Privacy Act Annual Report - April 1, 2013, to March 31, 2014

Table of contents

• Introduction
  • Additional copies
• Part I — General information on the Public Service Commission
  • 1.1 Raison d'être and mandate
  • 1.2 Strategic Outcome and Program Alignment Architecture
• Part II — Report on the Privacy Act
  • 1. Organization of delegation and activities
    • 1.1 Delegation order
    • 1.2 The Access to Information and Privacy Coordinator
    • 1.3 The Access to Information and Privacy Office
    • 1.4 Liaison officers
  • 2. Summary of Access to Information and Privacy Office activities
    • 2.1 Development of policies, directives, guidelines and other key documents
    • 2.2 Management Accountability Framework
    • 2.3 Internal advice and training
    • 2.4 Tracking system and imaging software
    • 2.5 Collection, use and disclosure of personal information
  • 3. Statistical report: Interpretation
    • 3.1 Requests under the Act
    • 3.2 Nature of requests
    • 3.3 Inter-organizational consultations
    • 3.4 Informal review of information
    • 3.5 Disposition of requests completed
    • 3.6 Exemptions invoked
    • 3.7 Exclusions invoked
    • 3.8 Extension of time limits
    • 3.9 Completion time
    • 3.10 Translation
    • 3.11 Method of access
    • 3.12 Corrections and notations
    • 3.13 Costs
  • 4. Complaints
    • 4.1 Number of complaints
    • 4.2 Nature of complaints
    • 4.3 Complaints closed
  • 5. Privacy impact assessments
• Appendix A – Delegation Instrument
• Appendix B - Historical Comparisons
• Appendix C – 2013-2014 Annual Privacy Act Statistical Report

Introduction

The Privacy Act (R.S., 1985, c. P-21) was proclaimed on July 1, 1983.

The Privacy Act (the “Act”) gives individuals the right to access information about them that is held by the government. This is, however, subject to specific and limited exceptions.

The Act also protects individuals' privacy by preventing others from accessing their personal information and by giving them substantial control over the collection, use and disclosure of personal information.

Section 72 of the Act requires that the head of every federal government institution prepare an Annual Report, for submission to Parliament, on the administration of the Act within the institution. Every report shall be laid before each House of Parliament within three months after the financial year in respect of which it is made or, if that House is not then sitting, on any of the first 15 days next thereafter that it is sitting.

This Annual Report provides a summary of the management and administration of the Act within the Public Service Commission of Canada (PSC) for the fiscal year 2013-2014.

Additional copies

Additional copies of this report may be obtained by writing to:

Access to Information and Privacy Office
Public Service Commission of Canada
22 Eddy Street
Gatineau QC
K1A 0M7

Or at CFP.AIPRP-ATIP.PSC@cfp-psc.gc.ca

Or by calling 819-420-6561 (fax: 819-420-6552)

The PSC’s Privacy Act Annual Report is also available on the PSC web site.

Part I – General information on the Public Service Commission^{Footnote 1} 

1.1 Raison d'être and mandate

Raison d'être

The Public Service Commission (PSC) is dedicated to building a public service that strives for excellence. The PSC protects merit and non-partisanship and the use of both official languages in a staffing context, while ensuring respect for the values of fairness, access, transparency and representativeness.

The PSC recruits talented Canadians to the public service. The PSC continually renews its recruitment services to meet the needs of a modern and innovative public service. The PSC also helps the public service retain and redeploy experienced and skilled employees with priority entitlement whose jobs have been affected by public service downsizing or for other reasons, for example, former members who have been medically released from the Canadian Forces.

Responsibilities

The PSC is responsible for promoting and safeguarding merit-based appointments that are free from political influence and, in collaboration with other stakeholders, for protecting the non-partisan nature of the public service. It reports independently on its mandate to Parliament.

The PSC is mandated to:

• Appoint, or provide for the appointment of, persons to and from within the public service, based on merit and free from political influence. The Public Service Employment Act (PSEA) allows the PSC to delegate to deputy heads its authority for making appointments, subject to certain terms and conditions. This authority is currently delegated to 82 deputy heads subject to the PSEA, across the federal government;
• Administer the provisions of the PSEA that are related to the political activities of employees and deputy heads. Part 7 of the PSEA recognizes the right of employees to engage in a political activity, while maintaining the principle of political impartiality in the public service. It also sets out specific roles and responsibilities for employees and the PSC related to political activities and the administration of the related political activities regime; and
• Oversee the integrity of the staffing system and ensure non-partisanship. This oversight role includes: The ongoing monitoring of the staffing performance of delegated organizations, the conduct of audits that provide an independent assessment of the performance and management of staffing activities and, the conduct of investigations of staffing processes and improper political activities by public servants.

1.2 Strategic Outcome and Program Alignment Architecture

The PSC Program Alignment Architecture consists of one strategic outcome and four programs.

Program 1.1.0
Staffing System Integrity and Political Impartiality

The Staffing System Integrity and Political Impartiality program is focused on independently safeguarding merit and non-partisanship in the federal public service. This program includes developing and advancing strategic policy positions and directions; conducting policy research; establishing PSC policies and standards; providing advice, interpretation and guidance; and administering delegated and non-delegated authorities, including official languages, the political activities regime and  Priority Administration.

Program 1.2.0
Staffing Services and Assessment

The Staffing Services and Assessment program maintains the systems that link Canadians and public servants seeking employment opportunities in the federal public service with hiring departments and agencies. It provides assessment-related products and services in the form of research and development, consultation, assessment operations and counselling for use in recruitment, selection and development throughout the federal public service. This program also includes delivering staffing services, programs and products to departments and agencies, to Canadians and to public servants.

Program 1.3.0
Oversight of Integrity in Staffing and of Non-partisanship

The Oversight of Integrity in Staffing and of Non-partisanship program provides an accountability regime for the implementation of the appointment policy. It also provides a regulatory framework for safeguarding the integrity of public service staffing and ensuring that staffing is free from political influence. This program includes monitoring departments’ and agencies’ staffing performance and compliance with legislative requirements, conducting audits and studies, carrying out investigations and reporting to Parliament on the integrity of public service staffing and the non-partisanship of the public service.

Program 2.1.0
Internal Services

The Internal Services program enables the PSC to operate more efficiently and effectively. At the PSC, consistent with other government departments and agencies, Internal Services consists of three program sub-groups: Governance and management support, comprised of governance, communications and legal services; resource management services, including human resource management, financial management, information management, information technology, travel and other administrative services; and asset management services, consisting of real property, materiel and acquisition services.

Part II — Report on the Privacy Act

1. Organization of delegation and activities

1.1 Delegation order

Under section 3 of the Privacy Act (the “Act”), the President of the PSC is designated as the head of the government institution for purposes of the administration of the Act.

Pursuant to section 73 of the Act, deputy heads may delegate any of their powers, duties or functions under the Act by signing an order authorizing one or more officers or employees of the institution, who are at the appropriate level, to exercise or perform the powers, duties or functions of the head specified in the order.

The powers, duties and functions of the president, under the Act, are delegated to the corporate secretary, Corporate Secretariat, who is the PSC’s Access to Information and Privacy (ATIP) coordinator (see Appendix A – Delegation Instrument).

1.2 The Access to Information and Privacy Coordinator

The ATIP coordinator is responsible and accountable for the development, coordination and implementation of effective policies, guidelines, systems and procedures to enable the efficient processing of requests under the Act.

The coordinator is also responsible for the development, coordination and implementation of policies, systems and procedures that are required by the Act or Treasury Board (TB) directives and policies. The activities of the coordinator include:

• Processing requests made under the Act;
• Acting as spokesperson for the PSC in dealings with the Treasury Board of Canada Secretariat, the Office of the Privacy Commissioner and other government departments and agencies on matters related to the Act;
• Responding to consultation requests submitted by other federal institutions;
• Reviewing information collection in accordance with the Government Policy on Information Collection and Public Opinion Research;
• Preparing the Annual Report to Parliament and other statutory reports, as well as other material that may be required by central agencies;
• Developing policies, procedures and guidelines for the orderly implementation of the Act by the PSC;
• Promoting awareness and providing advice to PSC employees to ensure responsiveness to the obligations of the Act, TB policies and their impact on various program initiatives; and
• Monitoring PSC compliance with the Act, regulations and relevant procedures and policies.

1.3 The Access to Information and Privacy Office

The Access to Information and Privacy (ATIP) Office administers the provisions of the Act for the PSC. The manager of the ATIP Office reports to the ATIP coordinator who is accountable directly to the President of the PSC. The ATIP Office operates with one analyst to manage the requests received. The analyst is responsible for processing Privacy Act and consultation requests and supporting the preparation of responses to complaints. The analyst is also responsible for coordinating reviews of the PSC’s Info Source chapter.

During the course of this reporting period, the Corporate Secretariat hired a consultant to assist the ATIP Office with the processing of official requests. The Office also received ad hoc support from the Corporate Secretariat for updating Info Source, preparing reports, and scanning and entering data.

The ATIP Office Intranet site is updated on a regular basis and is the primary vehicle for communicating with PSC employees. In addition, the ATIP Office delivers training sessions for PSC employees.

The ATIP Office also reviews office procedures to improve the support it provides to its branch liaison officers and promote a better understanding of their role, responsibilities and obligations related to the processing of requests under the Act.

1.4 Liaison officers

The ATIP Office processes requests with the assistance of liaison officers. There are liaison officers for each program activity. They include the following:

• Appointment integrity and political impartiality (one liaison officer);
• Oversight of integrity in staffing (two liaison officers);
• Staffing and assessment services (one liaison officer); and
• Internal services (one liaison officer).

2. Summary of Access to Information and Privacy Office activities

2.1 Development of policies, directives, guidelines and other key documents

The PSC started working on a procedure/guidance document on how to process privacy requests in relation to investigations conducted under the Public Service Employment Act (PSEA), as well as a review of the Privacy Breach Policy. Both initiatives should be completed over the course of the next reporting period.

2.2 Management Accountability Framework

Information management and the ATIP program were not subject to Management Accountability Framework review over the course of the reporting period.

2.3 Internal advice and training

Internal Advice

In addition to processing Access to Information Act and Privacy Act requests, the ATIP Office received 207 requests for advice from PSC managers and employees, as well as from other organizations regarding a variety of issues and questions related to both Acts.

The ATIP Office was also involved in PSC initiatives such as:

• Providing advice on project initiation forms, such as threat and risk assessments, statements of sensitivity and risk analysis and impact documents;
• Answering questions related to the protection of personal information in Memoranda of Understanding, information sharing agreements and contracts;
• Assisting program areas in the drafting of privacy notice statements; and
• Reviewing audit reports and other documents prior to publication to ensure that personal information is released in accordance with the Act.

The ATIP coordinator is also a member of the PSC Executive Management Committee and sub-committees and offers them advice related to access, privacy and the protection of personal information.

Training

The ATIP Office provided six training sessions to 34 PSC employees and managers on the provisions of the Access to Information Act and the Privacy Act and their impact on programs and initiatives.

In addition, the ATIP liaison working group met four times during the reporting period to discuss best practices, address gaps and provide training opportunities.

2.4 Tracking system and imaging software

During the reporting period, the ATIP Office continued to use the AccessPro Case Management and AccessPro Redaction software and upgraded to the newest version available.

2.5 Collection, use and disclosure of personal information

2.5.1 Personal Information Banks

Personal Information Bank (PIB) descriptions were created and/or updated for Info Source.

During this reporting period, the PSC reviewed its 74 PIBs to ensure that they were aligned with its Program Alignment Architecture.

Statutory and Regulatory Priorities: This PIB is currently being updated in order to reflect changes in the Priority Information Management System and reporting requirements. A Privacy Impact Assessment (PIA) is in progress.

2.5.2 Exempt banks

The PSC does not have any exempt banks. There were no denials of access under subsection 18(2) of the Act.

2.5.3. Disclosure under section 8(2)(m) of the Act

Personal information under the control of a government institution should not, without the consent of the individual to whom it relates, be disclosed by the institution except in accordance with subsection 8(2) of the Act.

Subsection 8(2) indicates that, subject to any other act of Parliament, personal information under the control of a government institution may be disclosed pursuant to the exceptions specified in applicable paragraphs 8(2)(a) to 8(2)(m) of the Act.

Paragraph 8(2)(m) of the Act concerns cases where, in the opinion of the head of the institution, the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure or where disclosure would clearly benefit the individual to whom the information relates.

In the reporting period, the PSC did not release any information under paragraph 8(2)(m) of the Act.

2.5.4 Review of documents

The ATIP Office regularly reviews certain documents prior to disclosure or to project implementation in order to identify personal information that may have been included. These reviews also ensure that proper procedures for their release are followed and support the provisions of the Act.

Audit reports

The ATIP Office reviewed six audit reports over the course of the reporting period.

Project Initiation Forms

In 2013-2014, the ATIP Office also routinely reviewed informatics technology Project Initiation Forms (PIF) and statements of sensitivities to:

• Ensure privacy requirements are addressed in new technology initiatives;
• Determine if there are requirements for a PIA; and
• Ensure that PIBs provide proper descriptions.

The ATIP Office closed two PIFs over the course of the reporting period, leaving seven active ones. Most of these are related to the technical aspects of the PSC’s office move from Ottawa to Gatineau, while others deal with Government of Canada initiatives such as Voice over Internet Protocol and e-mail transformation.

Privacy Notice Statements and contract clauses

The ATIP Office reviewed and provided advice regarding updates to six Privacy Notice Statements. No privacy/security contract clauses were reviewed over the course of this reporting period.

Memoranda of Understanding and statistical studies

The ATIP Office reviewed one Memorandum of Understanding and one statistical study during the reporting period.

3. Statistical report: Interpretation

3.1 Requests under the Act

The PSC received 18 requests under the Act and processed 4 160 pages of information during the reporting period. There were three requests outstanding from the 2012-2013 reporting period, for a total of 21 requests.

The PSC completed its response to 19 of the 21 requests during the reporting year and carried forward two requests into the 2014-2015 reporting period.

For a historical comparison of requests received and responses completed, see Appendix B.

3.2 Nature of requests

As in previous years, the 19 closed requests covered the entire gamut of PSC activities:

• Twelve requests (63%) related to staffing activities. For the most part, they were from individuals seeking personal information and/or test results (including second language evaluation) obtained during selection processes;
• Six requests (32%) were from individuals seeking information about themselves contained in PSC records; and
• One request (5%) was from someone seeking information related to investigations conducted under the Public Service Employment Act (PSEA).

3.3 Inter-organizational consultations

The PSC received eight requests for privacy consultations from other government organizations. The processing of these requests required the review of 298 pages of information. The PSC determined that of the eight requests, the information pertaining to the PSC could be released:

• In full for four requests;
• In part for one request; and
• Exempted three requests.

The requests for consultation pertained to the PSEA and to information on staffing assessment results and investigations.

The PSC consulted other government departments and agencies to process 5 of the 19 closed requests.

3.4 Informal review of information

In an attempt to increase and facilitate access, the PSC informally reviews as many requests for information as possible. Requesters may obtain access to their personal information on an informal basis by contacting the manager of the program area that controls the records. In these instances, the ATIP Office provides assistance and advice, as required.

The ATIP Office did not receive any such requests during the reporting period.

3.5 Disposition of requests completed

For the 19 closed requests, information was released either in whole or in part in 17 cases (89%).

3.5.1 All disclosed

In five of the 19 completed cases (26%), the applicants were provided with full access to the relevant records.

3.5.2 Disclosed in part

Based on the exemptive and exclusionary provisions of the Act, the PSC provided applicants with partial access in 12 of the 19 completed cases (63%).

3.5.3 Nothing disclosed (exemption or exclusion)

No request was entirely exempted or excluded under the provisions of the Act.

3.5.4 Unable to process

The PSC was unable to process two requests (11%) for lack of records.

3.5.5 Abandoned by the Applicant

There were no requests abandoned by the applicant.

3.5.6 Transferred

The PSC did not have any requests transferred to another government institution.

3.6 Exemptions invoked

Individuals’ right of access to their personal information under the Act is limited by a number of exemptions specified in sections 18 through 28 of the legislation.

During the reporting period, the PSC invoked exemptions under:

• Section 22(1)(b) in one request;
• Section 26 in nine requests; and
• Section 27 in five requests.

For a historical comparison of exemptions invoked, see Appendix B.

3.7 Exclusions invoked

Pursuant to section 69, the Act does not apply to material that is published or available for purchase, library or museum material preserved solely for public record, material deposited with Library and Archives Canada or records considered to be confidences of the Queen's Privy Council of Canada, pursuant to section 70 of the Act.

During the reporting period, no exclusions were invoked by the PSC under sections 69 or 70.

3.8 Extension of time limits

Of the 19 closed requests, the PSC used a “30 day or under” extension in seven instances, in accordance with section 15 of the Act. Interference with operations and consultations were among the reasons for the extensions.

3.9 Completion time

Of the 19 closed requests, the PSC responded to 12 within 30 days or less, representing 63% of all the requests completed. Five (26%) were completed within 31 to 60 days and two (11%) within 180 days.

Overall, the PSC was successful in responding to 89% of requests within the allowable time limits.

3.10 Translation

The PSC did not receive any requests for translation of information.

3.11 Method of access

For 17 completed responses in which information was released, the applicants received copies of the information on paper in 12 cases, electronically in 3 instances and in other formats in 2.

3.12 Corrections and notations

The PSC received one request for the correction of personal information under section 12(2) of the Act. The PSC was unable to process this request because the requester did not provide enough information.

3.13 Costs

The total salary cost associated with the privacy program was $122,043. The total operations and maintenance cost was $28,041, for a combined total of $150,084.

The associated full-time equivalent resources were estimated at two (both dividing their work between Access to Information and Privacy files), and at two for part-time for the reporting period.

4. Complaints

4.1 Number of complaints

The Office of the Privacy Commissioner (OPC) received six complaints regarding the Privacy Act requests presented to the PSC during the reporting period. Four complaints were carried over from the 2012-2013 reporting period, for a total of 10.

4.2 Nature of complaints

One applicant filed four of the six complaints received, which dealt with refusal of access and allegations of missing records. The other two complaints were from a second individual who contested the refusal of a correction request and alleged that personal information was improperly disclosed.

Of the four complaints carried over from the previous year, two related to allegations concerning missing records and refusal of access, while the others dealt with allegations of unauthorized disclosure of personal information related to investigations conducted under the PSEA.

4.3 Complaints closed

During the 2013-2014 reporting period, one complaint was closed (it was considered founded by the OPC), leaving nine outstanding at the end of the year.

5. Privacy impact assessments

The Treasury Board of Canada’s Privacy Impact Assessment Policy (PIA) came into effect in May 2002 and was replaced by the Directive on Privacy Impact Assessment in April 2010. The goal of the policy is to allow government institutions to identify whether a program or a service delivery initiative involving the collection, use or disclosure of personal information, as defined in the Act, complies with privacy principles. The PIA also aims to avoid or mitigate any identifiable risks to privacy. The ATIP Office provides advice and guidance to PSC managers throughout the PIA process, including the review of PIA reports and liaison with the OPC.

Although no PIA was completed during the reporting period, the ATIP Office supported two PSC programs in which PIAs were at different stages of completion.

Appendix A – Delegation Instrument

Privacy Act – Delegation Order

The President of the Public Service Commission of Canada, as head of the government institution, hereby designates Pursuant to section 73 of the Privacy Act, the persons holding the positions set out below, or the persons occupying on an acting basis those positions, to exercise the powers, duties or functions of the President as specified below and as more fully described in Annex A:

Dated at the City of Ottawa, this 22^nd day of June, 2012.

Anne-Marie Robinson
President

Privacy Act

8(2)(j) Disclosure for research purposes

8(4) Copies of requests under 8(2)(e) to be retained

8(5) Notice of disclosure under 8(2)(m)

9(1) Record of disclosures to be retained

9(4) Consistent uses

10 Personal information to be included in personal information banks

14 Notice where access requested

15 Extension of time limits

17(2)(b) Language of access

17(3)(b) Access to personal information in alternative format

18(2) Exemption (exempt bank) - Disclosure may be refused

19(1) Exemption - Personal information obtained in confidence

19(2) Exemption - Where authorized to disclose

20 Exemption - Federal-provincial affairs

21 Exemption - International affairs and defence

22 Exemption - Law enforcement and investigation

22.3 Exemption - Public Servants Disclosure Protection Act

23 Exemption - Security clearances

24 Exemption - Individuals sentenced for an offence

25 Exemption - Safety of individuals

26 Exemption - Information about another individual

27 Exemption - Solicitor-client privilege

28 Exemption - Medical record

31 Notice of intention to investigate

33(2) Right to make representation

35(1) Findings and recommendations of Privacy Commissioner (complaints)

35(4) Access to be given

36(3) Report of findings and recommendations (exempt banks)

37(3) Report of findings and recommendations (compliance review)

51(2)(b) Special rules for hearings

51(3) Ex parte representations

72(1) Report to Parliament

Privacy Regulations

9 Reasonable facilities and time provided to examine personal information

11(2) Notification that correction to personal information has been made

11(4) Notification that correction to personal information has been refused

13(1) Disclosure of personal information relating to physical or mental health may be made to a qualified medical practitioner or psychologist for an opinion on whether to release information to the requestor

14 Disclosure of personal information relating to physical or mental health may be made to a requestor in the presence of a qualified medical practitioner or psychologist

Appendix B - Historical Comparisons

Appendix C – 2013-2014 Annual Privacy Act Statistical Report

Statistical Report on the Privacy Act

Name of institution: Public Service Commission

Reporting period: 2013/04/01 to 2014/03/31

PART 1 – Requests under the Privacy Act

PART 2 - Requests closed during the reporting period

2.1 Dispostion and completion time

2.2 Exemptions

2.3 Exclusions

2.4 Format of information released

2.5 Complexity

2.5.1 Relevant pages processed and disclosed

2.5.2 Relevant pages processed and disclosed by size of requests

2.5.3 Other complexities

2.6 Deemed refusals

2.6.1 Reasons for not meeting statutory deadline

2.6.2 Number of days past deadline

2.7 Requests for translation

PART 3 – Disclosures under subsection 8(2)

PART 4 – Requests for correction of personal information and notations

PART 5 – Extensions

5.1 Reasons for extensions and disposition of requests

5.2 Length of extensions

PART 6 – Consultations received from other institutions and organizations

6.1 Consultations received from other government institutions and organizations

6.2 Recommendations and completion time for consultations received from other government institutions

6.3 Recommendations and completion time for consultations received from other organizations

PART 7 – Completion time of consultations on Cabinet confidences

PART 8 – Resources related to the Privacy Act

8.1 Costs

8.2 Human Resources

Footnotes