Annual Report 2024—2025 Administration of the Privacy Act

1. 2024-2025 Highlights

• During the 2024–2025 fiscal year, the on-time compliance rates for Privacy Act requests stood at 66%.
• 124% increase in Privacy Act requests from the 2023–2024 fiscal year (total of 9,218 Privacy Act requests received for the 2024–2025 fiscal year). 
• 89% of the Privacy Act requests received were from individuals seeking the status of their (or someone else’s) immigration/ citizenship application.
• 47% of the overall Privacy Act requests were from foreign nationals located outside of Canada (represents 4,377 requests).

2. Summary

This reporting period marked the 40th anniversary of the Canadian Security Intelligence Service (CSIS) that has, since 1984, continued to demonstrate its value to Canadians by providing the Government of Canada with crucial information and advice linked to threats to the security of Canada and to Canadian interests.

Security threats facing Canada and its allies continued to increase in complexity, intensity, velocity and volume in 2024–2025. As international conflicts persist, there are increasing threats from foreign nations seeking to undermine Canada’s security, economic prosperity and democracy through acts of foreign interference, coercion, and espionage. Despite successful high profile terrorism-related arrests this past year, the trajectory of terrorism threat trends is concerning. Canada also faces pressures from the impact of new technologies such as encryption and generative artificial intelligence, requiring Canada to keep pace in their adoption, and our understanding of the varied opportunities and risks. The ever-evolving and persistent threat environment requires a nimble and dynamic operational approach.

Within this context, CSIS remains committed to being as transparent with Canadians as possible, while protecting national security sensitivities and privileged information. It is, in part, through the Access to Information and Privacy (ATIP) program that we achieve this transparency, a program that has performed very well and has had, historically, high on-time compliance rates. More recently, and over the last year in particular, the CSIS ATIP program has faced a number of challenges and workload pressures, which has resulted in a drop in performance. For example, while the 2023–24 ATI on-time compliance rate was 96%, it now stands at 77%, while Privacy Act on-time compliance has fallen from 96% to 66%. There are a number of factors at play, however, this drop is largely attributable to a massive, 124% increase in requests under the Privacy Act by individuals seeking the status of immigration and citizenship applications. As a comparatively small ATIP unit where the analysts are generalized, this significant and rapid increase in immigration-related Privacy Act requests has resulted in a drop in overall on-time compliance under both the Privacy Act and Access to Information Act (ATIA).

The ATIP Section’s management team is actively examining a variety of options to deal with some of these pressures. This includes:

• leveraging partnerships, and reviewing and streamlining consultation processes, such as with Library Archives Canada (LAC), where we are managing a significant backlog of historical files; 
• examining better, more direct ways to address client requirements for information regarding their immigration process;
• using technology as a source of efficiencies, including the introduction of a new case management software system, and moving towards full digitization of our internal business processes; and,
• in terms of human resources, undertaking a number of staffing strategies in order to fill the current capacity gaps and in support of succession planning in the coming years, with some retirements on the horizon. 

The collective impact of the aforementioned lines of efforts are expected—with time—to yield some efficiencies in processing time and improve on-time compliance rates. However, the sheer volumes are such that the backlog of unopened and unprocessed immigration-related Privacy Act requests will continue to grow, as will non-compliance with legislated timelines.

3. Introduction

The Privacy Act provides all individuals with the right to access their personal information under the control of the Government of Canada. The right of access to personal information is balanced against the legitimate need to protect sensitive information and to maintain the effective functioning of government, while promoting transparency and accountability in government institutions. The Privacy Act protects an individual’s privacy by preventing others from accessing his or her personal information, and manages the collection, retention, use and disclosure of personal information.

CSIS prepared this report for tabling in Parliament in accordance with section 72 of the Privacy Act. It covers the way in which the CSIS administered the Privacy Act from April 1, 2024, to March 31, 2025.

CSIS is not reporting on behalf of wholly owned subsidiaries or non-operational institutions.

4. CSIS mandate

The CSIS Act gives CSIS the mandate to investigate activities suspected of constituting threats to the security of Canada, including terrorism and violent extremism, espionage and sabotage, foreign influenced activities, and subversion of government. In addition to providing advice to Government on these threats, CSIS may also take lawful measures to reduce them. CSIS also provides security assessments on individuals who require site access to classified information or sensitive files within the Government of Canada, as well as security advice relevant to the exercise of the Citizenship Act and the Immigration and Refugee Protection Act. CSIS conducts foreign intelligence collection within Canada at the request of the Minister of Foreign Affairs or the Minister of National Defence.

In 2024 Bill C-70, An Act respecting countering foreign interference, updated the CSIS Act in a significant way, providing the basis for some of its operational activities to keep pace with advances in technology and significantly increasing its ability to engage with stakeholders outside the Government of Canada.

5. Organizational structure

In 2024–2025, the ATIP Section remained under the Deputy Director, Policy and Strategic Partnerships Directorate. The employees of the ATIP Section are fully dedicated to the administration of both the Privacy Act and the ATIA programs within CSIS, providing high quality and timely responses to internal and external clients, including other government departments, as well as providing advice to CSIS employees as they fulfill their obligations under both acts. The CSIS Legal Services Branch, staffed by Department of Justice lawyers, provides legal advice as required.

The Director General of the Litigation and Disclosure Branch, within the Directorate, supported by the Chief (Coordinator) lead the CSIS ATIP Section. There are three key units, namely the ATIP Intake/Governance Unit and two ATIP operational units. These units worked together to process ATIP requests in accordance with legislation, regulations, policies and directives. Their responsibilities included:

• receiving and processing all requests in accordance with the Privacy Act;
• assisting requesters in formulating their requests when required;
• gathering all pertinent records and ensuring rigorous and complete searches;
• conducting the initial review of the records and providing recommendations to the program areas;
• applying all discretionary and mandatory exemptions under the Privacy Act;
• conducting and responding to all internal and external consultations;
• consolidating the recommendations;
• assisting the Office of the Privacy Commissioner (OPC) in all privacy related matters including complaints against CSIS;
• representing CSIS in privacy litigation cases;
• coordinating the annual Info Source update and submission to the Treasury Board of Canada Secretariat (TBS);
• preparing the annual report on the administration of the Privacy Act;
• providing ongoing advice and guidance to senior management and departmental staff on all matters related to the Privacy Act;
• ensuring all employees are aware of the obligations imposed by the legislation;
• monitoring relevant changes to procedures and policies; and
• participating in ATIP community activities, such as TBS ATIP community meetings and various working groups.

The ATIP Section is comprised of 22 full-time and one part-time term position at various levels. These positions included one chief (coordinator), one deputy chief, two unit heads, two senior analysts, 12 analysts, three ATIP officers, one researcher and one part-time term analyst. One senior analyst, one analyst and the part-time term analyst worked solely on ATIA consultations from LAC for historical records of the Royal Canadian Mounted Police (RCMP) Security Service. The other senior analyst’s responsibilities included proactive publication obligations under Part 2 of the ATIA. Some of these positions were vacant during the reporting period and, overall, the ATIP Section’s vacancy rate stood at 18%. This situation is complicated by challenges with recruitment and staffing, where attracting ATIP analysts to CSIS, given the unique work requirements, is difficult, and the hiring process is lengthy. The ATIP unit also experienced a disruption in leadership, with the Coordinator reassigned to support other priority areas temporarily (a new CSIS ATIP coordinator started in March 2025).

As defined in section 73.1 of the Privacy Act, CSIS did not provide or receive services related to any power, duty or function to or from another government institution during this reporting period.

6. Delegation order

Pursuant to subsection 73(1) of the Privacy Act, the Minister of Public Safety, Democratic Institutions and Intergovernmental Affairs delegated the powers, duties and functions for the administration of the Privacy Act to CSIS employees in the following positions:

• Director,
• Deputy Director, Policy and Strategic Partnership,
• Director General, External Review and Compliance (Section 10 of the Privacy Act),
• Director General, Litigation and Disclosure Branch,
• Chief, Access to Information Section,
• Deputy Chief and Unit Head, Access to Information Section.

The Delegation Order (Annex A) issued by the Honourable Dominic LeBlanc, P.C., K.C., M.P., on April 24, 2024, remained in effect at the end of this reporting period. Further to the 2025 Federal Election and the subsequent appointment of the Honourable Gary Anandasangaree, P.C., M.P. as Minister of Public Safety Canada, a new delegation order will be included in the 2025–2026 Privacy Act annual reporting.

7. Interpretation of the 2024-2025 Statistical Report for requests under the Privacy Act

Every year, TBS requires institutions to submit a statistical report on their administration of the Privacy Act, which contains cumulative data on the application of the legislation during the fiscal year. The CSIS Statistical Report and Supplemental Report for 2024–2025 are included in Annex B and Annex C of this report. The statistics included in this report have been rounded to the nearest decimal point. 

As indicated in table 1, CSIS received 9,218 requests between April 1, 2024, and March 31, 2025. This represents a 124% increase from the requests received during the previous reporting period. CSIS had 281 outstanding requests at the end of the 2023–2024 reporting period. Of those 281 requests, 249 were received during that fiscal year and 32 remained outstanding for more than one reporting period.

As of the end of the 2024–2025 fiscal year, 4,687 requests were carried over to the next fiscal year (see section 2.1 of Annex C). A total of 20% of those active requests were within their legislated timelines as of March 31, 2025, and 80% were beyond their legislated timelines as of that same date. 

7.1 - Sources of requests

The 9,218 requests received during this reporting period came from various sources. A total of 80% of requests came from members of the public who were seeking their personal information and primarily those seeking the status of their citizenship or immigration application. A total of 9% of requests came from various businesses such as immigration consultants and law offices looking for the personal information of their clients in relation to the status of their immigration and citizenship application. Finally, 98% of requests were submitted through the ATIP Online Request Service (AORS), and the remaining 2% were received by email or by mail.

 

Over the past few years, the ATIP Section has seen a continued increase in immigration-related Privacy Act requests resulting directly from the coming-into-force of Universal Access, increased immigration, and the strain on the immigration system in Canada. Privacy Act requests to obtain personal information related to immigration and citizenship applications have placed pressure on this institution and the broader federal access to information and privacy regimes. These types of requests have become unmanageable. Of the 9,218 Privacy Act requests received, 95% related to immigration and citizenship. Of those, 4,377 were from foreign nationals outside of Canada seeking the status of their immigration/citizenship applications. Foreign nationals represented 46% of requesters. Compared to the previous reporting period, 1,551 requests came from foreign nationals. That is a 182% increase in requests from foreign nationals during this fiscal year.

7.2 - Disposition of completed requests

The ATIP Section successfully closed 4,812 requests during the 2024–2025 reporting period: 20% were closed within 1 to 15 days, 46% were closed within 16 to 30 days, and 34% took over 31 days to close. Vis-à-vis the records related to these requests, none were disclosed in full, 22% were disclosed in part, 63% were all exempt, 8% did not exist, 4% were abandoned, and for 3%, the existence of the requested records could neither be confirmed nor denied. The substantial increase in the all-exempt disposition resulted from the increase in requests from those whose immigration/citizenship applications were still in process. Due to an unsurmountable workload, the ATIP Section was unable to close 4,687 requests and carried them over to the next reporting period.

7.3 - Deemed refusals

Out of the 4,812 requests closed during this reporting period, the ATIP Section successfully closed 3,174 requests (66%) within the legislated timelines; however, the remaining 1,638 requests (34%) were closed past the legislated timelines. Out of those 1,638 requests, extensions were taken on 2%. The main reasons for requests closed past their legislated timeline were interference with operations, internal consultations and a significant increase in workload without additional resources. CSIS ATIP was unable to give notice of extension on the 1,609 requests closed past their legislated timeline due to the increase in workload.

7.4 - Extensions

The legislation allows for extensions in certain circumstances: when the response requires internal or external consultations; there is a large amount of records; the review could interfere with CSIS operations; or, there is a large number of requests. During the reporting period, CSIS ATIP took extensions on 62 requests. Of the extensions taken, 31% were due to consultations with various internal branches and 69% were attributed to interference with operations, more specifically the large volume of requests received.

7.5 – Exemptions and exclusions invoked

The Privacy Act allows institutions to exempt information from disclosure for a variety of reasons. The ATIP Section invoked 15,437 exemptions under the Privacy Act during the reporting period.

The Privacy Act excludes from disclosure information already publically available and Cabinet Confidences. No exclusions of this type were applicable to information reviewed by the ATIP Section during the reporting period.

7.6 - Consultations received from other Government of Canada institutions

During the 2024–2025 fiscal year, CSIS received 18 consultation requests under the Privacy Act involving CSIS records or CSIS information. Three consultation requests were outstanding from the previous fiscal year.

For 2024–2025, the ATIP Section closed 16 Privacy Act consultation requests totaling 1,979 pages reviewed. For 60% of those consultations, it took less than 30 days to process. The ATIP Section carried over to 2025–2026 five Privacy Act consultation requests. 

7.7 – Informal requests

The ATIP Section also acted as a resource for CSIS executives by offering advice and guidance further to provisions in the legislation. The ATIP Section provided assistance, over 14 times, on a variety of matters including, but not limited to, releases of information made by CSIS outside the parameters of the Privacy Act.

Throughout 2024–2025, the ATIP Section continued to receive telephone calls and emails from employees of CSIS as well as from the public seeking direction on how to obtain their personal information and/or how to submit a request under the Privacy Act. The ATIP Section administration team provided guidance in a professional manner and often directed these individuals to the AORS website for additional information.

8. Training and awareness

During this fiscal year, the employees of the CSIS ATIP Section and the Privacy Unit participated in a variety of deep dive sessions offered by the TBS ATIP Professionals Community Development Office. The ATIP Section continued to encourage its employees to explore other training opportunities including a variety of courses offered by CSIS, the Canada School of Public Service and other venues.

The ATIP Section continued to offer its awareness sessions through ATIP e-learning narrated slides. These form part of the employee orientation program, which is required for all new employees. All other CSIS employees have the ability to reference the narrative slides at any given time through an e-learning application. The narrated slides provided participants with an overview of the Privacy Act and the ATIA, promoted a better comprehension of individual responsibilities and obligations relating to the acts, and offered a greater understanding of the internal ATIP process. During the 2024–2025 fiscal year, 161 CSIS employees viewed the ATIP online module.

Through the 2024–2025 reporting period, the ATIP Section offered only limited in-person training sessions due to competing priorities. However, CSIS ATIP provided regular advice on the requirements of the Privacy Act to CSIS employees.

For its part, the CSIS Privacy Unit undertook a number of initiatives designed to increase awareness and educate employees of the Privacy Act obligations over the past year, setting the foundation for a robust and sustainable privacy management framework. This included the arrangement of a Privacy Act 101 learning session provided by CSIS Legal Services and made available to all CSIS employees during Privacy Awareness Week, which served as a crucial starting point for employees to understand their roles and responsibilities in protecting personal information. The Privacy Unit also arranged for the OPC to provide a panel discussion on privacy awareness, allowing employees to ask questions and learn best practices from the experts, and gain a deeper understanding of the importance of privacy impact assessments (PIAs) in identifying and mitigating privacy risks.

The Privacy Unit continued to be involved in the new intelligence officer onboarding training, ensuring that privacy considerations are integrated into the core of our operations and that employees are equipped with the knowledge and skills necessary to handle personal information responsibly. Furthermore, the Privacy Unit has proactively engaged with senior management and branches throughout the year to educate and build awareness on PIA obligations, fostering a culture of privacy awareness and compliance across the organization. The Director General and Chief, External Review and Compliance, as well as the Head of Privacy also conducted awareness sessions, involving executives, in an effort to educate and inform the leaders of the organization of their Privacy Act obligations, and to emphasize the importance of privacy leadership and accountability.

The Head of the Privacy Unit also attended the International Association of Privacy Professionals Conference, where training and professional development opportunities were pursued to enhance knowledge and stay updated on the latest trends and best practices in privacy management. This investment in professional development enabled the Privacy Unit to stay at the forefront of privacy expertise, and to provide guidance and support to CSIS employees on complex privacy issues. By building a strong foundation of privacy knowledge and expertise, CSIS is well positioned to navigate the evolving privacy landscape and to ensure that privacy considerations are integrated into all aspects of our operations.

9. Policies, guidelines, procedures and initiatives

The CSIS ATIP Section revised its procedures multiple times throughout the reporting period to deal with the drastic increase in immigration/citizenship-related requests. The amendments made to the procedures were, in most part, administrative. Because of the digitization initiative of the CSIS Information Management Branch, CSIS ATIP reviewed its workflow processes to support a shift from a paper-based environment to a digital environment. The ATIP Section responded to requesters via email rather than mailing paper or CD responses. This initiative improved the delivery of timely responses to Canadians and contributed to CSIS’ goal to decrease its reliance on paper.

The ATIP Section did not implement any specific policies related to other privacy matters this fiscal year. For their part, the Privacy Unit continued to be consulted in the drafting of CSIS policies and procedures to be compliant with the Privacy Act. The Privacy Unit also implemented the new standardized TBS PIA template.

10. Initiatives and projects to improve privacy

The CSIS ATIP Section was on-boarded to the TBS’ AORS and the ATIP Online Management Tool (AOMT) in 2023. The purpose of the AOMT is to improve service delivery to requesters; however, CSIS ATIP struggled to use it to its full capabilities. The AOMT continued to be extremely slow and required too many repetitive actions. The challenges brought forth by the AOMT combined with the drastic increase in requests this fiscal year made it unmanageable for the team to respond/close requests through the portal. Despite several updates to the AOMT, the ATIP Section continued to have difficulties with its efficiency.

The CSIS ATIP Section turned its attention to the evaluation of current and future needs to select the best option for the new Request Processing Software Solution (RPSS). Further to various discussions with the ATIP Community and lessons learned from those who were in the implementation stage, CSIS ATIP committed to the procurement and implementation of the new RPSS during the next reporting period.

In the past year, the Privacy Unit made significant strides in promoting privacy awareness across the organization in collaboration with the Employee Communications and Engagement (ECE) Branch. One of the key initiatives included a privacy-related campaign showcased on various platforms throughout CSIS locations. Privacy Awareness Week activities and communications also helped to educate employees on the importance of privacy and the role they play in protecting it.

The Privacy Unit also published a message to all employees regarding the TBS privacy implementation notice on de-identification to ensure awareness of the latest developments and requirements related to protecting sensitive information. By keeping employees informed, the Privacy Unit empowered them to make decisions and take the necessary steps to safeguard sensitive information.

To reinforce its commitment to privacy, the Privacy Unit also added all TBS privacy implementation notices (PINs) to the CSIS intranet site to highlight the importance of these notices and the role they play in guiding privacy practices.

This integration promotes a culture of transparency and accountability, and demonstrates CSIS’ dedication to adhering to the Privacy Act and the subsequent direction from TBS. Overall, the Privacy Unit’s collaborative efforts with ECE and the incorporation of TBS PINs into the intranet site demonstrate CSIS’ commitment to promoting a strong privacy culture within the organization.

11. Issues and actions taken on complaints or audits

Section 29 (1) of the Privacy Act provides requesters with the right to file a complaint with the OPC if they are not satisfied with the response to their personal information request. Reasons for complaints include the refusal of an institution to disclose personal information, personal information used and disclosed for other purposes, delays in receiving a response, etc. Sixtyeight complaints were registered with the OPC during the 2024–2025 fiscal year. Complaints received were either due to delays or to the denial of access to the personal information requested. Complaints received by the OPC represents less than 1% of the total number of Privacy Act requests received throughout the fiscal year.

OPC investigators closed and issued their findings on 59 complaints. They determined that five complaints were not well founded and two were discontinued. Forty complaints were resolved during the early resolution stage and did not require any OPC investigation. Eleven complaints were deemed well founded; however, CSIS provided sufficient information to the OPC, which did not require any further action from CSIS.

CSIS had four open complaints at the end of the 2024–2025 reporting period. The following table shows the number of open complaints that were outstanding from previous reporting periods (see Annex C - section 2.2 of the Supplemental Statistical Report on the Access to Information Act and Privacy Act).

CSIS continued to work closely with the OPC in order to resolve complaints in an efficient and timely manner. CSIS ATIP reached out to the OPC about the growing number of time delay complaints further to immigration/citizenship related requests. CSIS ATIP and the OPC worked together to develop a streamlined process, which led to the high number of time delay complaints closed at the early resolution stage. In addition, CSIS reviewed the outcome of all OPC investigations and integrated lessons learned into corporate processes where possible.

There were no court actions filed against CSIS regarding the Privacy Act during this reporting period.

12. Monitoring Compliance

There is a robust case monitoring system in place using reports produced by the ATIP case management software. The Chief, the Deputy Chief and the Unit heads monitor, on a daily basis, Privacy Act requests, the need for inter-institutional consultations and proactive publication requirements. The ATIP Coordinator conveys compliance issues to the Director General, Litigation and Disclosure Branch when required. Currently, the Privacy Unit does not have any measures in place to monitor compliance with the Privacy Act.

13. Material Breaches

CSIS did not report any material privacy breaches to the OPC or TBS during this reporting period.

14. Privacy Impact Assessments (PIA)

There were no privacy impact assessments completed during this reporting period.

15. Public Interest Disclosures

There was no disclosure made under paragraph 8(2) (m) of the Privacy Act during the reporting period.

16. Other

Throughout the 2024–2025 fiscal year, CSIS incurred $1,377,077 in salary costs and $6,639 in other costs associated with the administration of the Privacy Act. The total cost of operating the CSIS Privacy Act program during the 2024–2025 fiscal year was $1,383,716.

Annex A: Delegation Order

Privacy Act Delegation Order

The Minister of Public Safety, Democratic Institutions and Intergovernmental affairs pursuant to section 73 (1) of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Minister as the head of the Canadian Security Intelligence Service, under the provisions of the Privacy Act and related regulations set out in the Schedule opposite each position. This designation replaces all previous delegation orders.

Schedule

Positions	Authority Under the Privacy Act and regulations
Director Deputy Director, Policy and Strategic Partnerships Director General, Litigation and Disclosure Chief, Access to Information and Privacy (ATIP) Deputy Chief, ATIP Unit Head, ATIP	Full authority
Director General, External Review and Compliance	Authority limited to section 10

Dated, at the City of Ottawa, this 25 day of day of April 

The Honourable Dominic LeBlanc, P.C., K.C., M.P. 2024.

Minister of Public Safety, Democratic Institutions and Intergovernmental Affairs

Annex B: 2024–2025 Statistical Report on the Administration of the Privacy Act

Section 1: Requests under the Privacy Act

Name of institution: Canadian Security Intelligence Service (CSIS)

Reporting period: 2023-04-01 to 2025-03-31

1.1 Number of requests

	Number of requests
Received during reporting period	9,218
Outstanding from the previous period	281
Outstanding from previous reporting period	249
Outstanding from more than one reporting period	32
Total	9,499
Closed during reporting period	4,812
Carried over to the next period	4,687
Carried over within legislated timeline	945
Carried over beyond legislated timeline	3,742

1.2 Channels of requests

Source	Number of requests
Online	9,117
E-mail	98
Mail	3
In person	0
Phone	0
Fax	0
Total	9,218

Section 2: Informal requests

2.1 Number of informal requests

		Number of requests
Received during the reporting period		14
Outstanding from previous reporting periods		0
Outstanding from previous reporting period	0
Outstanding from more than one reporting period	0
Total		14
Closed during the reporting period		14
Carried over to next reporting period		0

2.2 Channels of informal requests

Source	Number of requests
Online	0
E-mail	14
Mail	0
In person	0
Phone	0
Fax	0
Total	14

2.3 Completion time of informal requests

Completion time
1 to 15 days	16 to 30 days	31 to 60 days	61 to 120 days	121 to 180 days	181 to 365 days	More than 365 days	Total
14	0	0	0	0	0	0	14

2.4 Pages released informally

Less than 100 pages released		100-500 pages released		501-1,000 pages released		1,001 - 5,000 pages released		More than 5000 pages released
Number of requests	Pages released	Number of requests	Pages released	Number of requests	Pages released	Number of requests	Pages released	Number of requests	Pages released
14	42	0	0	0	0	0	0	0	0

Section 3: Requests closed during the reporting period

3.1 Disposition and completion time

Disposition of requests	Completion time
	1 to 15 days	16 to 30 days	31 to 60 days	61 to 120 days	121 to 180 days	181 to 365 days	More than 365 days	Total
All disclosed	0	0	0	0	0	0	0	0
Disclosed in part	105	416	179	182	165	15	2	1,064
All exempted	583	1,484	462	268	211	16	1	3,025
All excluded	0	0	0	0	0	0	0	0
No records exist	83	192	47	31	32	4	0	389
Request abandoned	158	28	4	3	1	1	1	196
Neither confirm nor denied	20	79	25	12	2	0	0	138
Total	949	2,199	717	496	411	36	4	4,812

3.2 Exemptions

Section	Number of requests	Section	Number of requests	Section	Number of requests
18(2)	138	22(1)(a)(i)	4,089	23(a)	0
19(1)(a)	3	22(1)(a)(ii)	0	23(b)	0
19(1)(b)	0	22(1)(a)(iii)	0	24(a)	0
19(1)(c)	0	22(1)(b)	4,089	24(b)	0
19(1)(d)	0	22(1)(c)	1	25	1
19(1)(e)	0	22(2)	0	26	3,025
19(1)(f)	0	22.1	0	27	2
20	0	22.2	0	27.1	0
21	4,089	22.3	0	28	0
		22.4	0

3.3 Exclusions

Section	Number of requests	Section	Number of requests	Section	Number of requests
69(1)(a)	0	70(1)	0	70(1)(d)	0
69(1)(a)	0	70(1)(a)	0	70(1)(e)	0
69.1	0	70(1)(b)	0	70(1)(f)	0
		70(1)(c)	0	70.1	0

3.4 Format of information released

Paper	Electronic				Other
	E-record	Dataset	Video	Audio
32	1,028	0	0	0	0

3.5 Complexity

3.5.1 Relevant pages processed and disclosed for paper and e-record formats

Number of pages processed	Number of pages disclosed	Number of requests
23,450	12,798	4,423

3.5.2 Relevant pages processed per request disposition for paper and e-record formats by size of requests

Disposition	Less than 100 pages processed		100-500 pages processed		501-1,000 pages processed		1,001-5,000 pages processed		More than 5,000 pages processed
	Number of requests	Pages processed	Number of requests	Pages processed	Number of requests	Pages processed	Number of requests	Pages processed	Number of requests	Pages processed
All disclosed	0	0	0	0	0	0	0	0	0	0
Disclosed in part	1,037	7,985	18	3,986	4	3,911	5	7,568	0	0
All exempted	3,025	0	0	0	0	0	0	0	0	0
All excluded	0	0	0	0	0	0	0	0	0	0
Request abandoned	196	0	0	0	0	0	0	0	0	0
Neither confirm nor denied	139	0	0	0	0	0	0	0	0	0
Total	4,396	7,985	18	3,986	4	3,911	5	7,568	0	0

3.5.3 Relevant minutes processed and disclosed for audio formats

Number of minutes processed	Number of minutes disclosed	Number of requests
0	0	0

3.5.4 Relevant minutes processed per request disposition for audio formats by size of requests

Disposition	Less than 60 minutes processed		60 - 120 minutes processed		More than 120 minutes processed
	Number of requests	Minutes processed	Number of requests	Minutes processed	Number of requests	Minutes processed
All disclosed	0	0	0	0	0	0
Disclosed in part	0	0	0	0	0	0
All exempted	0	0	0	0	0	0
All excluded	0	0	0	0	0	0
Request abandoned	0	0	0	0	0	0
Neither confirm nor denied	0	0	0	0	0	0
Declined to act with the approval of the Information Commissioner	0	0	0	0	0	0
Total	0	0	0	0	0	0

3.5.5 Relevant minutes processed and disclosed for video formats

Number of minutes processed	Number of minutes disclosed	Number of requests
0	0	0

3.5.6 Relevant minutes processed per request disposition for video formats by size of requests

Disposition	Less than 60 minutes processed		60 - 120 minutes processed		More than 120 minutes processed
	Number of requests	Minutes processed	Number of requests	Minutes processed	Number of requests	Minutes processed
All disclosed	0	0	0	0	0	0
Disclosed in part	0	0	0	0	0	0
All exempted	0	0	0	0	0	0
All excluded	0	0	0	0	0	0
Request abandoned	0	0	0	0	0	0
Neither confirm nor denied	0	0	0	0	0	0
Declined to act with the approval of the Information Commissioner	0	0	0	0	0	0
Total	0	0	0	0	0	0

3.5.7 Other complexities

Disposition	Consultation required	Legal advice sought	Other	Total
All disclosed	0	0	0	0
Disclosed in part	57	0	0	57
All exempted	0	0	0	0
All excluded	0	0	0	0
Request abandoned	0	0	0	0
Neither confirm nor denied	0	0	0	0
Total	57	0	0	57

3.6 Closed requests

3.6.1 Requests closed within legislated timelines

Number of requests closed within legislated timelines	3,174
Percentage of requests closed within legislated timelines (%)	65.96

3.7 Deemed refusals

3.7.1 Reasons for not meeting legislated timelines

Number of requests closed past the legislated timelines	Principal reason
	Interference with operations/workload	External consultation	Internal consultation	Other
1,638	1,611	0	27	0

3.7.2 Requests closed beyond legislated timelines (including any extension taken)

Number of days past legislated timelines	Number of requests past legislated timeline where no extension was taken	Number of requests past legislated timeline where an extension was taken	Total
1 to 15 days	464	8	472
16 to 30 days	210	4	214
31 to 60 days	378	6	384
61 to 120 days	414	5	419
121 to 180 days	140	4	144
181 to 365 days	1	2	3
More than 365 days	2	0	2
Total	1,609	29	1,638

3.8 Requests for translation

Translation requests	Accepted	Refused	Total
English to French	0	0	0
French to English	0	0	0
Total	0	0	0

Section 4: Disclosures Under Subsection 8(2) and 8(5)

Paragraph 8(2)(e)	Paragraph 8(2)(m)	Subsection 8(5)	Total
0	0	0	0

Section 5: Requests for correction of Personal Information and Notations

Disposition for correction requests received	Number
Notations attached	0
Requests for correction accepted	1
Total	1

Section 6: Extensions

6.1 Reasons for extensions and disposition of requests

Number of requests where an extension was taken	15(a)(i) Interference with operations				15(a)(ii)Consultation			15(b) Translation purposed or conversion
	Further review required to determine exemptions	Large volume of pages	Large volume of requests	Documents are difficult to obtain	Cabinet Confidence Section (s.70)	External	Internal
62	0	43	0	0	0	0	19	0

6.2 Length of extensions

Length of Extension	15(a)(i) Interference with operations				15(a)(ii)Consultation			15(b) Translation purposed or conversion
	Further review required to determine exemptions	Large volume of pages	Large volume of requests	Documents are difficult to obtain	Cabinet Confidence section (s.70)	External	Internal
1 to 15 days	0	0	0	0	0	0	0	0
16 to 30 days	0	0	43	0	0	0	19	0
31 days or greater	0	0	0	0	0	0	0	0
total	0	0	43	0	0	0	19	0

Section 7: Consultations received from other institutions and organizations

7.1 Consultations received from other Government of Canada institutions and other organizations

Consultations	Other Government of Canada Institutions	Number of pages to review	Other organizations	Number of pages to review
Received during the reporting period	18	725	0	0
Outstanding from the previous reporting period	3	1,254	0	0
Total	21	1,979	0	0
Closed during the reporting period	16	1,963	0	0
Carried over within legislated timeline	5	16	0	0
Carried over beyond negotiated timelines	0	0	0	0

7.2 Recommendations and completion time for consultations received from other Government of Canada institutions

Recommendation	Number of days required to complete consultation requests
	1 to 15 days	16 to 30 days	31 to 60 days	61 to 120 days	121 to 180 days	181 to 365 days	More than 365 days	Total
Disclosed entirely	0	0	0	1	0	0	0	1
Disclosed in part	3	5	2	0	2	1	1	14
Exempt entirely	0	1	0	0	0	0	0	1
Exclude entirely	0	0	0	0	0	0	0	0
Consult other institution	0	0	0	0	0	0	0	0
Other	0	0	0	0	0	0	0	0
Total	3	6	2	1	2	1	1	16

7.3 Recommendations and completion time for consultations received from other organizations outside the Government of Canada

Recommendation	Number of days required to complete consultation requests
	1 to 15 days	16 to 30 days	31 to 60 days	61 to 120 days	121 to 180 days	181 to 365 days	More than 365 days	Total
Disclosed entirely	0	0	0	0	0	0	0	0
Disclosed in part	0	0	0	0	0	0	0	0
Exempt entirely	0	0	0	0	0	0	0	0
Exclude entirely	0	0	0	0	0	0	0	0
Consult other institution	0	0	0	0	0	0	0	0
Other	0	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0	0

Section 8: Completion time of consultations on Cabinet Confidences

8.1 Requests with Legal Services

Number of days	Fewer than 100 pages processed		100-500 pages processed		501-1,000 pages processed		1,001-5000 pages processed		More than 5000 pages processed
	Number of requests	Pages processed	Number of requests	Pages processed	Number of requests	Pages processed	Number of requests	Pages processed	Number of requests	Pages processed
1 to 15	0	0	0	0	0	0	0	0	0	0
16 to 30	0	0	0	0	0	0	0	0	0	0
31 to 60	0	0	0	0	0	0	0	0	0	0
61 to 120	0	0	0	0	0	0	0	0	0	0
121 to 180	0	0	0	0	0	0	0	0	0	0
181 to 365	0	0	0	0	0	0	0	0	0	0
More than 365	0	0	0	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0	0	0	0

8.2 Requests with Privy Council Office

Number of days	Fewer than 100 pages processed		100-500 pages processed		501-1,000 pages processed		1,001-5,000 pages processed		More than 5,000 pages processed
	Number of requests	Pages processed	Number of requests	Pages processed	Number of requests	Pages processed	Number of requests	Pages processed	Number of requests	Pages processed
1 to 15	0	0	0	0	0	0	0	0	0	0
16 to 30	0	0	0	0	0	0	0	0	0	0
31 to 60	0	0	0	0	0	0	0	0	0	0
61 to 120	0	0	0	0	0	0	0	0	0	0
121 to 180	0	0	0	0	0	0	0	0	0	0
181 to 365	0	0	0	0	0	0	0	0	0	0
More than 365	0	0	0	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0	0	0	0

Section 9: Complaints and investigation notices received

9.1 Investigations

Section 31	Section 33	Section 35	Court Action	Total
68	59	6	0	133

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

10.1 Privacy Impact Assessments

Number of PIAs completed	0
Number of PIAs modified	0

10.2 Institution-specific and central Personal Information Banks

Personal Information Banks	Active	Created	Terminated	Modified
Institution-specific	15	0	0	1
Central	0	0	0	0
Total	15	0	0	1

Section 11: Privacy breaches

11.1 Material privacy breaches reported

Number of material privacy breaches reported to TBS	0
Number of material privacy breaches reported to OPC	0

11.2 Non-material privacy breaches

Number of non-material privacy breaches

16

Section 12: Resources related to the Privacy Act

12.1 Allocated costs

Expenditures		Amount
Salaries		$1,377,077
Overtime		$4,464
Goods and Services		$2,175
Professional services contracts	$0
Other	$2,175
Total		$1,383,716

12.2 Human resources

Resources	Person years dedicated to privacy activities
Full-time employees	13,000
Part-time and casual employees	0,500
Regional staff	0,000
Consultants and agency personnel	0,000
Students	1,000
Total	13,500

Note: Enter values to three decimal places.

Annex C: 2024-2025 Supplemental Statistical Report

Section 1: Requests carried over and active complaints under the Access to Information Act 

Name of institution: Canadian Security Intelligence Service (CSIS)

Reporting period: 2023-04-01 to 2025-03-31

1.1 Requests carried over to next reporting period, broken down by reporting period received

1.2 Enter the number of open complaints with the Information Commissioner of Canada that are outstanding from previous reporting periods.

Section 2: Open requests and complaints under the Privacy Act

2.1 Enter the number of open requests that are outstanding from previous reporting periods.

2.2 Enter the number of open complaints with the Privacy Commissioner of Canada that are outstanding from previous reporting periods.

Section 3: Social Insurance Number (SIN)

Section 4: Universal Access under the Privacy Act