Public Health Agency of Canada Annual report on the Access to Information Act and the Privacy Act 2023-2024

Table of contents

• Introduction
  • About the Public Health Agency of Canada
  • Purpose of the Acts
• Organizational structure
  • Shared Services Partnership Agreement
  • Access to Information and Privacy Operations Division
  • Privacy Management Division
  • Total FTEs supporting the ATIA and the Privacy Act
  • Governance
• Delegation of authority
• Openness and transparency
  • Part 2 of the Access to Information Act and proactive publication of information
• Performance for 2023-2024
  • Access to Information Act
  • Privacy Act
• Reporting on fees for the Service Fees Act
• Cost for administering the Access to Information Act
• Costs for administering the Privacy Act
• Training and awareness
  • Access to information training
  • Access to information awareness
  • Privacy training
  • Privacy awareness
• Policies, guidelines, procedures and initiatives
  • The Public Health Agency of Canada's Access to Information and Privacy Action Plan
  • Betterment Solutions Working Group
  • ATIP Operations Division's Professional Development Program
  • Privacy Breach Reporting Portal
  • Privacy Act modernization
• Summary of key issues and actions taken on complaints and audits
  • Privacy management audit
• Complaints management
  • Complaints to the Information Commissioner of Canada
  • Outstanding number of Access to Information complaints
  • Complaints to the Privacy Commissioner of Canada
  • Outstanding number of privacy complaints
• Federal Court cases
  • Applications and appeals submitted to the Federal Court
• Monitoring compliance
• Other reporting requirements specific to the Privacy Act
  • Material privacy breaches
  • Privacy Impact Assessments
  • Public interest disclosures
• Appendix A: Access to Information Act and Privacy Act – Delegation Order
  • Delegation of Authority Schedule
• Appendix B: Statistical Report on the Access to Information Act
  • Section 1: Requests under the Access to Information Act
  • Section 2: Informal requests
  • Section 3: Applications to the Information Commissioner on declining to act on requests
  • Section 4: Requests closed during the reporting period
  • Section 5: Extensions
  • Section 6: Fees
  • Section 7: Consultations received from other institutions and organizations
  • Section 8: Completion time of consultations on cabinet confidences
  • Section 9: Investigations and reports of finding
  • Section 10: Court action
  • Section 11: Resources related to the Access to Information Act
• Appendix C: Statistical Report on the Privacy Act
  • Section 1: Requests under the Privacy Act
  • Section 2: Informal requests
  • Section 3: Requests closed during the reporting period
  • Section 4: Disclosures under subsections 8(2) and 8(5)
  • Section 5: Requests for correction of personal information and notations
  • Section 6: Extensions
  • Section 7: Consultations received from other institutions and organizations
  • Section 8: Completion time of consultations on cabinet confidences
  • Section 9: Complaints and investigation notices received
  • Section 10: Privacy Impact Assessments (PIA) and Personal Information Banks (PIB)
  • Section 11: Privacy breaches
  • Section 12: Resources related to the Privacy Act
• Appendix D: Supplemental Statistical Report on the Access to Information Act and Privacy Act
  • Section 1: Open requests and complaints under the Access to Information Act
  • Section 2: Open requests and complaints Under the Privacy Act
  • Section 3: Social Insurance Number (SIN)
  • Section 4: Universal access under the Privacy Act

Introduction

The Public Health Agency of Canada is pleased to present to Parliament its consolidated annual report on the administration of Access to Information and Privacy (ATIP) services, in accordance with section 94 of the Access to Information Act (ATIA) and section 72 of the Privacy Act and section 20 of the Service Fees Act. The report describes activities that support compliance with these laws for the fiscal year beginning April 1, 2023 and ending March 31, 2024.

About the Public Health Agency of Canada

The Public Health Agency of Canada's mission is to promote and protect the health of Canadians through leadership, partnership, innovation and action in public health.

The role of the Public Health Agency of Canada is to:

• Promote health;
• Prevent and control chronic diseases and injuries;
• Prevent and control infectious diseases;
• Prepare for and respond to public health emergencies;
• Serve as a central point for sharing Canada's public health expertise with the rest of the world;
• Apply international research and development to Canada's public health programs; and
• Strengthen intergovernmental collaboration on public health and facilitate national approaches to public health policy and planning.

For more information about the Public Health Agency of Canada, please visit our website.

Purpose of the Acts

The ATIA gives Canadian citizens and permanent residents of Canada, and anyone present in Canada the right to access information contained in federal government records, subject to certain specific and limited exceptions. The ATIA complements, but does not replace, other means of obtaining government information.

The Privacy Act protects an individual's privacy by setting out provisions related to the collection, retention, accuracy, disposal, use and disclosure of personal information. It also gives individuals the right of access to information about themselves held by the federal government, with certain specific and limited exceptions.

Organizational Structure

Shared Services Partnership Agreement

ATIP Operations Division and the Privacy Management Division provide services to both the Public Health Agency of Canada and Health Canada and do so as part of the Shared Services Partnership Agreement. These divisions are housed under the Corporate Policy, Planning and Services Directorate of Health Canada's Corporate Services Branch. ATIP Operations Division manages the processing of requests under both the ATIA and the Privacy Act, while the Privacy Management Division is responsible for privacy policy and providing guidance to programs. Although ATIP services are provided to both institutions, the statistics and financial data provided in this report are only for the Public Health Agency of Canada.

Access to Information and Privacy Operations Division

The primary function of the ATIP Operations Division is to ensure compliance of the Public Health Agency of Canada's program delivery with the provisions of the ATIA and Privacy Act, along with the policies and directives of the Treasury Board of Canada Secretariat.

The ATIP Operations Division is responsible for responding to access to information and privacy requests. It reviews information to support various disclosures including the appropriate sharing of investigation reports, and proactive publication under Part 2 of the ATIA, as well as providing advice to Parliamentary Affairs when responding to Parliamentary motions. In addition, ATIP Operations Division promotes awareness of ATIP obligations and provides ATIP training to staff.

In 2023-2024, there were 42.859 full-time equivalents within the ATIP Operations Division supporting the Public Health Agency of Canada's administration of both the ATIA and the Privacy Act. A breakdown of the different types of full-time equivalents is provided in the table below.

Privacy Management Division

The primary functions of the Privacy Management Division include supporting compliance of the Public Health Agency of Canada's program delivery with the provisions of the Privacy Act and the privacy-related policies and directives of the Treasury Board of Canada Secretariat. Responsibilities include:

• The development of privacy policies, procedures and practices;
• The delivery of privacy training and awareness programs to staff;
• Assessing and reporting on privacy breaches;
• Providing review and attestation of Treasury Board Submissions and Memoranda to Cabinet as Privacy Functional Area;
• Providing review and approval of section 8(2)(j) disclosures (for research) and section 8(2)(m) disclosures (for public interest or to benefit the individual);
• Coordinating the Agency's InfoSource input; and
• Providing privacy analysis and advice using a number of tools including Privacy Impact Assessments (PIA) and Privacy Protocols.

In 2023-2024, there were 7.504 full-time equivalents within the Privacy Management Division supporting compliance of Health Canada's program delivery with the provisions of the Privacy Act and the privacy-related policies and directives of the Treasury Board of Canada Secretariat. A breakdown of the different types of full-time equivalents is provided in the table below.

Total FTEs supporting the ATIA and the Privacy Act

In 2023-2024, there were a total of 50.363 full-time equivalents supporting the administration of the ATIA and the Privacy Act. This comprised 35.774 full-time equivalents supporting the ATIA and 14.589 full-time equivalents supporting the Privacy Act.

For clarity and greater accountability, the following table illustrates the total resources from the ATIP Operations Division and the Privacy Management Division supporting the administration of the ATIA and the Privacy Act.

Governance

Initiatives related to access to information and privacy are governed through the ATIP Executive Leaders Committee. This committee is made up of executive-level representatives from across the Public Health Agency of Canada who provide leadership and strategic direction on key topics, communicating them within their respective branches. The Committee is chaired by the Director General, Corporate Policy, Planning and Services Directorate, Corporate Services Branch, who is responsible for the ATIP Operations Division and the Privacy Management Division.

ATI and privacy matters requiring a higher level of oversight or strategic direction are also brought forward to the Public Health Agency of Canada's Executive Committee.

Delegation of authority

In keeping with Treasury Board of Canada Secretariat recommendations on best practices, the Delegation Order extends authorities to multiple positions including the President, the Corporate Services Branch's Assistant Deputy Minister, the Director General of Corporate Policy, Planning and Services Directorate, the Director of the Privacy Management Division, the Executive Director of ATIP Operations Division and ATIP Coordinator. As appropriate, certain administrative authorities are delegated to various senior levels within the ATIP Operations Division and Privacy Management Division to support the effective and efficient administration of the ATIA and the Privacy Act. The delegation order that was in effect at the end of 2023-2024 is included in this report (Appendix A).

Openness and transparency

The Public Health Agency of Canada is committed to being open and transparent and continues to make more information available to Canadians. The Agency continues to publish information in accordance with Part 2 of the ATIA including briefing note titles, travel and hospitality expenses, reclassification of positions, and contracts over $10,000.

Part 2 of the Access to Information Act and proactive publication of information

The Public Health Agency of Canada is a government institution that is listed in Schedule I of the Financial Administration Act for the purposes of Part 2 of the ATIA.

The ATIP Operations Division worked with the Strategic Policy Branch, Chief Financial Officer Branch, Corporate Services Branch and the Communications and Public Affairs Branch to ensure that records identified under Part 2 of the Access to Information Act are proactively published. Existing procedures were leveraged to facilitate the proactive publication of information.

The processing of records for proactive publication involves several steps. Many of these steps are automated and an efficient approval process was implemented. A front-end approach for translation and ATI review has been established. Branches proactively identify information that may be subject to valid exceptions and ensure that briefing materials are prepared such that they can be readily published on the website.

The Strategic Policy Branch is responsible for proactively publishing the records listed in the tables below for the Ministers' Office and on behalf of the Public Health Agency of Canada. In 2023-2024, the Strategic Policy Branch proactively published all applicable proactive requirements within legislated timelines. Please see the following tables for the details.

The Chief Financial Officer Branch is responsible for proactively publishing the records listed in the tables below for the Ministers' Office and on behalf of the Public Health Agency of Canada. In 2023-2024, the Chief Financial Officer Branch proactively disclosed all applicable proactive requirements within legislated timelines. Please see the following tables for the details.

The Corporate Services Branch is responsible for proactively publishing records related to the reclassification of positions. In 2023-2024, the Corporate Services Branch published all notices for reclassification of position within legislated timelines. Please see the following table for the details.

The Communications and Public Affairs Branch is responsible for publishing records to the Government of Canada's Open Government website. Records that have been proactively published can be found on Canada.ca: Proactive Disclosure.

Performance for 2023-2024

In 2023-2024, the Public Health Agency of Canada received 458 requests (Access to Information, Access Informal and Privacy) and closed 514. The Public Health Agency of Canada closed more requests than it received during this period.

The following section of the report includes an interpretation and explanation of the data contained in Public Health Agency of Canada's Statistical Report, which summarizes Access to Information (ATI) and Privacy-related activity for the period between April 1, 2023 and March 31, 2024 (Appendix B – ATI and Appendix C – Privacy).

Access to Information Act

Access Informal Requests

Requests can be made for records previously released under the ATIA, which are referred to as 'Access Informal Requests'. Summaries of previously released access to information requests are posted monthly on the Open Government website, as part of the Government of Canada's commitment to openness and transparency.

The Public Health Agency of Canada received 160 Access Informal requests and processed 145 in 2023-2024. Sixteen requests were carried over to the 2024-2025 reporting period.

Caseload and carry forward and outstanding active access to information requests

In 2023-2024, the Public Health Agency of Canada managed 878 active access to information requests. Of this total, 239 were new requests received in 2023-2024, a decrease from the 373 received in 2022-2023. Of the 878 active access to information requests, 639 were outstanding from previous fiscal years with 148 from 2022-2023 and 491 from earlier periods.

The Public Health Agency of Canada closed 308 access to information requests and carried forward 570 to the 2024-2025 fiscal year. Of the 570 files carried forward, 110 were carried over within legislated timelines while 460 were carried over beyond legislated timelines.

Although more requests were closed than received, a high volume of requests were carried forward. This is largely due to the pandemic and its impact to operations early on. The ATIP Operations Division is well-equipped to handle this accumulated inventory with a dedicated ATIP COVID-19 team. This team was established early on, to focus on processing COVID-19-related requests and has extensive knowledge and experience in the subject matter. During 2023-2024, the team made headway on closing many of the outstanding files, while also addressing some of the largest and most complex requests.

Processing times for requests

In 2023-2024, the Public Health Agency of Canada closed a total of 308 requests. Below is the breakdown of the time taken to process these requests.

• 30 were closed 1 to 15 days within 1 to 15
• 47 were closed within 16 to 30 days
• 24 were closed within 31 to 60 days
• 23 were closed within 61 to 120
• 25 were closed within 121 to 180 days
• 30 were closed within 181 to 365 days
• 129 took more than 365 days

Of the 308 requests that the Public Health Agency of Canada closed in 2023-2024, 96 requests (31%) were closed within legislated timelines (30 days plus applicable extension) while 212 (69%) were closed past the legislated timelines. Of the 212 requests closed past legislated timelines (including any extensions taken):

• 24 were closed 1 to 15 days past legislated timelines
• 5 were closed 16 to 30 days past legislated timelines
• 12 were closed 31 to 60 days past legislated timelines
• 17 were closed 61 to 120 days past legislated timelines
• 8 were closed 121 to 180 days past legislated timelines
• 22 were closed 181 to 365 days past legislated timelines
• 124 were closed more than 365 days past legislated timelines

Requests are closed past the legislated timelines for a number of reasons:

• 117 were closed past the legislated timelines due to 'interference with operations/ workload'
• 11 were closed past the legislated timelines due to 'external consultations'
• 7 were closed past the legislated timelines due to 'internal consultations'
• 77 were closed past the legislated timelines for reasons 'other' than those specified above

Data quality

Please note that small data variances may exist from year to year, including in the previously reported number of outstanding requests carried forward into the current fiscal year. Several reasons contribute to inevitable shifts in data, including requests by the Office of the Information Commissioner to re-open access to information requests in the context of complaint resolution, and requesters seeking to divide one incoming request into several files while retaining the initial date received.

Access to information requests received and completed

Figure 1 : Descriptive text

The graph shows the ATI requests received and completed each fiscal year from 2019-2020 to 2023-2024.

For 2019-2020, 138 requests were received; 130 requests were completed.

For 2020-2021, 501 requests were received; 209 requests were completed.

For 2021-2022, 757 requests were received; 397 requests were completed.

For 2022-2023, 373 requests were received; 453 requests were completed.

For 2023-2024, 239 requests were received; 308 requests were completed.

Source of requests under the Access to Information Act

The Public Health Agency of Canada's requests mostly came from the public (34%) and the media (28%) in 2023-2024. Only a small number of requests came from academia (5%), businesses (4%) and organizations (2%), while 26% declined to identify which category they associate with.

Extensions

Most of the extensions 44 (54%) invoked under the ATIA were due to interference with operations for requests involving a large volume of records, 24 (29%) were to conduct consultations with institutions other than third parties, and 14 (17%) were taken to conduct consultations with third parties.

Completing consultations with other government organizations and third parties is a necessary step in the process, enabling the Public Health Agency of Canada to release as much information as possible. Over the last several years, the Public Health Agency of Canada has made more information accessible, continuously reassessing the balance between its commitment to openness and transparency, with the need to safeguard confidential business information.

Consultations completed from other institutions

In addition to processing its own requests, the Public Health Agency of Canada also completes consultations received from other institutions and organizations.

In 2023-2024, the Public Health Agency of Canada managed 140 consultations from other Government of Canada institutions (123 received in the 2023-2024 fiscal year and 17 received in 2022-2023). The Public Health Agency of Canada also managed 44 requests from other organizations (39 received in the 2023-2024 fiscal year and five received in 2022-2023).

The Public Health Agency of Canada closed 173 consultations having reviewed 9,857 pages of records. A total of three consultations were carried over to 2024-2025 within negotiated timelines, while eight were carried over beyond negotiated timelines. In most cases, the Public Health Agency of Canada consented to full disclosure of the records.

Disposition of completed requests

Of the access to information requests completed in 2023-2024, 55% were disclosed in part and 9% percent were all disclosed. No records existed for 9% of requests while 21% precent of access to information requests were abandoned. The breakdown of the remaining 'other' completed files is as follows:

• 1.6% request transferred
• 0.3% all exempted
• 2.6% all excluded
• 0.6% neither confirmed nor denied

*Numbers may not add up to 100% due to rounding

Figure 2 : Descriptive text

The doughnut chart shows the disposition of completed ATI requests by percent and color. The percent of requests 'disclosed in part' is in light blue (55%). The percent of requests 'all disclosed' is in dark blue (9%). The percent of 'requests abandoned' is in red (21%). The percent of requests for which 'no records exist' is in light red (9%). Records that are 'transferred', 'all exempted' 'all excluded' or neither confirmed or denied are in grey (5%).

Exemptions invoked

Sections 13 to 24 of the ATIA provide specific legislated exemptions intended to protect information from disclosure, while section 26 provides a temporary exemption relating to information that will soon be published. In some instances, records may have multiple exemptions applied to them to appropriately safeguard information.

An exemption was applied for section 19(1) (personal information) 147 times. The application of section 20 (to protect third party information) in 142 requests required consultations in many cases to ensure that only proprietary and commercially sensitive information is protected. Section 21 (the protection of information related to government operations) was applied to 61 requests. For a detailed breakdown of exemptions see table 4.2 Exemptions.

Exclusions cited

The ATIA does not apply to published material, material available to the public for purchase, or for public reference (section 68), nor does it apply to confidences of the King's Privy Council of Canada (section 69). Requests containing proposed exclusions under section 69 require consultation with the Department of Justice, and in some cases, the Privy Council Office.

In 2023-2024, three requests contained exclusions for publicly available material and 31 requests had records pursuant to confidences of the King's Privy Council of Canada.

Translations

No translations were required to respond to requests in 2023-2024.

Format of information released

Of the requests that were fully or partially disclosed, 183 were released as electronic copies, 15 were released in paper format, and one as a data set. The Public Health Agency of Canada releases records in the preferred format of the requestor, while encouraging the use of the Government of Canada's ATIP Online Request Service platform to receive timely and secure access to the records.

Privacy Act

Informal requests

No informal requests were made in 2023-2024.

Caseload and carry forward of privacy requests

In 2023-2024, the Public Health Agency of Canada managed 71 active privacy requests. Of these, 59 were new privacy requests and 12 were outstanding from previous reporting periods.

A total of 61 privacy requests were closed and 10 were carried forward to the 2024-2025 fiscal year. Of the 10 privacy requests carried forward to 2024-2025, two were carried over within legislated timelines while eight were carried over beyond legislated timelines. For detailed information about outstanding requests from previous fiscal years, please see the section 1 of Appendix C.

Requests for personal information under the Privacy Act are generally received from current and former Public Health Agency of Canada employees who want to obtain their personal information, and from people who have applied for employment at the Public Health Agency of Canada, seeking management's consideration of their applications.

Human Resource services for the Public Health Agency of Canada are delivered by Health Canada, and associated records therefore are legally held by that institution. As a result, requests for personal information relating to Agency employees and staffing processes may be opened by both the Public Health Agency of Canada and Health Canada in order to identify all records to support an individual's right of access.

Privacy requests received and completed

Figure 3 : Descriptive text

The graph shows the number of privacy requests received and completed each fiscal year from 2019-2020 to 2023-2024.

For 2019-2020, 19 requests were received; 23 requests were completed.

For 2020-2021, 51 requests were received; 40 requests were completed.

For 2021-2022, 78 requests were received; 69 requests were completed.

For 2022-2023, 70 requests were received; 79 requests were completed.

For 2023-2024, 59 requests were received; 61 requests were completed.

Processing Time for Requests

In 2023-2024, the Public Health Agency of Canada closed a total of 61 privacy requests. Below is a breakdown of the time taken to process these requests.

• 34 were closed within 1 to 15 days
• 9 were closed within 16 to 30 days
• 14 were closed within 31 to 60 days
• 1 were closed within 61 to 120 days
• 0 were closed within 121 to 180 days
• 2 were closed within 181 to 365 days
• 1 took more than 365 days

Of the 61 requests that the Public Health Agency of Canada responded to, 43 (70.5%) of privacy requests were closed within legislated timelines (30 days plus applicable extension), while 18 (29.5%) were closed beyond legislated timelines.

Of the 18 requests closed past legislated timelines (including any extensions taken):

• 8 were closed within 1 to 15 days
• 6 were closed within 16 to 30 days
• 0 were closed within 31 to 60 days
• 1 were closed within 61 to 120 days
• 0 were closed within 121 to 180 days
• 2 were closed within 181 to 365 days
• 1 took more than 365 days

Requests are closed past the legislated timelines for a number of reasons:

• 10 were closed past the legislated timelines due to 'interference with operations/ workload'
• 0 were closed past the legislated timelines due to 'external consultations'
• 0 were closed past the legislated timelines due to 'internal consultations'
• 8 were closed past the legislated timelines for reasons 'other' than those specified above

In accordance with the Treasury Board of Canada Secretariat's Directive on Personal Information Requests and Correction of Personal Information, the Public Health Agency of Canada continues to notify requesters in writing of anticipated delays.

Extensions

One extension was taken in 2023-2024 as the documents were difficult to obtain. Under the Privacy Act, 30 days is the longest extension that can be taken.

Consultations completed from other institutions

The Public Health Agency of Canada did not receive consultations from other Government of Canada institutions or other organizations.

Disposition of completed requests

Of the privacy requests completed in 2023-2024, 23% were disclosed in part and 8% were all disclosed. The breakdown of the remaining completed files is as follows:

• 43% request abandoned
• 26% no records exist
• 0% all excluded
• 0% all exempted
• 0% neither confirmed nor denied

*Numbers may not add due to rounding.

Figure 4 : Descriptive text

The doughnut chart shows the disposition of completed privacy requests by percent and color. The percent of requests 'disclosed in part' is in light blue (23%). The percent of requests 'all disclosed' is in dark blue (5%). The percent of 'requests abandoned' is in light red (43%). The percent of requests for which 'no records exist' is in red (26%).

Exemptions invoked

All of the 14 exemptions applied to privacy requests in 2023-2024, were to protect the personal information of individuals other than the requester.

Exclusions cited

No exclusions were applied to privacy requests in 2023-2024 for records pursuant to confidences of the King's Privy Council.

Translations

No translations were required to respond to requests in 2023-2024.

Format of information released

Of the 19 requests that were fully or partially disclosed, all were released as electronic copies.

Privacy Management Division advisory services

During 2023-2024, the Privacy Management Division received 316 requests for privacy advice from the Public Health Agency of Canada program clients. This represents a slight decrease in the overall number of requests from the previous year (375). Year after year, the complexity of files continues to increase, requiring in-depth privacy analysis, on an expanding range of topics.

In 2023-2024, the Privacy Management Division provided advisory services to the Public Health Agency of Canada. This included privacy advice on matters such as contracts, digital solutions, the handling of personal information, use and disclosure of personal information, and privacy risk assessments on programs, activities and research projects.

The Public Health Agency of Canada is committed to properly handling personal information under its control and ensuring that privacy requirements and risks are considered when new initiatives are developed and deployed.

Reporting on fees for the Service Fees Act

The Service Fees Act requires a responsible authority to report annually to Parliament on the fees collected by the institution.

With respect to fees collected under the ATIA, the information below is reported in accordance with the requirements of section 20 of the Service Fees Act.

Enabling authority: Access to Information Act

Fee amount: The $5.00 application fee is the only fee charged for an access to information request.

Total Revenue: The total fee revenue for 2023-­2024 was $790

Fees waived: In accordance with the changes to the ATIA that came into force on June 21, 2019, The Public Health Agency of Canada may only charge an application fee of $5, as set out in paragraph 7(1)(a) of the Regulations. Pursuant to section 11 of the ATIA, institutions can waive this application fee as deemed appropriate.

A total of $405 was waived or refunded by the Public Health Agency of Canada in 2023-2024.

In February 2024, Treasury Board Secretariat issued an Implementation Notice regarding waiving the $5 application fee in support of advancing Indigenous Reconciliation. Health Canada has implemented a process to align with this direction.

Cost for administering the Access to Information Act

The Public Health Agency of Canada spent a total of $4,015,433 on ATI functions in 2023-2024. Of this total, salaries and overtime costs represent $2,879,951 and goods and services costs were $1,135,482. Most of the goods and services costs ($1,067,609) were used to retain temporary resources to address larger and more complex requests.

Costs for administering the Privacy Act

The Public Health Agency of Canada spent a total of $1,698,387 on privacy functions in 2023-2024. Of this total, salaries and overtime costs represent $1,358,727. Temporary resources to support the processing of privacy requests accounted for $302,088 and other goods and services costs were $37,572.

Training and awareness

Access to information training

A mandatory online ATIP Fundamentals course, offered by the Canada School of Public Service, is available to all staff. A total of 787 Public Health Agency of Canada employees completed this course in 2023-2024, resulting in approximately 50% of employees having completed the course.

The Public Health Agency of Canada also offers targeted training specific to the agency and its processes. This includes a one-hour course, ATIP for Branch Single Window Contacts, which is offered to all new Single Windows. Additionally, a facilitated course, Introduction to ATIP Requests at the Public Health Agency of Canada, is available to all employees. Training is promoted at all Single Window working group meetings, at the ATIP Executive Leaders Committee, through Broadcast News messages, and on Public Health Agency of Canada's intranet site.

Access to information awareness

In 2023, Canada celebrated Right to Know Week from September 25^th to October 1^st. The Public Health Agency of Canada kicked off the event with a message from the Assistant Deputy Minister of the Corporate Services Branch, marking 40 years of ATIP legislation and highlighting that the right to privacy and the right for individuals to access information under the government's control are fundamental in an open, free, and democratic society. The Public Health Agency of Canada promoted the online ATIP course offered by the Canada School of Public Service and shared resources on how to respond to ATIP requests and manage information.

During the 2023-2024 fiscal year, communications were sent to all employees promoting access to information training and emphasizing its importance. In addition, information was provided to all employees addressing common questions, such as how to conduct record searches and what types of records need to be provided. The goal is to foster a culture of transparency while also promoting the timely provision of high-quality information.

Privacy training

During 2023-2024, the Privacy Management Division delivered several in-person and virtual privacy training sessions to support the Agency's privacy management. In total, over 200 Public Health Agency Canada employees attended the Privacy Management Division's virtual training sessions.

The Privacy Management Division's online privacy training is available to all Public Health Agency of Canada employees. Approximately, 192 Public Health Agency of Canada employees completed the online training in 2023-2024.

Privacy awareness

In 2023, Canada celebrated Privacy Awareness Week from May 8^th to 12^th, and in 2024, Canada celebrated Data Privacy Week from January 22^nd to 26^th. 2023 also marked the 40^th anniversary of the of the Privacy Act coming into force. The Public Health Agency of Canada commemorated each event with a message from the Assistant Deputy Minister of Corporate Services Branch, highlighting key privacy messages such as the importance of appropriate safeguards to protect personal information.

The Public Health Agency of Canada shared several privacy resources with its employees, such as responsibly managing Personal Information Banks and preventing privacy breaches. Throughout the year, regular communications are sent to all employees on privacy-related matters with the aim of supporting a culture of strong privacy awareness within the agency.

Policies, guidelines, procedures and initiatives

The Public Health Agency of Canada's Access to Information and Privacy Action Plan

The COVID-19 pandemic increased public interest in the Public Health Agency of Canada, leading to a surge in ATIP requests. In 2022, an ATIP Action Plan was developed and implemented. The purpose of this action plan was to identify ATIP challenges and improve performance within the Agency.

A range of challenges were identified and three key areas were targeted for improvement: strengthening accountability, enhancing infrastructure and tools, and optimizing file management. All of the activities outlined in the action plan were completed in 2023-2024, with two on-going activities remaining (ATIP training and reporting on branch performance).

Betterment Solutions Working Group

The ATIP Operations Division's Betterment Solutions Working Group continued to meet regularly throughout 2023-2024 to foster a culture of innovation by promoting employee-led improvements. At this working group, ATIP Analysts and support staff from a variety of levels identify and prioritize operational issues, in an effort to find and implement solutions. The working group also provides horizontal input in response to policy consultations from Treasury Board Secretariat.

ATIP Operations Division's Professional Development Program

The ATIP Operations Division's Professional Development Program was launched in January 2017. This program allows employees to progress based on performance, without the need of a competitive hiring process. In 2023-2024, 40 analysts were enrolled in the program and 15 advanced to the next level. The Professional Development Program helps increase ATIP capacity within the Government of Canada.

Privacy breach reporting portal

The Privacy Management Division launched a new privacy breach reporting portal in January 2024. The interactive portal is available to all Public Health Agency of Canada employees on the Agency's intranet to use to report a potential privacy breach. The portal is easy to use and helps employees to provide the Privacy Management Division with the right information that it needs to analyse the potential breach.

Privacy Act modernization

The Public Health Agency of Canada continues to participate in Privacy Act modernization efforts led by the Department of Justice Canada. In 2023-2024, the Privacy Management Division provided feedback on the unique health-related aspects of the amendments being considered for a modernized Act.

Summary of key issues and actions taken on complaints and audits

Privacy management audit

An internal privacy audit was concluded during fiscal year 2019-2020 on the management of privacy practices at Health Canada and the Public Health Agency of Canada. The audit made four recommendations to further strengthen the management of privacy practices.

The Privacy Management Division completed all remaining recommendations and formally closed the Management Response and Action Plan in 2023-2024.

A copy of the full audit report can be found at Audit of the Management of Privacy Practices at Health Canada and the Public Health Agency of Canada

Complaints management

Individuals and organizations who believe federal institutions have not respected their rights under the ATIA may ask the Office of the Information Commissioner to investigate within 60 days of receiving a response from a federal institution or if they have not received a response within the legislated timeline.

Individuals and organizations who think their personal information has been mishandled have the right to file a complaint to the Privacy Commissioner of Canada.

Complaints to the Information Commissioner of Canada

In 2023–2024, 27 complaints under the ATIA were filed with the Office of the Information Commissioner for the Public Health Agency of Canada's requests. The Public Health Agency of Canada received 13 final reports from the Office of the Information Commissioner with seven containing an order and six with recommendations. Fourteen of the 27 complaints, resulted in the Information Commissioner either refusing or ceasing to investigate the complaints under section 30(5) of the ATIA.

Areas of complaint include deemed refusal (late) and exemptions applied to personal information and third party information.

The Public Health Agency of Canada supports the Office of the Information Commissioner during investigations by providing details on the way a file was or is being processed, providing evidence of the search that was undertaken, explaining key considerations in applying exemptions, conducting new searches, providing rationales, etc. The Agency reviews the outcomes of all investigations conducted by the Office of the Information Commissioner, and where appropriate, incorporates lessons learned into business processes.

Outstanding number of access to information complaints

There are 13 open complaints with the Information Commissioner of Canada. The following table lists the number of open complaints with the Information Commissioner of Canada by year.

The Public Health Agency of Canada actively communicates and collaborates with the Office of the Information Commissioner to ensure the effective handling and resolution of complaints.

Complaints to the Privacy Commissioner of Canada

During 2023-2024, four complaints related to the handling of personal information by the Public Health Agency of Canada were received under Section 31 of the Privacy Act. Two of the complaints related to requests for personal information. One was for deemed refusal, and the other alleged missing records but was closed as not-well founded. One was regarding unauthorized disclosures of personal information, and was resolved using the Office of the Privacy Commissioner of Canada's early resolution process. One was regarding unauthorized disclosures of personal information but has not yet been resolved. The Public Health Agency of Canada provided representations to the Office of the Privacy Commissioner of Canada under Section 33 of the Privacy Act for one complaint. There were six letters of finding received under Section 35 from the Office of the Privacy Commissioner of Canada relating to complaints received in previous years.

The Public Health Agency of Canada supports the Privacy Commissioner during investigations by providing details on the way a file was or is being processed, conducting new searches, providing rationales, etc. The Public Health Agency of Canada reviews the outcomes of all investigations, and where appropriate, incorporates lessons learned into business processes.

Outstanding number of privacy complaints

There are two open complaints with the Privacy Commissioner of Canada. The following table lists the number of open complaints with the Privacy Commissioner of Canada by year.

The Public Health Agency of Canada communicates and collaborates with the Office of the Privacy Commissioner to ensure the effective handling and resolution of complaints.

Federal Court cases

Applications and appeals submitted to the Federal Court

Access to Information Act

No applications or appeals were made to the Federal Court or the Federal Court of Appeal during the 2023–2024 fiscal year.

Privacy Act

No applications or appeals were made to the Federal Court during the 2023-2024 fiscal year.

Monitoring compliance

ATIP Operations Division produces weekly, monthly and semi-annual reports to senior management in order to monitor performance within the Public Health Agency of Canada. These reports outline the incoming volume of requests, the number of closed requests, and the timelines of retrieval of records. Additionally, the ATIP Operations Division encourages branches to identify common request types and explore alternative methods for disclosing such information.

The Privacy Management Division produces semi-annual reports to senior management on privacy breaches and training as well as requests for privacy analysis. The Privacy Management Division supports compliance by periodically reviewing its privacy policies, procedures and practices.

In response to the 2019-2020 Audit on the Management of Privacy Practices at Health Canada and the Public Health Agency of Canada, the Privacy Management Division implemented a monitoring and follow-up process for Privacy Impact Assessments and Privacy Protocol recommendations in 2023-2024.

The Privacy Management Division assists programs, ensuring the appropriate privacy protections are included in contracts, agreements and arrangements (e.g., review contracts and information-sharing agreements).

Other reporting requirements specific to the Privacy Act

Material privacy breaches

During 2023-2024, the Public Health Agency of Canada reported no material privacy breaches to the Office of the Privacy Commissioner and the Treasury Board Secretariat.

Privacy Impact Assessments

During 2023-2024, two Privacy Impact Assessments were completed.

1. Public Health Agency of Canada Expert Roster and Scientific Performance Measurement Database

The Expert Roster and Scientific Performance Measurement Database program establishes a curated database of scientific experts in diverse public health fields. It ensures efficient selection and engagement of experts for advisory roles, enhancing evidence-based decision-making in public health matters. Administered directly by the Public Health Agency of Canada through internal system and utilizing an online platform. The Privacy Impact Assessment recommended mitigation actions in the following risk areas: retention and disposition processes, maintaining accuracy of personal information, and ensuring the appropriate security assessments and features such as access controls, audit functions, and encryption are in place when the program moves from its interim IT solution to a permanent IT solution. A summary of this Privacy Impact Assessment has not yet been published.

2. Pandemic Border Measures PIA Addendum

The Quarantine Program, administered by the Public Health Agency of Canada under the Quarantine Act, aims to prevent the importation of communicable diseases by screening and assessing travelers at international ports of entry. In line with this mandate, the Public Health Agency of Canada implemented temporary pre-departure COVID-19 test requirements for travelers from China, Hong Kong, and Macao, which were repealed in March 2023. A Privacy Impact Assessment addendum was conducted due to the use of travelers' personal information for decision-making and involvement of third-party contractors. The Privacy Impact Assessment recommended establishing a Personal Information Bank, amending online privacy notices, documenting disclosures in an Information Sharing Agreement, and limiting personal information collection. A summary of this Privacy Impact Assessment addendum has not yet been published.

Public interest disclosures

During 2023-2024, there were no disclosures made under section 8(2)(m) of the Privacy Act and no section 8(5) written notifications were provided to the Office of the Privacy Commissioner.

Appendix A: Access to Information Act and Privacy Act – Delegation Order

Appendix A : Descriptive text

On May 24, 2023, the Minister of Health, Jean-Yves Duclos, signed a delegation order. The order stipulates the following:

Delegation Order

Access to Information Act and Privacy Act

I, the Minister of Health, pursuant to section 95 of the Access to Information Act and section 73 of the Privacy Act, hereby delegate the persons holding the positions set out in the Delegation of Authority Schedule attached hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Minister as head of the Public Health Agency of Canada, under the provisions of the Act and related regulations set out in the schedule opposite each position. This delegation supersedes all previous delegation orders.

Delegation of authority schedule

Access to Information Act

Appendix B: Statistical Report on the Access to Information Act

Reporting period: 2023-04-01 to 2024-03-31. Data extracted on April 15, 2024.

Section 1: Requests under the Access to Information Act

Section 2: Informal requests

Section 3: Applications to the Information Commissioner on declining to act on requests

Section 4: Requests closed during the reporting period

4.5 Complexity

4.6 Closed requests

4.7 Deemed refusals

Section 5: Extensions

Section 6: Fees

Section 7: Consultations received from other institutions and organizations

Section 8: Completion time of consultations on Cabinet Confidences

Section 9: Investigations and reports of finding

Section 10: Court action

10.2 Court actions on third party notifications under paragraph 28(1)(b)

Section 11: Resources related to the Access to Information Act

Appendix C: Statistical Report on the Privacy Act

Reporting period: 2023-04-01 to 2024-03-31. Data extracted on April 15, 2024.

Section 1: Requests under the Privacy Act

Section 2: Informal requests

Section 3: Requests closed during the reporting period

3.5 Complexity

3.6 Closed requests

3.7 Deemed refusals

Section 4: Disclosures under Subsections 8(2) and 8(5)

Section 5: Requests for correction of personal information and notations

Section 6: Extensions

Section 7: Consultations received from other institutions and organizations

Section 8: Completion time of consultations on Cabinet Confidences

Section 9: Complaints and investigation notices received

Section 10: Privacy Impact Assessments (PIA) and Personal Information Banks (PIB)

10.1 Privacy Impact Assessments

Section 11: Privacy breaches

11.1 Material privacy breaches reported

11.2 Non-material privacy breaches

Section 12: Resources related to the Privacy Act

Appendix D: Supplemental Statistical Report on the Access to Information Act and Privacy Act

In addition to completing the forms for the Statistical Reports on the ATIA and Privacy Act for 2023-2024, institutions were asked to complete this Supplemental Report. The data requirements are set out in the tables below.

Section 1: Open requests and complaints under the Access to Information Act

Section 2: Open requests and complaints under the Privacy Act

Section 3: Social Insurance Number (SIN)

The Public Health Agency of Canada did not receive authority for a new collection or new consistent use of the SIN in 2023-2024.

Section 4: Universal access under the Privacy Act

The Public Health Agency of Canada received two requests confirmed from foreign nationals outside of Canada in 2023-2024.