ARCHIVED - Annual Report 2009-2010 Privacy Act

 

from the
Public Health Agency of Canada
on the
Privacy Act
for the period
of April 1, 2009 to March 31, 2010

To promote and protect the health of Canadians through leadership, partnership,
innovation and action in public health.
— Public Health Agency of Canada

Annual Report 2009-2010
Privacy Act
is available on the Internet at the following address:
http://www.phac-aspc.gc.ca

Également disponible en français sous le titre :
Rapport annuel 2009-2010
sur la Loi sur la protection des renseignements personnels

http://www.phac-aspc.gc.ca

To obtain additional copies, please contact:
Access to Information and Privacy Office
Public Health Agency of Canada
130 Colonnade Road, A.L. 6503F
Ottawa, Ontario K1A 0K9
Tel: (613) 948-8187Fax: (613) 957-9093

This publication can be made available in alternative formats upon request.

© Her Majesty the Queen in Right of Canada, 2010

Cat.: / ISBN:
Online Cat.: / Online ISBN:

Table of Contents

Section 1: Introduction

The Privacy Act protects the privacy of all Canadian citizens and permanent residents of Canada regarding personal information held by a government institution against unauthorized use and disclosure. The Privacy Act also gives Canadians, including those in Canada who are not permanent residents or citizens, the right to access personal information held by the government.

Section 72 of the Privacy Act requires that the head of every government institution submit an annual report to Parliament on the administration of the Act during the financial year.

This Annual Report provides a summary of the management and administration of the Privacy Act within the Public Health Agency of Canada for the fiscal year 2009-2010.


For further information or to make a request under the Privacy Act, please direct your inquiries to:

Access to Information and Privacy Office
Public Health Agency of Canada
130 Colonnade Road
A.L. 6503F
Ottawa, Ontario
K1A 0K9

Tel: (613) 948-8187
Fax: (613) 957-9093

1.1 Background on the Agency

The Public Health Agency of Canada (PHAC) is the main Government of Canada agency responsible for public health in Canada. PHAC’s primary goal is to strengthen Canada’s capacity to protect and improve the health of Canadians and to help reduce pressures on the health-care system. To do this, the Agency is working to build an effective public health system that enables Canadians to achieve better health and well-being in their daily lives by promoting good health, helping prevent and control chronic diseases and injury, and protecting Canadians from infectious diseases and other threats to their health. PHAC is also committed to reducing health disparities between the most advantaged and disadvantaged Canadians.

Because public health is a shared responsibility, the PHAC works in close collaboration with all levels of government (provincial, territorial and municipal) to build on each others’ skills and strengths. The Agency also works closely with non-government organizations, including civil society and business, and other countries and international organizations like the World Health Organization (WHO) to share knowledge, expertise and experiences.

The PHAC was established in September 2004, in part as a response to the SARS outbreak in 2003, and was confirmed as a legal entity in December 2006 by the Public Health Agency of Canada Act .

PHAC is one of six departments and agencies that make up the federal government’s Health Portfolio and reports to Parliament through the Minister of Health. PHAC is managed by the Chief Public Health Officer of Canada, currently Dr. David Butler-Jones, who plays a dual role:

Deputy minister in the federal public service, heading the Agency and advising the Minister of Health on matters of public health and the function of the Agency; and

Lead federal public health professional tasked with communicating directly with Canadians and governments on important public health matters.

Further, as of September 4, 2009, the Prime Minister of Canada, appointed Ms. Mary Chaput as Associate Deputy Minister to the CPHO. The Associate Deputy Minister shares the responsibility of Agency accountability with the CPHO and focuses her efforts internally within the Agency and within government.

The PHAC consists of two branches, led by a senior assistant deputy minister and three assistant deputy ministers. Three other PHAC executives report directly to the Chief Public Health Officer: the Senior Science Advisor, the Chief Audit Executive, and the Chief Financial Officer.

To maintain the knowledge and skills needed to develop and deliver the public health advice and tools required by Canadians, the Agency relies on the efforts of its dedicated staff. PHAC’s approximately 2,400 employees work across Canada in a wide range of operational, scientific, technical and administrative positions.

Public health focuses on the entire population at both the individual and the community level. It encompasses a range of activities performed by all three levels of government (federal, provincial/territorial, and municipal) in collaboration with a wide variety of stakeholders and communities across the country.

The role of the Public Health Agency of Canada is to:

Promote health; Prevent and control chronic diseases and injuries; Prevent and control infectious diseases; Prepare for and respond to public health emergencies, and Strengthen public health capacity in a manner consistent with a shared understanding of the determinants of health and of the common factors that maintain health or lead to disease and injury.

Through our research, programs and services, our goals are to bring about healthier Canadians, reduced health disparities, and a stronger capacity to deliver on and support public health activities.

The Minister of Health is the designated head of the Agency for the purposes of Section 72 of the Privacy Act. The Minister has delegated full authority for the administration of the Act to the ATIP Director/Coordinator.

The Public Health Agency of Canada Act, section 15(1) cites: “The Governor in Council may, on the recommendation of the Minister, may make regulations respecting (a) the collection, analysis, interpretation, publication and distribution of information relating to public health for the purpose of paragraph 4(2)(h) of the Department of Health Act, and (b) the protection of that information if it is confidential information, including if it is personal information as defined in section 3 of the Privacy Act.” Department of Justice Canada is currently preparing regulations that will satisfy legislative requirements.

1.2 Values Guiding the PHAC's Actions

In serving Parliament and Canadians, the PHAC is guided by and proudly adheres to the following organizational values:

  • Leadership
  • Healthy Work Environment
  • Ethical Behavior
  • Commitment to Excellence
  • Dedication to Service

1.3 Privacy Activities

The PHAC has a Director/Coordinator of Access to Information and Privacy (ATIP) that is responsible and accountable for the development, coordination and implementation of effective policies, guidelines, systems and procedures to enable the efficient processing of requests under the Privacy Act.

The Director/Coordinator is also responsible for related policy, systems and procedures emanating from the Act, such as the government's policy on information collection.

The activities of the Director/Coordinator include:

  • processing requests made under the Privacy Act;
  • acting as spokesperson for the PHAC in dealings with the Treasury Board Secretariat, the Privacy Commissioner, and other government departments and agencies related to the Privacy Act;
  • responding to consultation requests submitted by other federal institutions for PHAC documents;
  • reviewing and approving Privacy Impact Assessments (PIA)
  • promoting privacy awareness to ensure the PHAC's responsiveness to the obligations of the Privacy Act;
  • preparing the annual report to Parliament and other statutory reports, as well as other material that may be required by central agencies;
  • developing policies, procedures and guidelines for the orderly implementation of the Privacy Act by the PHAC;
  • monitoring the PHAC's compliance with the Privacy Act, regulations and relevant procedures and policies;
  • providing, to PHAC employees, advice and awareness sessions on the provisions of the Privacy Act and Treasury Board policies and their impact on various program initiatives;
  • Coordinates regular updates to Info Source manuals; and
  • Reviews departmental documents, such as audits and evaluations, prior to proactively disclosing these on the Agency’s website.

Of note, the entire Agency was mobilized in order to support the response to the H1N1 pandemic. This also caused a significant increase in related ATI requests further taxing the ATIP Office resources and adding to the workload of the programs who were responding to the outbreak.

1.4 Info Source

During the fiscal year, a Full assessment was conducted by the Treasury Board Secretariat for the PHAC, as part of the Management Accountability Framework (MAF) leading to the changes in the Info Source introduction, to better reflect the PHAC's Program Activity Architecture (PAA). Over the coming years, with resources permitting, the PHAC will continue the work on revamping its Info Source Chapter to re-align the classes of records and personal information banks to reflect the PAA. Individualized training and mentoring to program representatives will continue to be provided in order to ensure a complete Info Source.

1.5 Training, Education and Accomplishments for 2009-2010

The Access to Information and Privacy Office (ATIPO) continued to provide advice and training on the provisions of the Access to Information and Privacy Acts and its impact on PHAC programs and initiatives:

  • Three (3) general presentations on Access to Information and Privacy were delivered to over 50 employees of PHAC;
  • streamlined procedures to better assist OPI with their retrieval processes to ensure that established timelines are respected;
  • participated on various interdepartmental working groups; and
  • initiated staffing actions in order to fill vacant positions in the ATIPO.

However, because of the priority given to the management of access to information and privacy files (both formal and informal), and because of a high surge in the number of these requests, mostly due to the H1N1 Pandemic (+85.7% of formal access to information requests, and +90.9% of formal privacy requests), the Director/Coordinator had to prioritize work on these files, and had to cancel training to PHAC’s staff and other activities in order to deliver the access to information and privacy programs.

1.6 Upcoming Initiatives for the PHAC ATIP Office

In 2010-2011, PHAC ATIP Director/Coordinator intends to implement the following initiatives:

  • Finalize the development of an agency-wide Privacy Management Framework, including Privacy policies;
  • all available standard classes of records and standard Personal Information Banks (PIBs) will continue to be identified in Info Source. The ATIP Unit will lead a departmental working group with representatives from each branch to update the Agency's institution specific classes of records descriptions and PIBs. The group's work is ongoing, and the PHAC expects that some of the required updates will be reflected in the 2010 Info Source publication;
  • creation of a Privacy Impact Assessment (PIA) Advisory Committee. The Committee will help with the development of the PHAC guidelines on PIAs and will start reviewing PIA reports prior to their submission to the PHAC Chief Public Health Officer and to the Office of the Privacy Commissioner (OPC). The terms of reference for the Committee and the PHAC guidelines are still under development;
  • create an ATIP Office procedures manual;
  • continue to review of best management practices for program delivery at regional and headquarters level;
  • introduce a Recruitment and Retention Program for employees which includes succession planning and classification review;
  • continue to staff the ATIP Office; and
  • update PHAC Info Source chapter and related information.

1.7 Delegation of Authority

The responsibilities associated with the administration of the Privacy Act, such as notifying applicants of extensions and transferring requests to other institutions, are delegated to the PHAC ATIP Director/Coordinator through a delegation instrument signed by the Minister of Health Canada.

A detailed delegation instrument is reproduced at Appendix A.

1.8 Highlights and Accomplishments for 2009-2010

The PHAC has continued to improve the way in which the Agency responds to ATIP requests, by focusing on improving timeliness, efficiency and accuracy. The PHAC ATIP Director/Coordinator implemented concrete measures in FY 2009-2010 that allowed the Agency to achieve these goals, and the Agency will continue to build on these improvements over the next three years. Some of the highlights are as follows:

  • The Agency's Management Committee was briefed on the status of the Agency's information holdings as well as its obligations. The Committee agreed that the Agency would continue registering required standard banks, ADMs would review the entries in Info Source to validate their currency, and the Agency would respect statutory requirements in relation to any new program activities from this point forward.
  • The PHAC ATIP Director/Coordinator has further engaged ADMs around timeliness of responding to ATIP requests through weekly reporting to senior management and quarterly reporting on meeting retrieval deadlines by Branch.
  • Despite a significant increase in consultations during this past year, the Agency has remained committed to on-time performance in the face of the continued high volume of requests.
  • The Office of Public Health Practice and the ATIP Office have worked in unison to advance the completion of a Privacy Management Framework for the Agency. A committee was instituted and a consulting firm was hired in order for the Agency to address privacy matters.

Section 2: Report on the administration of the Privacy Act

The number of requests received under the Privacy Act has increased since last year. From April 1, 2009 to March 31, 2010, the PHAC received 21 new requests while the previous year, in 2008-2009, it received 11 requests.

Appendix B provides a statistical summary of the privacy requests received and/or finalized in 2009-2010.

2.1 Requests Made under the Privacy Act

The requests completed were, for the vast majority of them, of very high-volume.

Received during the reporting period
21
Outstanding from previous period
3
TOTAL
24

The figures do not reflect requests processed informally or other services that the ATIP Unit provides to the Agency.

As was the case last year, the preferred method of access reported by the PHAC, as well as by departments and agencies throughout the federal government, is to receive copies of government records as opposed to simply view them.

Historical comparisons
  2007-2008 2008-2009 2009-2010
Requests received 12 11 21
Requests completed 11 9 20

2.2 Disposition of Requests Completed

The Agency finalized the 20 requests cited in Appendix B in the following manner:

  • 2 requests resulted in the release of all information sought.
  • 11 requests resulted in partial disclosures. Section 26 was the most invoked section of the ATIA.
  • In 4 requests, no relevant records existed under the control of the agency.
  • 2 requests were abandoned. Requests are considered abandoned when the applicant formally withdraws the request or when he/she does not respond to correspondence sent by ATIPO.
  • 1 request was transferred to another department.

Pages Examined 214,340

Pages Released 3,356

2.3 Exemptions Invoked

As noted in Appendix B, exemptions under sections 19, 26, and 27 of the Act were invoked by PHAC. Appendix B is intended to show the number of requests where specific types of exemptions were invoked to sever information. For example, if, in processing a request, five different exemptions were applied by PHAC, one exemption under each relevant section would be reported for a total of five. If the same exemption is claimed several times for the same request, it is reported only once in Appendix B.

2.4 Exclusions Cited

The Act does not apply to published material pursuant to section 69 and to confidences of the Queen's Privy Council pursuant to section 70. Appendix B shows that no exclusion was invoked.

2.5 Extension of Time Limits

Section 15 of the Act provides for the extension of the statutory time limits if consultations are necessary or the request is for a large volume of records and processing the request within the original time limit would unreasonably interfere with the operations of the Agency. During the reporting period, 9 requests were within 30 days, 8 requests were extended for 30 days, and another 3 requests required extensions for more than 60 days.

2.6 Completion Time

This year, 20 requests were completed, of which 17 (85%) of the requests were completed within the prescribed legislative time frame:

  • 2 requests (10%) were completed 61-120 days after due date;
  • 1 request (5%) was completed over 121 days after due date.

2.7 Costs

Total salary costs associated with the Privacy Act were $49,939.90 for 2009-2010. Other administrative costs amounted to $10,931.90 for a total of $60,871.80. The associated employee resources for 2009-2010 are estimated at 0.82 FTEs for administering the Privacy Act. These numbers are for the ATIP PHAC Office and do not reflect the overall associated cost to the Agency.

2.8 Complaints

2 complaints regarding requests addressed to the PHAC were lodged with the OPC during this reporting period.

  • 1 complaint claimed that PHAC took an unreasonable extension of time, while the file encompassed 210,000 pages. Pursuant to section 15 of the Privacy Act the PHAC ATIP Director/Coordinator may extend the time limit for a maximum of 30 days over the initial delay of 30 days. The ATIP Office is addressing this issue in order to maintain legislated deadlines.
  • The other complaint was about the application of exemptions to the records. The investigation is still ongoing.

2.9 Court applications and appeals

In 2009-2010, there were no court applications / appeals submitted to the Federal Court or Federal Court of Appeal.

2.10 Disclosures Pursuant to Paragraphs 8(2)(e), (f), (g) and (m) of the Privacy Act

Subsection 8(2) of the Privacy Act provides limited and specific circumstances under which institutions may disclose personal information without an individual's consent. Treasury Board Secretariat identified four categories of disclosures made by virtue of specific paragraphs of this subsection that institutions must include in this year's annual report. These categories concern disclosures made for law enforcement purposes, to Members of Parliament and those made in the public interest. During the reporting period, the PHAC did not disclose personal information pursuant to paragraphs 8(2)(e), (f), (g) and (m) of the Privacy Act.

2.11 Privacy Impact Assessments (PIAs) and Preliminary Privacy Impact Assessments (PPIAs)

Over the last three years, the ATIP Office has been developing a PIA framework and an accompanying communications strategy.

Statistics

  • Preliminary Privacy Impact Assessments initiated in 2009-2010: 9
  • Preliminary Privacy Impact Assessments completed: 10 (including 1 from previous fiscal year)
  • Privacy Impact Assessments initiated: 6
  • Privacy Impact Assessments completed: 3
  • Privacy Impact Assessments sent to the OPC: 0
  • Total: 16

The 6 PIAs initiated during this fiscal year were:

  • Personnel Screening / New Security Program;
  • Canadian Immunization Conference;
  • Children and Youth Surveillance System;
  • Creutzfeldt-Jakob Disease Surveillance System;
  • Info Hub Database;
  • Cancer in Young People in Canada.

The 3 PIAs completed were:

  • Creutzfeldt-Jakob Disease Surveillance System;
  • Info Hub Database;
  • Cancer in Young People in Canada.

The 2 PIAs abandoned, from previous fiscal year, were:

  • Public Health Map Generator;
  • Childhood National Immunization Coverage Survey project.

The 9 PPIAs initiated during this fiscal year were:

  • Canadian Breast Cancer Screening Database;
  • 2010 Winter Games;
  • Conference Data Storage System;
  • Physical Activity Social Marketing Working Group;
  • Personnel Screening;
  • Manuscript Central;
  • Centre for Chronic Disease and Prevention Control Virtual Library;
  • Corporate Wiki;
  • Web-based platform Professional Development Program.

The 9 PPIAs completed were:

  • 2010 Winter Games;
  • Canadian Breast Cancer Screening Database;
  • Conference Data Storage System;
  • Physical Activity Social Marketing Working Group;
  • Personnel Screening;
  • Manuscript Central;
  • Centre for Chronic Disease and Prevention Control Virtual Library;
  • Corporate Wiki;
  • Web-based platform Professional Development Program.

2.12 Data Matching and Data Sharing Activities Reported for the Period

The PHAC ATIP Director/Coordinator was not made aware of any new data matching or data sharing activities.

Section 3: Report on Privacy Consultations and Informal Requests

3.1 Privacy Consultations

The PHAC received 2 requests for consultations from other government departments and agencies. These requests amounted to a review of over 13 pages of information.

Pages Examined 13

3.2 Informal Privacy Requests

There were 14 informal requests processed during this reporting period.

Pages Examined 245

APPENDIX A: Delegation Order – Privacy Act

Privacy Act - Delegation Order
Text Equivalent

Privacy Act - Delegation Order

Pursuant to the power of delegation conferred upon me by Section 73 of the Privacy Act, the person exercising the functions and position of Access to Information and Privacy Coordinator for the Public Health Agency of Canada and the respective successor, including in the Coordinator's absence, a person or officer designated in writing to act in the place of the holder of such functions and position is hereby authorized to exercise these powers, duties or functions of the Minister as the head of the government institution under the Act, set out in the attached schedule.

The person exercising the functions and position of Access to Information and Privacy Coordinator for the Public Health Agency of Canada and the respective successor, including in the coordinator's absence, a person or officer designated in writing to act in the place of the holder of such functions and position, is hereby authorized to exercise these powers, duties or functions of the Minister as the head of the government institution under the Act, set out in sections 13 and 15 of the Act.

Public Health Agency of Canada Schedule of Delegation Order

Delegation of Powers, Duties and Functions Pursuant to Section
73 of the Privacy Act
Sections of Act Powers, Duties or Functions Responsible Position
8(2) Disclose personal information without the consent of the individual to whom it relates ATIP Co-ordinator
8(4) Retain a copy of 8(2)(e) requests and disclosed records ATIP Co-ordinator
8(5) Notify the Privacy Commissioner of 8(2)(m) disclosures ATIP Co-ordinator
9(1) Retain a record of the use of personal information ATIP Co-ordinator
9(4) Notify the Privacy Commissioner of a consistent use of personal information and update the index accordingly ATIP Co-ordinator
10 Include personal information in personal information banks ATIP Co-ordinator
14 Respond to a request for access within statutory deadlines; give access or give notice ATIP Co-ordinator
15 Extend the time limit and notify the applicant ATIP Co-ordinator
17(2)(b) Determine the necessity for a tranlation or interpretation for requested personal information ATIP Co-ordinator
18(2) Refuse to disclose information contained in an exempt bank ATIP Co-ordinator
19(1) Refuse to disclose information obtained in confidence from another government ATIP Co-ordinator
19(2) Disclose any information referred in 19(1) if the other government consents to the disclosure or makes the information public ATIP Co-ordinator
20 Refuse to disclose information injurious to federal-provincial affairs ATIP Co-ordinator
21 Refuse to disclose information injurious to international affairs and/or defense ATIP Co-ordinator
22 Refuse to disclose information injurious to law enforcement and investigation ATIP Co-ordinator
23 Refuse to disclose information injurious to security clearance ATIP Co-ordinator
24 Refuse to disclose information colleted by the Canadian Penitentiary Service, the National Parole Service or the National Parole Board ATIP Co-ordinator
25 Refuse to disclose information which could threaten the safety of the individual ATIP Co-ordinator
26 Refuse to disclose information about other individuals, and shall refuse to disclose such information where disclosure is prohibited under Section 8 ATIP Co-ordinator
27 Refuse to disclose information subject to solicitor-client privilege ATIP Co-ordinator
28 Refuse to disclose information relating to an individual's physical or mental health where disclosure is contrary to the best interests of the individual ATIP Co-ordinator
31 Receive notice of an investigation by the Privacy Commissioner ATIP Co-ordinator
33(2) Make representations to the Privacy Commissioner during an investigation ATIP Co-ordinator
35(1) Receive the Privacy Commissioner's report of findings of the investigation and give notice of action taken ATIP Co-ordinator
35(4) Give the complainant access to information after a 35(1)(b) notice ATIP Co-ordinator
36(3) Receive the Privacy Commissioner's report of findings of investigation of exempt banks ATIP Co-ordinator
37(3) Receive the report of the Privacy Commissioner's findings after a compliance investigation ATIP Co-ordinator
51(2)(b) Request that a matter be heard and determined in the National Capital Region ATIP Co-ordinator
51(3) Request and make representations in Section 51 hearings ATIP Co-ordinator
72(1) Prepare an Annual Report to Parliament ATIP Co-ordinator
77 Carry out responsibilities conferred on the head of the institution by regulations made under section 77 which are not included above ATIP Co-ordinator

APPENDIX B: Statistical Report - Privacy Act

Report on the Privacy act
Text Equivalent

Report on the Privacy Act

Institution: Public Health Agency of Canada
Reporting period: 4/1/2009 to 3/31/2010

I - Requests Under the Privacy Act

Received during reporting period: 21
Outstanding from previous period: 3
TOTAL: 24
Completed during reporting period: 20
Carried forward: 4

II - Disposition of Requests Completed

  1. All disclosed: 2
  2. Disclosed in part: 11
  3. Nothing disclosed (excluded): 0
  4. Nothing disclosed (exempt): 0
  5. Unable to process: 4
  6. Abandoned by applicant: 2
  7. Transferred: 1

TOTAL: 20

III - Exemptions Invoked

S. Art. 18(2): 0

S. Art. 19(1)(a): 0
(b): 0
(c): 0
(d): 1

S. Art. 20: 0

S. Art. 21: 0

S. Art. 22(1)(a): 0
(b): 0
(c): 0
S. Art. 22(2): 0

S. Art. 23(a): 0
(b): 0

S. Art. 24: 0

S. Art. 25: 0

S. Art. 26: 10

S. Art. 27: 1

S. Art. 28: 0

IV - Exclusions Cited

S. Art. 69(1)(a): 0
(b): 0

S. Art. 70(1)(a): 0
(b): 0
(c): 0
(d): 0
(e): 0
(f): 0

V - Completion Time

30 days or under: 9
31 to 60 days: 8
61 to 120 days: 2
121 days or over: 1

VI - Extensions

  30 days or under 31 days or over
Interference with operations 6 0
Consultation 0 0
Translation 0 0
TOTAL 6 0

VII - Translations

Translations requested: 0

Translations prepared

English to French: 0
French to English: 0

VIII - Method of Access

Copies given: 13
Examination: 0
Copies and examination: 0

IX - Corrections and Notation

Corrections requested: 0
Corrections made: 0
Notation attached: 0

X - Costs

Financial (all reasons) ($000)

Salary: 49,939.9
Administration (O and M): 10,931.9
TOTAL: 60,871.8

Person Year Utilization (all reasons)

Person year (decimal format): 0.82

Report a problem or mistake on this page
Please select all that apply:

Thank you for your help!

You will not receive a reply. For enquiries, contact us.

Date modified: