Annual Report on the Administration of the Privacy Act 2024-2025

Table of Contents

• Introduction
• 1. About the Public Service Commission of Canada
  • 1.1 Raison d’être
  • 1.2 Mandate and role
  • 1.3 Programs
• 2. Organizational structure
• 3. Delegation Order
• 4. 2024-2025 Performance
  • 4.1 Requests under the Privacy Act
  • 4.2 Disposition of requests completed
  • 4.3 Completion time and extensions
  • 4.4 Format of information released
  • 4.5 Consultations
  • 4.6 Active complaints
• 5. Training and awareness
• 6. Policies, guidelines and procedures
• 7. Initiatives and projects to improve privacy
• 8. Summary of key issues and actions taken on complaints
• 9. Material Privacy breaches
• 10. Privacy Impact Assessments
• 11. Public Interest Disclosures
• 12. Monitoring compliance
• Annex A – Delegation Order

Introduction

The Privacy Act (the Act) came into force on July 1, 1983. The Act provides the legal framework for the collection, retention, use, disclosure, disposition, and accuracy of personal information in the administration of programs and activities by federal government institutions. It also provides Canadian citizens and permanent residents with a right of access to, and correction of, their own personal information under the control of a federal institution with certain specific and limited exceptions.

Section 72 of the Act requires that the head of every federal government institution prepare an annual report, for submission to Parliament, on the administration of the Act within the institution. The report must be tabled before each House of Parliament within the first 15 sitting days of the parliamentary session after September 1.

Prepared and tabled in Parliament in accordance with section 72 of the Act, this annual report provides a summary of the administration of the Act by the Public Service Commission of Canada for the 2024–2025 fiscal year.

This report is also available on the Publications page of the Public Service Commission of Canada’s website.

1. About the Public Service Commission of Canada

1.1 Raison d’être

The President of the King’s Privy Council for Canada is identified as the appropriate minister for the Public Service Commission of Canada (PSC) in accordance with the Financial Administration Act. The PSC reports independently on its mandate to Parliament.

Through collaboration with departments and agencies, the PSC is dedicated to building tomorrow’s public service that is based on excellence and is representative of Canada’s diversity. It safeguards non-partisanship and promotes and protects merit and the use of both official languages in a staffing and recruitment context. It supports departments and agencies in recruiting talented people from coast to coast using innovative and modern services, tools, and practices.

1.2 Mandate and role

Under the delegated staffing system set out in the Public Service Employment Act, the PSC fulfills its mandate by promoting and safeguarding a non-partisan, merit-based and representative public service that serves all Canadians. It does this by:

• supporting departments and agencies in hiring qualified individuals into and within the public service
• overseeing and ensuring the integrity of public service hiring
• protecting the non-partisan nature of the public service while respecting employees’ rights to participate in political activities
• delivering recruitment programs and assessment services

1.3 Programs

As per the Service Inventory, the PSC delivers services via 3 programs, with support from Internal Services, all of which support the delivery of its departmental results.

Policy Direction and Support

The Policy Direction and Support Program exists to support departments and agencies in hiring qualified individuals into and within the public service, in experimenting and innovating with their staffing approaches and supporting strategies to help them both meet their business needs and achieve their diversity and employment equity objectives. This program establishes government-wide direction on staffing through regulations and policy and provides guidance to organizations to enable legislative, regulatory and policy compliance. It also assesses public servants' requests for permission to become candidates for elected office and conducts outreach to ensure public servants know their legal rights and responsibilities regarding political activities.

Recruitment and Assessment Services

The Recruitment and Assessment Services Program supports departments and agencies in the hiring of qualified individuals into and within the public service, helping to shape a workforce reflecting Canada’s diversity. This includes the delivery of recruitment programs, student programs, assessment and accommodation services, and the administration of legislated priority entitlements. Through outreach and the use of modern tools, online systems, and technology, the program reduces barriers for Canadians accessing public service jobs. It also collaborates with departments and agencies to create and implement innovative staffing and assessment approaches to meet the Government of Canada’s strategic recruitment priorities and renew the public service.

Oversight and Monitoring

The Oversight and Monitoring Program supports the integrity of the merit-based public service hiring process and helps identify areas for continuous improvement of the public service. The program performs audits and investigations and conducts surveys to monitor organizational compliance with staffing legislation, regulations, policies, and to provide a system-wide view of the public service staffing environment. This program also monitors and analyzes hiring data and conducts research to provide departments and agencies, and Canadians, with an informed view of the dynamics of public service hiring.

Internal Services

Internal services are groups of related activities and resources that are administered to support the needs of programs and other corporate obligations of an organization. These groups are: Acquisitions, Communications Services, Financial Management, Human Resources Management, Information Management, Information Technology, Legal Services, Management and Oversight Services, Material, Real Property, and Travel and Other Administrative Services.

2. Organizational structure

The PSC has a stable and effective Access to Information and Privacy (ATIP) program. The ATIP Office works closely with PSC employees to make sure all requests are handled on time. It relies on open communication with PSC sectors, government organizations, third parties and requestors to ensure optimal application of the Act.

ATIP Office

Housed in the Chief Financial Officer and Vice-President’s Office of the Corporate Affairs Sector, in the National Capital Region, the ATIP Office supports the Director, Sector Management and ATIP Coordination (the Director) in administering the provisions of the Act and related Treasury Board Secretariat (TBS) policies for the PSC.

During the reporting period, the ATIP Office was composed of a Manager, a Senior Advisor, an analyst and a junior analyst. There was no change to the composition of the ATIP Office team in 2024-2025.

In addition to receiving and processing requests made under the Act, the ATIP Office is responsible for:

• developing and offering training and awareness sessions to employees to ensure they understand their roles, responsibilities and obligations under the Act
• providing support to sector liaison officers
• administering the departmental privacy protection program, which includes the provision of advice and the development of Privacy Impact Assessments (PIAs) and other privacy compliance documents (e.g. privacy notice statements)
• monitoring the PSC’s compliance with the Act, regulations and other relevant policies and directives
• responding to consultation requests submitted by other government institutions with respect to PSC documents
• preparing the Annual Report to Parliament on the administration of the Act and other statutory reports, as well as other material that may be required by central agencies
• developing, reviewing and implementing effective guidelines, systems and procedures that ensure requests are processed as required under the Act and as directed by TBS policies and directives.

The PSC was not party to any service agreements, new or pre-existing, for ATIP services with other government institutions during the reporting period.

Liaison Officers

The ATIP Office processes requests with the help of liaison officers, who are employees across the organization with extensive knowledge of their respective sector’s activities, which enables them to act as the point of contact between their area and the ATIP Office. There is a liaison officer for each sector of the PSC, as well as for the Corporate Secretariat and the Office of the Chief Audit and Evaluation Executive.

Liaison officers play an important role in making sure the PSC thoroughly searches its information holdings when handling requests, by:

• assigning program experts to search for relevant records
• advising if other groups in the PSC could have relevant information
• informing the ATIP Office of any issues regarding specific requests (delays, interference with operations, need to consult)
• delivering relevant records, with any recommendations about disclosure, to the ATIP Office

3. Delegation Order

The President of the PSC is designated as the head of the institution for the administration of the Act. Pursuant to section 73 of the Act, the President has delegated full powers, duties and functions under the Act to the Chief Financial Officer and Vice-President, Corporate Affairs and to the Director, Sector Management and ATIP Coordination (as the designated ATIP Coordinator for the PSC). Partial delegation is also provided to the ATIP Manager, who has operational responsibility for the application of the Act.

The signed and dated delegation order that was in effect at the end of the reporting period is available in Appendix A.

4. 2024-2025 Performance

In the 2024-2025 reporting period, the PSC received a total of 60 requests under the Access to Information Act and the Privacy Act. This is a 20% decrease in overall volume received compared to the previous year. Generally speaking, volume has remained fairly consistent over the past 5 reporting periods.

4.1 Requests under the Privacy Act

From April 1, 2024, to March 31, 2025, the PSC received 33 requests under the Act, in addition to 4 requests that were carried over from the previous period. This represents a 6% decrease in privacy requests received compared with the previous year.

The PSC closed 33 privacy requests during the reporting period. A total of 26,568 pages were reviewed, of which 6,934 were disclosed in whole or in part. At the end of the period, 4 requests received during the year were still being processed and were carried over within legislated timelines.

4.2 Disposition of requests completed

Of the 33 requests closed during this reporting period:

• 11 resulted in full disclosure of information
• 9 resulted in partial disclosure of information
• 3 produced no relevant records
• 10 were abandoned

4.3 Completion time and extensions

Of the 33 requests closed during the reporting period:

• 11 (33%) were completed within 15 days
• 15 (45%) were completed within 30 days
• 5 (15%) were completed within 31 to 60 days
• 2 (6%) were completed within 61 to 120 days

All requests were closed within legislated timelines, but 7 required extensions under section 15 of the Act. The 2 requests completed in more than 60 days are deemed to have been closed within legislated timelines because the due date fell on a weekend or statutory holiday and the requests were closed on the following business day.

4.4 Format of information released

All information released during the reporting period was provided in electronic format.

4.5 Consultations

The PSC received no requests for consultation under the Act from other government institutions during this reporting period, and none were carried over from the previous reporting period.

4.6 Active complaints

During the 2024-2025 reporting period, 1 new complaint against the PSC was registered with the OPC. This complaint was closed at the early resolution stage by the OPC, who made no findings.

At the close of the reporting period, there were no active complaints pending against the PSC.

For more information on key issues and actions taken on complaints, see section 8.

5. Training and awareness

The ATIP Office develops and offers privacy-related training for PSC supervisors and managers. The main goal of this training is to ensure that supervisors and managers are fully aware of their responsibilities under the Act and relevant policies. Training sessions are held upon request or when situations arise that indicate a lack of knowledge or awareness (for example, privacy breaches due to human error).

The PSC continues to promote the Canada School of Public Service’s self‑directed course Access to Information and Privacy Fundamentals (COR502) for all employees.

During the reporting period, the ATIP Office offered a privacy awareness session for the summer cohort of students and held 2 targeted privacy awareness sessions for program areas involved in privacy breaches.

6. Policies, guidelines and procedures

During the reporting period, the ATIP Office began a review of its entire suite of directives and procedures. Existing instruments were implemented in 2010 and do not reflect all changes made to legislation and to TBS policies and directives in recent years nor do they accurately address the increasingly digital environment.

The work undertaken in 2024-2025 will streamline the PSC Privacy Management Framework and position the PSC to continue ensuring the protection and efficient handling of personal information. This work is also expected to help identify areas where artificial intelligence could be leveraged to further increase efficiency and support compliance with the Act.

It is expected that the work will be completed and that the new instruments will be implemented in 2025-2026.

7. Initiatives and projects to improve privacy

Request Processing Software Solution

During the reporting period, the PSC collaborated with internal IT and Procurement experts to undertake acquisition of a new request processing software solution to replace the aging AccessPro system. The ATIP Office relies on such technology to ensure the processing and tracking of all ATIP-related files, including requests made under the Act. The PSC has chosen ATIPXpress, and deployment is expected in the 2025-2026 fiscal year.

8. Summary of key issues and actions taken on complaints

When a requestor alerts the PSC that they are unhappy with the response to their request, the ATIP Office takes measures to resolve the situation informally whenever possible, for example by conducting a new search or by disclosing additional records after supplemental analysis. Most complaints are resolved in this manner.

However, if requestors are not satisfied with the response provided to their request or with the PSC’s subsequent actions to resolve an informal complaint, they have the option to file an official complaint with the Office of the Privacy Commissioner (OPC). This recourse process and the related contact information are provided to requestors in the response letter sent at the close of each request.

Upon notification that a complaint has been received by the OPC, the PSC ATIP Office collaborates with investigators to make representations and provide relevant documentation and commits to incorporating any lessons learned into its processes. If the PSC is able to meet the requestor’s needs before the OPC reaches a finding, the OPC notifies the requestor that the complaint is deemed resolved and ceases to investigate.

During the reporting period, the OPC closed a total of 4 complaints registered against the PSC (3 pending since 2022-2023 and 1 registered in 2024-2025):

9. Material Privacy breaches

No material privacy breaches occurred at the PSC during the reporting period.

10. Privacy Impact Assessments

The TBS Directive on Privacy Protection was updated in the Fall 2024, including its Standard on Privacy Impact Assessments which came into effect on October 9, 2024. The updated directives aims “to facilitate the implementation and public reporting of consistent and sound privacy management practices for the protection of personal information throughout its life cycle, which includes the creation, collection, retention, use, disclosure and disposal of personal information under the control of government institutions, whether the information is held by the institution or by a third party acting under contract, information-sharing agreement or information-sharing arrangement with the institution”.

The ATIP Office works in close collaboration with business areas to support the development of PIAs. This includes providing advice and guidance throughout the analysis and production process, liaising with TBS and the Office of the Privacy Commissioner, documenting decisions about privacy considerations, and providing recommendations on whether a PIA should be initiated or updated.

No PIAs were completed during the reporting period. However, the ATIP Office continued to support program leads on 2 assessments initiated during previous reporting periods:

• Data Analytics Environment PIA
• PIA for Equity Seeking Groups Data Collection

A PIA on the GC Jobs Transformation project was put on hold pending decision about the future of the project.

11. Public Interest Disclosures

Subsection 8(2) of the Act describes the conditions in which personal information under the control of a government institution may be disclosed.

Paragraph 8(2)(m) of the Act applies to disclosures when, in the opinion of the head of the institution, reasons of public interest clearly outweigh any invasion of privacy that could result, or if the person concerned would clearly benefit from the disclosure. The PSC invoked this provision on a single occasion during the reporting period and notified the OPC as required.

12. Monitoring compliance

The PSC ATIP Office relies on software tools and trackers to monitor all requests as they are received, analyzed and completed. This allows for the scheduling and monitoring of time required to complete a request and to anticipate the potential need for extensions. The ATIP Office assists the OPIs throughout the information retrieval process and ensures timelines are met by setting clear deadlines and making regular follow-ups and reminders.

Employees of the ATIP Office meet regularly to discuss ongoing requests and to ensure that the processing of requests is meeting scheduled milestones, and the Director is briefed on workload and other related issues on a weekly basis. This workflow contributes to ensuring that legislated timelines are met consistently.

The ATIP Office also works in close collaboration with PSC program areas to proactively ensure that privacy requirements are reflected in contracts, MOUs, and information and data sharing agreements. The ATIP Office reviews document drafts upon request and provides feedback on any privacy considerations, helps program areas in developing privacy notices and clauses, and offers expert advice during PSC governance meetings.

Annex A – Delegation Order

*Due to a technical issue, the date of signature on the English version of the delegation order is different from the French version. The order was in effect as of March 28, 2025.

Privacy Act – Delegation Order

The President of the Public Service Commission of Canada, pursuant to section 73 of the Privacy Act (the Act), hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the President as the head of the Public Service Commission, under the provisions of the Act and related regulations set out opposite each position. This designation replaces all previous delegation orders.

Copyright information

Information contained in this publication or product may be reproduced, in part or in whole, and by any means, for personal or public non-commercial purposes without charge or further permission, unless otherwise specified. Commercial reproduction and distribution are prohibited except with written permission from the Public Service Commission of Canada.

For more information, contact
Public Service Commission of Canada
22 Eddy Street
Gatineau (Quebec) K1A 0M7

Email: cfp.infocom.psc@cfp-psc.gc.ca
Website of publisher: https://www.canada.ca/en/public-service-commission.html

© His Majesty the King in Right of Canada, as represented by the President of the Public Service Commission of Canada, 2025

Cat No SC1-20E-PDF (Electronic PDF, English)
ISSN 2819-7399