy Commissioner of Canada under Section 33 of the Privacy Act for nine complaints. There were three letters of finding received under Section 35 from the Office of the Privacy Commissioner of Canada relating to complaints.

Outstanding Number of Active Complaints

Individuals have the right to make a complaint to the Privacy Commissioner of Canada. There are 12 open complaints with the Privacy Commissioner of Canada. The following table lists the number of open complaints with the Privacy Commissioner of Canada by year.

The Public Health Agency of Canada communicates and collaborates with the Office of the Privacy Commissioner to ensure the effective handling and resolution of complaints.

Federal Court Cases

Applications and appeals submitted to the Federal Court

Access to Information Act

No applications or appeals were made to the Federal Court or the Federal Court of Appeal during the 2022–2023 fiscal year.

Privacy Act

One application was made to the Federal Court during the 2022-2023 fiscal year. A summary of the application is below.

Michael Weedon v. His Majesty the King (Public Health Agency of Canada)

On November 7, 2022 Mr. Weedon filed a claim against the Public Health Agency of Canada alleging that they failed to provide a response to a request for access to personal information within 30 days as required under the Privacy Act, and that his personal information was provided to the Ontario government. The claim followed an investigation by the Office of the Privacy Commissioner of Canada that determined the Public Health Agency of Canada had not responded within the timeframe required. In addition to requesting an apology, the plaintiff sought damages for the wait time incurred and asked that the Court order fines to be paid by employees, including the President of the Public Health Agency of Canada, to the maximum amount of $1,000.00 per person who disregarded their obligations under the Privacy Act.

On January 3, 2023 the court struck out the claim for failing to raise a reasonable cause of action and because the court does not have the authority to award damages under the Privacy Act. While Canada had not sought costs, the decision notes that the judge would have been inclined to grant them in order to discourage frivolous and unnecessary litigation.

Monitoring compliance

ATIP Operations Division produces weekly, monthly and semi-annual reports to senior management in order to monitor performance within the Public Health Agency of Canada. This includes incoming volume of requests, number of closed requests, and timeliness of retrieval of records. In addition, the ATIP Operations Division helps branches conduct a detailed analysis to identify frequent request types and explore alternate methods to disclose such information.

The Privacy Management Division produces quarterly reports to senior management on privacy breaches, training as well as requests for privacy analysis. The Privacy Management Division supports compliance by periodically reviewing its privacy policies, procedures and practices.

In response to the 2019-2020 audit on the management of privacy practices at Health Canada and the Public Health Agency of Canada, the Privacy Management Division will implement a monitoring and follow-up process for Privacy Impact Assessments and protocol recommendations in 2023-2024.

The Privacy Management Division assists programs, ensuring the appropriate privacy protections are included in contracts, agreements and arrangements (e.g. review contracts and information sharing agreements).

Other reporting requirements specific to the Privacy Act

Material privacy breaches

During 2022-2023, the Public Health Agency of Canada reported one material privacy breach to the Office of the Privacy Commissioner and the Treasury Board Secretariat. The breach was the result of a misdirected email. Measures were taken to prevent the risk of recurrence.

Privacy impact assessments

During 2022-2023, five Privacy Impact Assessments and four Privacy Compliance Evaluations were completed. Although the interim Directive expired on March 31, 2021, the Secretary granted the Agency an exception from the requirements of section 6.3 of the Directive of Privacy Impact Assessment, which allowed the Agency to continue to identify and mitigate the privacy risks of its pandemic response through the more streamlined Privacy Compliance Evaluation option (the policy exception expired on September 30, 2022).

For each of the five Privacy Impact Assessments summarized below, mitigation actions were identified to address any potential concerns.

Onboarding the Canadian Food Inspection Agency to iStop

iStop is a system used by Public Health Agency of Canada to carry out its regulatory activities. Integrating the Canadian Food Inspection Agency into the iStop system enables improved coordination and data sharing. In accordance with the Treasury Board Directive on Privacy Impact Assessments, a Privacy Impact Assessment was completed to ensure compliance with the Privacy Act and Treasury Board policies. For more information, please contact by email: privacy-vieprivee@phac-aspc.gc.ca .

School health grant for youth

The School Health Grant for Youth provides Canadian youth an opportunity to apply for a grant to develop youth-driven and youth-inspired initiatives that encourage and promote healthy living in their school. A summary of this Privacy Impact Assessment has not yet been published. For more information, please contact by email: privacy-vieprivee@phac-aspc.gc.ca.

Routine activities under the Quarantine Act

To prevent the introduction and spread of communicable diseases that are of significant harm to public health, the Public Health Agency of Canada collaborates with border partners, such as the Canada Border Services Agency, to administer the Quarantine Act, at all international points of entry into Canada. A summary of this Privacy Impact Assessment has not yet been published. For more information, please contact by email: privacy-vieprivee@phac-aspc.gc.ca.

Pandemic border measures under the Quarantine Act

Due to the COVID-19 pandemic, enhanced border measures (enacted under the authority found in section 58 of the Quarantine Act) were part of the Government of Canada's efforts to slow the introduction and spread of the virus associated with international travel. A summary of this Privacy Impact Assessment has not yet been published. For more information, please contact by email: privacy-vieprivee@phac-aspc.gc.ca.

Investigation of breach of scientific integrity

The Investigation Process for Allegations of Breach of Scientific Integrity is designed to allow for the reporting and subsequent investigation (if required) of potential breaches of scientific integrity. A summary of this Privacy Impact Assessment has not yet been published. For more information, please contact by email: privacy-vieprivee@phac-aspc.gc.ca.

A summary of the four Privacy Compliance Evaluations that were completed in place of Privacy Impact Assessments are below:

COVID-19 related tickets to travelers

Due to the COVID-19 pandemic, enhanced border measures were introduced to ensure appropriate measures were taken to reduce the spread of the virus. Public Health Agency of Canada contracted process servers to serve COVID-related tickets to travellers. In accordance with the Treasury Board Interim Directive on Privacy Impact Assessments, a Privacy Compliance Evaluation was completed in place of conducting a Privacy Impact Assessment. A summary of this Privacy Compliance Evaluation has not yet been published. For more information, please contact by email: privacy-vieprivee@phac-aspc.gc.ca.

Moving testing offsite

Due to the COVID-19 pandemic, enhanced border measures were introduced to ensure appropriate measures were taken to reduce the spread of the virus. For travellers entering Canada by air, mandatory random testing was required at the four major airports (Toronto-Pearson, Montreal-Trudeau, Calgary, and Vancouver). In accordance with the TB Interim Directive on Privacy Impact Assessment, a Privacy Compliance Evaluation was completed in place of conducting a Privacy Impact Assessment. A summary of this a Privacy Compliance Evaluation has not yet been published. For more information, please contact by email: privacy-vieprivee@phac-aspc.gc.ca.

Personal information collection in quarantine case management system

During the COVID-19 pandemic, enhanced border measures were introduced to ensure appropriate measures are taken to reduce the spread of the virus, including collecting information from travellers entering Canada, and administering and enforcing the Mandatory Isolation Order. In accordance with the TB Interim Directive on Privacy Impact Assessment, a Privacy Compliance Evaluation was completed in place of conducting a Privacy Impact Assessment. For more information, please refer to: Quarantine Case Management System privacy compliance evaluation.

Border testing irregular asylum seekers

Roxham Road is an unofficial border crossing in Quebec used by irregular arrival asylum seekers. Due to the number of irregular arrival asylum seekers entering Canada through this location, services including the Public Health Agency of Canada testing were temporarily located at this site. In accordance with the Treasury Board Interim Directive on Privacy Impact Assessments, a Privacy Compliance Evaluation was completed in place of conducting a Privacy Impact Assessment. A summary of this Privacy Compliance Evaluation has not yet been published. For more information, please contact by email: privacy-vieprivee@phac-aspc.gc.ca.

Public interest disclosures

During 2022-2023, there was one disclosure made under section 8(2)(m) of the Privacy Act and two section 8(5) written notifications were provided to the Office of the Privacy Commissioner. One 8(5) notification was made after the information was disclosed and the other was made prior to the disclosure of personal information; however, the program decided to not disclose the personal information.

Appendix A: Access to Information Act and Privacy Act – Delegation Order

Figure 5 - Text Description

Delegation Order

Access to Information Act and Privacy Act

I, the Minister of Health, pursuant to section 95 of the Access to Information Act and section 73 of the Privacy Act, hereby delegate the persons holding the positions set out in the Delegation of Authority Schedule attached hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Minister as head of Health Canada, under the provisions of the Act and related regulations set out in the schedule opposite each position. This delegation supersedes all previous delegation orders.

Jean-Yves Duclos
Minister of Health

March 22, 2022

Delegation of Authority Schedule

The tables below outline which positions can exercise the powers, duty or functions of the Minister, under the provisions of the Act.

Access to Information Act

Part 1 and 3

Privacy Act

Appendix B: Statistical Report on the Access to Information Act

Reporting period: 2022-04-01 to 2023-03-31. Data extracted on May 29, 2023.

Section 1: Requests under the Access to Information Act

Section 2: Informal Requests

Section 3: Applications to the Information Commissioner on declining to act on requests

Section 4: Requests Closed During the Reporting Period

4.5 Complexity

4.6 Closed Requests

4.7 Deemed Refusals

Section 5: Extensions

Section 6: Fees

Section 7: Consultations received from other institutions and organizations

Section 8: Completion Time of consultations on Cabinet Confidences

Section 9: Investigations and reports of finding

Section 10: Court Action

Section 11: Resources related to the Access to Information Act

Appendix C: Statistical Report on the Privacy Act

Reporting period: 2022-04-01 to 2023-03-31. Data extracted on May 29, 2023.

Section 1: Requests under the Privacy Act

Section 2: Informal Requests

Section 3: Requests closed during the reporting period

3.5 Complexity

3.6 Closed Requests

3.7 Deemed Refusals

Section 4: Disclosures under Subsections 8(2) and 8(5)

Section 5: Requests for correction of personal information and notations

Section 6: Extensions

Section 7: Consultations Received From Other Institutions and Organizations

Section 8: Completion time of consultations on Cabinet Confidences

Section 9: Complaints and investigation notices received

Section 10: Privacy Impact Assessments (PIA) and Personal Information Banks (PIB)

Section 11: Privacy Breaches

Section 12: Resources related to the Privacy Act

Appendix D: Supplemental Statistical Report on the Access to Information Act and Privacy Act

In addition to completing the forms for the Statistical Reports on the ATIA and Privacy Act for 2022-2023, institutions were asked to complete this Supplemental Report to help identify the institutional capacity during COVID-19. The data requirements are set out in the tables below.

Section 1: Capacity to Receive Requests under the Access to Information Act and Privacy Act

1.1 The following table reports the number of weeks the Public Health Agency of Canada was able to receive ATIP requests through different channels.

Section 2: Capacity to process records under the Access to Information Act and Privacy Act

Section 3: Open requests and complaints under the Access to Information Act

Section 4: Open Requests and Complaints under the Privacy Act

Section 5: Social Insurance Number (SIN)

The Public Health Agency of Canada did not received authority for a new collection or new consistent use of the SIN in 2022-2023.

Section 6: Universal access under the Privacy Act

The Public Health Agency of Canada received two requests confirmed from foreign nationals outside of Canada in 2022-2023.