Language selection

Government of Canada / Gouvernement du Canada

Search

Public Services and Procurement Canada
2023 to 2024 Annual report on the Privacy Act

Information contained in this publication or product may be used and reproduced, in part or in whole, and by any means, for personal or public non-commercial purposes, without charge or further permission, unless otherwise specified, provided that you do the following:

Commercial reproduction and distribution is prohibited, except with written permission from Public Services and Procurement Canada (PSPC). For more information, please consult Contact Government of Canada Publications.

The official symbols of the Government of Canada, including the Canada wordmark and flag symbol, may not be reproduced, whether for commercial or non-commercial purposes.

© His Majesty the King in Right of Canada, represented by the Minister of Public Services and Procurement, 2024.

Aussi disponible en français.

ISSN 2817-5689

On this page

Introduction

Public Services and Procurement Canada is pleased to present to parliament its annual report on the administration of the Privacy Act. This report describes the activities that support compliance with the act for the fiscal year commencing April 1, 2023, and ending March 31, 2024.

Section 72 of the Privacy Act requires that the head of every federal government institution submit an annual report to parliament on the administration of the Privacy Act during the fiscal year.

Purpose of the act

The purpose of the Privacy Act is to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution and that provide individuals with a right of access to that information. The Privacy Act protects an individual’s privacy by preventing others from having unlawful access to personal information. It also grants an individual specific rights regarding the collection, use and disclosure of this information.

About Public Services and Procurement Canada

Public Services and Procurement Canada, formerly Public Works and Government Services Canada, derives its mandate from the Department of Public Works and Government Services Act of 1996, which established the department as a common service provider. As such, the department plays an important role in the daily operations of the Government of Canada as a key provider of services for federal departments and agencies. The department supports them in the achievement of their mandated objectives in 5 service categories:

PSPC provides services across Canada through its headquarters in the National Capital Region, 5 regional offices, as well as offices in Europe (Geilenkirchen,Germany) and the United States (Washington, DC).

Organizational structure

The Access to Information and Privacy (ATIP) Directorate is responsible for the administration of the Access to Information Act and the Privacy Act within PSPC. The ATIP senior director acts as the department’s ATIP coordinator. The directorate is overseen by the director general of the Corporate Secretariat and Accessibility Sector, who is also the department’s chief privacy officer.

In the 2023 to 2024 fiscal year, 14.900 full-time equivalent (FTE) employees and 0.190 FTEs casual employees administered the Privacy Act with the support of 1 consultant, for a total complement of 16.090 FTEs.

Access to Information and Privacy reporting structure at Public Services and Procurement Canada

Organizational chart of the Public Services and Procurement Canada Access to Information and Privacy Directorate — Text version below the chart

Text version

This organizational chart displays a hierarchy beginning with the ATIP coordinator of PSPC at the top. Directly below the ATIP coordinator are 5 divisions who report to the coordinator:

  • the administration team carries out administrative functions for the ATIP Directorate and ensures the maintenance of ATIP software
  • the operations team processes requests received under the Access to Information Act and the Privacy Act, and liaises with the offices of the information and privacy commissioners to resolve complaints
  • the privacy management team advises and supports the department in the management of privacy risk, ensuring compliance with privacy legislation and related policy instruments
  • the policy, transparency and proactive publications team develops directives, leads PSPC’s approach on transparency and openness, provides advice and is responsible for proactive publications
  • the governance and outreach team develops procedures and statistical reports, delivers training, promotes awareness and is responsible for ATIP annual reports

Below these divisions there is another level for ATIP liaison officers, who coordinate the retrieval, review and submission of information held by their branch or region in response to ATIP requests.

The Access to Information Act and the Privacy Act allow for the provision of services by a government institution to another government institution that is presided over by the same minister. In fiscal year 2023 to 2024, PSPC had a service agreement for the provision of corporate services to the Office of the Procurement Ombudsman (OPO) which included access to information and privacy services under section 96 of the Access to Information Act and section 73.1 of the Privacy Act. The ATIP Directorate was responsible for addressing potential concerns regarding OPO’s independence and perception of conflict of interest, including file segregation and limited access to OPO files. OPO was responsible for reviewing and confirming the application of exemptions and exceptions on release packages and provide informal final approval prior to public release.

Delegation of authority

Pursuant to section 73(1) of the Privacy Act, the minister of Public Services and Procurement Canada has delegated the power, duties and functions of the administration of the act down to ATIP manager level. This excludes paragraph 8(2)(m) of the Privacy Act which is only delegated down to senior director level. Certain administrative functions are also delegated to ATIP managers, team leaders and senior analysts to accelerate the processing of requests.

The most recent PSPC delegation instrument was signed on October 23, 2023, with a separate matrix for ATIP delegation. An excerpt of the delegation of authorities approved by the minister, pertaining to delegation under the Privacy Act, is attached as Annex A: Delegation of authorities chart for the Privacy Act and its regulations.

Performance for 2023 to 2024

In this section

Requests received and closed

Volume of privacy requests received and closed by fiscal year — Text version below the chart.

Text version

Chart summary: Requests received and closed

  • 2019 to 2020: 495 requests received, 472 requests closed
  • 2020 to 2021: 353 requests received, 381 requests closed
  • 2021 to 2022: 369 requests received, 366 requests closed
  • 2022 to 2023: 515 requests received, 512 requests closed
  • 2023 to 2024: 369 requests received, 391 requests closed

The department received a total of 369 requests pursuant to the Privacy Act in the 2023 to 2024 reporting period, which represents a decrease of 28.35% from the previous year. Privacy requests were mainly related to pension, pay files, and personal records.

Pages reviewed

Number of pages reviewed under the Privacy Act by fiscal year — Text version below the chart

Text version
Table 1: Chart summary: Pages reviewed (in thousands)
Fiscal year Pages reviewed for requests under the Privacy Act
2019 to 2020 147,000
2020 to 2021 162,000
2021 to 2022 130,000
2022 to 2023 142,000
2023 to 2024 153,000

In the 2023 to 2024 reporting period, PSPC reviewed 152,914 pages for requests received under the Privacy Act. While PSPC received fewer requests than in the previous reporting period, and the same number of requests as reporting period 2021 to 2022, the number of pages reviewed increased by approximately 11,000 pages, leading to an increase in workload for the ATIP Directorate.

Completion times

Percentage of privacy requests completed within certain timeframes — Text version below the chart

Text version
Table 2: Chart summary: Completion time
Completion time Privacy requests
Within 30 days 49.87%
31 to 60 days 38.36%
61 to 120 days 10.49%
121 days or more 1.28%

PSPC’s overall compliance rate for the 2023 to 2024 reporting period was 87.98% for requests made under the Privacy Act. This compliance rate represents all files that were completed either within the initial 30 days or within an extension period for reasons of volume or consultations.

The percentage of requests closed within the initial 30 days was 49.87%.

Factors influencing performance

The compliance rate of 87.98% highlights the dedicated efforts of the Department to fulfill the responsibilities relating to the administration of the Privacy Act. However, the following factors affected ATIP Directorate operations during the reporting period:

Outstanding requests

Active requests

Number of privacy active requests within and beyond legislated timeline by fiscal year — Text version below the chart

Text version
Table 3: Chart summary: Active requests within and beyond legislated timeline
Fiscal year Privacy active requests within legislated timelines Privacy active requests beyond legislated timelines
2019 to 2020 0 1
2020 to 2021 0 2
2021 to 2022 0 1
2022 to 2023 0 1
2023 to 2024 35 0

At the end of the 2023 to 2024 reporting period, PSPC had a total of 40 active requests pursuant to the Privacy Act that were outstanding from all previous reporting periods. The majority of these active requests (87.50%) were received during the reporting period.

Exemptions

The department invoked exemptions allowed under the Privacy Act on 128 requests (32.74%), and disclosed all information in 216 requests (55.24%). The remaining 47 requests (12%) were either abandoned or those for which no records existed.

The majority of exemptions invoked by PSPC fell under Section 26, which protects personal information, and was used in 127 files (99.22%).

Of note, more than one exemption can be applied to a specific request.

Exclusions

In the 2023 to 2024 reporting period, PSPC did not apply any exclusions to records requested under the Privacy Act.

Consultations

PSPC did not receive consultation requests from other government institutions and organizations for records relating to the Privacy Act.

Extensions

Section 15 of the Privacy Act permits the statutory time limits to be extended if consultations are necessary, if translation is required, or if the request is for a large volume of records and processing it within the original time limits would unreasonably interfere with the operations of the department.

PSPC invoked 185 extensions during the 2023 to 2024 reporting period. Of these, 177 were deemed necessary to allow the department to process a large volume of requests which otherwise would have interfered with operations, 3 were required to process a large volume of pages, and 5 were required to complete consultations with internal and external stakeholders.

Disposition

Volume and percentage of closed privacy requests by disposition decision — Text version below the chart

Text version

Chart summary: Request disposition

  • All disclosed: 216 requests (55.24%)
  • Disclosed in part: 127 requests (32.48%)
  • All exempted: 1 request (0.26%)
  • Abandoned: 13 requests (3.32%)
  • No records exists: 34 requests (8.70%)

Approximately 96% of all requests closed during the 2023 to 2024 reporting period were either disclosed in part (32.48%), fully disclosed (55.24%), or those for which no records existed (8.70%). The balance of requests were abandoned (3.32%), and 1 request was all exempted.

Complaints

Active complaints

Number of privacy active complaints by fiscal year — Text version below the chart

Text version
Table 4: Chart summary: Active complaints
Fiscal year Privacy active complaints
2019 to 2020 2
2020 to 2021 5
2021 to 2022 3
2022 to 2023 2
2023 to 2024 6

At the end of the 2023 to 2024 reporting period, PSPC had a total of 18 active complaints with the OPC that were outstanding from previous reporting periods.

Complaints received and closed

During the 2023 to 2024 reporting period, PSPC was notified of 16 new complaints received by the OPC, and submitted formal representations for 15 active complaints received in the current or previous reporting periods. Most of these complaints were related to refusal of access due to applied exemptions.

The ATIP Directorate closed 11 complaint investigations. Of these, 3 complaints were deemed well-founded and 8 were deemed not well-founded.

Training and awareness

Through the delivery of training and various activities, PSPC strengthened institution-wide awareness with the Privacy Act and departmental obligations.

During the 2023 to 2024 reporting period, the ATIP Directorate continued to offer virtual training sessions and added hybrid sessions to support the hybrid workplace transition. These delivery formats gave the ATIP Directorate the ability to reach more participants throughout the country. They also encouraged active engagement and collaboration, either virtually or in person, while promoting ATIP trainings and tools on a larger scale within the department.

PSPC delivered the following training sessions:

In addition to the training sessions delivered, the ATIP Directorate participated in the following activities:

Through these events, the ATIP Directorate informed participants of their obligations under the Privacy Act and the department’s efforts to make the government more accessible to everyone.

Privacy breach prevention and reporting

The ATIP Directorate offered the mandatory “Privacy Breach Prevention and Reporting” training via PSPC’s online learning platform, ALTO, to 7981 employees. This training was designed to promote awareness of internal guidelines and procedural safeguards to avoid privacy breaches. Training sessions provided valuable information to participants relating to their role, responsibilities and obligations towards the requirements of privacy breach management. They also provided instructions on the necessary actions in case of a privacy breach, and preventive actions.

Policies, guidelines and procedures

During the 2023 to 2024 reporting period, PSPC continued to develop internal guidance documents, procedures and tools to ensure consistent practices in request processing. These documents covered multiple operational actions, such as request intake, data validation, and request processing system management. PSPC also provided onboarding material for new employees. Current practices were reviewed to ensure standardized monitoring and to facilitate compliance with requirements.

To improve the administration of the ATIP program, the ATIP Directorate held weekly management meetings to discuss emerging and ongoing operational and policy issues.

Directive on privacy management

The departmental Directive on Privacy Management was introduced on August 16, 2022 and led to significant improvements in the management and protection of personal information across the department during the reporting period. Updated personal information protection measures were effectively integrated into daily operations, strengthening compliance with the Privacy Act and related policy instruments. Regular audits and feedback from internal and external stakeholders indicated greater transparency in the handling of personal information. Clear communication of privacy practices was consistently maintained, fostering trust among employees and the public. As a result, the directive allowed PSPC to meet its commitment to sound privacy management and the protection of the privacy of individuals.

Initiatives and projects to improve privacy

Personal information and privacy glossary

During 2023 to 2024 reporting period, the ATIP Directorate collaborated with the Translation Bureau and the OPC to develop the Personal Information and Privacy Glossary with the goal of disseminating and standardizing the terminology used in the field of privacy protection in Canada. The glossary presents bilingual terminology relating to nearly 300 concepts specific to the application of legislative instruments and policies governing the protection of personal information and privacy. Published on the Language Portal of Canada in November 2023, the glossary is a useful tool for anyone who deals with or is interested in personal information and privacy.

Development program

As in previous years, significant employee shortages continued to affect PSPC’s ATIP operations throughout reporting period 2023 to 2024. To alleviate shortages of experienced employees, the ATIP Directorate used its developmental program to foster the professional development of individuals with limited or no ATIP experience, allowing their progression from entry level ATIP Trainee (PM-01) to Senior ATIP Officer (PM-04). PSPC adjusted the curriculum to supplement available governmental and private training, and provided additional professional development through mentorship. The training included hands-on experience processing request pursuant to the Access to Information Act and the Privacy Act. The Development Program is a long-term recruitment initiative also intended to increase employee retention.

During reporting period 2023 to 2024, PSPC welcomed 2 ATIP Trainees (PM-01) to the program, promoted 1 participant from ATIP Trainee (PM-01) to Junior ATIP Officer (PM-02), and 2 participants from Junior ATIP Officer (PM-02) to ATIP Officer (PM-03) as they had acquired the necessary skills. Of those 2 ATIP Officers, 1 was assigned files pursuant to the Privacy Act as part of the developmental program curriculum.

Technological improvements

PSPC continued to collaborate with stakeholders to advance the replacement of the current outdated request processing system and major milestones were achieved during the reporting period. This is an ongoing and government-wide project initiated by the Treasury Board of Canada Secretariat (TBS) involving all ATIP programs throughout the Government of Canada.

Summary of key issues and actions taken on complaints

Most complaints PSPC received during the 2023 to 2024 reporting period were related to refusal of access due to applied exemptions. Depending on the nature of the complaint, PSPC contacted the OPC investigator to clarify the reasons behind the complaint, contacted the relevant office of primary interest (OPI) within PSPC to request new searches and disclosed additional records when applicable, and reviewed applied exemptions and exclusions to confirm their applicability.

Material privacy breaches

A privacy breach is deemed material if it involves sensitive personal information, could reasonably be expected to cause serious injury or harm to the individual, or involves a larger number of affected individuals. To guide the department's responses regarding privacy breaches, PSPC makes use of a privacy breach protocol. First established in 2015 and updated in 2021, the protocol includes communications with affected individuals and implementation of mitigation measures.

During the 2023 to 2024 reporting period, PSPC reported 1 material privacy breach to the OPC and to TBS. This material privacy breach was due to a cyberattack and affected the personal information of federal government employees held by BGRS and Sirva Canada. These affiliated companies were contracted by the Government of Canada to provide relocation services and held the personal information of employees who had used relocation services as early as 1999. The breach was appropriately managed in accordance with TBS’ privacy breach management toolkit.

Privacy impact assessments

In the course of fulfilling its mandate as a service provider, PSPC collects, retains, uses and discloses personal information. In accordance with TBS’ Directive on Privacy Impact Assessment, the ATIP Directorate provides guidance and recommendations for the elaboration of privacy impact assessments and for any substantial modifications to the use of personal information.

During the 2023 to 2024 reporting period, PSPC completed one privacy impact assessment (PIA), the ALTO Learning Management System. The summary of this PIA is available on Canada.ca

ALTO learning management system

ALTO is a learning management system used to deliver training and professional development to PSPC employees. It offers a catalog of over 300 courses, either developed internally or by third parties, and allows for the printing of certificates and transcripts upon successful completion of training.

PSPC adopted ALTO in April 2017 to replace the Learning Management System previously managed by the Canada School of Public Service, aligning with TBS recommendations. ALTO sources learner data from PSPC’s MyGCHR and does not require the use of a Personal Record Identifier. Although privacy risks remained unchanged, this PIA was required to update previous assessments and ensure compliance with current privacy requirements.

Public interest disclosures

In accordance with subsection 8(2) of the Privacy Act, under certain circumstances, a government institution may disclose personal information under its control without the consent of the individual to whom the information relates.

Paragraph 8(2)(e) permits disclosure of personal information to a federal investigative body for the purpose of enforcing law or carrying out a lawful investigation. PSPC made 8 disclosures to an investigative body during reporting period 2023 to 2024, releasing the information of 8 individuals. The Act does not require the institution to notify the OPC.

Paragraph 8(2)(m) permits the disclosure of personal information where the disclosure is in the public interest or would benefit the individual to whom the information relates. PSPC made 2 such disclosures during reporting period 2023 to 2024. The first disclosure involved the information of 1 individual who threatened self-harm while seeking assistance from the department for specific concerns. In keeping with standard operating procedures, a mental health and wellness call was placed to emergency services and the name and contact information of the individual were disclosed. The second disclosure involved the information of an individual for the purpose of assisting another government agency in the course of an investigation. In accordance with the Privacy Act, the OPC was notified following these disclosures.

Monitoring compliance

Through ongoing consultations on privacy management practices pursuant to the Privacy Act, PSPC’s ATIP Directorate monitored the use of personal information by departmental programs when dealing with third parties, stakeholders, and partners. Monitoring occurred primarily in the establishment of contracts, information sharing agreements or memorandums of understanding. The Directorate’s Privacy Oversight Committee supported the departmental Chief Privacy Officer in monitoring by ensuring that stakeholders were informed of their role, responsibilities and obligations regarding the collection, use, retention, disclosure and disposal of personal information. Privacy Oversight Committee meetings were held biannually at the Director General level during the 2023 to 2024 reporting period.

Additionally, the ATIP Directorate provided advice, guidance and recommendations to internal and external stakeholders concerning sound privacy management and compliance with the Privacy Act. The use of a tracking system to process all incoming consultations enabled PSPC to monitor any initiatives making use of personal information and facilitated the production of accurate reports for statistical purposes.

The ATIP Directorate also provided a weekly “snapshot” report to senior management containing statistics on the number of requests received and being processed under the act.

In addition to these practices, the ATIP Directorate had a number of measures in place to monitor the time taken to process requests, to limit inter-institutional consultations, and to review frequently requested types of information.

During the 2023 to 2024 reporting period, ATIP Officers regularly communicated with OPIs to monitor the time taken to process requests, ensuring that the ATIP Directorate obtained extensions in a timely manner. Additionally, managers reviewed and monitored the status of privacy requests using the request processing system and conducted weekly meetings with staff to review active tasks and establish priorities.

Annex A: Delegation of authorities chart for the Privacy Act and its regulations

Table 5: Privacy Act and its regulations for the Department minister and senior executives
Position titles Privacy Act Privacy regulations
Minister Full Full
Deputy minister Full Full
Associate deputy minister Full Full
Table 6: Privacy Act and its regulations for Department Policy, Planning and Communications Branch
Position titles Privacy Act Privacy regulations
Senior departmental manager Full Full
Director general Full Full
Senior director Full Full
Director Full Full
Manager Restrictedtable 6 note 1 Full
Supervisor Restrictedtable 6 note 2 Restrictedtable 6 note 3
Officer Restrictedtable 6 note 4 Not applicable

Table 6 Notes

Table 6 Note 1

Managers may fully exercise the authorities delegated under the Privacy Act, with the exception of paragraph 8(2)(m)

Return to table 6 note 1 referrer

Table 6 Note 2

Supervisors may fully exercise the authorities limited to the following sections of the Privacy Act: 14, 15, 25, 26 and 27

Return to table 6 note 2 referrer

Table 6 Note 3

Supervisors may fully exercise only section 9 of the Privacy Regulations

Return to table 6 note 3 referrer

Table 6 Note 4

Officers may fully exercise the authorities limited to the following sections of the Privacy Act: 14, 15 and 26

Return to table 6 note 4 referrer

Delegation of authority

Access to Information Act and Privacy Act

I, the Minister of the Department of Public Works and Government Services, pursuant to section 95 of the Access to Information Act and section 73 of the Privacy Act, hereby designate the persons holding the positions set out in the Access to Information and Privacy Delegation of Authority matrix, or the persons occupying on an acting basis those positions, to exercise the power, duties and functions of the Minister responsible for Public Services and Procurement Canada, under the provisions of the acts and related regulations set out in the schedule opposite each position. This designation supersedes all previous delegations of authority.

The Honourable Jean-Yves Duclos

Minister Public Services and Procurement

Signed October 23, 2023

Annex B: Statistical report on the Privacy Act

In this section

Name of institution: Public Services and Procurement Canada

Reporting period: April 1, 2023 to March 31, 2024

Section 1: Requests under the Privacy Act

Table 7: 1.1 Number of requests received
Type Number of requests
Received during reporting period 369
Outstanding from previous reporting periods:
  • outstanding from previous reporting period (7)
  • outstanding from more than 1 reporting period (55)
 62
Total 431
Closed during reporting period 391
Carried over to next reporting period:
  • carried over within legislated timeline (35)
  • carried over beyond legislated timeline (5)
 40
Table 8: 1.2 Channels of requests
Channel Number of requests
Online 269
E-mail 82
Mail 12
In person 0
Phone 0
Fax 6
Total 369

Section 2: Informal requests

Table 9: 2.1 Number of informal requests
Type Number of requests
Received during reporting period 0
Outstanding from previous reporting periods:
  • outstanding from previous reporting period (0)
  • outstanding from more than 1 reporting period (0)
 0
Total 0
Closed during reporting period 0
Carried over to next reporting period 0
Table 10: 2.2 Channels of informal requests
Channel Number of requests
Online 0
E-mail 0
Mail 0
In person 0
Phone 0
Fax 0
Total 0
Table 11: 2.3 Completion time of informal requests
Completion time Number of informal requests
1 to 15 days 0
16 to 30 days 0
31 to 60 days 0
61 to 120 days 0
121 to 180 days 0
181 to 365 days 0
More than 365 days 0
Total 0
Table 12: 2.4 Pages released informally
Volume of pages released Number of requests Pages released
Less than 100 0 0
100 to 500 0 0
501 to 1,000 0 0
1,001 to 5,000 0 0
More than 5,000 0 0

Section 3: Requests closed during the reporting period

Table 13: 3.1 Disposition and completion time
Disposition of requests 1 to 15 days 16 to 30 days 31 to 60 days 61 to 120 days 121 to 180 days 181 to 365 days More than 365 days Total
All disclosed 5 108 87 15 1 0 0 216
Disclosed in part 3 34 62 26 1 0 1 127
All exempted 0 1 0 0 0 0 0 1
All excluded 0 0 0 0 0 0 0 0
No records exist 7 26 1 0 0 0 0 34
Request abandoned 9 2 0 0 0 0 2 13
Neither confirmed nor denied 0 0 0 0 0 0 0 0
Total 24 171 150 41 2 0 3 391
Table 14: 3.2 Exemptions applied
Section Number of requests
18(2) 0
19(1)(a) 0
19(1)(b) 0
19(1)(c) 0
19(1)(d) 0
19(1)(e) 0
19(1)(f) 0
20 0
21 8
22(1)(a)(i) 6
22(1)(a)(ii) 0
22(1)(a)(iii) 0
22(1)(b) 8
22(1)(c) 0
22(2) 0
22.1 0
22.2 0
22.3 0
22.4 0
23(a) 0
23(b) 0
24(a) 0
24(b) 0
25 0
26 127
27 8
27.1 0
28 0
Table 15: 3.3 Exclusions applied
Section Number of requests
69(1)(a) 0
69(1)(b) 0
69.1 0
70(1) 0
70(1)(a) 0
70(1)(b) 0
70(1)(c) 0
70(1)(d) 0
70(1)(e) 0
70(1)(f) 0
70.1 0
Table 16: 3.4 Format of information released
Paper E-record Dataset Video Audio Other
18 325 0 2 15 0

3.5 Complexity

Table 17: 3.5.1 Relevant pages processed and disclosed for paper, e-records and dataset formats
Number of pages processed Number of pages disclosed Number of requests
152,914 151,178 357
Table 18: 3.5.2 Relevant pages processed by request disposition for paper, e-records and dataset formats by size of requests
Disposition Less than 100 pages processed 101 to 500 pages processed 501 to 1,000 pages processed 1,001 to 5,000 pages processed More than 5,000 pages processed
Number of requests Pages processed Number of requests Pages processed Number of requests Pages processed Number of requests Pages processed Number of requests Pages processed
All disclosed 101 2,998 59 13,060 35 23,360 21 33,311 0 0
Disclosed in part 28 1,286 49 11,703 16 12,439 34 54,522 0 0
All exempted 0 0 1 235 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0 0 0
Request abandoned 13 0 0 0 0 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0 0 0 0 0 0
Total 142 4,284 109 24,998 51 35,799 55 87,833 0 0
Table 19: 3.5.3 Relevant minutes processed and disclosed for audio formats
Number of minutes processed Number of minutes disclosed Number of requests
1,806 1,784 15
Table 20: 3.5.4 Relevant minutes processed per request disposition for audio formats by size of requests
Disposition Less than 60 minutes processed 60 to 120 minutes processed More than 120 minutes processed
Number of requests Minutes processed Number of requests Minutes processed Number of requests Minutes processed
All disclosed 3 35 0 0 0 0
Disclosed in part 3 83 2 182 7 1,506
All exempted 0 0 0 0 0 0
All excluded 0 0 0 0 0 0
Request abandoned 0 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0 0
Total 6 118 2 182 7 1,506
Table 21: 3.5.5 Relevant minutes processed and disclosed for video formats
Number of minutes processed Number of minutes disclosed Number of requests
31 31 2
Table 22: 3.5.6 Relevant minutes processed per request disposition for video formats by size of requests
Disposition Less than 60 minutes processed 60 to 120 minutes processed More than 120 minutes processed
Number of requests Minutes processed Number of requests Minutes processed Number of requests Minutes processed
All disclosed 1 20 0 0 0 0
Disclosed in part 1 11 0 0 0 0
All exempted 0 0 0 0 0 0
All excluded 0 0 0 0 0 0
Request abandoned 0 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0 0
Total 2 31 0 0 0 0
Table 23: 3.5.7 Other complexities
Disposition Consultation required Legal advice sought Interwoven information Other Total
All disclosed 3 0 2 4 9
Disclosed in part 9 0 111 6 126
All exempted 0 0 1 0 1
All excluded 0 0 0 0 0
Request abandoned 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0
Total 12 0 114 10 136

3.6 Closed requests

Table 24: 3.6.1 Number of requests closed within legislated timelines
Type Requests closed within legislated timelines
Number of requests closed within legislated timelines 344
Percentage of requests closed within legislated timelines (%) 87.97953964

3.7 Deemed refusals

Table 25: 3.7.1 Reasons for not meeting legislated timelines
Principal reason Number of requests closed past the legislated timelines
Interference with operations / workload 38
External consultation 5
Internal consultation 1
Other 3
Total 47
Table 26: 3.7.2 Requests closed beyond legislated timelines (including any extension taken)
Number of days past legislated timelines Number of requests past legislated timeline where no extension was taken Number of requests past legislated timeline where an extension was taken Total
1 to 15 days 6 23 29
16 to 30 days 1 4 5
31 to 60 days 4 4 8
61 to 120 days 1 1 2
121 to 180 days 0 0 0
181 to 365 days 0 0 0
More than 365 days 0 3 3
Total 12 35 47
Table 27: 3.8 Requests for translation
Translation requests Accepted Refused Total
English to French 0 0 0
French to English 2 0 2
Total 2 0 2

Section 4: Disclosures under subsections 8(2) and 8(5)

Table 28: Number of disclosures
Paragraph 8(2)(e) Paragraph 8(2)(m) Subsection 8(5) Total
8 2 2 12

Section 5: Requests for correction of personal information and notations

Table 29: Disposition for correction requests received
Disposition for correction requests received Number
Notations attached 0
Requests for correction accepted 0
Total 0

Section 6: Extensions

Table 30: 6.1 Reasons for extensions
Number of requests where an extension was taken 15(a)(i) Interference with operations 15 (a)(ii) Consultation 15(b) Translation purposes or conversion
Further review required to determine exemptions Large volume of pages Large volume of requests Documents are difficult to obtain Cabinet confidence section (section 70) External Internal
185 0 3 177 0 0 4 1 0
Table 31: 6.2 Length of extensions
Length of extensions 15(a)(i) Interference with operations 15 (a)(ii) Consultation 15(b) Translation purposes or conversion
Further review required to determine exemptions Large volume of pages Large volume of requests Documents are difficult to obtain Cabinet confidence section (section 70) External Internal
1 to 15 days 0 0 2 0 0 0 0 0
16 to 30 days 0 3 175 0 0 4 1 0
Total 0 3 177 0 0 4 1 0

Section 7: Consultations received from other institutions and organizations

Table 32: 7.1 Consultations received from other Government of Canada institutions and organizations
Consultations Other Government of Canada institutions Number of pages to review Other organizations Number of pages to review
Received during reporting period 0 0 0 0
Outstanding from the previous reporting period 0 0 0 0
Total 0 0 0 0
Closed during the reporting period 0 0 0 0
Carried over within negotiated timelines 0 0 0 0
Carried over beyond negotiated timelines 0 0 0 0
Table 33: 7.2 Recommendations and number of days required to complete consultation requests received from other Government of Canada institutions
Recommendation 1 to 15 days 16 to 30 days 31 to 60 days 61 to 120 days 121 to 180 days 181 to 365 days More than 365 days Total
Disclose entirely 0 0 0 0 0 0 0 0
Disclose in part 0 0 0 0 0 0 0 0
Exempt entirely 0 0 0 0 0 0 0 0
Exclude entirely 0 0 0 0 0 0 0 0
Consult other institution 0 0 0 0 0 0 0 0
Other 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0
Table 34: 7.3 Recommendations and number of days required to complete consultation requests received from other organizations outside the Government of Canada
Recommendation 1 to 15 days 16 to 30 days 31 to 60 days 61 to 120 days 121 to 180 days 181 to 365 days More than 365 days Total
Disclose entirely 0 0 0 0 0 0 0 0
Disclose in part 0 0 0 0 0 0 0 0
Exempt entirely 0 0 0 0 0 0 0 0
Exclude entirely 0 0 0 0 0 0 0 0
Consult other institution 0 0 0 0 0 0 0 0
Other 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0

Section 8: Completion time of consultations on Cabinet confidences

Table 35: 8.1 Requests with Legal Services
Number of days Fewer than 100 pages processed 101 to 500 pages processed 501 to 1,000 pages processed 1,001 to 5,000 pages processed More than 5,000 pages processed
Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed
1 to 15 0 0 0 0 0 0 0 0 0 0
16 to 30 0 0 0 0 0 0 0 0 0 0
31 to 60 0 0 0 0 0 0 0 0 0 0
61 to 120 0 0 0 0 0 0 0 0 0 0
121 to 180 0 0 0 0 0 0 0 0 0 0
181 to 365 0 0 0 0 0 0 0 0 0 0
More than 365 0 0 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0 0 0
Table 36: 8.2 Requests with Privy Council Office
Number of days Fewer than 100 pages processed 101 to 500 pages processed 501 to 1,000 pages processed 1,001 to 5,000 pages processed More than 5,000 pages processed
Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed
1 to 15 0 0 0 0 0 0 0 0 0 0
16 to 30 0 0 0 0 0 0 0 0 0 0
31 to 60 0 0 0 0 0 0 0 0 0 0
61 to 120 0 0 0 0 0 0 0 0 0 0
121 to 180 0 0 0 0 0 0 0 0 0 0
181 to 365 0 0 0 0 0 0 0 0 0 0
More than 365 0 0 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0 0 0

Section 9: Complaints and investigations notices received

Table 37: Number of complaints and investigation notices received
Section 31 Section 33 Section 35 Court action Total
16 15 11 0 42

Section 10: Privacy impact assessments and personal information banks

Table 38: 10.1 Privacy impact assessments
Type Number
Number of privacy impact assessments (PIAs) completed 1
Number of PIAs modified 0
Table 39: 10.2 Institution-specific and central personal information banks
Personal information banks Active Created Terminated Modified
Institution-specific 14 0 0 0
Central 10 0 0 0
Total 24 0 0 0

Section 11: Privacy breaches

Table 40: 11.1 Material privacy breaches reported
Type Number
Number of material privacy breaches reported to TBS 1
Number of material privacy breaches reported to OPC 1
Table 41: 11.2 Non-material privacy breaches
Type Number
Number of non-material privacy breaches 219

Section 12: Resources related to the Privacy Act

Table 42: 12.1 Allocated costs
Expenditures Amount
Salaries $1,495,480
Overtime $593
Goods and services:
  • professional services contracts ($106,790)
  • other ($246,904)
 $353,694
Total $1,849,767
Table 43: 12.2 Human resources
Resources Person years dedicated to privacy activities
Full-time employees 14.900
Part-time and casual employees 0.190
Regional staff 0.000
Consultants and agency personnel 1.000
Students 0.000
Total 16.090

Annex C: Supplemental statistical report on the Access to Information Act and the Privacy Act

In this section

Name of institution: Public Services and Procurement Canada

Reporting period: April 1, 2023 to March 31, 2024

Section 1: Open requests and complaints under the Access to Information Act

Table 44: 1.1 Number of open requests that are outstanding from previous reporting periods
Fiscal year open requests were received Open requests that are within legislated timelines as of March 31, 2024 Open requests that are beyond legislated timelines as of March 31, 2024 Total
Received in 2023 to 2024 184 32 216
Received in 2022 to 2023 3 37 40
Received in 2021 to 2022 3 60 63
Received in 2020 to 2021 0 61 61
Received in 2019 to 2020 0 23 23
Received in 2018 to 2019 0 18 18
Received in 2017 to 2018 0 11 11
Received in 2016 to 2017 0 11 11
Received in 2015 to 2016 0 0 0
Received in 2014 to 2015 or earlier 0 0 0
Total 190 253 443
Table 45: 1.2 Number of open complaints with the Information Commissioner of Canada that are outstanding from previous reporting periods
Fiscal year open complaints were received by institution Number of open complaints
Received in 2023 to 2024 48
Received in 2022 to 2023 17
Received in 2021 to 2022 31
Received in 2020 to 2021 17
Received in 2019 to 2020 2
Received in 2018 to 2019 1
Received in 2017 to 2018 0
Received in 2016 to 2017 0
Received in 2015 to 2016 0
Received in 2014 to 2015 or earlier 0
Total 116

Section 2: Open requests and complaints under the Privacy Act

Table 46: 2.1 Number of open requests that are outstanding from previous reporting periods
Fiscal year open requests were received Open requests that are within legislated timelines as of March 31, 2024 Open requests that are beyond legislated timelines as of March 31, 2024 Total
Received in 2023 to 2024 35 0 35
Received in 2022 to 2023 0 1 1
Received in 2021 to 2022 0 1 1
Received in 2020 to 2021 0 2 2
Received in 2019 to 2020 0 1 1
Received in 2018 to 2019 0 0 0
Received in 2017 to 2018 0 0 0
Received in 2016 to 2017 0 0 0
Received in 2015 to 2016 0 0 0
Received in 2014 to 2015 or earlier 0 0 0
Total 35 5 40
Table 47: 2.2 Number of open complaints with the Privacy Commissioner of Canada that are outstanding from previous reporting periods
Fiscal year open complaints were received by institution Number of open complaints
Received in 2023 to 2024 6
Received in 2022 to 2023 2
Received in 2021 to 2022 3
Received in 2020 to 2021 5
Received in 2019 to 2020 2
Received in 2018 to 2019 0
Received in 2017 to 2018 0
Received in 2016 to 2017 0
Received in 2015 to 2016 0
Received in 2014 to 2015 or earlier 0
Total  18

Section 3: Social insurance number

Table 48: New collection or new consistent use of the social insurance number (SIN)
Question Answer
Has your institution begun a new collection or new consistent use of the SIN in 2023 to 2024? No

Section 4: Universal access under the Privacy Act

Table 49: Requests received from confirmed foreign nationals outside of Canada
Question Answer
How many requests were received from confirmed foreign nationals outside of Canada in 2023 to 2024? 0

Page details

2024-11-15