Language selection

Government of Canada / Gouvernement du Canada

Search

Public Health Agency of Canada Annual report on the Access to Information Act and the Privacy Act 2024-2025

Download in PDF format
(579 KB, 34 pages)

Organization: Public Health Agency of Canada

Published: 2025-10-29

Cat.: HP2-19E-PDF

ISSN: 2563-5549

Pub.: 250154

Table of contents

Introduction

The Public Health Agency of Canada is pleased to present to Parliament its consolidated annual report on the administration of Access to Information and Privacy (ATIP) services, in accordance with section 94 of the Access to Information Act (ATIA) and section 72 of the Privacy Act. The report describes activities that support compliance with these laws for the fiscal year beginning April 1, 2024 and ending March 31, 2025.

About the Public Health Agency of Canada

The Public Health Agency of Canada is part of the federal health portfolio. Its activities focus on protecting against threats to public health, preventing and reducing diseases and injury, and promoting health, well-being, and equity.

The Public Health Agency of Canada does not have any entities with no employees or assets (non-operational ‘paper’ subsidiaries).

For more information about the Public Health Agency of Canada, please visit our website.

Purpose of the Acts

The ATIA gives Canadian citizens, permanent residents of Canada, and anyone present in Canada the right to access information contained in federal government records, subject to certain specific and limited exceptions. The ATIA complements, but does not replace, other means of obtaining government information.

The Privacy Act protects an individual's privacy by setting out provisions related to the collection, retention, accuracy, disposal, use and disclosure of personal information. It also gives individuals the right of access to information about themselves held by the federal government, with certain specific and limited exceptions.

The ATIA and Privacy Act enhance accountability and transparency of federal institutions, promoting an open and democratic society.

Organizational structure

Shared services partnership agreement

Housed within Health Canada’s Corporate Service Branch, the Access to Information and Privacy Services Directorate (ATIPSD) was formed in 2024-2025 and comprises two divisions: ATIP Operations Division and the Privacy Management Division. Prior to this, both divisions were part of the Corporate Policy, Planning and Services Directorate within Corporate Services Branch. The new directorate supports both Health Canada and the Public Health Agency of Canada under the Shared Services Partnership Agreement. This restructure was implemented to elevate the role of access to information and privacy within the Public Health Agency of Canada. Although services are provided to both institutions, only the Public Health Agency of Canada’s statistics and financial data are included in this report.

Access to Information and Privacy Operations Division

The primary function of the ATIP Operations Division is to ensure compliance of the Public Health Agency of Canada’s program delivery with the provisions of the ATIA, the Privacy Act, and related policies and directives of the Treasury Board of Canada Secretariat. Key responsibilities include:

In 2024-2025, there were 40.10 full-time equivalents within the ATIP Operations Division supporting the Public Health Agency of Canada’s administration of both the ATIA and the Privacy Act. A breakdown of full-time equivalents by category is provided in the table below.

Privacy Management Division

The primary functions of the Privacy Management Division include supporting compliance of the Public Health Agency of Canada’s program delivery with the provisions of the Privacy Act and the privacy-related policies and directives of the Treasury Board of Canada Secretariat. Key responsibilities include:

In 2024-2025, there were 8.349 full-time equivalents within the Privacy Management Division supporting compliance of the Public Health Agency of Canada's program delivery with the provisions of the Privacy Act and the privacy-related policies and directives of the Treasury Board of Canada Secretariat. A breakdown of full-time equivalents by category is provided in the table below.

Total full-time equivalents supporting the Access to Information Act and the Privacy Act

In 2024-2025, there were a total of 48.444 full-time equivalents supporting the administration of the ATIA and the Privacy Act. This comprised 35.464 full-time equivalents supporting the ATIA and 12.98 full-time equivalents supporting the Privacy Act. The following table outlines resources by Act and division.

Total full-time equivalents supporting the ATIA and the Privacy Act by Division
Type of full-time equivalents ATIA
ATIP Operations		 Privacy Act
ATIP Operations		 Privacy Act
Privacy Management Division		 Total
Full-time employees 31.188 4.073 6.882 42.143
Part-time and casual employees 1.633 0.213 0.758 2.604
Regional staff 0.000 0.000 0.000 0.000
Consultants and agency personnel 2.643 0.345 0.143 3.131
Students 0.000 0.000 0.566 0.566
Total full-time equivalents ATIA and Privacy Act 35.464 4.631 8.349 48.444

For a breakdown of the groups and/or positions responsible for meeting proactive publication requirements under Part 2 of the ATIA, see the section on proactive publication below.

Governance

Initiatives related to access to information and privacy are governed through the ATIP Executive Leaders Committee. This committee is made up of executive-level representatives from across the Public Health Agency of Canada who provide leadership and strategic direction on key topics and are responsible for communicating them within their respective branches.

The Executive Leaders Committee is chaired by the Executive Director, Access to Information and Privacy Services Directorate, Corporate Services Branch, who is responsible for the ATIP Operations Division and the Privacy Management Division.

ATI and privacy matters requiring a higher level of oversight or strategic direction may also be brought forward to the Public Health Agency of Canada’s Executive Committee.

Delegation of authority

In keeping with Treasury Board of Canada Secretariat recommendations on best practices, the Delegation Order extends authorities to multiple positions including the President, the Corporate Services Branch’s Assistant Deputy Minister, the Director General of Corporate Policy, Planning and Services Directorate, the Executive Director of ATIP Operations Division and ATIP Coordinator, and the Director of the Privacy Management Division.

As appropriate, certain administrative authorities are delegated to various senior levels within the ATIP Operations Division to support the effective and efficient administration of the ATIA and the Privacy Act. The delegation order that was in effect at the end of 2024-2025 is included in this report (Appendix A).

Proactive publication under Part 2 of the Access to Information Act

The Public Health Agency of Canada is a government institution that is listed in Schedule I of the Financial Administration Act for the purposes of Part 2 of the ATIA.

The ATIP Operations Division worked with the Strategic Policy Branch, Chief Financial Officer Branch, Corporate Services Branch and the Communications and Public Affairs Branch to ensure that records identified under Part 2 of the Access to Information Act are proactively published. Existing procedures were leveraged to facilitate the proactive publication of information. 

Branches involved in proactive publication use trackers with deadlines to monitor the timeliness of published information. There are also quality assurance teams that regularly validate that the accuracy and completeness of information proactively published.

Below are tables that outline the types of proactive publications and the percentage that are published within legislative timelines.

Applies to all Government Institutions as defined in section 3 of the Access to Information Act
Legislative Requirement Section of ATIA Publication Timeline Does the requirement apply to your institution? (Y/N) Internal group(s) or positions(s) responsible for fulfilling requirement % published within legislated timelines Link to web page where published
Travel Expenses 82 Within 30 days after the end of the month of reimbursement Y Accounting Operations Division, Chief Financial Officer Branch, Health Canada 100% Government Travel Expenses
Hospitality Expenses 83 Within 30 days after the end of the month of reimbursement Y Accounting Operations Division, Chief Financial Officer Branch, Health Canada 100% Hospitality Expenses
Reports tabled in Parliament 84 Within 30 days after tabling Y Each program responsible for preparing the report that is tabled 100% various
Applies to government entities or Departments, agencies, and other bodies subject to the Act and listed in Schedules I, I.1, or II of the Financial Administration Act
Legislative Requirement Section of ATIA Publication Timeline Does the requirement apply to your institution? (Y/N) Internal group(s) or positions(s) responsible for fulfilling requirement % published within legislated timelines Link to web page where published

Contracts over $10,000

86

Q1-3: Within 30 days after the quarter

Q4: Within 60 days after the quarter

Y

Procurement and Investment Management Directorate, Chief Financial Officer Branch , Health Canada

100%

Search Government Contracts over $10,000

Grants & Contributions over $25,000

87

Within 30 days after the quarter

Y

Centre for Grants and Contributions, Chief Financial Officer and Corporate Management Branch

100%

Grants and Contributions

Packages of briefing materials prepared for new or incoming deputy heads or equivalent

88(a)

Within 120 days after appointment

Y

Corporate Secretariat Directorate, Office of the President

N/A for 2024-25

Open Government Portal

Titles and reference numbers of memoranda prepared for a deputy head or equivalent, that is received by their office

88(b)

Within 30 days after the end of the month received

Y

Corporate Secretariat Directorate, Office of the President

100%

Briefing Note Titles and Numbers

Packages of briefing materials prepared for a deputy head or equivalent’s appearance before a committee of Parliament

88(c)

Within 120 days after appearance

Y

Corporate Secretariat Directorate, Office of the President

100%

Open Government Portal
Applies to government institutions that are departments named in Schedule I to the Financial Administration Act or portions of the core public administration named in Schedule IV to that Act (i.e. government institutions for which Treasury Board is the employer)
Legislative Requirement Section of ATIA Publication Timeline Does the requirement apply to your institution? (Y/N) Internal group(s) or positions(s) responsible for fulfilling requirement % published within legislated timelines Link to web page where published
Reclassification of positions 85 Within 30 days after the quarter Y Human Resources Services Directorate, Corporate Services Branch, Health Canada 100% Position Reclassification
Applies to Ministers’ Offices (therefore apply to any institution that performs proactive publication on behalf of a Minister’s Office)
Legislative Requirement Section of ATIA Publication Timeline Does the requirement apply to your institution? (Y/N) Internal group(s) or positions(s) responsible for fulfilling requirement % published within legislated timelines Link to web page where published
Packages of briefing materials prepared by a government institution for new or incoming ministers 74(a) Within 120 days after appointment Y Published by Health Canada for the Public Health Agency of Canada. N/A for 2024-25 Open Government Portal
Titles and reference numbers of memoranda prepared by a government institution for the minister, that is received by their office 74(b) Within 30 days after the end of the month received Y Corporate Secretariat Directorate, Office of the President 100% Open Government Portal
Package of question period notes prepared by a government institution for the minister and in use on the last sitting day of the House of Commons in June and December 74(c) Within 30 days after last sitting day of the House of Common in June and December Y Published by Health Canada for the Public Health Agency of Canada. N/A Question Period Notes
Packages of briefing materials prepared by a government institution for a minister’s appearance before a committee of Parliament 74(d) Within 120 days after appearance Y Corporate Secretariat Directorate, Office of the President 100% Open Government Portal
Travel Expenses 75 Within 30 days after the end of the month of reimbursement Y Accounting Operations Division, Chief Financial Officer Branch, Health Canada 100% Government Travel Expenses
Hospitality Expenses 76 Within 30 days after the end of the month of reimbursement Y Accounting Operations Division, Chief Financial Officer Branch, Health Canada 100% Hospitality Expenses
Contracts over $10,000 77 Q1-3: Within 30 days after the quarterQ4: Within 60 days after the quarter Y Procurement and Investment Management Directorate, Chief Financial Officer Branch, Health Canada 100% Search Government Contracts over $10,000
Ministers’ Offices Expenseson behalf of all institutions. 78 Within 120 days after the fiscal year Y Note: This consolidated report is currently published by TBS N/A Expenditures of Ministers' Offices | Open Government - Government of Canada

Performance for 2024-2025

In 2024-2025, the Public Health Agency of Canada received 990 requests (Access to Information, Access Informal and Privacy) and closed 1,054. The Public Health Agency of Canada closed more requests than it received during this period. When compared to the previous fiscal year, the Public Health Agency of Canada received 116% more requests. This is due to an increase in the number of access informal requests that were made.

Type of request Received Closed
Access to Information 181 268
Access Informal 778 751
Privacy 31 35
Total 990 1,054

The following sections of the report include an interpretation and explanation of the data contained in Public Health Agency of Canada’s Statistical Report, which summarizes Access to Information (ATI) and Privacy-related activities for the period between April 1, 2024 and March 31, 2025. This data can be found in the Open Government Portal: Access to Information and Privacy Statistics.

Data quality

It should be noted that minor data variances may occur from year to year, including in previously reported figures, such as the number of outstanding requests carried forward into the current fiscal year, material privacy breaches, or completed Privacy Impact Assessments. These variances arise due to a number of factors, including re-opened access to information requests at the request of the Office of the Information Commissioner during complaint resolution, or occasional human error during data entry. While every effort is made to ensure accuracy, minor discrepancies may occasionally occur.

Access to Information Act

Access informal requests

Requests can be made for records previously released under the ATIA, which are referred to as ‘Access Informal Requests’. Summaries of previously released access to information requests are posted monthly on the Open Government website where the public can make a request for copies of these records. This forms part of the Government of Canada’s commitment to openness and transparency.

The Public Health Agency of Canada received 778 Access Informal requests and closed 751 in 2024-2025. A total of 41 requests were carried over to the next reporting period.

Access to information requests received and completed

In 2024-2025, a total of 181 access to information requests were received and 268 were completed with 142,349 pages reviewed. More requests were closed than received, reducing the Public Health Agency of Canada’s accumulated inventory of requests.

Figure 1: Access to information requests received and completed each fiscal year from 2020-2021 to 2024-2025

Figure 1

Figure 1 - Text Equivalent

The bar graph shows the ATI requests received (yellow bars) and completed (black bars) for each fiscal year from 2020-2021 to 2024-2025.

  • For 2020-2021, 501 requests were received; 209 requests were completed.
  • For 2021-2022, 757 requests were received; 397 requests were completed.
  • For 2022-2023, 373 requests were received; 453 requests were completed.
  • For 2023-2024, 239 requests were received; 308 requests were completed.
  • For 2024-2025, 181 requests were received; 268 requests were completed.
Key statistics by fiscal year
Fiscal year Number of requests received Outstanding from previous reporting periods Total caseload Number of requests closed # of pages reviewed for closed files
2020-2021 501 68 569 209 13,595
2021-2022 757 360 1,117 397 41,139
2022-2023 373 719 1,092 453 115,137
2023-2024 239 639 878 308 341,949
2024-2025 181 570 751 268 142,349

Caseload and carry forward and outstanding active access to information requests

In 2024-2025, the Public Health Agency of Canada managed 751 active access to information requests. Of this total, 181 were new requests received in 2024-2025, a decrease from the 239 received in 2023-2024. Of the 751 active access to information requests, 570 were outstanding from previous fiscal years with 120 from 2023-2024 and 450 from earlier periods.

The Public Health Agency of Canada closed 268 access to information requests and carried forward 483 to the 2025-2026 fiscal year. Of the 483 files carried forward, 61 were carried over within legislated timelines while 422 were carried over beyond legislated timelines.

Although more requests were closed than received, a high volume were carried forward. An inventory reduction plan was launched in the Spring of 2024 and focus on closing older files. A target to close 25% of the accumulated inventory received prior to April 1, 2023 (114 files) was set and this goal was surpassed, with 30% of these files being closed. The Public Health Agency of Canada will continue implementing this reduction strategy.

Processing times for access to information requests

In 2024-2025, the Public Health Agency of Canada closed a total of 268 requests. Below is the breakdown of the time taken to process these requests.

Of the 268 requests that the Public Health Agency of Canada closed in 2024-2025, 63 requests (23.5%) were closed within legislated timelines (30 days plus applicable extension) while 205 (76.5%) were closed past the legislated timelines. Of the 205 requests closed past legislated timelines (including any extensions taken):

Requests are closed past the legislated timelines for a number of reasons:

Requests carried over to the next reporting period by reporting period received

In 2024-2025, 483 requests were carried over to the next reporting period. Below is a table outlining the number of access to information requests carried over to the next reporting period, broken down by the reporting period the request was received, and by whether the request was within legislated timelines.

Requests carried over to the next reporting period by reporting period received
Reporting period requests carried over were received Requests carried over that are within legislated timelines Requests carried over that are beyond legislated timelines Total

Received in 2024-2025

38

65

103

Received in 2023-2024

7

57

64

Received in 2022-2023

1

47

48

Received in 2021-2022

18

202

220

Received in 2020-2021

0

39

39

Received in 2019-2020

0

6

6

Received in 2018-2019

0

1

1

Received in 2017-2018

0

1

1

Received in 2016-2017

0

0

0

Received in 2015-2016 or earlier

0

1

1

Total

64

419

483

Source of requests under the Access to Information Act

The Public Health Agency of Canada’s requests mostly came from the public (43%), the media (19%), and businesses (10%). Only a small number of requests came from academia (4%), and organizations (3%). Additionally, 20% declined to identify which category they associate with.

Proportion of requests among sources
Source Number of Requests Proportion of RequestsTable 9 Footnote * Change from 2023-2024
Public 78 43% +9%
Media 35 19% -9%
Academia 8 4% -1%
Business (Private Sector) 18 10% +6%
Organizations (e.g. political party, association, union) 6 3% +1%
Decline to Identify 36 20% -6%
Total 181  
Table 9 Footnote *

Numbers may not add up to 100% due to rounding.

Table 9 Return to footnote * referrer

Extensions

The majority of the extensions invoked under the ATIA, 91 (71%), were due to consultation with other parties such as third parties and other institutions. The remaining 38 extensions (29%) were taken because processing the requests would have interfered with operations due to the large volume of records involved.

Completing consultations with other government organizations and third parties is a necessary step in the process, enabling the Public Health Agency of Canada to release as much information as possible. Over the last several years, the Public Health Agency of Canada has made more information available to the public, continuously reassessing the balance between its commitment to openness and transparency, with the need to safeguard confidential business information.

Consultations completed from other institutions

In addition to processing its own requests, the Public Health Agency of Canada also completes consultations received from other institutions and organizations.

In 2024-2025, the Public Health Agency of Canada managed 115 consultations from other Government of Canada institutions (100 received in the 2024-2025 fiscal year and 15 received in 2023-2024). The Public Health Agency of Canada also managed 34 requests from other organizations (27 received in the 2024-2025 fiscal year and seven received in 2023-2024).

The Public Health Agency of Canada closed 126 consultations, having reviewed 10,523 pages of records. A total of six consultations were carried over to 2025-2026 within negotiated timelines, while 17 were carried over beyond negotiated timelines. In most cases the Public Health Agency of Canada consented to full disclosure of the records.

Disposition of completed requests

Of the access to information requests completed in 2024-2025, 58% had records that were disclosed in part and 8% were all disclosed. No records existed for 7% of requests while 24% of access to information requests were abandoned. The breakdown of the remaining ‘other’ completed files is as follows:

Numbers may not add up to 100% due to rounding.

Figure 2: Disposition of completed access to information requests

Figure 2

Figure 2 - Text Equivalent

The doughnut chart shows the disposition of completed ATI requests by percent and color.

  • The percent of requests 'disclosed in part' is in dark blue (58%).
  • The percent of requests 'all disclosed' is in light blue (8%).
  • The percent of ‘requests abandoned’ is in light purple (24%).
  • The percent of requests for which 'no records exist' is in yellow (7%).
  • Records that are ‘request transferred’, 'all exempted', 'all excluded', 'neither confirmed nor denied' are in dark purple (3%).

Exemptions invoked

Sections 13 to 24 of the ATIA provide specific legislated exemptions intended to protect information from disclosure, while section 26 provides a temporary exemption relating to information that will soon be published. In some instances, records may have multiple exemptions applied to them to appropriately safeguard information.

An exemption was applied for section 19(1) (personal information) 151 times. The application of section 20 (to protect third-party information) in 143 requests required consultations in many cases to ensure that only proprietary and commercially sensitive information was protected. Section 21 (the protection of information related to government operations) was applied to 106 requests. 

Exclusions cited

The ATIA does not apply to published material, material available to the public for purchase, or for public reference (section 68), nor does it apply to confidences of the King's Privy Council of Canada (section 69). Records containing proposed exclusions under section 69 require consultation with the Department of Justice, and in some cases, the Privy Council Office.

In 2024-2025, six requests contained exclusions for publicly available material and 41 requests contained exclusions for records pursuant to confidences of the King’s Privy Council of Canada.

Translations

One translation was required to respond to a request in 2024-2025.

Format of information released

Of the requests where records were fully or partially disclosed, 147 were released as electronic copies, 10 were released in paper format, and 19 as a data set. The Public Health Agency of Canada releases records in the format preferred by the requestor, while encouraging the use of the Government of Canada’s ATIP Online Request Service platform to receive timely and secure access to the records.

Privacy Act

Informal requests

No informal requests were made in 2024-2025.

Privacy requests receive and completed

In 2024-2025, 31 privacy requests were received and 35 were completed, with 2,945 pages reviewed. More requests were closed than received, reducing the Public Health Agency of Canada’s accumulated inventory of requests.

Figure 3: Privacy requests received and completed each fiscal year from 2020-2021 to 2024-2025.

Figure 3

Figure 3 - Text Equivalent

The bar graph shows the number of privacy requests received (yellow bars) and completed (black bars) for each fiscal year from 2020-2021 to 2024-2025.

  • For 2020-2021, 51 requests were received; 40 requests were completed.
  • For 2021-2022, 78 requests were received; 69 requests were completed.
  • For 2022-2023, 70 requests were received; 79 requests were completed.
  • For 2023-2024, 59 requests were received; 61 requests were completed.
  • For 2024-2025, 31 requests were received; 35 requests were completed.
Key statistics by fiscal year
Fiscal year Number of requests received Outstanding from previous reporting periods Total caseload Number of requests closed # of pages reviewed for closed files
2020-2021 51 2 53 40 50
2021-2022 78 13 91 69 3,537
2022-2023 70 21 91 79 2,499
2023-2024 59 12 71 61 1,119
2024-2025 31 10 41 35 2,945

Caseload and carry forward of privacy requests

In 2024-2025, the Public Health Agency of Canada managed 41 active privacy requests. Of these, 31 were new privacy requests and 10 were outstanding from previous reporting periods.

A total of 35 privacy requests were closed and six were carried forward to the 2025-2026 fiscal year. Of the six privacy requests carried forward to 2025-2026, two were carried over within legislated timelines while four were carried over beyond legislated timelines.

Requests for personal information under the Privacy Act are generally received from current and former Public Health Agency of Canada employees who want to obtain their personal information, and from individuals who have applied for employment at the Public Health Agency of Canada, seeking management’s consideration of their applications.

Human Resource services for the Public Health Agency of Canada are delivered by Health Canada, and associated records therefore are legally held by that institution. As a result, requests for personal information relating to Agency employees and staffing processes may be opened by both the Public Health Agency of Canada and Health Canada in order to identify all records to support an individual’s right of access.

Processing time for requests

In 2024-2025, the Public Health Agency of Canada closed a total of 35 privacy requests. Below is a breakdown of the time taken to process these requests.

Of the 35 requests that the Public Health Agency of Canada responded to, 25 (71.4%) privacy requests were closed within legislated timelines (30 days plus applicable extension), while 10 (28.6%) were closed beyond legislated timelines.

Of the 10 requests closed past legislated timelines (including any extensions taken):

Requests are closed past the legislated timelines for a number of reasons:

In accordance with the Treasury Board of Canada Secretariat’s Directive on Personal Information Requests and Correction of Personal Information, the Public Health Agency of Canada continues to notify requesters in writing of anticipated delays.

Requests carried over to the next reporting period by reporting period received

In 2024-2025, six requests were carried over to the next reporting period. Below is a table outlining the number of privacy requests carried over to the next reporting period, broken down by the reporting period the request was received, and by whether it was within legislated timelines.

Requests carried over to the next reporting period by reporting period received
Reporting period requests carried over were received Requests carried over that are within legislated timelines Requests carried over that are beyond legislated timelines Total
Received in 2024-2025 2 2 4
Received in 2023-2024 0 0 0
Received in 2022-2023 0 0 0
Received in 2021-2022 0 0 0
Received in 2020-2021 0 2 2
Total 2 4 6

Extensions

Two extensions were taken in 2024-2025, due to a large volume of pages. Under the Privacy Act, 30 days is the longest extension that can be taken.

Consultations completed from other institutions

The Public Health Agency of Canada received one consultation from another Government of Canada institution. This consultation was closed during the 2024-2025 reporting period.

Disposition of completed requests

Of the privacy requests completed in 2024-2025, 29% had records that were disclosed in part, 57% were abandoned, and no records existed for 14% .

Figure 4: Disposition of completed privacy requests

Figure 4

Figure 4 - Text Equivalent

The doughnut chart shows the disposition of completed privacy requests by percent and color.

  • The percent of requests 'disclosed in part' is in blue (29%).
  • The percent of 'requests abandoned' is in purple (57%).
  • The percent of requests for which 'no records exist' is in yellow (14%).

Exemptions invoked

Of the 14 exemptions applied in response to privacy requests in 2024-2025, 12 were to protect the personal information of individuals other than the requester, and two were to protect solicitor-client privilege.

Exclusions Cited

No exclusions were applied to privacy requests in 2024-2025.

Translations

No translations were required to respond to requests in 2024-2025.

Format of information released

Of the 10 requests where records were disclosed, all were released as electronic copies.

Privacy Management Division workload

In 2024-2025, the Privacy Management Division received a total of 578 requests, including 284 for privacy advisory services from the Public Health Agency of Canada program clients, and 294 requests for policy analysis and reporting. This represents a significant increase in the overall number of requests from the previous year (316).

The Public Health Agency of Canada is committed to properly handling personal information under its control and ensuring that privacy requirements and risks are considered when new initiatives are developed and deployed.

In 2024–2025, the Privacy Management Division supported this commitment by providing advice to program clients on the collection, use, and disclosure of personal information, and by assessing privacy risks for new initiatives, projects, and research activities. As the volume and complexity of files continue to grow—particularly in areas such as artificial intelligence, Open Government publishing, and Cloud services—the Division has conducted increasingly in-depth privacy analyses to address emerging challenges.

Cost for administering the Access to Information Act

The Public Health Agency of Canada spent a total of $3,635,180 on access to information functions in 2024-2025. Of this total, salaries and overtime costs represent $2,899,697 and goods and services costs were $735,483. Most of the goods and services costs ($626,806) were used to retain temporary resources to address larger and more complex requests.

Costs for administering the Privacy Act

The Public Health Agency of Canada spent a total of $1,444,044 on privacy functions in 2024-2025. Of this total, salaries and overtime costs represent $1,269,980. Temporary resources for privacy services accounted for $115,426 and other goods and services costs totalled $58,638.

Training and awareness

An overview of access to information and privacy obligations is included in the New Employee Onboarding E-Module, which is mandatory for all new employees to complete in their first month at the Public Health Agency of Canada. This ensures that all new employees are made aware of their legal obligations, and directs them to additional resources and training to further their learning. Additional information about training and awareness can be found below.

Access to information training

The online ATIP Fundamentals course, offered by the Canada School of Public Service, is mandatory for all staff as a foundation for understanding their legal obligations. A total of 688 Public Health Agency of Canada employees completed this course in 2024-2025.

The Public Health Agency of Canada also offers training specific to the department and its processes. This includes a one-hour course, ATIP for Branch Single Window Contacts, which is offered to all new Single Windows. The facilitated course, Introduction to ATIP Requests at the Public Health Agency of Canada is available to all employees, and was completed by 112 employees in 2024-2025.

Training is promoted at all Single Window working group meetings, at the ATIP Executive Leaders Committee and the Public Health Agency of Canada Executive Committee, through Broadcast News messages, and on the Public Health Agency of Canada’s intranet site.

Access to information awareness

In 2024, Canada celebrated Right to Know Week from September 23rd to 29th. The Public Health Agency of Canada kicked off the event with a message from Health Canada’s Assistant Deputy Minister of the Corporate Services Branch, highlighting openness and transparency as essential to good governance and democracy, and raising awareness about the public’s right to access information held by the government and other public institutions.

During Right to Know Week, the Public Health Agency of Canada promoted the online ATIP courses offered by the Canada School of Public Service and shared resources on how to respond to ATIP requests and manage information. 

In 2024-2025, communications were sent to all employees promoting access to information training and emphasizing its importance. Additionally, information was provided to all employees addressing common questions, such as how to conduct record searches and what types of records need to be provided. The goal is to foster a culture of openness and transparency while also promoting the timely provision of high-quality records.

Privacy training

During 2024-2025, the Privacy Management Division delivered several tailored privacy training and awareness sessions to 20 employees across various groups within the Agency.

The Privacy Management Division’s online privacy training is available to all Public Health Agency of Canada employees. Approximately, 754 Public Health Agency of Canada employees completed the online training in 2024-2025.

Privacy awareness

The Public Health Agency of Canada commemorated Data Privacy Week with a learning event, organized by the Privacy Management Division, featuring speakers from the Treasury Board of Canada Secretariat and the Office of the Privacy Commissioner of Canada. The speakers shared important insights on key privacy topics such as the privacy considerations when using artificial intelligence, the need for strong safeguards to protect personal information, and the responsibility to report privacy breaches.

To promote privacy responsibilities during Privacy Awareness Week, the Public Health Agency of Canada shared several privacy resources with its employees, such as guidance on when to include privacy notices, how to navigate privacy risk assessments and best practices for protecting personal information in contracts.

Throughout the year, regular communications are sent to all employees on privacy-related matters with the aim of building a culture of strong privacy awareness within the agency.

Policies, guidelines, procedures and initiatives

Betterment Solutions Working Group

The ATIP Operations Division’s Betterment Solutions Working Group continued to meet regularly throughout 2024-2025 to foster a culture of innovation by promoting employee-led improvements. At this working group, ATIP Analysts and support staff from a variety of levels identify and prioritize operational issues, in an effort to find and implement solutions. The working group also provides horizontal input in response to policy consultations from Treasury Board Secretariat.

ATIP Operations Division’s Professional Development Program

The ATIP Operations Division’s Professional Development Program was launched in January 2017. This program allows employees to progress based on performance, without the need for a competitive hiring process. In 2024-2025, 45 analysts were enrolled in the program and 13 advanced in level. The Professional Development Program helps increase ATIP capacity within the Government of Canada.

Indigenous reconciliation

In February 2024, Treasury Board Secretariat issued an Implementation Notice waiving the $5 application fee in support of Indigenous Reconciliation. The Public Health Agency of Canada has aligned its process with this direction.

Request processing software solution project

In 2024-2025, Health Canada began the process of acquiring a new access to information and privacy request processing software solution, which will support the Public Health Agency of Canada as well. The new software solution will provide an integrated platform to manage the full life cycle of an access to information or personal information request and will streamline activities, resulting in a more efficient and effective process. Full implementation is expected in 2025-2026.

New case management system

In 2024-2025, the Privacy Management Division advanced the development of a new case management system to manage privacy requests to enhance operational efficiency, as well as to improve data integrity and service delivery. The new system is scheduled to deploy in 2025-2026, and is designed to streamline workflows, improve the user experience, and support better decision-making through automated analytics and reporting capabilities.

New privacy breach management and reporting process

In 2024-2025, the Privacy Management Division implemented a new, streamlined privacy breach management and reporting process. This updated process improves briefing to senior management by providing each branch head with access to an automated, real-time, breach dashboard for the Agency. These reports enable senior leaders to identify and monitor privacy breach trends within their respective branches, which improves informed oversight and decision-making.

Transparency requirements for sharing personal information with third parties

In October 2022, the Treasury Board of Canada Secretariat announced new transparency requirements for federal institutions like the Public Health Agency of Canada when sharing personal information with third parties through written agreements. To meet these requirements, the Public Health Agency of Canada must identify all parties involved in these agreements in InfoSource and publish summaries of the agreements on its Canada.ca Access to Information and Privacy webpage.

The Privacy Management Division is leading a project to meet this new requirement. The Public Health Agency of Canada published summaries of the relevant agreements in June 2025.

Standard on Privacy Impact Assessment

In October 2024, the Treasury Board of Canada Secretariat introduced new requirements affecting Privacy Impact Assessments, Privacy Protocols, and Personal Information Banks. Any program that requires a Personal Information Bank, but does not currently have one registered, must complete a Privacy Impact Assessment or Privacy Protocol and register a Personal Information Bank by October 10, 2025. The Privacy Management Division led an initiative to identify any programs that require a Personal Information Bank and, is working with program officials to complete a Privacy Impact Assessment or Privacy Protocol where required to bring the Public Health Agency of Canada into compliance.

To support these changes, the Privacy Management Division is also developing new resources, processes and awareness campaigns to ensure employees understand their responsibilities related to privacy assessments.

Concept for artificial intelligence supported Privacy Impact Assessments

In 2024-2025, the Privacy Management Division explored how artificial intelligence could be used to improve the efficiency, consistency, and quality of Privacy Impact Assessments. The goal was to reduce manual effort, support early identification of privacy risks, and enhance the timeliness of privacy compliance activities. In 2025-2026, the Privacy Management Division will continue advancing this initiative to manage the growing volume and complexity of Privacy Impact Assessment while maintaining compliance and accountability.

Summary of key issues and actions taken on complaints and audits

Complaints management

Individuals and organizations who believe federal institutions have not respected their rights under the ATIA may ask the Office of the Information Commissioner to investigate within 60 days of receiving a response from a federal institution or if they have not received a response within the legislated timeline.

Individuals and organizations who think their personal information has been mishandled have the right to file a complaint to the Privacy Commissioner of Canada.

Complaints to the Information Commissioner of Canada

In 2024–2025, 21 complaints under the ATIA were filed with the Office of the Information Commissioner for the Public Health Agency of Canada's requests. The Public Health Agency of Canada received 14 final reports from the Office of the Information Commissioner with eight containing an order. Seven of the 21 complaints, resulted in the Information Commissioner either refusing or ceasing to investigate the complaints under section 30(5) of the ATIA.

Areas of complaint were primarily due to exemptions applied to the records and time extensions taken.

The Public Health Agency of Canada cooperates with the Office of the Information Commissioner during investigations by providing details on the way a file was or is being processed, providing evidence of the search that was undertaken, explaining key considerations in applying exemptions, conducting new searches, providing rationales, disclosing additional records etc. The Agency reviews the outcomes of the investigations conducted by the Office of the Information Commissioner, follows up on recommendations or orders, and where appropriate, incorporates lessons learned into business processes.

Outstanding number of access to information complaints

There are 23 open complaints with the Information Commissioner of Canada. The following table lists the number of open complaints with the Information Commissioner of Canada by year.

Number of open complaints with the Information Commissioner of Canada that are outstanding from previous reporting periods
Fiscal year open complaints were received by
the Public Health Agency of Canada		 Number of open complaints
Received in 2024-2025 18
Received in 2023-2024 2
Received in 2022-2023 1
Received in 2021-2022 1
Received in 2020-2021 1
Total 23

The Public Health Agency of Canada actively communicates and collaborates with the Office of the Information Commissioner to ensure the effective handling and resolution of complaints.

Complaints to the Privacy Commissioner of Canada

In 2024-2025, the Public Health Agency of Canada received two complaints under the Privacy Act. One of the complaints was related to the unauthorized disclosure of personal information and was resolved using the Office of the Privacy Commissioner of Canada’s early resolution process. The second complaint was related to a delay in processing a personal information request.

The Public Health Agency of Canada provided zero representations to the Office of the Privacy Commissioner of Canada under Section 33 of the Privacy Act. One letter of finding was received under Section 35, relating to complaints received in previous years.

The Public Health Agency of Canada cooperates with the Office of the Privacy Commissioner during investigations by providing details on the way a file was or is being processed, conducting new searches, providing rationales, etc. The Public Health Agency of Canada reviews the outcomes of the investigations, and where appropriate, incorporates lessons learned into business processes.

Outstanding number of privacy complaints

There are two open complaints with the Privacy Commissioner of Canada. The following table lists the number of open complaints with the Privacy Commissioner of Canada by year.

Number of open complaints with the Privacy Commissioner of Canada that are outstanding from previous reporting periods
Fiscal year open complaints were received
by the Public Health Agency of Canada		 Number of open complaints
Received in 2024-2025 1
Received in 2023-2024 0
Received in 2022-2023 1
Total 2

The Public Health Agency of Canada communicates and collaborates with the Office of the Privacy Commissioner to ensure the effective handling and resolution of complaints.

Federal Court Cases

Applications & appeals submitted to the federal court

Access to Information Act

No applications or appeals were made to the Federal Court or the Federal Court of Appeal during the 2024–2025 fiscal year.

Privacy Act

No applications or appeals were made to the Federal Court during the 2024-2025 fiscal year.

Monitoring Compliance

ATIP Operations Division generates weekly, monthly and semi-annual reports to senior management in order to monitor performance within the Public Health Agency of Canada. These reports outline the incoming volume of requests, the number of closed requests, and the timelines of the retrieval of records. Additionally, the ATIP Operations Division encourages branches to identify common request types and explore alternative methods for disclosing such information.

The Privacy Management Division produces monthly reports to senior management on privacy breaches. The Privacy Management Division supports compliance by periodically reviewing its privacy policies, procedures and practices.

The Privacy Management Division assists programs with ensuring that all information sharing agreements, information sharing arrangements, and contracts involving personal information include the appropriate privacy protections and respect the requirements of the Directive on Privacy Practices, including embedding the right of access. This includes reviewing draft agreements, providing departmental guidance, and making available to the public summaries of agreements involving personal information disclosures by the Public Health Agency of Canada.

The Public Health Agency of Canada has embedded standard requirements to support the right of access to information in contracts, information sharing agreements and information sharing arrangements.

Other Reporting Requirements Specific to the Privacy Act

Material privacy breaches

During 2024-2025, the Public Health Agency of Canada reported no material privacy breaches to the Office of the Privacy Commissioner and the Treasury Board Secretariat.

Privacy Impact Assessments 

During 2024-2025, no Privacy Impact Assessments were completed. Information about the Public Health Agency of Canada’s Privacy Impact Assessments is found on the Agency’s PIA website. 

Public interest disclosures 

During 2024-2025, there were no disclosures made under section 8(2)(m) of the Privacy Act and no section 8(5) written notifications were provided to the Office of the Privacy Commissioner. 

Appendix A: Access to Information Act and Privacy Act – Delegation Order

Delegation order

Delegation Order - Text Equivalent

Delegation order signed by the Minister of Health on May 24, 2024.

I, the Minister of Health, pursuant to section 95 of the Access to Information Act and section 73 of the Privacy Act, hereby delegate the persons holding the positions set out in the Delegation of Authority Schedule attached hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Minister as head of the Public Health Agency of Canada, under the provisions of the Act and related regulations set out in the schedule opposite each position.  This delegation supersedes all previous delegation orders.

Delegation of Authority Schedule

Access to Information Act - Part 1 and 3

Full Delegation
Provision Description President ADM CSB DG PPMSD Executive Dir, ATIP Ops
Dir, ATIP Ops

N/A

All powers, duties and functions under the Access to Information Act, R.S.C. 1985, c. A-1 (prior to and following June 21, 2019) and related regulations (prior to and following June 21, 2019)

Full authority
Partial Delegation
Provision Description Dir, PMD Deputy Dir / Manager, ATIP Ops Team Leader/ Senior Advisor Senior Analyst Analyst
4(2.1) Responsibility of government institutions No Yes Yes Yes Yes
6.1(1) Reasons for declining to act on request No Yes No No No
6.1(1.3), (1.4), (2) Notice – suspension, end of suspension No Yes Yes Yes No
7 Notice when access requested No Yes Yes Yes Yes
8(1) Transfer of request No Yes Yes No No
9 (1) Extension of time limits No Yes Yes No No
9(2) Notice of extension to Information Commissioner No Yes Yes Yes Yes
10 Where access is refused No Yes Yes No No
11(2) Application Fee Waiver No Yes Yes No No
12(2)(b) Language of access No Yes Yes No No
12(3)(b) Access to record in alternative format No Yes Yes No No
Exemption Provisions of the Access to Information Act
13 Information obtained in confidence No Yes No No No
14 Federal-provincial affairs No Yes No No No
15 International affairs and defence No Yes No No No
16 Law enforcement and investigations No Yes Yes No No
16.5 Public Servants Disclosure Protection Act No Yes No No No
17 Safety of individuals No Yes No No No
18 Economic interests of Canada No Yes No No No
18.1 Economic interest of certain government institutions No Yes No No No
19 Personal information No Yes Yes No No
20 Third-party information No Yes Yes No No
21 Advice, etc. No Yes No No No
22 Testing procedures, tests and audits No Yes No No No
22.1 Internal Audits No Yes No No No
23 Protected information – solicitors, advocates and notaries No Yes Yes No No
23.1 Protected information – patents and trade-marks No Yes Yes No No
24 Statutory prohibitions against disclosure No Yes Yes No No
Other Provisions of the Access to Information Act
25 Severability No Yes Yes No No
26 Refusal of access if information to be published No Yes No No No
27(1), (4) Notice to third parties No Yes Yes Yes No
28(1)(b),
(2), (4)		 Representations of third-party and decision No Yes Yes No No
33 Notice to Information Commissioner of notices to third parties No Yes Yes Yes No
35(2)(b) Right to make representations No No No No No
37(1)(c) Notice of actions to implement recommendations of Commissioner No No No No No
37(4) Access to be given to complainant No Yes No No No
41(2) Review by Federal Court – government institution No No No No No
43(2) Service or notice of application to Federal Court for review No Yes Yes No No
44(2) Notice to person who requested record No Yes Yes No No
52(2)(b), 52(3) Special rules for hearings No No No No No
94 Annual report – government institutions No No No No No
96(3) Notice of Provision of services related to access to information No No No No No
96(5) Spending authority No No No No No
Access to Information Regulations
6(1) Transfer of request No Yes No No No
8 Method of access No Yes No No No
8.1 Limitations in respect of format No Yes No No No

Privacy Act

Full Delegation
Description President ADM CSB DG PPMSD
All powers, duties and functions under the Act and Regulations Full authority
Full Delegation with Exceptions
Description Executive Dir, ATIP Ops
Dir, ATIP Ops		 Dir, PMD

All powers, duties and functions under the Act and Regulations, with noted exceptions

Full authority except Sections 8(2)(j), 8(2)(m), 8(5), 9(1), 9(4), 10

Full authority except Sections 14-28 inclusively
Partial Delegation
Provision Description Deputy Dir / Manager ATIP Ops Team Leader/ Senior Advisor Senior Analyst Analyst
8(2)(j) Disclosure for research or statistical purposes No No No No
8(2)(m) Disclosure in the public interest or in the interest of the individual No No No No
8(4) Copies of requests under paragraph 8(2)(e) No No No No
8(5) Notice of disclosure under paragraph 8(2)(m) No No No No
9(1) Record of disclosures to be retained No No No No
9(4) Consistent uses No No No No
10 Personal information to be included in personal information banks No No No No
14(a) Notice where access requested Yes Yes Yes No
14(b) Giving access to the record Yes Yes No No
15 Extension of time limits Yes Yes Yes No
16 Where access is refused Yes Yes No No
17(2)(b) Language of access Yes Yes No No
17(3)(b) Access in an alternative format Yes Yes No No
18(2) Exempt banks Yes No No No
19 Information obtained in confidence Yes No No No
20 Federal-provincial affairs Yes No No No
21 International affairs and defence Yes No No No
22 Law enforcement and investigations Yes No No No
22.3 Public Servants Disclosure Protection Act Yes No No No
23 Security clearances Yes No No No
24 Individuals sentenced for an offence Yes No No No
25 Safety of individuals Yes No No No
26 Information about another individual Yes Yes No No
27 Protected information – solicitors, advocates and notaries Yes Yes No No
27.1 Protected information – patents and trade-marks Yes Yes No No
28 Medical records Yes No No No
33(2) Right to make representations No No No No
35(1)(b) Notice of actions to implement recommendations of Commissioner Yes No No No
35(4) Access to be given to complainant Yes No No No
36(3)(b) Notice of actions to implement recommendations of Commissioner concerning exempt banks Yes No No No
51(2)(b),(3) Special rules for hearings No No No No
72 Annual report to Parliament No No No No
73.1(3) Notice of Provision of services related to privacy No No No No
73.1(5) Spending authority No No No No
Privacy Regulations
7 Retention of personal information requested under paragraph 8(2)(e) No No No No
9 Examination of information Yes Yes Yes Yes
11(2),11(4) Notification concerning corrections Yes Yes Yes Yes
13(1) Disclosure of personal information relating to physical or mental health Yes Yes No No
14 Examination in presence of medical practitioner or psychologist Yes Yes No No
Legend
Yes Delegated
No No Delegation

Page details

2025-10-29