Annual Report on the Privacy Act 2012-2013

2012-2013 Annual Report on the Privacy Act
is available on the Public Health Agency of Canada web site.
Également disponible en français sur le site Web de l’Agence de la santé publique du Canada sous le titre :
Rapport annuel 2012-2013 sur la
Loi sur la protection des renseignements personnels.
To obtain additional copies, please contact:
Access to Information and Privacy Division
Public Health Agency of Canada
1600 Scott Street
Holland Cross, Tower B, A.L. 3107A
7th Floor, Suite 700
Ottawa, Ontario K1A 0K9
Tel: 613-954-9165
Fax: 613-941-4541
This publication can be made available in alternative formats upon request.
© Her Majesty the Queen in Right of Canada, 2013

Table of Contents

• Introduction
  1. Privacy Act
  2. About The Public Health Agency of Canada
• Privacy Infrastructure
  1. The Access to Information and Privacy (ATIP) Division
• Delegation of Authority
• Requests under the Privacy Act - Statistical Figures and Interpretation and Explanation
  1. Statistical Report
  2. Number of Privacy Requests and Case Load
  3. Disposition of Completed Requests
  4. Exemptions Invoked
  5. Exclusions Cited
  6. Completion Time
  7. Extensions
  8. Translations
  9. Format of Information Released
  10. Corrections and Notations
  11. Costs
• Training and Awareness
• Recent Privacy Initiatives
• New and/or Revised Institution-Specific Privacy Related Policies, Guidelines and Procedures
  1. ATIP Division and the Transformation Agenda
  2. Audit of Privacy Practices
  3. Other Initiatives
• Key Issues Raised as a Result of Privacy Complaints and/or Investigations
  1. Complaints to the Privacy Commissioner
  2. Applications/Appeals Submitted to the Federal Court/Federal Court of Appeal
  3. Agency Responses to Recommendations raised by other Agents of Parliament
• Privacy Impact Assessments completed
• Disclosures Made Pursuant to Subsections 8(2)m) of the Privacy Act
• Appendix A: Privacy Act — Delegation Order
• Appendix B: Statistical Report on the Privacy Act

Introduction

I. Privacy Act

The Privacy Act (the Act) gives Canadian citizens and permanent residents of Canada the right of access to information about themselves held by the federal government with certain specific and limited exceptions. The Act protects an individual's privacy by setting out provisions related to the collection, retention, accuracy, disposal, use and disclosure of personal information.

The Act requires the head of every federal government institution to submit an annual report to Parliament on the administration of the Act following the close of each fiscal year. This annual report is prepared and is being tabled before each House of Parliament in accordance with section 72 of the Act. This report summarizes how the Public Health Agency of Canada has fulfilled its privacy responsibilities during the fiscal year 2012-2013.

II. About The Public Health Agency of Canada

The Public Health Agency of Canada's (the Agency) mission is to promote and protect the health of Canadians through leadership, partnership, innovation and action in public health.

The role of the Agency is to:

• Promote health;
• Prevent and control chronic diseases and injuries;
• Prevent and control infectious diseases;
• Prepare for and respond to public health emergencies;
• Serve as a central point for sharing Canada's public health expertise with the rest of the world;
• Apply international research and development to Canada's public health programs; and
• Strengthen intergovernmental collaboration on public health and facilitate national approaches to public health policy and planning.

For more information about the Agency, please visit our web site at: http://www.phac-aspc.gc.ca/index-eng.php

Privacy Infrastructure

I. The Access to Information and Privacy (ATIP) Division

The issue of privacy and the appropriate management of personal information, including personal health information, are extremely important for Canadians and the Agency. The Agency takes its role in the management of personal information seriously and has taken steps to raise awareness and implement processes to comply with the Privacy Act. These are outlined in this report.

In June 2012, under the Public Health Agency of Canada (the Agency)- Health Canada (HC) Shared Services Partnership Agreement the Agency and HC established a shared service for Access to Information and Privacy (ATIP) by merging resources to allow for a streamlined and consistent approach to applying the Access to Information Act and the Privacy Act across both institutions. Although the shared service was established, the Agency and HC maintain separate ATIP Coordinators, who have been delegated with all access to information (ATI) and privacy authorities for their respective institutions. This report will only address privacy activity within the Agency. A separate report has been prepared for HC.

The Access to Information and Privacy (ATIP) Division is housed in the Planning, Integration and Management Services Directorate, Corporate Services Branch at HC.

In 2012-2013, administration of the Act was performed by 1.6 full-time equivalent (FTE) employees as well as 1.4 FTEs, retained through service contracts to support administration, reporting, monitoring, management and policy, for a total complement of 2.9. In addition, approximately 3.5 FTEs were dedicated to working on privacy policy for the Agency files.

The ATIP Coordinator is accountable for the development, coordination and implementation of effective policies, guidelines, systems and procedures in order to enable efficient processing of requests under the Act. The Coordinator is also responsible for related policies, systems and procedures stemming from the Act. The Division is responsible for all Agency privacy legislative requirements pursuant to the Act such as:

• Responding to privacy requests within the statutory time frame as well as meeting the duty to assist requesters;
• Providing advice and guidance to staff on the application of the Act and Treasury Board of Canada policies and directives;
• Developing corporate privacy policies and practices that promote a culture of privacy awareness and understanding;
• Promoting staff awareness and providing training on the Act;
• Ensuring that personal information holdings are published in Info Source;
• Coordinating and overseeing the Privacy Impact Assessment (PIA) process;
• Coordinating the containment, assessment and reporting of privacy breaches;
• Monitoring trends in national and international privacy issues to provide informed advice to clients;
• Analyzing privacy practices in the health sector;
• Preparing the Annual Report to Parliament and providing input to the Management Accountability Framework (MAF); and
• Liaising with the Office of the Privacy Commissioner (OPC), Treasury Board of Canada Secretariat (TBS), other federal departments and agencies, provincial ministries of health and other key partners regarding the application of the Act to develop relevant policies, tools and guidelines.

Delegation of Authority

The Delegation Order is attached as Appendix A.

Requests under the Privacy Act - Statistical Figures and Interpretation and Explanation

I. Statistical Report

This section includes an interpretation and explanation of the data contained in the Agency's statistical report which summarizes privacy-related activity for the period between April 1, 2012 and March 31, 2013 (Appendix B).

II. Number of Privacy Requests and Case Load

Requests under the Privacy Act

The number of new privacy request has increased over the past five years. In 2008-2009 there were 11 privacy requests compared to 30 in 2012-2013 which represents a 173% increase over five years. However, there was a decrease in requests received from 2011-2012, when the Agency received 47 new requests.

Case Load

During fiscal year 2012-2013, the Agency completed processing 28 of 32 (88%) active requests. Active requests included 30 new requests and 2 requests carried over from fiscal year 2011-2012.

Privacy Requests Received and Completed by Fiscal Year

Note: More requests are completed than received when the institution completes requests that were carried-over from previous years as well as those received within the fiscal year.

In 2012-2013, the Agency reviewed 6,275 pages in the course of responding to privacy requests. The amount of pages reviewed over the past five years has varied substantially from year to year and is depicted below:

Pages Reviewed by Fiscal Year

Consultations Completed from Other Government Institutions

In 2012-2013, there were no requests for the Agency to complete consultations from other government departments.

III. Disposition of Completed Requests

Completed requests were classified as follows:

Disposition of Requests Completed, 2012-2013

IV. Exemptions Invoked

Sections 18 through 28 of the Act set out the exemptions intended to protect information pertaining to a particular public or private interest. The Agency makes every effort to release as much information as possible. In 2012-2013, all of the exemptions invoked by the Agency, 14 in total, fell under section 26 of the Privacy Act, which protects information about another individual.

V. Exclusions Cited

The Act does not apply to personal information that is available to the public (section 69) nor does it apply to confidences of the Queen's Privy Council, with some exceptions (section 70). Requests containing proposed exclusions under section 70 require consultation with the Privy Council Office.

The Agency did not exclude any information under sections 69 or 70.

VI. Completion Time

The Agency closed 28 privacy requests and was able to respond within 30 days in 16 (57%) cases. The remaining requests were completed within 31 to 60, or 121 days or more.

Completion Time of Requests

VII. Extensions

Legal extensions were invoked in 14 cases (50%) of the total 28 requests completed.

VIII. Translations

There were no requests for translation of the personal information kept in the Agency's records.

IX. Format of Information Released

This section refers to the format in which applicants have received their records. Applicants received records in paper format in all instances (100%).

As part of the shared services arrangement, imaging software will be implemented to respond to formal privacy requests using Portable Document Format (PDF) which provides more delivery options to the public. Released documents can be mailed on CD-ROM which eliminates the need for photocopying; and documents can also be delivered through ePosting for faster delivery when the requester provides an email address. It is anticipated that electronic format will become the preferred delivery choice in future years.

X. Corrections and Notations

There were no requests for the correction or the notation of personal information during the reporting period.

XI. Costs

The Agency spent a total of $185,373 responding to privacy requests under the Act. Of this total, salaries accounted for $140,220 and administration costs accounted for $45,153.

Training and Awareness

Orientation and Awareness

The Agency continued activities to promote employee awareness of their responsibilities under the Act by publishing helpful tips and tools on the intranet site, as well as through Broadcast News messages (a daily electronic newsletter sent to every Agency employee) throughout the reporting period.

Training for the Agency's Employees

The Agency's main privacy training is the 'Privacy 101' course. The course covers a broad range of topics and highlights departmental and employee obligations under the Act and its supporting policies and directives. In 2012-2013, 12 sessions of the 'Privacy 101' course were held, attended by 59 Agency employees.

In addition to the Agency's 'Privacy 101' course, program areas sometimes request customized privacy training. In these courses, the content is customized for the recipient. Four (4) specialty courses were held and attended by a total of 95 Agency employees.

There is also an online learning tool available entitled "Privacy: The Basics". This e-learning course provides employees with the basic introduction to their roles and responsibilities surrounding the safeguarding of personal information. The course was designed to increase employees' awareness of privacy legislation, as well as the policies and directives that govern the privacy practices.

Recent Privacy Initiatives

Over the past year, there has been increased interest in privacy issues from various programs in both the Agency and HC. The ATIP Division worked collaboratively with program areas to identify and mitigate privacy issues. Below are some examples of recent initiatives in which the Division is working closely with program areas to address privacy considerations.

Pan-Canadian Health Information Privacy Group

The ATIP Division is represented on the Pan-Canadian Health Information Privacy Group, a federal/provincial/territorial (F/P/T) committee established to deal with the privacy issues associated with the development of electronic health records, across all jurisdictions in Canada. The work has assisted jurisdictions in understanding and working with the different privacy regimes across the country in developing privacy legislation and the Pan-Canadian electronic health record system.

Multi-Lateral Information Sharing Agreement (MLISA)

The ATIP Division is providing privacy input into the MLISA, an agreement that sets out the parameters regarding public health information to be shared among and used by federal, provincial and territorial governments. The objective of MLISA is to improve infectious disease surveillance and responses to urgent public health events, while strengthening the safeguards and transparency that govern the flow of personal and health information. Federally, this initiative is being spearheaded by the Agency.

New and/or Revised Institution-Specific Privacy Related Policies, Guidelines and Procedures

I. ATIP Division and the Transformation Agenda

The creation of the ATIP shared service harmonized the Agency and HC's ATIP operations which include treatment of ATI and privacy requests, as well as privacy policy and other key functions. Separate ATIP Coordinator functions remain in place for Agency and HC to comply with the Acts. As part of this move to a shared service, a transformation agenda was developed, the main components of which are identified below:

ATIP Delegation Order

In 2012-2013 the ATIP delegation orders were reviewed to ensure that they aligned with the structure of the ATIP Division and to streamline processes and efficiencies.

Business Process Review

A business process review was completed in the fall of 2012. The management team and staff members continue to be engaged in the implementation of strengthened processes around ATIP requests.

ATIP IT System

An Information Technology (IT) case management and imaging system was procured to improve the ability to track and respond to requests, enhance efficiencies, streamline office of the primary interest (OPI) ATIP processes, and enhance reporting capacity.

Governance and Outreach

There is an increased focus on employee engagement within the Division and stakeholder engagement through meetings with branches, central agencies and other government departments.

Organizational Review

An organizational structure was developed and approved by senior management which will strengthen and stabilize the ATIP function by permanently resourcing to meet increased workload. Competitive staffing processes were launched to fill vacant positions and to support the new structure.

II. Audit of Privacy Practices

Internal Audit of Privacy Practices

In December 2012, HC completed an internal audit of privacy practices within the Department. The focus of this audit was on the privacy practices at HC and adherence to the Act.

The audit found that overall, HC is managing personal information under its control with care and consideration, and that the Department benefits from a strong culture of security and confidentiality in the delivery of core program activities.

The audit made six recommendations to strengthen privacy practices within the department and a management action plan has been developed to address the items identified in the audit. The recommendations are being addressed from a shared service perspective and will be implemented as appropriate in both the Agency and HC.

III. Other Initiatives

Health Partnership Privacy Committee (HPPC)

In 2012-2013, to support the move to a shared service, a new Health Partnership Privacy Committee (HPPC) was established. As a director level forum with representation from all areas of the Agency and HC, the HPPC generates discussion and approval on privacy guidance, practices and tools, collaborates in ensuring that privacy compliance requirements are met, and makes recommendations to senior management.

Privacy Management Framework (PMF)

In 2012-2013, the Agency and HC jointly developed and approved a Privacy Management Framework to strengthen privacy management in both institutions. The PMF is comprised of four components; i) legislation, policy, and governance; ii) privacy risk management; iii) awareness and training; and, iv) compliance assurance. It has been approved by the Partnership Executive Committee, chaired by the deputy heads of both institutions, and will be shared throughout the Agency and HC.

New Guidelines and Standardized Risk Tools

Work continued in 2012-2013 to standardize PIA tools, the privacy breach management process and the registration of personal information banks. The existing HC PIA tool kit in place since 2006 has been reviewed and is being updated to align with current TBS privacy directives, and will be used by programs at both the Agency and HC.

Key Issues Raised as a Result of Privacy Complaints and/or Investigations

I. Complaints to the Privacy Commissioner

During 2012-2013, five complaints were filed under the Act with the OPC, and four complaints were carried over from the previous fiscal year. The complaints received during the fiscal year were related to the following: application of exemptions or exclusions (3), refusal to disclose (1) and other (1).

A total of five complaints were closed in this reporting period, all of which were abandoned.

II. Applications/Appeals Submitted to the Federal Court/Federal Court of Appeal

There were no applications or appeals submitted to the Federal Court or to the Federal Court of Appeal during fiscal year 2012-2013.

III. Agency Responses to Recommendations raised by other Agents of Parliament

There were no recommendations raised by other Agents of Parliament during fiscal year 2012-2013.

Privacy Impact Assessments during the Reporting Period

In 2012-2013, no Privacy Impact Assessments were completed.

Disclosures Made Pursuant to Subsections 8(2)m) of the Privacy Act

Subsection 8(2)(m) allows for the disclosure of personal information where the head of a government institution is of the opinion that the public interest in the disclosure clearly outweighs any invasion of privacy that could result from the disclosure.

In 2012-2013, there were no disclosures of personal information pursuant to that provision of the Act made by the Agency.

Appendix A: Privacy Act — Delegation Order

Privacy Act — Delegation Order

Pursuant to the powers of delegation conferred upon me by Section 73 of the Privacy Act, the person exercising the functions and position of Access to Information and Privacy Coordinator for the Public Health Agency of Canada and the respective successor, including in the Coordinator's absence, a person or officer designated in writing to act in the place of the holder of such functions and position is hereby authorized to exercise these powers, duties, or functions of the Minister as the head of the government institution under the Act, set out in the attached schedule.

The person exercising the functions and position of Access to Information and Privacy Coordinator for the Public Health Agency of Canada and the respective successor, including in the Coordinator's absence, a person or officer designed in writing to act in the place of the holder of such functions and position, is hereby authorized to exercise these powers, duties or functions of the Minister as the head of the government institution under the Act, set out in sections 13 and 15 of the Act.

Public Health Agency of Canada Schedule of Delegation Order

Appendix B: Statistical Report on the Privacy Act

TBS/SCT 350-63

Name of institution: Public Health Agency of Canada

Reporting period: 2011-04-01 to 2012-03-31

Part 1 – Requests under the Privacy Act

Part 2 – Requests closed during the reporting period

2.1 Disposition and completion time

2.2 Exemptions

2.3 Exclusions

2.4 Format of information released

2.5 Complexity

2.5.1 Relevant pages processed and disclosed

2.5.2 Relevant pages processed and disclosed by size of requests

2.5.3 Other complexities

2.6 Deemed refusals

2.6.1 Reasons for not meeting statutory deadline

2.6.2 Number of days past deadline

2.7 Requests for translation

Part 3 – Disclosures under subsection 8(2)

Part 4 – Requests for correction of personal information and notations

Part 5 – Extensions

5.1 Reasons for extensions and disposition of requests

5.2 Length of extensions

Part 6 – Consultations received from other institutions and organizations

6.1 Consultations received from other government institutions and organizations

6.2 Recommendations and completion time for consultations received from other government institutions

6.3 Recommendations and completion time for consultations received from other organizations

Part 7 – Completion time of consultations on Cabinet confidences

Part 8 – Resources related to the Privacy Act

8.1 Costs

8.2 Human Resources