2018-2019 Annual Report on the Administration of the Privacy Act

Posted on : February 4, 2020

The Privacy Act

The Privacy Act (hereafter the “Act”) came into force on July 1, 1983. Under subsection 12(1) of the Act, Canadian citizens, permanent residents and individuals present in Canada have the right to access personal information that is under the control of the Government of Canada. This right of access is balanced against the legitimate need to protect sensitive information and to permit effective functioning of government, while promoting transparency and accountability in government institutions.

In addition, the Act protects an individual’s privacy by preventing others from accessing his or her personal information, and manages the collection, retention, use and disclosure of personal information.

Section 72 of the Act requires the head of every government institution to submit an annual report to Parliament on the administration of the Act during the fiscal year.  This report describes how the Canadian Security Intelligence Service (CSIS) administered the Act throughout the  2018-2019 fiscal year.

Overview of the Canadian Security Intelligence Service

In 1984, the Government of Canada passed an Act of Parliament for the creation of a civilian security intelligence service. This legislation not only gave birth to CSIS, it also clarified the differences between security intelligence activities and law-enforcement work, bringing to an end the 120-year interlocking of Canada's security intelligence service with the federal police force. CSIS came into existence on July 16, 1984.

CSIS is at the forefront of Canada's national security establishment and as such, its programs are proactive and pre-emptive.  Its role is to investigate activities suspected of constituting threats to the security of Canada, and to report on these to the Government of Canada.  CSIS may also take measures to reduce threats to the security of Canada in accordance with well-defined legal requirements and Ministerial direction.  Key threats include terrorism, espionage, foreign interference, the proliferation of weapons of mass destruction and cyber-threats against critical information systems and infrastructure.

Through its Security Screening Program, CSIS provides advice that prevents non-Canadians who pose security concerns from entering Canada or receiving permanent resident status or citizenship. CSIS also helps prevent individuals of security concern from gaining access to Canadian information, assets, sites or events.

The Access to Information and Privacy Section

The Access to Information and Privacy (ATIP) Section reported to the Assistant Director Intelligence via the Director General Litigation and Disclosure Branch throughout the 2018-2019 reporting period. The ATIP Section has an establishment of 16 fulltime employees to fulfill CSIS’ obligations under the Access to Information Act and the Privacy Act.   When fully staffed, the ATIP Section is comprised of a chief, a deputy chief, three unit heads, eight analysts, a privacy advisor, one administrative officer and one researcher. 

During the 2018-2019 reporting period, all 16 of the positions were filled with the exception of the researcher position which remained vacant for most of the year.  The privacy advisor position was staffed in June of 2018.  In addition, the Assistant Director Intelligence approved the transfer of three positions, from other sections of the branch, to create three new analyst positions in ATIP in order to address the increase in requests received throughout the year.  The three analyst positions will be created and staffed during the 2019-2020 fiscal year.

All employees in the ATIP Section are fully dedicated to the administration of the Access to Information Act and the Privacy Act programs within CSIS, providing high-quality and timely responses to internal and external clients including other government departments.  The only exception is the privacy advisor who is not involved with the administration of the Access to Information Act.  CSIS Legal Services Branch, which is staffed by Department of Justice (DoJ) lawyers, provides legal advice as required.
         
The ATIP Section’s responsibilities regarding the Act include, but are not limited to:

  • receive and process all requests in accordance with the Act;
  • assist requesters in formulating their requests when required;
  • gather all pertinent records, ensuring that the search for information is rigorous and    complete;                           
  • conduct the initial record review and provide recommendations to the program areas;
  • conduct all internal and external consultations;
  • consolidate the recommendations;
  • apply all discretionary and mandatory exemptions under the Act;
  • assist the Office of the Privacy Commissioner (OPC) in all privacy-related matters, including complaints against CSIS;
  • represent the Service in privacy-related litigation cases;
  • coordinate the annual update of Info Source and submission to Treasury Board Secretariat (TBS);
  • prepare the annual report on the administration of the Act;
  • provide ongoing advice and guidance to senior management and departmental staff on all matters related to privacy;
  • promote privacy awareness and training sessions within the department to ensure all staff are aware of the obligations imposed by the legislation;
  • monitor departmental compliance with the Act, regulations and relevant procedures and policies;
  • respond to consultations received from external organizations on CSIS records being considered for release;
  • develop and maintain privacy policies and guidelines, as required; and
  • participate in ATIP community activities, such as the annual Canadian Access and Privacy Association (CAPA) conference, TBS ATIP community meetings and various working groups.

Education and Training

During the 2018-2019 reporting period, members of CSIS ATIP Section provided one presentation to the Executive as well as one presentation to a foreign agency. Additionally, the ATIP Section continues to conduct awareness sessions through ATIP e-learning narrative slides. The narrative slides form part of the new employee orientation program which is required for all new employees.  All other Service employees have the ability to reference the narrative slides at any given time through the e-learning application. The narrative slides provides participants with an overview of the Access to Information Act and the Act, promotes a better comprehension of individual responsibilities and obligations relating to the Acts and offers an greater understanding of the internal ATIP process.  During the 2018-2019 fiscal year, 268 Service employees viewed the ATIP narrative slides.

Monitoring the Progress of Requests

There is a robust case monitoring system in place using reports produced by the ATIP Case Management software. The status of requests is monitored by the chief ATIP and the unit heads on an ongoing basis.

Compliance and Deemed Refusal Rates

A total of 1048 requests were received in the 2018-2019 fiscal year. Although faced with a significant increase in volume from the previous fiscal year, the Service closed 1071 requests and maintained a high on-time compliance rate of 97.4 % with a 2.6 % deemed refusal rate.  As of April 1st, 2019, two requests received during the 2018-2019 fiscal year were in a deemed refusal situation.

Other Requests

The ATIP Section also acted as a resource for CSIS officials, and offered advice and guidance on the provisions of the legislation. The ATIP Section was consulted on issues relating to a wide range of matters including, but not limited to, information management, security of information, draft policies and memoranda of understanding, Parliamentary question period notes (QPNs) and releases of information made by CSIS outside the parameters of the Act.

Delegation of Authority

In accordance with section 73 of the Act, a delegation of authority, signed by the Minister of Public Safety Canada (Annex 1), designates the persons holding the positions of Director of CSIS, the Assistant Director Intelligence, the Director General Litigation and Disclosure Branch, the Chief ATIP, the Deputy Chief and the Unit Heads to exercise and perform some of the powers, duties and functions of the Minister as head of the institution. The order was issued on March 8, 2016, by the Minister of Public Safety and Emergency Preparedness Canada, the Honourable Ralph Goodale.

Requests under the Act

The CSIS privacy client group consists, for the most part, of individuals who were subject to the security clearance process as well as members of the public interested in knowing whether CSIS had any information regarding their person.

The following statistics for the 2018-2019 reporting period were validated by TBS (Annex 2):

  • 1048 requests were received;
  • 92 requests were outstanding from the previous reporting period;
  • 1071 requests were closed; and
  • 69 requests were carried over to the next reporting period.
The following table maps out the trend for the previous three years
Request Status

Fiscal Year

2016-2017 2017-2018 2018-2019
Requests received 529 844 1048
Requests closed 523 787 1071
Requests carried over 29 35 92
Requests carried forward 35 92 69

Disposition of Completed Requests

The disposition of the 1071 requests completed in 2018-2019 was as follows:

  • All disclosed:                                      None
  • Disclosed in part:                                250
  • All exempted:                                      238
  • All excluded:                                            2
  • No records exist:                                 247
  • Abandoned:                                           39
  • Neither confirmed nor denied:        295
The following table maps out the trend for the previous three years
Request Disposition

Fiscal Year

2016-2017 2017-2018 2018-2019
All disclosed 10 0 0
Disclosed in part 93 171 250
All exempted 5 117 238
Exclusions 0 0 2
No records 134 161 247
Abandoned 20 16 39
Neither confirmed nor denied 261 322 295

Completion Rate

During the 2018-2019 fiscal year, the CSIS ATIP Section completed 1071 requests under the Act within the following time frames:

  • 1 to 15 days:                           471
  • 16 to 30 days:                         484
  • 31 to 60 days:                           85
  • 61 to 120 days:                         24
  • 121 to 180 days:                         6
  • 181 to 365 days:                         1         
  • more than 365 days:         None

Exemptions Invoked

The ATIP Section invoked a total of 1 865 exemptions under the Act.  These break down as follows:

  • 275 times under paragraph 18(2) (disclosure may be refused);
  • 3 times under paragraph 19(1) (a) (information obtained in confidence);
  • 1 time under paragraph 19(1) (d) (information obtained in confidence);
  • 1 time under paragraph 20 (Federal-provincial affairs);
  • 508 times under paragraph 21 (international affairs and defence);
  • 423 times under paragraph 22(1) (a) (law enforcement and investigation);
  • 2 times under subparagraph 22 (1) (a) (i) (law enforcement and investigation);
  • 1 time under subparagraph 22 (1) (a) (iii) (law enforcement and investigation);
  • 495 times under paragraph 22(1) (b) (law enforcement and investigation);
  • 3 times under paragraph 22(1) (c) (law enforcement and investigations);
  • 1 time under paragraph 23 (a) (security clearance investigations);
  • 149 times under section 26 (information about another individual); and
  • 3 times under section 27 (solicitor-client privilege).

Two new exemptions (22.4 and 27.1) were added to the Privacy Act during this reporting period.  The Service did not rely on any of the new exemptions.

Exclusions Cited

No exclusions were invoked during the 2018-2019 reporting period.

Reasons for not meeting statutory deadline

31 requests were closed past the statutory deadline due to:

  • workload:                                25
  • external consultations:           5
  • other:                                         1

Number of Days Past Deadline

During the 2018-2019 fiscal year, 31 requests went over the deadline:

  • 1 to 15 days:                           21
  • 16 to 30 days:                         1
  • 31 to 60 days:                         2
  • 61 to 120 days:                       6
  • 121 to 180 days:                     1
  • 181 to 365 days:                     None
  • more than 365 days:             None

Format of Information Released

During the 2018-2019 reporting period, the information released was sent:

  • 130 times in hard copy; and
  • 120 times in an electronic format.

Translation of Requests

  • No requests for translation were received during the 2018-2019 reporting period.

Disclosures under Subsection 8(2) of the Act

During this fiscal year, no disclosures were made pursuant to paragraphs 8(2) (e), 8(2) (m) or 8(5) of the Act.

Requests for Correction of Personal Information and Notations

  • 1 request for correction was received and accepted.
  • The ATIP section made no notations.

Extensions

Throughout the reporting period, a total of 97 extensions were taken pursuant to paragraph 15 (Extension of time limits) of the Act. The extensions were taken as follows:

  • 34 were taken pursuant to subparagraph 15(a) (i) (interference with operations); and
  • 63 were taken pursuant to subparagraph 15(a) (ii) (other consultation).

The length of the 97 extensions taken was between 16 to 30 days.

Consultations Received from Other Government of Canada Institutions

During this reporting period:

  • 47 consultation requests were received;
  • 6 consultation requests were outstanding from the previous reporting period;
  • 53 consultation requests were closed; and
  • No consultation requests were carried over to the next reporting period.
The following table maps out the trend for the previous three-year
Request Status 2016-2017 2017-2018 2018-2019
Requests received 43 99 47
Request closed 43 95 53
Requests carried over 2 2 6
Requests carried foward 2 6 0

Completion Time for Consultations Received from Other Government of Canada Institutions

During the 2018-2019 fiscal year, the CSIS ATIP Section completed the consultations within the following time frames

  • 0 to 15 days:                    30
  • 16 to 30 days:                  11
  • 31 to 60 days:                    9
  • 61 to 120 days:                  3
  • 121 to 180 days:              None
  • 181 to 365 days:              None  
  • more than 365 days:      None

Consultations Received from Other Organizations

During this reporting period, no consultations were received from other organizations.

Completion Time of Consultations on Cabinet Confidences

During this reporting period, no consultations on Cabinet Confidences were with the Department of Justice or with Privy Council.

Complaints and Investigations with the Office of the Privacy Commissioner during 2018-2019

  • Complaints received: 24
    • Access 18
    • Collection 1
    • Time limits 2
    • Extension notice 1
    • Correction 2
  • Complaints assigned and active: 12
    • Exemptions/Exclusions 8
    • Correction 2
    • Time limits 1
    • Extension Notice 1
  • Complaints closed: 22
    • Well-founded 2
    • Not well-founded 6
    • Discontinued/Settled/Resolved 14

The Service reviews the outcome of all investigations by the Office of the Privacy Commissioner (OPC) and where appropriate, integrates lessons learned into corporate processes. 

Monitoring Compliance

The unit heads are responsible for monitoring compliance and reporting issues to the chief ATIP.   The monitoring is continuously conducted via reports produced by the ATIP Case Management Software.  The ATIP Coordinator conveys compliance issues to the Director General, Litigation and Disclosure Branch when required.

Costs Related to the Administration of the Act

During the 2018-2019 fiscal year, the ATIP section incurred $695,530 in costs related to the Administration of the Act.

Expenditures

Amount

Salaries

$695,192

Overtime

$0

Goods and Services

$338

TOTAL: $695,530

Privacy Impact Assessments

The TBS Privacy Impact Assessment (PIA) Directive took effect on April 1, 2010. The PIA is a process that helps determine whether an initiative involving the use and collection of personal information raises privacy risks. It measures, describes and quantifies the risks, and proposes solutions to eliminate or mitigate them to an acceptable level prior to the implementation of new or substantially modified programs or activities.

Since the ATIP section was selected as the CSIS Policy Center for the PIA development and approval process, a privacy advisor position was created.  This position was staffed in June 2018.  In consultation with subject matter experts within the Service, the privacy advisor has the responsibility to assess whether modified or new programs /activities have an impact on privacy and warrant the preparation of a PIA based on the TBS Directive on PIAs.   When a PIA is required, the privacy advisor will  initiate the process, determine the appropriate format for the PIA, coordinate the completion of the PIA, seek proper approvals, submit the PIA to the President of TBS and to the OPC and respond to the OPC’s observations and/or recommendations . 

During the reporting period, the ATIP section completed:

  • 27 consultations with subject matter experts within CSIS to determine the requirement for PIAs.
  • 4 PIAs were drafted and submitted to the OPC. 

For national security reasons, the Service will only publish summaries of unclassified or Protected PIAs.

Material Privacy Breaches

One material privacy breach occurred at the Service during the 2018-2019 reporting period.  The breach was deemed ‘material’ and was therefore reported to the OPC and TBS.  The Service managed the breach in accordance with the TBS Guidelines for Privacy Breaches and the Privacy Breach Management Toolkit.  The Service also took actions and measures to prevent the recurrence.  

Data-matching and Data-sharing Activities

CSIS is not in a position to publicly discuss data-matching or data-sharing activities for National Security reasons.

New Privacy-related Policies or Procedures Implemented

No changes to report for the 2018-2019 fiscal year.

Significant Changes to the Organization, Programs, Operations or Policy

No changes to report for the 2018-2019 fiscal year.

Changes As a Result of Issues Raised by the Office of the Privacy Commissioner

No changes to report for the 2018-2019 fiscal year.

Federal Court Cases

There are two pending cases against CSIS.

2018-2019 Statistical Report on the Privacy Act

Name of institution: Canadian Security Intelligence Service

Reporting Period: 01 April 2018 to 31 March 2019

Part 1 – Requests under the Privacy Act
1. Number of requests
  Number of requests
Received during the report period 1048
Outstanding for the previous reporting period 92
Total 1140
Closed during the reporting period 1071
Carried over to the next reporting period 69

 

Part 2 – Requests closed during the reporting period
2.1 Disposition and closing time
Disposition of requests Completion time
1 to15 days 16 to 30 days 31 to 60 days 61 to 120 days 121 to 180 days 181 to 365 days More than 365 days Total
All disclosed 0 0 0 0 0 0 0 0
Disclosed in part 50 103 66 24 6 1 0 250
All exempted 140 94 4 0 0 0 0 238
All excluded 1 1 0 0 0 0 0 2
No records exist 131 107 9 0 0 0 0 247
Request abandoned 37 2 0 0 0 0 0 39
Neither confirmed nor denied 112 177 6 0 0 0 0 295
Total 471 484 85 24 6 1 0 1071

 

2.2 Exemptions

Section
Number of requests
18(2) 275
19(1)(a) 3
19(1)(b) 0
19(1)(c) 0
19(1)(d) 1
19(1)(e) 0
19(1)(f) 0
20 1
21 508
22(1)(a)(i) 2
22(1)(a)(ii) 0
22(1)(a)(iii) 1
22(1)(b) 495
22(1)(c) 3
22(2) 0
22.1 0
22.2 0
22.3 0
23(a) 1
23(b) 0
24(a) 0
24(b) 0
25 0
26 149
27 3
28 0

 

2.3 Exclusions

Section
Number of requests
69(1)(a) 0
69(1)(b) 0
69.1 0
70(1) 0
70(1)(a) 0
70(1)(b) 0
70(1)(c) 0
70(1)(d) 0
70(1)(e) 0
70(1)(f) 0
70.1 0

 

2.4 Format of information released

Disposition
Paper Electronic Other formats
All disclosed 0 0 0
Disclosed in part 130 120 0
Total 130 120 0

 

2.5 Complexity
2.5.1 Relevant pages processed and disclosed

Disposition of requests
Number of pages processed Number of pages disclosed Number of requests
All disclosed 0 0 0
Disclosed in part 16316 10125 250
All exempted 7169 0 238
All excluded 33 0 2
Requests abandoned 46 0 39
Neither confirmed nor denied 0 0 295
Total 23564 10125 824

 

2.5.2 Relevant pages processed and disclosed by size of requests
Disposition Less than100 pages processed 101 to 500 Pages processed 501 to 1000 Pages processed 1001 to 5000 Pages processed More than 5001 Pages processed
Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed
All disclosed 0 0 0 0 0 0 0 0 0 0
Disclosed in part 207 3407 42 6170 1 548 0 0 0 0
All exempted 235 0 3 0 0 0 0 0 0 0
All excluded 2 0 0 0 0 0 0 0 0 0
Request abandoned 39 0 0 0 0 0 0 0 0 0
Neither confirmed nor denied 295 0 0 0 0 0 0 0 0 0
Total 778 3407 45 6170 1 548 0 0 0 0

 

2.5.3 Other complexities

Disposition
Consultation required Legal advice sought Interwoven information Other Total
All disclosed 0 0 0 0 0
Disclosed in part 198 0 0 0 198
All exempted 8 0 0 0 8
All excluded 0 0 0 0 0
Request abandoned 1 0 0 0 1
Neither confirmed nor denied 26 0 0 0 26
Total 233 0 0 0 233

 

2.6 Deemed refusals
2.6.1 Reasons for not meeting statutory deadline
Number of requests past deadline Principal Reason
Workload External consultation Internal consultation Other
31 25 5 0 1

 

2.6.2 Number of days past deadline

Number of days past deadline
Number of requests past deadline where no extension was taken Number of requests past deadline where and extension was taken Total
1 to 15 days 6 15 21
16 to 30 days 1 0 1
31 to 60 days 1 1 2
61 to 120 days 0 6 6
121 to 180 days 0 1 1
181 to 365 days 0 0 0
More than 365 days 0 0 0
Total 8 23 31

 

2.7 Requests for translation

Translation requests
Accepted Refused Total
English to French 0 0 0
French to English 0 0 0
Total 0 0 0

 

Part 3 - Disclosures under subsection 8(2)
Paragraph 8(2)(e) Paragraph 8(2)(m) Paragraph 8(2)(m) Total
0 0 0 0

 

Part 4 - Requests for correction of personal information and notations
Disposition for Correction Requests Received Number
Notations attached 0
Requests for correction accepted 1
Total 1

 

Part 5 - Extensions
5.1 Reasons for extensions and dispositions of requests
Disposition of requests where an extension was taken 15(1(a)(i)
Interference with
operations
15(1)(a)(ii) Consultation 15(b) Translation or conversion
Section 70 Other
All disclosed 0 0 0 0
Disclosed in part 28 0 62 0
All exempted 0 0 0 0
All excluded 0 0 0 0
No records exist 6 0 1 0
Requests abandoned 0 0 0 0
Total 34 0 63 0

 

5.2 Length of extensions
Length of extensions 15(a)(i)
Interference with operations
15(a)(ii)
Consultation
15(b)
Translation or conversion
Section 70 Other
1 to 15 days 0 0 0 0
16 to 30 days 34 0 63 0
Total 34 0 63 0

 

Part 6 - Consultations received from other institutions and organizations 
6.1 Consultations received from other institutions and organizations

Consultations
Other Government of Canada Institutions Number of pages to review Other  organizations Number of pages to review
Received during the reporting period 47 1206 0 0
Outstanding from the previous reporting period 6 87 0 0
Total 53 1293 0 0
Closed during the reporting period 53 1293 0 0
Pending at the end of the reporting period 0 0 0 0

 

6.2 Recommendations and completion time for consultations received from other government institutions
Recommendations Number of days required to complete consultation requests
1 to 15 days 16 to 30 days 31 to 60 days 61 to 120 days 121 to 180 days 181 to 365 days More than 365 days Total
All disclosed 2 0 0 1 0 0 0 3
Disclosed in part 28 10 8 2 0 0 0 48
All exempted 0 1 0 0 0 0 0 1
All excluded 0 0 0 0 0 0 0 0
Consult other institution 0 0 0 0 0 0 0 0
Other 0 0 1 0 0 0 0 1
Total 30 11 9 3 0 0 0 53

 

6.3 Recommendations and completion time for consultations received from other government institutions
Recommendations Number of days required to complete consultation requests
1 to 15 days 16 to 30 days 31 to 60 days 61 to 120 days 121 to 180 days 181 to 365 days More than 365 days Total
All disclosed 0 0 0 0 0 0 0 0
Disclosed in part 0 0 0 0 0 0 0 0
All exempted 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0
Consult other  institution 0 0 0 0 0 0 0 0
Other 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0

 

Part 7: Completion Time of Consultations on Cabinet Confidences
7.1 Requests with Legal Services
Number of Days Fewer Than 100 Pages Processed 101-500 Pages Processed 501-1000 Pages Processed 1001-5000 Pages Processed More Than 5000 Pages Processed
Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed
1 to 15 0 0 0 0 0 0 0 0 0 0
16 to 30 0 0 0 0 0 0 0 0 0 0
31 to 60 0 0 0 0 0 0 0 0 0 0
61 to 120 0 0 0 0 0 0 0 0 0 0
121 to 180 0 0 0 0 0 0 0 0 0 0
181 to 365 0 0 0 0 0 0 0 0 0 0
More than 365 0 0 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0 0 0

 

7.2 Requests with Privy Council Office
Number of Days Fewer Than 100 Pages Processed 101‒500 Pages Processed 501-1000 Pages Processed 1001-5000 Pages Processed More Than 5000 Pages Processed
Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed
1 to 15 0 0 0 0 0 0 0 0 0 0
16 to 30 0 0 0 0 0 0 0 0 0 0
31 to 60 0 0 0 0 0 0 0 0 0 0
61 to 120 0 0 0 0 0 0 0 0 0 0
121 to 180 0 0 0 0 0 0 0 0 0 0
181 to 365 0 0 0 0 0 0 0 0 0 0
More than 365 0 0 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0 0 0

 

Part 8: Complaints and Investigations Notices Received
Section 31 Section 33 Section 35 Court action Total
24 12 22 2 60

 

Part 9: Privacy Impact Assessments (PIAs)
Number of PIA(s) completed 4
Part 10: Resources Related to the Privacy Act
10.1 Costs
Expenditures Amount
Salaries $695,192
Overtime $0
Goods and Services $338
Professional services contracts $0  
Other $338
Total $695,530

 

10.2 Human Resourcess
Resources Person Years Dedicated to Privacy Activities
Full-time employees 8.50
Part-time and casual employees 0.00
Regional staff 0.00
Consultants and agency personnel 0.00
Students 0.00
Total 8.50

Page details

Date modified: