Annual Report 2020-2021 - Administration of the Privacy Act

In June 2019, Bill C-58, An Act to Amend the Access to Information Act and Privacy Act and to make consequential amendments to other Acts, received Royal Assent. The Bill brought forth the most significant advances to the Access to Information Act as well as minor amendments to the Privacy Act since they came into force in 1983.

This report is prepared and tabled in Parliament in accordance with section 72 of the Privacy Act. It covers the way in which the Canadian Security Intelligence Service (CSIS) administered the Act from April 1, 2020 to March 31, 2021.

2. CSIS Mandate

CSIS has, for the past thirty-seven (37) years, continued to demonstrate its value to Canadians by providing the Government of Canada with crucial information and advice linked to threats to the security of Canada and of Canadian interests. The CSIS Act gives CSIS the mandate to investigate activities suspected of constituting threats to the security of Canada including terrorism and violent extremism, espionage and sabotage, foreign influenced activities, and subversion of government. CSIS also advises the Government on these threats and takes lawful measures to reduce them. In addition, the Service provides security assessments on individuals who require access to classified information or sensitive files within the Government of Canada as well as security advice relevant to the exercise of the Citizenship Act or the Immigration and Refugee Protection Act. Foreign intelligence collection within Canada is also conducted by CSIS at the request of the Minister of Foreign Affairs or the Minister of National Defence.

In June 2019, the National Security Act, 2017 received Royal Assent. This legislation modernized the original CSIS Act by addressing outdated legal authorities, introducing new safeguards and accountability measures as well as clarifying CSIS’ responsibilities. The legislation addressed specific challenges and provided new modern authorities needed to keep pace with continuous changes in the threat, as well as the technological and legal landscapes.

3. Organizational Structure

During the 2020-2021 fiscal year, the Access to Information and Privacy (ATIP) Section remained under the Deputy Director, Policy and Strategic Partnerships Directorate. Within the Directorate, the ATIP Section is part to the Litigation and Disclosure Branch headed by the Director General. The employees of the ATIP Section are fully dedicated to the administration of both the Privacy Act and the Access to Information Act programs within CSIS, providing high quality and timely responses to internal and external clients including other government departments as well as providing advice to CSIS employees as they fulfill their obligations under both Acts. CSIS Legal Services Branch, staffed by Department of Justice (DoJ) lawyers, provides legal advice as required.

The ATIP Section has twenty (20) full-time employees to fulfill CSIS’ obligations under the Access to Information and Privacy Acts. During this reporting period, the ATIP Section comprised of one (1) Chief (Coordinator), one (1) Deputy Chief, three (3) unit Heads, thirteen (13) full-time Analysts, one (1) Administrative Officer, one (1) Researcher and one (1) part-time Analyst.

The ATIP Section’s responsibilities vis-à-vis the Act are divided in two (2) categories:

Operations

• receiving and processing all requests in accordance with the Act;
• assisting requesters in formulating their requests when required;
• gathering all pertinent records and ensuring that the search for information is rigorous and complete;
• conducting the initial review of the records and providing recommendations to the program areas;
• applying all discretionary and mandatory exemptions under the Act;
• conducting and responding to all internal and external consultations;
• consolidating the recommendations;
• assisting the Office of the Privacy Commissioner (OPC) in all privacy related matters including complaints against CSIS; and
• representing CSIS in privacy litigation cases.

Policies and Procedures

• coordinating the annual Info Source update and submission to TBS;
• preparing the annual report on the administration of the Act;
• providing ongoing advice and guidance to senior management and departmental staff on all matters related to the privacy;
• promoting privacy awareness and training sessions and ensuring all employees are aware of the obligations imposed by the legislation;
• monitoring departmental compliance with the Act, regulations and relevant procedures and policies;
• maintaining the CSIS public reading room;
• developing and maintaining privacy policies and guidelines, when required; and
• participating in ATIP community activities, such as the annual Canadian Access and Privacy Association (CAPA) conference, TBS ATIP community meetings and various working groups.

As defined in section 73.1 of the Privacy Act, CSIS did not provide nor receive services related to any power, duty or function to or from another government institution, during this reporting period.

4. Delegation Order

In accordance with section 73(1) of the Act, a delegation order signed by the Minister of Public Safety and Emergency Preparedness designates the persons holding the positions of Director of CSIS, Deputy Director of the Policy and Strategic Partnerships Directorate, Director General of the Litigation and Disclosure Branch, as well as the Chief, Deputy Chief and the unit Heads of the Access to Information and Privacy Section to exercise and perform the duties of the Minister as Head of the institution.

The Honourable Bill Blair, P.C., M.P. issued the current delegation order on October 27, 2020.

5. Interpretation of the 2020-2021 statistical report for requests under the Privacy Act

Every year, TBS requires institutions to submit a statistical report on their administration of the Privacy Act, which contains cumulative data on the application of the legislation during the fiscal year. The CSIS Statistical Report and Supplemental Report for 2020-2021 are included this report. The statistics included in this report have been rounded to the nearest decimal point.

* The on-time compliance rates for 2019-2020 and 2020-2021 were impacted by the COVID-19 pandemic and will be discussed further in the report.

As indicated in table 1, the Service received 725 requests between April 1, 2020 and March 31, 2021. This represents a fourteen percent (14 %) decrease from the requests received during the previous reporting period. The decrease in requests is most likely linked to the global pandemic. During this reporting period, the Service reviewed 38,188 pages including a number of highly complex and sensitive requests.

5.1 - Sources of requests

The 725 requests received during this reporting period came from various sources. Seventy-eight percent (78 %) of requests came from members of the public who, largely, were seeking the status of their citizenship and immigration file or seeking to know whether the Service had information on them. Ten percent (10 %) of requests came from businesses; the most common being law offices looking for personal information on behalf of their clients who are seeking their immigration and citizenship status.

5.2 - Disposition of completed requests

The ATIP Section successfully closed 725 requests during the 2020-2021 reporting period: sixty-two percent (62 %) were closed within 1 to 15 days, twenty-one percent (21 %) were closed within 16 to 30 days and ten percent (10 %) took over 60 days to close. Of the records relevant to these requests, none was all disclosed while twenty-seven percent (27 %) were disclosed in part, thirty percent (30 %) did not exist, and thirty-three percent (33 %) for which the existence could be neither confirmed nor denied.

 

5.3 - Deemed refusals

Out of the 725 requests closed during this reporting period, the ATIP Section successfully closed 632 requests (eighty-seven percent (87 %)) within the legislated timelines; however, the remaining ninety-three (93) requests (thirteen percent (13 %)) were closed past the legislated timelines. It is important to note that out of those ninety-three (93) requests, extensions were taken on thirty-one percent (31 %). The two main reasons for requests being closed past the legislated timelines were the COVID-19 pandemic and the need to consult other government departments on classified records. The COVID-19 pandemic measures taken by the Service as well as those taken by other Government of Canada departments to stop the spread of COVID-19 had a negative impact on the ATIP Section’s ability to process requests within the timelines legislated by the Privacy Act.

5.4 - Extensions

The legislation allows for extensions when the response requires internal or external consultations, additional review time due to large amount of records, or when the review could interfere with Service operations. Throughout the reporting period, twenty-nine extensions (29) were taken. Fifty-five percent (55 %) of the twenty-nine (29) extensions taken were due to the need to consult various internal branches and/or other government departments and forty-one percent (41 %) were due to an interference with operations. One hundred percent (100 %) of the extensions taken were between 16 to 30 days.

5.5 – Exemptions and exclusions invoked

The Privacy Act allows institutions to exempt information from being released for a variety of reasons. The ATIP Section invoked 941 exemptions under the Act during the reporting period.

 

The Act does not apply to information already publically available and excludes from disclosure material such as Cabinet Confidences. The ATIP Section did not use this exclusion during the reporting period.

5.6 - Consultations received from other Government of Canada institutions

During the 2020-2021 fiscal year, the Service received ten (10) consultation requests under the Privacy Act involving Service records or matters. There were two (2) requests outstanding from the 2019-2020 fiscal year.

For this reporting period, the ATIP Section closed twelve (12) privacy consultation requests totaling 148 pages reviewed. Fifty percent (50 %) of consultation requests were processed in less than 15 days, twenty-five percent (25 %) were closed between 16 and 60 days and the remaining twenty-five (25) took more than 61 days to process. There were no privacy consultation requests carried over to the next fiscal year.

5.7 – Other requests

The ATIP Section also acted as a resource for CSIS executives by offering advice and guidance further to provisions in the legislation. The ATIP Section provided assistance, over 196 times, on a variety of matters including, but not limited to, releases of information made by CSIS outside the parameters of the Act.

Throughout 2020-2021, the ATIP Section continued to receive telephone calls and emails from employees of the Service as well as from the public seeking direction on how to obtain their personal information and/or how to submit a request under the Privacy Act. The ATIP Section administration team provided guidance in a professional manner and often directed these individuals to the ATIP Online Request Service website for additional information.

5.8 – Impact of Covid-19 measures

As indicated in table 1, the global COVID-19 pandemic had a major impact on the on-time compliance rate of the ATIP Section during this reporting period. The measures taken by the Service as well as those taken by the Government of Canada to combat the spread of the Coronavirus had negative repercussions for the CSIS ATIP Section.

On March 14, 2020, CSIS activated its Business Continuity Plan (BCP). Due to the BCP and the CSIS ATIP Section’s inability to process Secret and Top Secret records from home, the ATIP Section had to remain closed for eight (8) weeks. Consequently, privacy requests sent to the Service, between March 14, 2020 and May 19, 2020 were neither registered nor processed. However, the ATIP Section was able to follow the recommendations of the TBS and issue delay letters to the requesters affected. The CSIS website, as well as the public ATIP email auto-reply and voicemail message, were amended to notify requesters of potential delays in the processing of their requests due to the implementation of workplace measures to curb the spread of COVID-19.

When it was suitable and safe to do so, a limited number of employees returned to the office. The ATIP Section remained at partial capacity from May 19, 2020 to August 24, 2020 for a total of fourteen (14) weeks. For security reasons, the Service does not have the capability to process Secret or Top Secret electronic records. During those fourteen (14) weeks, the ATIP Section was able to close 188 paper requests; 138 of those requests were received after April 1, 2020. Starting August 24, 2020, the ATIP Section returned to the office at full capacity and remained as such until the end of the fiscal year. As noted in the 2020-2021 Supplemental Statistical Report on the Access to Information Act and Privacy Act, the Service was able to receive paper requests by mail and through the digital request service forty-four (44) out of fifty-two (52) weeks.

As previously mentioned, one of the biggest impacts of the COVID-19 pandemic on the Service’s ability to meet legislated timelines was the inability of certain institutions to receive and process Secret and Top Secret paper records. Although the CSIS ATIP Section was operating at full capacity for most of the year, many institutions advised the Service of their inability to process classified material due to their employees working from home, or that they were ultimately not accepting classified consultation requests. This resulted in requests being in deemed refusal, partial responses to requesters and necessary lengthy extensions. When the pandemic restrictions are lifted and institutions can once again receive and process classified paper records, the Service will be inundated with consultation requests and responses. The impact will likely be discussed in the 2021-2022 annual report.

6. Training and Awareness

During the 2020-2021 reporting period, the ATIP Section did not conduct in-person training. Rather, employees were encouraged to use other means of communication such as phone calls, collaboration software, teleconferences, etc. The ATIP Section did however, continue to offer its awareness sessions through ATIP e-learning narrated slides. The narrated slides form part of the employee orientation program, which is required for all new employees. All other Service employees have the ability to reference the narrative slides at any given time through an e-learning application. The narrated slides provides participants with an overview of the Act and the Access to Information Act, promotes a better comprehension of individual responsibilities and obligations relating to the Acts and offers a greater understanding of the internal ATIP process. During the 2020-2021 fiscal year, 241 Service employees viewed the ATIP online module.

7. Policies, Guidelines, Procedures and Initiatives

The Service worked in accordance with both interim directives on Privacy Practices and Privacy Impact Assessments (PIA) issued by TBS in response to the global pandemic. No other policies, guidelines or procedures were implemented during this reporting period further to new TBS policies and directives or issues raised by the OPC further to the Privacy Act.

The Privacy Advisor position, which had been a part of the ATIP Section since July 2018, was officially transferred to the Service’s Compliance Unit during the summer of 2020. The Privacy Advisor’s responsibilities include promoting privacy practices and ensuring compliance with the TBS policies. The Privacy Advisor continues to consult the ATIP Section in accordance with section 10 and section 71 (6) of the Privacy Act.

8. Issues and Actions Taken on Complaints or Audits

Section 29 (1) of the Act provides requesters with the right to file a complaint with the OPC should they be dissatisfied with the response to their access to information request. Reasons for complaints include the refusal of an institution to disclose personal information, personal information used and disclosed for other purposes, delays in receiving a response, etc. Fifteen (15) complaints were registered with the OPC during the 2020-2021 fiscal year. This represents two percent (2 %) of the total number of Privacy Act requests received throughout the fiscal year.

OPC investigators closed and issued their findings on seven complaints. They determined that five (5) complaints (seventy-two percent (72 %)) were not well founded, one (1) was resolved at the early resolution stage and one (1) complaint was discontinued.

 

CSIS continues to work closely with the OPC in order to resolve complaints in an efficient and timely manner. The Service reviews the outcome of all investigations by the OPC and where appropriate, integrates lessons learned into corporate processes.

There were four (4) Court actions filed against CSIS regarding the Act during this reporting period. The Court proceedings remain ongoing.

9. Monitoring Compliance

The unit Heads are responsible for monitoring compliance and reporting issues to the Chief ATIP. The monitoring is continuously conducted via reports produced by the ATIP Case Management Software. The ATIP Coordinator conveys compliance issues to the Director General, Litigation and Disclosure Branch.

10. Material Breaches

There was one (1) material privacy breach reported to the OPC during the 2020-2021 reporting period. The breach occurred at CSIS and involved the information of one external candidate. Some of the candidate’s personal information was inadvertently emailed to the hiring manager. Immediate action was taken to ensure the documents were deleted. The OPC was satisfied with the manner in which CSIS handled the breach and closed it on February 27, 2021. The organization takes the privacy of its employees and Canadians seriously and continues to act appropriately to prevent future breaches.

11. Privacy Impact Assessments

The TBS PIA Directive took effect on April 1, 2010. The PIA is a process that helps determine whether an initiative involving the use and collection of personal information raises privacy risks. It measures, describes and quantifies the risks, and proposes solutions to eliminate or mitigate them to an acceptable level prior to the implementation of new or substantially modified programs or activities. An interim directive on PIA’s was issued during the reporting period as a response to the COVID-19 pandemic.

In consultation with subject matter experts within the Service, the Privacy Advisor has the responsibility to assess whether modified or new programs / activities have an impact on privacy and warrant the preparation of a PIA, in accordance with the TBS Directive on PIAs. When a PIA is required, the Privacy Advisor initiates the process, coordinates the completion of the PIA, seeks proper approvals, submits the PIA to the TBS and to the OPC and responds to the OPC's recommendations. In 2020, as previously mentioned, the responsibility of conducting PIAs was transferred from the ATIP Section to the Service’s Compliance branch.

During this reporting period:

• Fourteen (14) consultations with subject matter experts took place to determine whether a PIA was required for new or modified programs/initiatives/activities;
• One (1) classified PIA was approved and submitted to the OPC;
• Nine (9) PIAs were in process.

For national security reasons, the Service only publishes the summaries of unclassified PIAs.

12. Public Interest Disclosures

There was no disclosure made under paragraph 8(2) (m) of the Privacy Act during the reporting period.

13. Other

Throughout the 2020-2021 fiscal year, the ATIP Section incurred $ 903,213 in salary costs and $ 192 in other costs associated with the administration of the Privacy Act.