Annual Report on the Privacy Act 2014-2015

Table of Contents

• Introduction
  • I. Privacy Act
  • II. About the Public Health Agency of Canada
• Privacy Delivery and Governance
  • I. Privacy Management Division
  • II. The Access to Information and Privacy Operations Division
• Delegation of Authority
• Requests under the Privacy Act - Statistical Figures, Interpretation and Explanation
  • I. Statistical Report
  • II. Number of Privacy Requests and Case Load
  • III. Disposition of Requests Completed
  • IV. Exemptions Invoked
  • V. Exclusions Cited
  • VI. Completion Time
  • VII. Extensions
  • VIII. Translation
  • IX. Format of Information Released
  • X. Corrections and Notations
  • XI. Costs
• Training and Awareness
• Recent Privacy Initiatives
• New and/or Revised Institution-Specific Privacy-Related Policies, Guidelines and Procedures
  • I. ATIP Operations Division
  • II. Privacy Management Division
  • III. Other Initiatives
• Key Issues Raised as a Result of Privacy Complaints and/or Investigations
  • I. Complaints to the Privacy Commissioner
  • II. Types of Complaints and their Disposition Completed
  • III. Applications/Appeals Submitted to the Federal Court/Federal Court of Appeal
  • IV. Agency Responses to Recommendations raised by other Agents of Parliament
  • V. Privacy Audits
• Privacy Impact Assessments Completed
• Privacy Breaches
• Disclosures made Pursuant to Paragraph 8(2)(m) of the Privacy Act
• Appendix A: Access to Information Act and Privacy Act - Delegation Order
• Appendix B: Statistical Report on the Privacy Act

Introduction

I. Privacy Act

The Privacy Act (the Act) gives Canadian citizens and permanent residents of Canada the right of access to information about themselves held by the federal government with certain specific and limited exceptions. The Act protects an individual's privacy by setting out provisions related to the collection, retention, accuracy, disposal, use and disclosure of personal information.

The Act requires the head of every federal government institution to submit an annual report to Parliament on the administration of the Act following the close of each fiscal year. This annual report is prepared and is being tabled before each House of Parliament in accordance with section 72 of the Act. This report summarizes how the Public Health Agency of Canada (the Agency) has fulfilled its privacy responsibilities during the fiscal year 2014-2015.

II. About the Public Health Agency of Canada

The Agency's mission is to promote and protect the health of Canadians through leadership, partnership, innovation and action in public health.
The role of the Agency is to:

• Promote health;
• Prevent and control chronic diseases and injuries;
• Prevent and control infectious diseases;
• Prepare for and respond to public health emergencies;
• Serve as a central point for sharing Canada's public health expertise with the rest of the world;
• Apply international research and development to Canada's public health programs; and
• Strengthen intergovernmental collaboration on public health and facilitate national approaches to public health policy and planning.

For more information about the Agency, please visit our web site.

Privacy Delivery and Governance

Privacy protection and the appropriate management of personal information, including personal health information, are extremely important for Canadians and the Agency. The Agency takes its role in the management of personal information seriously and has taken steps to raise awareness and implement processes to comply with the Privacy Act. These are outlined in this report.

Privacy Act requirements are led out of the Privacy Management Division and the Access to Information and Privacy Operations Division. Both Divisions are housed in the Planning, Integration and Management Services Directorate of the Corporate Services Branch at Health Canada.

In June 2012, under the terms of the Public Health Agency of Canada and HC Shared Services Partnership Agreement, a shared service was established for the administration of the Access to Information Act and the Privacy Act in the two institutions. 2013-2014 was the first full fiscal year under this new arrangement, and saw the implementation of a single ATIP Coordinator model for the Agency and HC.

In 2014-2015, the Act was administered at the Agency by 2.58 full-time equivalent (FTE) employees with the support of 0.24 FTEs in consultant services, as well as some part-time and casual employees at 0.05 FTEs for a total resource complement of 2.87 FTEs.

I. Privacy Management Division

In September 2014, a new Privacy Management Division was established to strengthen capacity and expertise supporting the Agency's programs in the collection, use, retention, disclosure and disposal of personal information.

The Privacy Management Division's key areas of work include:

• Developing corporate privacy policies, guidelines and practices that promote a culture of privacy awareness and understanding;
• Working with programs to complete, monitor and report on privacy impact assessments and privacy breaches;
• Actively promote privacy awareness in both the Public Health Agency of Canada and Health Canada through both on-line and in person training;
• Reviewing Memorandum to Cabinet and Treasury Board submissions to ensure privacy requirements are met;
• Coordinating the Public Health Agency of Canada and Health Canada annual input into Info Source and the development of Personal Information Banks;
• Liaising with the Office of the Privacy Commissioner of Canada on privacy aspects of new and proposed legislation/regulations, policies, privacy impact assessments, breaches and complaints
• Monitoring privacy policies, practices; and
• Liaising with other federal departments, agencies, provincial ministries of health and other key partnerships regarding privacy issues within the Health Portfolio to provide informed advice to clients.

II. The Access to Information and Privacy Operations Division

The management of requests and associated complaints under the Privacy Act continues to be led by the Access to Information and Privacy Operations Division. The Division is responsible for privacy legislative requirements pursuant to the Act such as:

• Responding to privacy requests within the statutory time frame as well as meeting the duty to assist requesters;
• Promoting staff awareness and providing training on the Act;
• Preparing the Annual Report to Parliament;
• Supporting other areas of the Agency by reviewing various documents to ensure the appropriate identification and redaction of personal information (e.g., documents for litigation, information disclosure, and relating to human resource issues); and
• Liaising with the Office of the Privacy Commissioner of Canada, Treasury Board of Canada Secretariat, other federal departments and agencies, provincial ministries of health and other key partners regarding the application of the Act to develop relevant policies, tools and guidelines.

Delegation of Authority

On July 11, 2013, a delegation order for the Privacy Act was signed by the Minister of Health. The delegation order extends the delegation of authorities beyond the Coordinator to the Assistant Deputy Minister and Director General levels within HC's Corporate Services Branch, which provides ATIP services to the Agency. Select authorities have also been delegated to ATIP managers and analysts in order to more effectively manage the volume of access to information requests received. This revised approach was adopted to maximize operational efficiency.

The Delegation Order is attached as Appendix A.

Requests under the Privacy Act - Statistical Figures, Interpretation and Explanation

I. Statistical Report

This section includes an interpretation and explanation of the data contained in the Agency's statistical report which summarizes privacy-related activity for the period between April 1, 2014 and March 31, 2015 (Appendix B).

II. Number of Privacy Requests and Case Load

Requests under the Privacy Act

Although there was a decrease in the number of requests received in 2014-2015 (45 as compared with 57 in 2013-2014), requests increased by 114% since 2010-2011, when the Agency received only 21 requests.

Case Load

During fiscal year 2014-2015, the Agency processed 46 of 47 (98%) active requests. Active requests included 45 new requests and 2 requests carried over from fiscal year 2013-2014.

The number of pages reviewed relating to Privacy Act requests was similar to the past year.

Consultations Completed from Other Government Institutions

In 2014-2015, the Agency completed one consultation (3 pages) from other federal government departments, as compared to the previous year, where the Agency completed two consultations totalling 71 pages.

III. Disposition of Requests Completed

Completed requests were classified as follows:

IV. Exemptions Invoked

Sections 18 through 28 of the Act set out the exemptions intended to protect information pertaining to a particular public or private interest. Section 26 "personal information of other individuals" accounted for 100% of the all exemptions invoked in 2014-2015.

V. Exclusions Cited

The Act does not apply to personal information that is available to the public (section 69), nor does it apply to confidences of the Queen's Privy Council (section 70), with some exceptions. Requests containing proposed exclusions under section 69 require consultation with the Department of Justice, and potentially the Privy Council Office. In 2014-2015, the Agency did not exclude any information under either section 69 or 70.

VI. Completion Time

The Agency tracks the disposition of closed requests and the length of time taken to process them. Of the total caseload of 47 requests, the Agency completed 46 cases and carried over one active request to fiscal year 2015-2016.

The Agency was able to respond within 30 days or less in 38 (83%) of completed cases. Of the remaining requests, 6 (13%) were completed in 31 to 60 days; 2 (4%) in 61 to 120 days, and none (0%) took 121 days or more to complete.

VII. Extensions

Legal extensions were invoked in six cases (13%) of the total 46 requests completed.

VIII. Translation

There were no requests for translation of records responsive to Privacy Act requests in 2014-2015.

IX. Format of Information Released

Applicants received records in electronic format 67% of the time and in paper format in all other instances (33%).

X. Corrections and Notations

There were no requests for the correction or the notation of personal information during the reporting period.

XI. Costs

The Agency spent a total of $269,679 responding to requests related to the Act. Of this total: salaries accounted for $235,700 and administration costs accounted for $33,979, most of which was used to retain temporary help to address the volume and complexity of requests. Staffing for the fiscal year amounted to 2.58 FTE employees dedicated to privacy activities with the support of 0.24 FTEs in consultant services, as well as some part-time and casual employees at 0.05 FTEs for a total resource complement of 2.87 FTEs. In previous years, these figures did not include administrative support, management, reporting, monitoring and policy resources, nor did they include their overhead cost which contributed to overall support of the operations of the application of the Act. In this fiscal year (2014-2015), these elements were incorporated in the above noted costs.

Training and Awareness

Training for Agency Employees

The Agency's main privacy training is the 'Privacy 101' course. The course covers a broad range of topics and highlights departmental and employee obligations under the Act and its supporting policies and directives. In 2014-2015, one session of the 'Privacy 101' course was held, attended by nine Agency employees.

There is also an online learning tool available entitled "Privacy: The Basics". This e-learning course provides employees with the basic introduction to their roles and responsibilities surrounding the safeguarding of personal information. The course was designed to increase employees' awareness of privacy legislation, as well as the policies and directives that govern privacy practices.

Orientation and Awareness

The Agency continued to increase awareness among employees of their responsibilities under the Act by targeted information sessions such as promoting Privacy Day, communications and general awareness messages through internal communication channels. These communications were supported by the development of a number of tools for employees such as the Personal Information Disclosure Guide, Info Source Handbook and a checklist for privacy considerations relevant to Treasury Board submissions. These documents provide guidance to employees when they need to handle personal information.

Recent Privacy Initiatives

Over the past year, there continued to be increased interest in the effective identification and management of privacy issues from various programs in the Agency. The Privacy Management Division worked collaboratively with program areas to identify and mitigate privacy risks.

In addition, the Privacy Management Division continued to collaborate with other government departments in developing common training resources, including an on-line module on privacy, which is expected to become available in 2015-16.

New and/or Revised Institution-Specific Privacy-Related Policies, Guidelines and Procedures

I. ATIP Operations Division

Organizational Review

Work continued to strengthen ATIP Operations function at the Agency, including a benchmarking exercise against selected other government departments. Competitive staffing processes were completed in the first quarter of 2014-2015 in order to position the ATIP Division to fill vacancies. Staffing activities will continue through 2015-2016 in order to continue to build internal capacity.

IT Systems Modernization

Case management tools used to manage/process requests were adapted to Windows 7, the new government standard operating system. Efforts to modernize tools continued throughout the year, and implementation of a new case management system and the addition of new imaging and document processing capacity are planned for the fall of 2015.

II. Privacy Management Division

Privacy Tools

The Privacy Management Division created a number of tools for employees. These tools provide guidance and advice on all stages of handling personal information and include an Info Source Handbook, Privacy Notice Statement Guide and a Personal Information Disclosure Guide, as well as a checklist for privacy considerations relevant to Treasury Board submissions. These documents along with the existing Privacy Management Framework (2013) and the Privacy Impact Assessment (PIA) Toolkit (2014) ensure that Agency employees have the information they need to handle personal information appropriately.

Governance and Outreach

There is an ongoing focus on engagement through meetings with employees across the Agency, central agencies and other government departments. For example, in 2014-15, several meetings of the Health Partnership Privacy Committee (HPPC) were held. As a director-level forum with representation from all areas of the Agency, the HPPC generates discussion and approval of privacy guidance, practices and tools, collaborates in ensuring that privacy compliance requirements are met, and makes recommendations to senior management.

III. Other Initiatives

Internal Audit Response

The Privacy Management Division completed all outstanding recommendations from an internal audit of privacy practices.

Health Information Privacy Group

The Agency continues to participate as a member of the Federal-Provincial-Territorial Health Information Privacy Working Group focused on privacy issues related to the development of electronic health records in Canada.

Privacy Impact Assessment Gap Analysis

The Agency undertook a gap analysis to determine what disease surveillance programs required a privacy impact assessment. The analysis included a prioritization of these assessments based on a set of agreed criteria.

Key Issues Raised as a Result of Privacy Complaints and/or Investigations

I. Complaints to the Privacy Commissioner

As illustrated in Part 8 of the Statistical Report (Appendix B), one complaint under Section 31 related to the processing of Privacy Act requests by the Agency were filed with the Office of the Privacy Commissioner of Canada (OPC). The OPC sent one notice (Section 33) to the Agency providing opportunity to make formal representations relating to active investigations. Lastly, five Letters of Finding (Section 35) relating to complaints were received by the OPC.

II. Types of Complaints and their Disposition Completed

During 2014-2015, five investigations into complaints that related to the processing of Privacy Act requests were completed by the OPC. Two complaints related to exemptions and were abandoned; one complaint was related to exemptions and was dismissed; one complaint was related to disclosure and was dismissed; and finally, one complaint was related to the application of exemptions and was not well founded.

The Agency reviews the outcomes of all OPC investigations, and where appropriate, incorporates lessons learned into business processes.

III. Applications/Appeals Submitted to the Federal Court/Federal Court of Appeal

There were no applications or appeals submitted to the Federal Court or to the Federal Court of Appeal during fiscal year 2014-2015.

IV. Agency Responses to Recommendations raised by other Agents of Parliament

There were no recommendations raised by other Agents of Parliament during fiscal year 2014-2015.

V. Privacy Audits

There were no privacy audits concluded during fiscal year 2014-2015 for the Agency.

Privacy Impact Assessments Completed

A Privacy Impact Assessment for the Regulatory Framework for Human Pathogens and Toxins was completed and provided to the OPC and the Treasury Board Secretariat during the 2014-2015 reporting period.

Privacy Breaches

The Agency reported one privacy breach during the fiscal year; it was of low sensitivity and not reported to the OPC.

Disclosures made Pursuant to Paragraph 8(2)(m) of the Privacy Act

Paragraph 8(2)(m) allows for the disclosure of personal information where the head of a government institution is of the opinion that the public interest in the disclosure clearly outweighs any invasion of privacy that could result from the disclosure.

There were no 8(2)(m) disclosures made this fiscal year.

Appendix A: Access to Information Act and Privacy Act - Delegation Order

Delegation of Authority

Access to Information Act and Privacy Act

I, the Minister of Health, pursuant to section 73 of the Access to Information Act and section 73 of the Privacy Act, hereby designate the persons holding the positions set out in the Delegation of Authority Schedule attached hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Minister as the head of the Public Health Agency of Canada, under the provisions of the Act and related regulations set out in the schedule opposite each position. This designation supersedes all previous delegation orders.

The Honorable Leona Aglukkaq, P.C., M.P.
Minister of Health
July 11, 2013

Appendix B: Statistical Report on the Privacy Act

TBS/SCT 350-63

Name of institution: Public Health Agency of Canada

Reporting period: 2014-04-01 to 2015-03-31

Part 1 - Requests under the Privacy Act

Part 2 - Requests closed during the reporting period

2.5 Complexity

2.6 Deemed refusals

Part 3 - Disclosures under subsections 8(2) and 8(5)

Part 4 - Requests for correction of personal information and notations

Part 5 - Extensions

Part 6 - Consultations received from other institutions and organizations

Part 7 - Completion time of consultations on Cabinet confidences

Part 8 - Complaints and investigations notices received

Part 9 - Privacy Impact Assessments (PIAs)

 

Part 10 - Resources related to the Privacy Act