Annual Report on the Privacy Act 2013-2014

Table of Contents

• Introduction
  1. Privacy Act
  2. About the Public Health Agency of Canada
• Privacy Infrastructure
  1. The Access to Information and Privacy Division
• Delegation of Authority
• Requests under the Privacy Act - Statistical Figures, Interpretation and Explanation
  1. Statistical Report
  2. Number of Privacy Requests and Case Load
  3. Disposition of Requests Completed
  4. Exemptions Invoked
  5. Exclusions Cited
  6. Completion Time
  7. Extensions
  8. Translation
  9. Format of Information Released
  10. Corrections and Notations
  11. Costs
• Training and Awareness
• Recent Privacy Initiatives
• New and/or Revised Institution-Specific Privacy-Related Policies, Guidelines and Procedures
  1. ATIP Division
  2. Other Initiatives
• Key Issues Raised as a Result of Privacy Complaints and/or Investigations
  1. Complaints to the Privacy Commissioner
  2. Types of Complaints and Their Disposition Completed
  3. Applications/appeals Submitted to the Federal Court/Federal Court of Appeal
  4. Agency Responses to Recommendations Raised by Other Agents of Parliament
  5. Privacy Audits
• Privacy Impact Assessments Completed
• Disclosures made Pursuant to Paragraph 8(2)(m) of the Privacy Act
• Appendix A: Access to Information Act and Privacy Act - Delegation Order
• Appendix B: Statistical Report on the Privacy Act

Introduction

I. Privacy Act

The Privacy Act (the Act) gives Canadian citizens and permanent residents of Canada the right of access to information about themselves held by the federal government with certain specific and limited exceptions. The Act protects an individual's privacy by setting out provisions related to the collection, retention, accuracy, disposal, use and disclosure of personal information.

The Act requires the head of every federal government institution to submit an annual report to Parliament on the administration of the Act following the close of each fiscal year. This annual report is prepared and is being tabled before each House of Parliament in accordance with section 72 of the Act. This report summarizes how the Public Health Agency of Canada (the Agency) has fulfilled its privacy responsibilities during the fiscal year 2013-2014.

II. About the Public Health Agency of Canada

The Agency's mission is to promote and protect the health of Canadians through leadership, partnership, innovation and action in public health.

The role of the Agency is to:

• Promote health;
• Prevent and control chronic diseases and injuries;
• Prevent and control infectious diseases;
• Prepare for and respond to public health emergencies;
• Serve as a central point for sharing Canada's public health expertise with the rest of the world;
• Apply international research and development to Canada's public health programs; and
• Strengthen intergovernmental collaboration on public health and facilitate national approaches to public health policy and planning.

For more information about the Agency, please visit our web site.

Privacy Infrastructure

I. The Access to Information and Privacy Division

Privacy protection and the appropriate management of personal information, including personal health information, are extremely important for Canadians and the Agency. The Agency takes its role in the management of personal information seriously and has taken steps to raise awareness and implement processes to comply with the Privacy Act. These are outlined in this report.

The Access to Information and Privacy (ATIP) Division is housed in the Planning, Integration and Management Services Directorate of the Corporate Services Branch at Health Canada (HC).

In June 2012, under the terms of the Agency and HC Shared Services Partnership Agreement, a shared service was established for the administration of the Access to Information Act and the Privacy Act in the two institutions. 2013-2014 was the first full fiscal year under this new arrangement, and saw the implementation of a single ATIP Coordinator model for the Agency and HC.

The ATIP Coordinator is accountable for the development, coordination and implementation of effective policies, guidelines, systems and procedures in order to enable efficient processing of requests under the Act. The Coordinator is also responsible for related policies, systems and procedures stemming from the Act. The division is responsible for all privacy legislative requirements pursuant to the Act such as:

• Responding to privacy requests within the statutory time frame as well as meeting the duty to assist requesters;
• Providing advice and guidance to staff on the application of the Act and Treasury Board of Canada policies and directives;
• Developing corporate privacy policies and practices that promote a culture of privacy awareness and understanding;
• Promoting staff awareness and providing training on the Act;
• Ensuring that personal information holdings are published in Info Source;
• Coordinating and overseeing the Privacy Impact Assessment (PIA) process;
• Coordinating the containment, assessment and reporting of privacy breaches;
• Monitoring trends in national and international privacy issues to provide informed advice to clients;
• Analyzing privacy practices in the health sector;
• Preparing the Annual Report to Parliament and providing input to the Management Accountability Framework (MAF); and
• Liaising with the Office of the Privacy Commissioner (OPC), Treasury Board of Canada Secretariat (TBS), other federal departments and agencies, provincial ministries of health and other key partners regarding the application of the Act to develop relevant policies, tools and guidelines.

In 2013-2014, the Act was administered at the Agency by 1.85 full-time equivalent (FTE) employees with the support of 0.31 FTEs in consultant services, for a total complement of 2.16 FTEs.

Additionally, there were approximately 2.1 FTEs dedicated to working on privacy policy for Agency files. The total complement of privacy-related FTEs within the Agency amounted to 4.26 FTEs.

Delegation of Authority

On July 11, 2013, a new delegation order for the Privacy Act was signed by the Minister of Health. The new delegation order extends the delegation of authorities beyond the Coordinator to the Assistant Deputy Minister and Director General levels within HC's Corporate Services Branch. Select authorities have also been delegated to ATIP managers and analysts in order to more effectively manage the volume of access to information requests received. This revised approach was adopted to maximize operational efficiency while continuing to minimize risks.

The Delegation Order is attached as Appendix A.

Requests under the Privacy Act - Statistical Figures, Interpretation and Explanation

I. Statistical Report

This section includes an interpretation and explanation of the data contained in the Agency's statistical report which summarizes privacy-related activity for the period between April 1, 2013 and March 31, 2014 (Appendix B).

II. Number of Privacy Requests and Case Load

Requests under the Privacy Act

The number of new privacy request has increased over the past five years. In 2009-2010 there were 21 privacy requests compared to 57 in 2013-2014 which represents a 171% increase over five years.

Case Load

During fiscal year 2013-2014, the Agency completed processing 59 of 61 (97%) active requests. Active requests included 57 new requests and 4 requests carried over from fiscal year 2012-2013.

While 2013-2014 saw a slight decrease from the previous year in the number of pages reviewed, there are a number of factors that contributed to this result. First, the Agency has attempted to be more strategic in the manner with which it deals with its requests, and has dedicated more resources to front-end processes. Requests are more closely analyzed and discussed with the requestor from the outset, in an attempt to retrieve records that respond to their needs. In a similar vein, ATIP has worked with departmental officials to help ensure that documents retrieved are relevant to the request. Finally, it is worth noting that the number of pages reviewed relate only to files closed during 2013-2014, and do not account for active requests still under review at the end of the fiscal year.

Consultations Completed from Other Government Institutions

In 2013-2014, the Agency completed a total of two consultations from one other federal government department, Health Canada. 71 pages were reviewed.

III. Disposition of Requests Completed

Completed requests were classified as follows:

IV. Exemptions Invoked

Sections 18 through 28 of the Act set out the exemptions intended to protect information pertaining to a particular public or private interest. The Agency makes every effort to release as much information as possible. Section 26 "personal information of other individuals" accounted for 95% of the all exemptions invoked in 2013-2014.

V. Exclusions Cited

The Act does not apply to personal information that is available to the public (section 69). Nor does it apply to confidences of the Queen's Privy Council, with some exceptions (section 70). Requests containing proposed exclusions under section 69 require consultation with the Department of Justice, and potentially the Privy Council Office. In 2013-2014, the Agency did not exclude any information under either section 69 or 70.

VI. Completion Time

The Agency tracks the disposition of closed requests and the length of time taken to process them. Of the total caseload of 61 requests, the Agency completed 59 cases and carried over 2 active requests to fiscal year 2014-2015.

The Agency was able to respond within 30 days or less in 50 (85%) of completed cases. Of the remaining requests, 5 (8%) were completed in 31 to 60 days; 1 (2%) in 61 to 120 days, and 5 (3%) in 121 days or more.

VII. Extensions

Legal extensions were invoked in 2 cases (3%) of the total 59 requests completed.

VIII. Translation

There were no requests for translation of records responsive to Privacy Act requests in 2013-2014.

IX. Format of Information Released

This section refers to the format in which applicants have received their records. Applicants received records in paper format in all instances (100%).

X. Corrections and Notations

There were no requests for the correction or the notation of personal information during the reporting period.

XI. Costs

The Agency spent a total of $228,862 responding to requests related to the Act. Of this total: salaries accounted for $161,359 and administration costs accounted for $67,502, most of which was used to retain temporary help to address the volume and complexity of requests. Staffing for the fiscal year amounted to 4.26 full-time resources dedicated to privacy activities. These figures do not include administrative support, management, reporting, monitoring and policy resources, nor do they include their overhead cost which contributed to overall support of the operations of the application of the Act. It is important to note that these amounts relate only to the costs associated within the ATIP division, and do not account for costs that other areas of the Agency incur in responding to privacy requests.

Training and Awareness

Training for Agency Employees

Within the ATIP division, there is one employee designated as a full time training coordinator. The Agency's main privacy training is the 'Privacy 101' course. The course covers a broad range of topics and highlights departmental and employee obligations under the Act and its supporting policies and directives. In 2013-2014, three sessions of the 'Privacy 101' course were held, attended by 33 Agency employees.

In addition to the Agency's 'Privacy 101' course, program areas sometimes request customized privacy training. These courses encompass both Access to Information and Privacy components, and the content is customized for the recipient. In 2013-2014, two such courses were held, attended by a total of eight Agency employees.

There is also an online learning tool available entitled "Privacy: The Basics". This e-learning course provides employees with the basic introduction to their roles and responsibilities surrounding the safeguarding of personal information. The course was designed to increase employees' awareness of privacy legislation, as well as the policies and directives that govern privacy practices.

Orientation and Awareness

The Agency continued to increase awareness among employees of their responsibilities under the Act by publishing helpful tips and tools on the intranet site, as well as through Broadcast News messages (a daily electronic newsletter sent to every Agency employee).

Informal Briefing

The ATIP Coordinator provided briefings at senior level management meetings on various privacy-related initiatives, including the development of a Privacy Impact Assessment toolkit.

Recent Privacy Initiatives

Over the past year, there has been increased interest in privacy issues from various programs in both the Agency and HC. The ATIP division worked collaboratively with program areas to identify and mitigate privacy issues. Below is an example of recent initiatives in which the division is working closely with program areas to address privacy considerations.

Privacy Impact Assessment (PIA) Process and Toolkit

A PIA toolkit for the Agency and HC was approved in March 2014. The toolkit was developed to assist employees in understanding PIA requirements and to walk them through the process of putting a PIA in place. The toolkit incorporates extensive comments solicited from all areas of the Agency and HC via the Health Partnership Privacy Committee (HPPC), which was used as a vehicle for consultations. The PIA toolkit is a key component of the Agency's privacy awareness activities which focus on the safeguarding of personal information within employees' control.

New and/or Revised Institution-Specific Privacy-Related Policies, Guidelines and Procedures

I. ATIP Division

The Agency and HC Shared Services Partnership, launched on June 29, 2012, enabled the streamlining and simplification of the Agency and HC ATIP operations, which included processing of ATI and privacy requests, as well as privacy policy and other key functions. 2013-2014 was the first complete year under the new shared services model and work continued on activities to integrate and optimize service delivery.

Privacy Delegation Order

As noted earlier, on July 11, 2013, a new delegation order was signed by the Minister of Health. The new delegation order extends the delegation of authorities beyond the Coordinator to the Assistant Deputy Minister and Director General levels and, in select cases, to ATIP managers and analysts. The revised approach was adopted to maximize operational efficiency while continuing to minimize risks.

Organizational Review

Work continued to enhance resources to strengthen and stabilize the ATIP function at the Agency and HC. This included a strategy to move away from temporary help consultants to full-time employees. Competitive staffing processes were completed in the fourth quarter of 2013-2014 in order to position ATIP to fill vacancies in 2014-2015 to support the revised structure. It is anticipated that staffing activities will continue through 2014-2015 in order to build internal capacity.

Business Processes

In 2013-2014, work continued on harmonizing institutional processes between the Agency and HC. A major milestone was the implementation of a single ATIP Coordinator model for both institutions. This approach, believed to be the first of its kind in the federal government, was adopted following extensive departmental consultations with the Legal Services unit and human resources section. The model is fully compliant with legislative requirements and involves the cross-appointment of select delegated authorities to both institutions.

The Agency and HC also addressed the 'care and custody' of records that are owned by one department, yet used by the other. For example, HC has 'care and custody' of the Agency's human resources records, which can now be accessed through a harmonized institutional process.

The management team and staff members continue to be engaged in the implementation of strengthened processes around ATIP requests.

IT Systems Modernization

A case management and imaging system has been procured to improve the ability to track and respond to requests, enhance efficiencies, streamline ATIP processes, and enhance reporting capacity. Much of the work performed in 2013-2014 consisted of system modification and testing, in collaboration with internal and external partners.

Governance and Outreach

There is an ongoing focus on employee engagement within the division and on stakeholder engagement through meetings with branches, central agencies and other government departments. In 2013-2014, three meetings of the Health Partnership Privacy Committee (HPPC) were held. As a director-level forum with representation from all areas of the Agency and HC, the HPPC generates discussion and approval of privacy guidance, practices and tools, collaborates in ensuring that privacy compliance requirements are met, and makes recommendations to senior management.

II. Other Initiatives

Internal Audits

In December 2012, an internal audit of privacy practices was completed at HC. The focus of this audit was on the privacy practices and adherence to the Act.

The audit found that overall, personal information under the institution's control is being managed with care and consideration, and that there is a strong culture of security and confidentiality in the delivery of core program activities.

The audit made six recommendations to strengthen privacy practices and a management action plan has been developed to address the items identified in the audit. The recommendations are being addressed from a shared service perspective and will be implemented as appropriate in both HC and the Agency.

During the last reporting period, the results of work on the audit recommendations included implementation of an enterprise-wide Privacy Management Framework and updated PIA processes and tools. Ongoing work includes the development and implementation of privacy notice tools, and guidance on the collection, use, disclosure and retention of personal information.

The division is also responding to audit recommendations in other areas of the department that have privacy implications. One item in development as a result is a Permissible Disclosure Framework that will be used by programs and services within both institutions to guide disclosures pursuant to subsection 8(2) of the Privacy Act.

Privacy Management Framework

In 2013-2014, the Agency and HC implemented the Privacy Management Framework (PMF) to strengthen privacy management in both institutions. The PMF is comprised of four components: i) legislation, policy, and governance; ii) privacy risk management; iii) awareness and training; and iv) compliance assurance, and work continued on various initiatives in all four areas during the year.

New Guidelines and Standardized Risk Tools

Work continued in 2013-2014 to standardize PIA tools, the privacy breach management process and the registration of personal information banks. An updated PIA toolkit was approved for use by the Agency and HC in March 2014.

Key Issues Raised as a Result of Privacy Complaints and/or Investigations

I. Complaints to the Privacy Commissioner

During 2013-2014, seven complaints were filed under the Act with the OPC related to the following: application of exemptions (4), disclosure (2) and delay (1).

II. Types of Complaints and their Disposition Completed

During 2013-2014, three complaint investigations were completed by the OPC. One related to deemed refusal (delay) was well-founded, one related to disclosure was abandoned, and one related to the application of exemptions was dismissed.

The Agency reviews the outcomes of all OPC investigations, and where appropriate, incorporates lessons learned into business processes.

III. Applications/Appeals Submitted to the Federal Court/Federal Court of Appeal

There were no applications or appeals submitted to the Federal Court or to the Federal Court of Appeal during fiscal year 2013-2014.

IV. Agency Responses to Recommendations raised by other Agents of Parliament

There were no recommendations raised by other Agents of Parliament during fiscal year 2013-2014.

V. Privacy Audits

There were no privacy audits concluded during fiscal year 2013-2014.

Privacy Impact Assessments Completed

No privacy impact assessments were completed during the 2013-2014 reporting period.

Disclosures made Pursuant to Paragraph 8(2)(m) of the Privacy Act

Paragraph 8(2)(m) allows for the disclosure of personal information where the head of a government institution is of the opinion that the public interest in the disclosure clearly outweighs any invasion of privacy that could result from the disclosure.

In 2013-2014, the Agency did not make any disclosures of personal information pursuant to this provision of the Act.

Appendix A: Access to Information Act and Privacy Act - Delegation Order

Delegation of Authority

Access to Information Act and Privacy Act

I, the Minister of Health, pursuant to section 73 of the Access to Information Act and section 73 of the Privacy Act, hereby designate the persons holding the positions set out in the Delegation of Authority Schedule attached hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Minister as the head of the Public Health Agency of Canada, under the provisions of the Act and related regulations set out in the schedule opposite each position. This designation supersedes all previous delegation orders.

The Honorable Leona Aglukkaq, P.C., M.P.
Minister of Health
July 11, 2013

Appendix B: Statistical Report on the Privacy Act

TBS/SCT 350-63

Name of institution: Public Health Agency of Canada

Reporting period: 2013-04-01 to 2014-03-31

Part 1 - Requests under the Privacy Act

Part 2 - Requests closed during the reporting period

2.5 Complexity

2.6 Deemed refusals

Part 3 - Disclosures under subsection 8(2)

Part 4 - Requests for correction of personal information and notations

Part 5 - Extensions

Part 6 - Consultations received from other institutions and organizations

Part 7 - Completion time of consultations on Cabinet confidences

Part 8 - Resources related to the Privacy Act