Annual Report on the Administration of the Privacy Act 2023-2024

Table of Contents

• Introduction
• 1. About the Public Service Commission of Canada
  • 1.1 Raison d’être
  • 1.2 Mandate and role
  • 1.3 Programs
• 2. Organizational structure and delegation
  • 2.1 Delegation order
  • 2.2 Organizational structure
• 3. 2023-2024 Performance
  • 3.1 Requests under the Privacy Act
  • 3.2 Disposition of requests completed
  • 3.3 Exemptions and exclusions invoked
  • 3.4 Completion time and extensions
  • 3.5 Format of information released
  • 3.6 Inter-organizational consultations
  • 3.7 Informal requests
  • 3.8. Active complaints
• 4. Summary of ATIP Office activities
  • 4.1 Advice, training and awareness
  • 4.2 Policies, guidelines and procedures
  • 4.3 Initiatives and projects to improve privacy
  • 4.4 Summary of key issues and actions taken on complaints
  • 4.5 Collection, use and disclosure of personal information
  • 4.6 Material Privacy breaches
  • 4.7 Monitoring compliance
  • 4.8 Privacy Impact Assessments
• Annex A – Delegation Order
• Annex B – 2022–2023 Privacy Act Statistical Report
• Annex C – Supplemental Statistical Report on the Access to Information Act and the Privacy Act

Introduction

The Privacy Act (the Act) came into force on July 1, 1983. The Act provides the legal framework for the collection, retention, use, disclosure, disposition, and accuracy of personal information in the administration of programs and activities by federal government institutions. It also provides Canadian citizens and permanent residents with a right of access to, and correction of, their own personal information under the control of a federal institution with certain specific and limited exceptions.

Section 72 of the Act requires that the head of every federal government institution prepare an annual report, for submission to Parliament, on the administration of the Act within the institution. The report must be tabled before each House of Parliament within the first 15 sitting days of the parliamentary session after September 1.

Prepared and tabled in Parliament in accordance with section 72 of the Act, this annual report provides a summary of the administration of the Act by the Public Service Commission of Canada for the 2023–2024 fiscal year.

This report is also available on the Publications page of the Public Service Commission of Canada’s website.

1. About the Public Service Commission of Canada

1.1 Raison d’être

The President of the King’s Privy Council for Canada is identified as the appropriate minister for the Public Service Commission of Canada (PSC) in accordance with the Financial Administration Act. The PSC reports independently on its mandate to Parliament.

Through collaboration with departments and agencies, the PSC is dedicated to building tomorrow’s public service that is based on excellence and is representative of Canada’s diversity. It safeguards non-partisanship and promotes and protects merit and the use of both official languages in a staffing and recruitment context. It supports departments and agencies in recruiting talented people from coast to coast using innovative and modern services, tools, and practices.

1.2 Mandate and role

Under the delegated staffing system set out in the Public Service Employment Act, the PSC fulfills its mandate by promoting and safeguarding a non-partisan, merit-based and representative public service that serves all Canadians. It does this by:

• supporting departments and agencies in hiring qualified individuals into and within the public service
• overseeing and ensuring the integrity of public service hiring
• protecting the non-partisan nature of the public service while respecting employees’ rights to participate in political activities
• delivering recruitment programs and assessment services

1.3 Programs

As per the Service Inventory, the PSC delivers services via 3 programs, with support from Internal Services, all of which support the delivery of its departmental results. While the programs correspond closely to the PSC sectors, they were not defined based on the organizational structure. In fact, a program’s departmental result can be the result of work accomplished in more than one sector.

Policy Direction and Support

The Policy Direction and Support Program exists to support departments and agencies in hiring qualified individuals into and within the public service, in experimenting and innovating with their staffing approaches and supporting strategies to help them both meet their business needs and achieve their diversity and employment equity objectives. This program establishes government-wide direction on staffing through regulations and policy and provides guidance to organizations to enable legislative, regulatory and policy compliance. It also assesses public servants' requests for permission to become candidates for elected office and conducts outreach to ensure public servants know their legal rights and responsibilities regarding political activities.

Recruitment and Assessment Services

The Recruitment and Assessment Services Program supports departments and agencies in the hiring of qualified individuals into and within the public service, helping to shape a workforce reflecting Canada’s diversity. This includes the delivery of recruitment programs, student programs, assessment and accommodation services, and the administration of legislated priority entitlements. Through outreach and the use of modern tools, online systems, and technology, the program reduces barriers for Canadians accessing public service jobs. It also collaborates with departments and agencies to create and implement innovative staffing and assessment approaches to meet the Government of Canada’s strategic recruitment priorities and renew the public service.

Oversight and Monitoring

The Oversight and Monitoring Program supports the integrity of the merit-based public service hiring process and helps identify areas for continuous improvement of the public service. The program performs audits and investigations and conducts surveys to monitor organizational compliance with staffing legislation, regulations, policies, and to provide a system-wide view of the public service staffing environment. This program also monitors and analyzes hiring data and conducts research to provide departments and agencies, and Canadians, with an informed view of the dynamics of public service hiring.

Internal Services

Internal services are the services that are provided within a department so that it can meet its corporate obligations and deliver its programs. There are 10 categories of internal services: Financial Management Services, Acquisition Management Services, Materiel Management Services, Human Resources Management Services, Information Management Services, Information Technology Services, Communications Services, Legal Services, Management and Oversight Services, Real Property Management Services.

2. Organizational structure and delegation

The PSC has a stable and effective Access to Information and Privacy (ATIP) program. The ATIP Office works closely with PSC employees to make sure all requests are handled on time. It relies on open communication with PSC sectors, government organizations, third parties and requestors to ensure optimal application of the Act. A new President of the Public Service Commission was appointed in January 2024.

2.1 Delegation order

The President of the PSC is designated as the head of the institution for the administration of the Act. Pursuant to section 73 of the Act, the head of an institution may delegate any of their powers, duties or functions under the Act by signing an order authorizing one or more officers or employees at the appropriate level to exercise or perform the powers, duties or functions of the head specified in the order.

Most of the powers, duties, and functions of the President under the Act are delegated to the Director, Sector Management and ATIP Coordination. The Director is the designated ATIP Coordinator for the PSC. Partial delegation is also granted to the ATIP Manager, who has operational responsibility for the application of the Act, as well as to the Chief Security Officer, for the disclosure of personal information pursuant to paragraph 8(2)(m) of the Act. This delegation is limited to specific circumstances related to security when the information was obtained outside PSC program activities.

Refer to Annex A – Delegation Order to consult the delegation order that was in effect at the end of the reporting period.

A new President of the Public Service Commission was appointed in January 2024, and a full review of the PSC delegation order is in progress.

2.2 Organizational structure

ATIP Office

The ATIP Office supports the Director, Sector Management and ATIP Coordination (the Director) in administering the provisions of the Act and related Treasury Board Secretariat (TBS) policies for the PSC. Housed in the Chief Financial Officer and Vice-President’s Office of the Corporate Affairs Sector, in the National Capital Region, the ATIP Office is currently supported by a Manager, a Senior Advisor and 2 Analysts.

The Director is responsible for developing, reviewing and implementing effective policies, guidelines, systems and procedures to ensure requests are processed as required under the Act and as directed by TBS policies and directives. The activities of the Director include:

• responding to requests made under the Act
• acting as spokesperson for the PSC in dealings with TBS, the Office of the Privacy Commissioner and other government departments and agencies on matters related to the Act
• responding to consultation requests submitted by other government institutions with respect to PSC documents
• reviewing information collected in accordance with the Policy on Communications and Federal Identity and the Mandatory Procedures for Public Opinion Research
• preparing the Annual Report to Parliament on the administration of the Actand other statutory reports, as well as other material that may be required by central agencies
• promoting awareness and providing advice to PSC employees to ensure that the obligations of the Act and TBS policies are met, and assessing their impact on various program initiatives
• monitoring the PSC’s compliance with the Act, regulations and other relevant policies and procedures

In addition to receiving and processing requests made under the Act, the ATIP Office provides general and personalized training sessions to employees, maintains policies and procedures, provides support to sector liaison officers, and makes sure employees understand their roles, responsibilities, and obligations under the Act.

The ATIP Office Manager is responsible for administering the departmental privacy protection program, as well as supporting activities of the PSC by providing guidance and reviewing privacy breaches and Privacy Impact Assessments (PIAs). The Senior Advisor supports the Manager in reviewing requests for personal information and in conducting regular reviews of the departmental Info Source chapter and helps PSC employees manage privacy breaches and disclosures of personal information.

The Analysts are responsible for processing requests and consultations under the Act, preparing responses, and supporting all other ATIP responsibilities. They also provide privacy advice and support in the evaluation of program activities, and help create privacy compliance documents, such as privacy notice statements and PIAs.

The services of a subject matter expert were retained through a professional services contract on an as-needed basis, to assist in the writing and reviewing of a PIA. The PSC did not enter into any new service agreements for ATIP services with other government institutions during the reporting period.

Liaison Officers

The ATIP Office processes requests with the help of liaison officers, who are employees across the organization with extensive knowledge of their respective sector’s activities, which enables them to act as the point of contact between their area and the ATIP Office. There is a liaison officer for each sector of the PSC, as well as for the Corporate Secretariat and the Office of the Chief Audit and Evaluation Executive.

Liaison officers play an important role in making sure the PSC thoroughly searches its record holdings when handling requests. They also:

• assign program experts to search for relevant records
• advise if there are other offices of primary interest
• inform the ATIP Office of any issues regarding specific requests (delays, interference with operations, need to consult)
• deliver relevant records, with sector recommendations, to the ATIP Office

3. 2023-2024 Performance

In the 2023-2024 reporting period, the PSC received a total of 75 requests under the Access to Information Act and the Privacy Act. This is a 4% decrease in overall volume received compared to the previous year. Excluding the limited surge in requests under the Privacy Act observed in 2015-2016 and 2016-2017, the overall number of requests received during the reporting period remains comparable to the average annual volume received by the PSC over the last 10 reporting periods.

3.1 Requests under the Privacy Act

From April 1, 2023, to March 31, 2024, the PSC received 35 requests under the Act, in addition to 1 request that was carried over from the previous period. This represents a 20% decrease in privacy requests received compared with the previous year.

The PSC closed 32 privacy requests during the reporting period. A total of 4,301 pages were reviewed, of which 2,405 were disclosed in whole or in part. At the end of the reporting period, 4 requests were still being processed and were carried forward to the next period.

These 32 requests touched on topics that tend to recur from year to year:

• 8 (25%) pertained to Human Resources files and job applications
• 5 (16%) pertained to Second Language Evaluation
• 4 (13%) were for other personal information held by the PSC
• 3 (9%) were for investigations conducted under the Public Service Employment Act
• 12 (38%) were requests for information not held by the PSC (these requestors received information to help them better direct their enquiries)

3.2 Disposition of requests completed

For the 32 requests closed during this reporting period, information was released in whole or in part in 12 cases, representing 38% of the total volume. Of the remaining requests, 10 were abandoned by the applicant (31%) and 10 produced no records (31%).

3.3 Exemptions and exclusions invoked

Sections 18 to 28 of the Act set out exemptions to protect information from disclosure. During the reporting period, the exemption used most often was to protect personal information of others (section 26).

No exclusions were invoked.

3.4 Completion time and extensions

Of the 32 requests closed during the reporting period:

• 23 (72%) were completed within 15 days
• 5 (16%) were completed within 30 days
• 4 (12%) required an extension and were completed within 31 to 60 days

All requests were closed within legislated timelines.

3.5 Format of information released

All information disclosed during the reporting period was provided in electronic format.

3.6 Inter-organizational consultations

The PSC received no requests for consultation on privacy requests from other government institutions during this reporting period, and none were carried over from the previous reporting period.

The PSC did not consult other government departments and agencies during this reporting period.

3.7 Informal requests

To improve and facilitate access, the PSC promotes informal methods of access whenever possible. Requestors may, in some cases, obtain access to their personal information on an informal basis by contacting the manager of the program area that controls the records. In these instances, the ATIP Office provides assistance and advice, as required.

No informal requests under the Act were received by the ATIP Office during the reporting period.

3.8. Active complaints

At the end of the reporting period, a total of 3 complaints against the PSC were active, carried over from previous years. One new complaint was accepted by the Office of the Privacy Commissioner and discontinued during the reporting period. An additional 4 complaints carried over from previous years were closed during the reporting period: 2 were deemed to be unfounded and 2 were deemed well-founded and subsequently resolved.

4. Summary of ATIP Office activities

4.1 Advice, training and awareness

Advice

In addition to processing requests under the Act, the ATIP Office advises PSC managers and employees on a variety of issues related to the Act.

During the reporting period, the ATIP Office responded to 71 internal consultation requests, which pertained mainly to:

• documents to be published on the Open Government Portal
• audit reports, responses to parliamentary questions and other documents to be reviewed prior to publication to make sure information is released in accordance with the Act
• Privacy Notice Statements

Training and awareness

The ATIP Office maintains a core training program for PSC supervisors and managers. The main goal of this training program is to ensure that supervisors and managers are fully aware of their responsibilities under the Act and related internal policies. Training sessions are held upon request or when situations arise that indicate a lack of knowledge or awareness.

The PSC continues to recommend that all employees complete the Canada School of Public Service’s self‑directed course Access to Information and Privacy Fundamentals (COR502).  

During the reporting period, the ATIP Office held a privacy awareness session for the summer cohort of students and a targeted privacy awareness session for a specific business line. In addition, it led 2 presentations on the new PIA development process.

In March 2024, the ATIP Office also implemented a three-week communications campaign published in the weekly employee bulletin in order to raise awareness to common privacy issues.

4.2 Policies, guidelines and procedures

In this reporting period, no policies, guidelines, procedures or other key documents were developed or updated by the ATIP Office. Work began on updating the PSC Privacy policy suite and is scheduled to be completed in 2024-2025.

4.3 Initiatives and projects to improve privacy

Case Management System

The PSC currently relies on AccessPro Case Management to track all requests. This tool is outdated and will need to be replaced in the near future. In consultation with TBS ATIP Digital Services, the ATIP Office has engaged with the Information Technology Services Directorate in Corporate Affairs Sector, to undertake the analysis required to choose a viable replacement option and to plan for potential deployment in the 2025-2026 fiscal year.

Review of documents

The ATIP Office regularly reviews documents prior to disclosure in order to identify personal information that may be involved. Moreover, the ATIP Office provides information, guidance and advice to the PSC to ensure compliance with the Act and associated policies. It also reviews and makes recommendations regarding personal information in memoranda of understanding and information-sharing agreements as well as administrative investigation reports (such as reports on violence or harassment in the workplace) prior to disclosure to the concerned parties. The recommendations aim to ensure compliance with the Act.

PIA development process

In response to feedback about the complexity and less-than-optimal process for developing PIAs, the ATIP Office connected with colleagues in other departments to discuss best practices and seek ways to improve the efficiency of processes at the PSC. It also looked to TBS guidance on PIAs. As a result, a new process was designed for drafting PIAs based on co-development principles and improved collaboration between program leads and the ATIP Office. This new process involved a simplified and annotated template and aims to rationalize the overall process and reduce dependency on specialized consultants.

4.4 Summary of key issues and actions taken on complaints

When a requestor alerts the PSC that they are unhappy with the response to their request, the ATIP Office takes measures to resolve the situation informally whenever possible, for example by conducting a new search or by disclosing additional records after supplemental analysis. Most complaints are resolved in this manner.

However, if requestors are not satisfied with the response provided to their request or with the PSC’s subsequent actions to resolve an informal complaint, they have the option to file an official complaint with the Office of the Privacy Commissioner. This recourse process and the related contact information are provided to requestors in the response letter sent at the close of each request.

4.5 Collection, use and disclosure of personal information

Personal information banks

The PSC currently has 21 active institution-specific personal information banks. During this reporting period, the ATIP Office collaborated with the Oversight and Investigations Sector to update personal information banks for the Investigations program. The PSC does not have any exempt banks.

Public Interest Disclosures

Subsection 8(2) of the Act describes the conditions in which personal information under the control of a government institution may be disclosed.

Paragraph 8(2)(e) of the Act applies to disclosures to designated investigative bodies for the purpose of enforcing the laws of Canada or a province, or to conduct lawful investigations. The PSC invoked this provision on a single occasion during the reporting period.

Paragraph 8(2)(m) of the Act applies to disclosures when, in the opinion of the head of the institution, reasons of public interest clearly outweigh any invasion of privacy that could result, or if the person concerned would clearly benefit from the disclosure. The PSC did not invoke this provision during the reporting period.    

4.6 Material Privacy breaches

No material privacy breaches occurred at the PSC during the reporting period.

4.7 Monitoring compliance

In order to ensure that all requests are handled in an appropriate manner, the PSC ATIP Office relies on software tools, namely AccessPro Case Management, to track all requests as they are received, analyzed and completed. For each request, information is input to document every step taken throughout processing, including any discussions with the requestor or with an office of primary interest (OPI) to clarify elements of the request. This process also allows for scheduling and monitoring of time taken to complete a request and to plan for any potential extensions. The ATIP Office assists the OPIs throughout the information retrieval process and takes steps to ensure timelines are met.

Employees of the ATIP Office meet regularly to discuss ongoing requests, and the Director, Sector Management and ATIP Coordination is briefed on workload and other related issues on a weekly basis.

Through internal consultation requests, the various programs of the PSC consult the ATIP Office on a range of issues relating to the protection of personal information, including pulse surveys, contracts and MOUs and investigation files. This process helps the PSC to meet its requirements under the Act and to protect the personal information it handles.

4.8 Privacy Impact Assessments

The TBS Directive on Privacy Impact Assessments came into effect in April 2010. The goal of the directive is to allow government institutions to identify whether a program or a service-delivery initiative involving the collection, use or disclosure of personal information, as defined in the Act, complies with privacy principles. PIAs also aim to avoid or mitigate any identifiable risks to privacy.

The ATIP Office provides advice and guidance to the PSC throughout the PIA production process, including the review of PIA reports and liaison with the Office of the Privacy Commissioner.

During the reporting period, the ATIP Office continued to support program leads on 3 assessments initiated during previous reporting periods:

• Personnel Psychology Centre PIA
• GC Jobs Transformation PIA
• Data Analytics Environment PIA

In addition, work was undertaken on a PIA for the PSC Self-Identification questionnaire. This initiative will be used to experiment with a new simplified PIA development process.

Annex A – Delegation Order

As President of the Public Service Commission, I confirm that the following reflects how my powers, duties and functions as the head of the government institution were delegated at the end of the reporting period (March 31, 2024).

Privacy Act – Delegation Order

The President of the Public Service Commission of Canada, as head of the government institution, hereby designates pursuant to section 73 of the Privacy Act (the Act), the persons holding the positions set out below, or the persons occupying on an acting basis those positions, to exercise the powers, duties or functions of the President vested in them by the Act.

This delegation is effective as of December 22, 2020.

Appendix A

Privacy Act

Privacy Regulations

Annex B – 2022–2023 Privacy Act Statistical Report

Name of institution: Public Service Commission of Canada

Reporting period: April 1, 2023 to March 31, 2024

Section 1: Requests Under the Privacy Act

1.1 Number of requests received

1.2 Channels of requests

Section 2: Informal requests

2.1 Number of informal requests

2.2 Channels of informal requests

2.3 Completion time of informal requests

2.4 Pages released informally

Section 3: Requests Closed During the Reporting Period

3.1 Disposition and completion time

3.2 Exemptions

3.3 Exclusions

3.4 Format of information released

3.5 Complexity

3.5.1 Relevant pages processed and disclosed for paper and e-record formats

3.5.2 Relevant pages processed by request disposition for paper and e-record formats by size of requests

3.5.3 Relevant minutes processed and disclosed for audio formats

3.5.4 Relevant minutes processed and disclosed for audio formats by size of requests

3.5.5 Relevant minutes processed and disclosed for video formats

3.5.6 Relevant minutes processed per request disposition for video formats by size of requests

3.5.7 Other complexities

3.6 Closed requests

3.6.1 Number of requests closed within legislated timelines

3.7 Deemed refusals

3.7.1 Reasons for not meeting legislated timelines

3.7.2 Requests closed beyond legislated timelines (including any extension taken)

3.8 Requests for translation

Section 4: Disclosures Under Subsections 8(2) and 8(5)

Section 5: Requests for Correction of Personal Information and Notations

Section 6: Extensions

6.1  Reasons for extensions and disposition of requests

6.2 Length of extensions

Section 7: Consultations Received From Other Institutions and Organizations

7.1 Consultations received from other Government of Canada institutions and other organizations

7.2 Recommendations and completion time for consultations received from other Government of Canada institutions

7.3 Recommendations and completion time for consultations received from other organizations outside the Government of Canada

Section 8: Completion Time of Consultations on Cabinet Confidences

8.1 Requests with Legal Services

8.2 Requests with Privy Council Office

Section 9: Complaints and Investigations Notices Received

Section 10: Privacy Impact Assessments (PIA) and Personal Information Banks (PIB)

10.1 Privacy Impact Assessments

10.2 Institution-specific and Central Personal Information Banks

Section 11: Privacy Breaches

11.1 Material Privacy Breaches reported

11.2 Non-Material Privacy Breaches

Section 12: Resources Related to the Privacy Act

12.1  Allocated Costs

12.2  Human Resources

Annex C – Supplemental Statistical Report on the Access to Information Act and the Privacy Act

Name of institution: Public Service Commission of Canada

Reporting period: April 1, 2023 to March 31, 2024

Section 1: Open Requests and Complaints Under the Access to Information Act

1.1 Enter the number of open requests that are outstanding from previous reporting periods.

1.2 Enter the number of open complaints with the Information Commissioner of Canada that are outstanding from previous reporting periods.

Section 2: Open Requests and Complaints Under the Privacy Act

2.1 Enter the number of open requests that are outstanding from previous reporting periods.

2.2 Enter the number of open complaints with the Privacy Commissioner of Canada that are outstanding from previous reporting periods.

Section 3: Social Insurance Number

Section 4: Universal Access Under the Privacy Act