Administration of the Privacy Act - Annual Report 2023-24

1. 2023-2024 Highlights

• During the 2023-2024 fiscal year, the on-time compliance rates for Privacy Act requests stood at 96%.
• 4,125 Privacy Act requests were received during the 2023-2024 fiscal year (176% increase from the 2022-2023 fiscal year). 
• 1,551 Privacy Act requests from foreign nationals outside of Canada were received since the coming into force of Universal Access in July 2022. Of the total number of requests received, 38% came from foreign nationals. 
• 89% of the Privacy Act requests received were from individuals seeking the status of their (or someone else’s) immigration/citizenship application.

2. Introduction

The Privacy Act (hereafter the “PA”) provides all individuals with the right to access their personal information under the control of the Government of Canada. The right of access to personal information is balanced against the legitimate need to protect sensitive information and to maintain the effective functioning of government, while promoting transparency and accountability in government institutions. The PA protects an individual’s privacy by preventing others from accessing his or her personal information, and manages the collection, retention, use and disclosure of personal information.

This report is prepared and tabled in Parliament in accordance with section 72 of the Privacy Act. It covers the way in which the Canadian Security Intelligence Service (CSIS) administered the PA from April 1, 2023 to March 31, 2024.

CSIS is not reporting on behalf of wholly owned subsidiaries or non-operational institutions.

3. CSIS Mandate

CSIS has, since 1984, continued to demonstrate its value to Canadians by providing the Government of Canada with crucial information and advice linked to threats to the security of Canada and to Canadian interests. The CSIS Act gives CSIS the mandate to investigate activities suspected of constituting threats to the security of Canada, including terrorism and violent extremism, espionage and sabotage, foreign influenced activities, and subversion of government. In addition to providing advice to Government on these threats, CSIS may also take lawful measures to reduce them. CSIS also provides security assessments on individuals who require access to classified information or sensitive files within the Government of Canada as well as security advice relevant to the exercise of the Citizenship Act and the Immigration and Refugee Protection Act. Foreign intelligence collection within Canada is also conducted by CSIS at the request of the Minister of Foreign Affairs or the Minister of National Defence.

The new, ever-evolving and persistent threat environment requires a nimble and dynamic operational approach. Canadians can be confident that when CSIS carries out its duties and functions, it acts in a manner consistent with fundamental Canadian rights and freedoms and in line with its democratic values.

4. Organizational Structure

During the 2023-2024 fiscal year, the Access to Information and Privacy (ATIP) Section remained under the Deputy Director, Policy and Strategic Partnerships (DDP) Directorate. Within the Directorate, the ATIP Section is part to the Litigation and Disclosure Branch headed by the Director General. The employees of the ATIP Section are fully dedicated to the administration of both the PA and the Access to Information Act (hereafter the “ATIA”)  programs within CSIS, providing high quality and timely responses to internal and external clients including other government departments as well as providing advice to CSIS employees as they fulfill their obligations under both Acts. CSIS Legal Services Branch, staffed by Department of Justice lawyers, provides legal advice as required.

The CSIS ATIP Section had 20 full-time positions and one part-time analyst to fulfill CSIS’ obligations under the PA and the ATIA. Throughout this reporting period, the ATIP Section welcomed three new employees to fill vacant positions. As such, the team comprised of one chief (coordinator), one deputy chief, three unit heads, 12 full-time analysts, and two administrative officers. Two of the 12 analysts and one part-time analyst worked solely on the processing of historical records under the ATIA. The team also included one senior coordinator responsible for the proactive publication obligations under Part 2 of the ATIA.

During the 2023-2024 fiscal year, the ATIP Section continued to experience similar resourcing challenges as other ATIP sections across government. In order to relieve some of those pressures, the ATIP Section’s management team examined a variety of options, including the reclassification of certain positions to reflect the realities of the workload and its complexity, the creation of career progression within the Section, and resourcing levels. The ATIP Section will continue to explore options in order to meet its obligations.

The ATIP Section’s responsibilities vis-à-vis the PA are divided in two categories:

Operations

• receiving and processing all requests in accordance with the PA;
• assisting requesters in formulating their requests when required;
• gathering all pertinent records and ensuring that the search for information is rigorous and complete;
• conducting the initial review of the records and providing recommendations to the program areas;
• applying all discretionary and mandatory exemptions under the PA;
• conducting and responding to all internal and external consultations;
• consolidating the recommendations;
• assisting the Office of the Privacy Commissioner (OPC) in all privacy related matters including complaints and audits against CSIS; and
• representing CSIS in privacy litigation cases.

Policies and Procedures

• coordinating the annual Info Source update and submission to Treasury Board of Canada Secretariat (TBS);
• preparing the annual report on the administration of the PA;
• providing ongoing advice and guidance to senior management and departmental staff on all matters related to the PA;
• promoting privacy awareness and training sessions and ensuring all employees are aware of the obligations imposed by the legislation;
• monitoring departmental compliance with the PA, regulations and relevant procedures and policies;
• developing and maintaining privacy policies and guidelines, when required; and
• participating in ATIP community activities, such as TBS ATIP community meetings and various working groups.

In addition to the ATIP Section, CSIS established a dedicated Privacy Unit under the Deputy Director, Policy and Strategic Partnerships (DDP) Directorate. Within the Directorate, the Privacy Unit is part of the External Review and Compliance Branch headed by the Director General. The Unit includes three dedicated full time positions (one Head and two Analysts) responsible for ensuring that CSIS fulfills its legal obligations under the PA and related TBS policies and directives. From January to April 2024, the Privacy Unit also employed one full-time CO-OP student. 

The day-to-day programs and activities of the Privacy Unit include:

• providing consultative services and advice to all employees on privacy-related inquiries;
• assisting with the development and approval of Privacy Impact Assessments (PIA), a risk-management tool that focuses on ensuring compliance to the PA, as required by the TBS Directives on PIAs; and
• reviewing and investigating corporate and operational compliance with privacy breaches, and notifies the OPC and TBS of material breaches including the measures taken to mitigate them.

As defined in section 73.1 of the PA, CSIS did not provide or receive services related to any power, duty or function to or from another government institution, during this reporting period. 

5. Delegation Order

In accordance with section 73(1) of the PA, a delegation order signed by the Minister of Public Safety and Emergency Preparedness designates the persons holding certain positions to exercise and perform the duties of the Minister as Head of the institution. In the case of CSIS, these positions consist of the Director of CSIS, the Deputy Director of the Policy and Strategic Partnerships Directorate, the Director General of the Litigation and Disclosure Branch, as well as the Chief, Deputy Chief and unit Heads of the ATIP Section.

The delegation order issued by the Honourable Marco E. L. Mendicino, P.C., M.P. on April 24, 2022 remained in effect at the end of this reporting period. A new delegation order issued by the Honourable Dominic LeBlanc, P.C., M.P. will be included as part of the 2024-2025 Privacy Act annual report. 

6. Interpretation of the 2023-2024 statistical report for requests under the Privacy Act

Every year, TBS requires institutions to submit a statistical report on their administration of the PA, which contains cumulative data on the application of the legislation during the fiscal year. The CSIS Statistical Report and Supplemental Report for 2023-2024 are included in Annex B and Annex C of this report. The statistics included in this report have been rounded to the nearest decimal point.

As indicated in table 1, CSIS received 4,125 requests between April 1, 2023 and March 31, 2024. This represents a 176% increase from the requests received during the previous reporting period. CSIS had 132 outstanding requests at the end of the 2022-2023 reporting period. Of those 132 requests, 121 were received during that fiscal year and 11 remained outstanding for more than one reporting period.

As of the end of the 2023-2024 fiscal year, 281 requests were carried over to the next fiscal year (see section 2.1 of Annex C). A total of 89% of those active requests were within their legislated timelines as of March 31, 2024 and 11% were beyond their legislated timelines as of that same date. 

6.1 - Sources of requests

The 4,125 requests received during this reporting period came from various sources. A total of 75% came from members of the public who, mostly, were seeking the status of their citizenship and immigration application. A total of 8% of requests came from businesses such as law offices looking for the personal information of their clients in relation to the status of their immigration and citizenship application. A total of 91% of requests were submitted through the ATIP Online Request Service (AORS). The remaining 9% were received by email or by mail.

It is important to highlight the significant increase in requests resulting from the coming-into-force of Universal Access under the PA. Of the 4,125 requests received, 1,551 were from foreign nationals outside of Canada seeking the status of their immigration/citizenship applications. Foreign nationals represented 38% of requesters. Compared to the previous reporting period, where 222 requests were from foreign nationals, there was a 598% increase in requests from foreign nationals during this fiscal year.

6.2 - Disposition of completed requests

The ATIP Section successfully closed 3,976 requests during the 2023-2024 reporting period: 35% were closed within 1 to 15 days, 54% were closed within 16 to 30 days and 11% took over 31 days to close. Concerning these requests, there were none where the records were all disclosed, 15% were disclosed in part, 59% were all exempt, 13% did not exist, 8% were abandoned, and for 5%, the existence could be neither confirmed nor denied.  The substantial increase in the all exempt disposition resulted from the increase in requests from individuals regarding the status of their immigration/citizenship applications.

6.3 - Deemed refusals

Out of the 3,976 requests closed during this reporting period, the ATIP Section successfully closed 3,819 requests (96%) within the legislated timelines; however, the remaining 157 requests (4%) were closed past the legislated timelines. Out of those 157 requests, extensions were taken on 39%. The three main reasons for requests being closed past their legislated timelines were the interference with operations, the need to consult other government departments on classified records, and a significant increase in workload without additional resources.

6.4 - Extensions

The legislation allows for extensions when:

• the response requires internal or external consultations;
• there is a large amount of records;
• the review could interfere with CSIS operations;
• or, there is a large number of requests.

During the reporting period, extensions were taken on 185 requests. Of the extensions taken, 30% were due to consultations with various internal branches, 35% due to consultations with other government departments, and 35% due to the interference with operations/heavy workload.

6.5 – Exemptions and exclusions invoked

The PA allows institutions to exempt information from being released for a variety of reasons. The ATIP Section invoked 8,486 exemptions under the PA during the reporting period. 

The PA excludes from disclosure information already publically available and Cabinet Confidences. No exclusions of this type were applicable to information reviewed by the ATIP Section during the reporting period.

6.6 - Consultations received from other Government of Canada institutions

During the 2023-2024 fiscal year, CSIS received twelve consultation requests under the PA involving CSIS records or CSIS information. Two consultation requests were outstanding from the 2022-2023 fiscal year.

For this reporting period, the ATIP Section closed 11 PA consultation requests totaling 282 pages reviewed and processed in less than 15 days for 73% of the consultations. Three PA consultation requests were carried over to the next fiscal year. 

6.7 – Informal requests

The ATIP Section also acted as a resource for CSIS executives by offering advice and guidance further to provisions in the legislation. The ATIP Section provided assistance, over 17 times, on a variety of matters including, but not limited to, releases of information made by CSIS outside the parameters of the PA.  

Throughout 2023-2024, the ATIP Section continued to receive telephone calls and emails from employees of CSIS as well as from the public seeking direction on how to obtain their personal information and/or how to submit a request under the PA. The ATIP Section administration team provided guidance in a professional manner and often directed these individuals to the AORS website for additional information.

7. Training and Awareness

During this fiscal year, the employee’s of the CSIS ATIP Section and the Privacy Unit participated in a variety of deep dive sessions offered by the Treasury Board of Canada Secretariat’s (TBS) ATIP Professionals Community Development Office (APCDO). The three new employees who joined the CSIS ATIP Section participated in the onboarding sessions for new ATIP professionals also offered by the APCDO. The ATIP Section continued to encourage its employees to explore other training opportunities including a variety of courses offered by CSIS, the Canada School of Public Service (CSPS) and other venues.

Through the 2023-2024 reporting period, the ATIP Section was able to continue to offer in-person training sessions. At the request of several CSIS branches, senior ATIP Analysts delivered valuable ATIP training sessions to employees on a variety of ATIP related topics.

The ATIP Section continued to offer its awareness sessions through ATIP e-learning narrated slides. The narrated slides form part of the employee orientation program, which is required for all new employees. All other CSIS employees have the ability to reference the narrative slides at any given time through an e-learning application. The narrated slides provided participants with an overview of the PA and the ATIA, promoted a better comprehension of individual responsibilities and obligations relating to the Acts, and offered a greater understanding of the internal ATIP process. During the 2023-2024 fiscal year, 421 CSIS employees viewed the ATIP online module.

During Privacy Awareness Week 2024, the Privacy Unit published one article per day on the CSIS Intranet. The articles explained CSIS’ organizational responsibilities under the PA. In addition, the Privacy Unit published a news bulletin announcing a government-wide information session on privacy (offered by CSPS) and encouraged all employees to participate. Training sessions were presented to operational employees and the Office of the Privacy Commissioner provided a presentation on the Interplay between privacy and security, information sharing and surveillance.

8. Policies, Guidelines, Procedures and Initiatives

The CSIS ATIP Section revised its procedures to deal with the coming into effect of Universal Access under the PA. This included the development of a robust process to verify identity in order to comply with the requirements of the Directive on Personal Information Requests and Correction of Personal Information.

During this fiscal year, procedures were amended because of the drastic increase in requests further to the coming into force of Universal Access under the PA as well as the on boarding to the AORS and the ATIP Online Management Tool (AOMT). The amendments made to the procedures were in most part administrative. The ATIP Section also began responding to requesters via email rather than mailing paper/CD responses. This initiative improved the delivery of timely responses to Canadians and reduced the CSIS’s paper consumption. The ATIP Section did not implement any policies related to any other privacy matters this fiscal year.  

The Privacy Unit updated the privacy breach assessments, privacy needs assessments, and PIA templates. It also introduced the requirement for the Operational Policy Unit to consult them regularly, prior to the publishing of new or modified policies, directives, and procedures. The implementation of this requirement ensured compliance with the PA and related TBS policies and directives.

9. Initiatives and Projects to Improve Privacy

The CSIS ATIP Section was on-boarded to the TBS’ AORS and the AOMT during the end of the previous fiscal year. While the purpose of the AOMT is meant to improve service delivery to requesters, the CSIS ATIP Section struggled to use it to its full capabilities. The AOMT continued to be extremely slow and required too many repetitive actions. The challenges brought forth by the AOMT combined with the drastic increase in requests this fiscal year, made it unmanageable for the team to respond/close requests through the portal. Despite several updates to the AOMT, the ATIP Unit continued to have difficulties with its efficiency.

Due to a significant increase in requests/workload and limited resources, the CSIS ATIP Section was unable to turn its attention to evaluate current and future needs to choose the best option for the new Request Processing Software Solution (RPSS). A decision had not been taken by the end of the fiscal period, however, the ATIP Section committed to the procurement of a new RPSS during the next reporting period.

The transformation of the ATIP Section continued to take place.  ATIP management worked diligently over the past few fiscal years to modernize its organizational structure and grow its team. It was determined that the creation of career progression was essential to retain ATIP expertise at CSIS and to maintain CSIS’ high delivery of ATIP standards and requirements to Canadians. While several roadblocks occurred during the reporting period, ATIP management is committed to continue pushing for its modernization.

The Privacy Unit increased its engagement with the OPC and TBS to determine privacy best practices and establish a comprehensive Privacy program to sensitize the organization to the PA. It also consulted with various departments and agencies to learn from their best practices. The Privacy Unit launched a dedicated intranet site for all-employees to easily access information related to the PA and TBS policies and directives. It displays helpful and practical articles related to privacy entitled:

• Know your obligations under the PA
• Privacy by Design – Be proactive, not reactive!
• What is a PIA and when is it required?
• What is a privacy breach?

The Head of the Privacy Unit sat on an operational committee dedicated to technology and the Chief responsible for the Unit sat on a review board responsible for enterprise technology decisions.This allowed the Privacy Unit to identify and facilitate CSIS applying a privacy lens early in the decision-making process regarding new operational tools, technology and programs being contemplated by CSIS for an administrative purpose.

10. Issues and Actions Taken on Complaints or Audits

Section 29 (1) of the PA provides requesters with the right to file a complaint with the OPC if they are not satisfied with the response to their personal information request. Reasons for complaints include the refusal of an institution to disclose personal information, personal information used and disclosed for other purposes, delays in receiving a response, etc. Twenty-three complaints were registered with the OPC during the 2023-2024 fiscal year.  This represents less than 1% of the total number of PA requests received throughout the fiscal year. 

OPC investigators closed and issued their findings on 11 complaints.  They determined that four complaints were not well founded. Two complaints were deemed well founded; however, they were resolved and did not require any further action from CSIS. The remaining complaints closed were either discontinued or resolved without an OPC investigation. 

CSIS had 26 open complaints at the end of the 2023-2024 reporting period. The following table shows the number of open complaints that were outstanding from previous reporting periods (see Annex C - section 2.2 of the Supplemental Statistical Report on the Access to Information and Privacy Acts).

CSIS continues to work closely with the OPC in order to resolve complaints in an efficient and timely manner. CSIS reviews the outcome of all investigations by the OPC and where appropriate, integrates lessons learned into corporate processes.

There were two Court actions filed against CSIS regarding the PA during this reporting period. The Court proceedings on these actions remain ongoing.

11. Monitoring Compliance

The unit Heads are responsible for monitoring compliance under the PA and reporting issues to the Chief, ATIP. The monitoring is conducted via reports produced by the ATIP Case Management Software. The ATIP Coordinator conveys compliance issues to the Director General, Litigation and Disclosure Branch when required.

The Privacy Unit monitors compliance relating to PIAs, Privacy Breaches and other privacy related matters. Issues are reported to the Head of the Privacy Unit and to the Director General of the External Review and Compliance Branch when necessary.

12. Material Breaches

CSIS did not report any material privacy breaches to the OPC (or TBS) during this reporting period.

13. Privacy Impact Assessments (PIA)

There were no PIAs completed during this reporting period.

14. Public Interest Disclosures

There was no disclosure made under paragraph 8(2) (m) of the PA during the reporting period.

15. Other

Throughout the 2023-2024 fiscal year, CSIS incurred $1,227,385 in salary costs and $9,196 in other costs associated with the administration of the PA.  The total cost of operating the CSIS Privacy Act program during the 2023-2024 fiscal year was $1,238,915.

2023-2024 Statistical Report on the Privacy Act

Name of institution: Canadian Security Intelligence Service (CSIS)

Reporting period: 2023-04-01 to 2024-03-31

Section 1: Requests Under the Privacy Act

1.1 Number of requests

	Number of Requests
Received during reporting period	4,125
Outstanding from the previous period	132
Outstanding from previous reporting period	121
Outstanding from more than one reporting period	11
Total	4,257
Closed during reporting period	3,976
Carried over to the next period	281
Carried over within legislated timeline	249
Carried over beyond legislated timeline	32

1.2 Channels of requests

Source	Number of Requests
Online	3,761
E-mail	345
Mail	19
In person	0
Phone	0
Fax	0
Total	4,125

Section 2: Informal Requests

2.1 Number of informal requests

		Number of Requests
Received during the reporting period		17
Outstanding from previous reporting periods		0
Outstanding from previous reporting period	0
Outstanding from more than one reporting period	0
Total		17
Closed during the reporting period		17
Carried over to next reporting period		0

2.2 Channels of informal requests

Source	Number of Requests
Online	0
E-mail	17
Mail	0
In person	0
Phone	0
Fax	0
Total	17

2.3 Completion time of informal requests

Completion Time
1 to 15 Days	16 to 30 Days	31 to 60 Days	61 to 120 Days	121 to 180 Days	181 to 365 Days	More Than 365 Days	Total
9	6	2	0	0	0	0	17

2.4 Pages released informally

Less than 100 pages released		100-500 Pages released		501-1,000 Pages released		1,001 - 5,000 Pages released		More Than 5000 Pages released
Number of requests	Pages released	Number of requests	Pages released	Number of requests	Pages released	Number of requests	Pages released	Number of requests	Pages released
16	59	1	152	0	0	0	0	0	0

Section 3: Requests Closed During the Reporting Period

3.1 Disposition and completion time

Disposition of Requests	Completion Time
	1 to 15 Days	16 to 30 Days	31 to 60 Days	61 to 120 Days	121 to 180 Days	181 to 365 Days	More than 365 Days	Total
All disclosed	0	0	0	0	0	0	0	0
Disclosed in part	120	344	71	72	5	0	0	612
All exempted	783	1,460	38	30	3	0	0	2,314
All excluded	0	0	0	0	0	0	0	0
No records exist	226	255	29	10	1	0	0	521
Request abandoned	271	35	2	3	0	0	0	311
Neither confirm nor denied	61	140	7	9	1	0	0	218
Total	1,461	2,234	147	124	10	0	0	3,976

3.2 Exemptions

Section	Number of Requests	Section	Number of Requests	Section	Number of Requests
18(2)	218	22(1)(a)(i)	2,234	23(a)	0
19(1)(a)	4	22(1)(a)(ii)	0	23(b)	0
19(1)(b)	0	22(1)(a)(iii)	1	24(a)	0
19(1)(c)	0	22(1)(b)	2,221	24(b)	0
19(1)(d)	0	22(1)(c)	0	25	2
19(1)(e)	0	22(2)	0	26	1,553
19(1)(f)	0	22.1	0	27	3
20	0	22.2	0	27.1	0
21	2,250	22.3	0	28	0
		22.4	0

3.3 Exclusions

Section	Number of Requests	Section	Number of Requests	Section	Number of Requests
69(1)(a)	0	70(1)	0	70(1)(d)	0
69(1)(a)	0	70(1)(a)	0	70(1)(e)	0
69.1	0	70(1)(b)	0	70(1)(f)	0
		70(1)(c)	0	70.1	0

3.4 Format of information released

Paper	Electronic				Other
	E-record	Dataset	Video	Audio
139	473	0	0	0	0

3.5 Complexity

3.5.1 Relevant pages processed and disclosed for paper and e-record formats

Number of Pages Processed	Number of Page Disclosed	Number of Requests
32,827	14,638	3,455

3.5.2 Relevant pages processed per request disposition for paper and e-record formats by size of requests

Disposition	Less than 100 Pages Processed		100-500 Pages Processed		501-1,000 Pages Processed		1,001-5,000 Pages Processed		More than 5,000 Pages Processed
	Number of Requests	Pages Processed	Number of Requests	Pages Processed	Number of Requests	Pages Processed	Number of Requests	Pages Processed	Number of Requests	Pages Processed
All disclosed	0	0	0	0	0	0	0	0	0	0
Disclosed in part	545	9,801	61	13,284	2	1,204	4	8,030	0	0
All exempted	2,313	79	1	414	0	0	0	0	0	0
All excluded	0	0	0	0	0	0	0	0	0	0
Request abandoned	231	218	1	109	0	0	0	0	0	0
Neither confirm nor denied	218	0	0	0	0	0	0	0	0	0
Total	3,387	9,895	62	13,698	2	1,204	4	8,030	0	0

3.5.3 Relevant minutes processed and disclosed for audio formats

Number of Minutes Processed	Number of Minutes Disclosed	Number of Requests
0	0	0

3.5.4 Relevant minutes processed per request disposition for audio formats by size of requests

Disposition	Less than 60 Minutes Processed		60 - 120 Minutes Processed		More than 120 Minutes Minutes Processed
	Number of Requests	Minutes Processed	Number of Requests	Minutes Processed	Number of Requests	Minutes Processed
All disclosed	0	0	0	0	0	0
Disclosed in part	0	0	0	0	0	0
All exempted	0	0	0	0	0	0
All excluded	0	0	0	0	0	0
Request abandoned	0	0	0	0	0	0
Neither confirm nor denied	0	0	0	0	0	0
Declined to act with the approval of the Information Commissioner	0	0	0	0	0	0
Total	0	0	0	0	0	0

3.5.5 Relevant minutes processed and disclosed for video formats

Number of Minutes Processed	Number of Minutes Disclosed	Number of Requests
0	0	0

3.5.6 Relevant minutes processed per request disposition for video formats by size of requests

Disposition	Less than 60 Minutes Processed		60 - 120 Minutes Processed		More than 120 Minutes Minutes Processed
	Number of Requests	Minutes Processed	Number of Requests	Minutes Processed	Number of Requests	Minutes Processed
All disclosed	0	0	0	0	0	0
Disclosed in part	0	0	0	0	0	0
All exempted	0	0	0	0	0	0
All excluded	0	0	0	0	0	0
Request abandoned	0	0	0	0	0	0
Neither confirm nor denied	0	0	0	0	0	0
Declined to act with the approval of the Information Commissioner	0	0	0	0	0	0
Total	0	0	0	0	0	0

3.5.7 Other complexities

Disposition	Consultation Required	Legal Advice Sought	Other	Total
All disclosed	0	0	0	0
Disclosed in part	139	0	0	139
All exempted	3	0	0	3
All excluded	0	0	0	0
Request abandoned	3	0	0	3
Neither confirm nor denied	0	0	0	0
Total	145	0	0	145

3.6 Closed requests

3.6.1 Requests closed within legislated timelines

Number of requests closed within legislated timelines	3,819
Percentage of requests closed within legislated timelines (%)	96,05130785

3.7 Deemed refusals

3.7.1 Reasons for not meeting legislated timelines

Number of requests closed past the legislated timelines	Principal Reason
	Interference with operations/workload	External Consultation	Internal Consultation	Other
157	84	34	32	7

3.7.2 Requests closed beyond legislated timelines (including any extension taken)

Number of days past legislated timelines	Number of requests past legislated timeline where no extension was taken	Number of requests past legislated timeline where an extension was taken	Total
1 to 15 days	33	21	54
16 to 30 days	5	25	30
31 to 60 days	20	11	31
61 to 120 days	37	5	42
121 to 180 days	0	0	0
181 to 365 days	0	0	0
More than 365 days	0	0	0
Total	95	62	157

3.8 Requests for translation

Translation Requests	Accepted	Refused	Total
English to French	0	0	0
French to English	0	0	0
Total	0	0	0

Section 4: Disclosures Under Subsection 8(2) and 8(5)

Paragraph 8(2)(e)	Paragraph 8(2)(m)	Subsection 8(5)	Total
0	0	0	0

Section 5: Requests for Correction of Personal Information and Notations

Disposition for Correction Requests Received	Number
Notations attached	0
Requests for correction accepted	1
Total	1

Section 6: Extensions

6.1 Reasons for extensions and disposition of requests

Number of requests where an extension was taken	15(a)(i) Interference with operations				15(a)(ii)Consultation			15(b) Translation purposed or conversion
	Further review required to determine exemptions	Large volume of pages	Large volume of requests	Documents are difficult to obtain	Cabinet Confidence Section (s.70)	External	Internal
185	0	0	64	0	0	65	56	0

6.2 Length of extensions

Length of Extension	15(a)(i) Interference with operations				15(a)(ii)Consultation			15(b) Translation purposed or conversion
	Further review required to determine exemptions	Large volume of pages	Large volume of requests	Documents are difficult to obtain	Cabinet Confidence Section (s.70)	External	Internal
1 to 15 days	0	0	0	0	0	0	0	0
16 to 30 days	0	0	64	0	0	65	56	0
31 days or greater	0	0	0	0	0	0	0	0
total	0	0	64	0	0	65	56	0

Section 7: Consultations Received from Other Institutions and Organizations

7.1 Consultations received from other Government of Canada institutions and other organizations

Consultations	Other Government of Canada Institutions	Number of Page to Review	Other Organizations	Number of Page to Review
Received during the reporting period	12	1,527	0	0
Outstanding from the previous reporting period	2	9	0	0
Total	14	1,536	0	0
Closed during the reporting period	11	282	0	0
Carried over within legislated timeline	3	1,254	0	0
Carried over beyond negotiated timelines	0	0	0	0

7.2 Recommendations and completion time for consultations received from other Government of Canada institutions

Recommendation	Number of Days Required to Complete Consultation Requests
	1 to 15 Days	16 to 30 Days	31 to 60 Days	61 to 120 Days	121 to 180 Days	181 to 365 Days	More Than 365 Days	Total
Disclosed entirely	2	0	0	0	0	0	0	2
Disclosed in part	6	2	0	1	0	0	0	9
Exempt entirely	0	0	0	0	0	0	0	0
Exclude entirely	0	0	0	0	0	0	0	0
Consult other institution	0	0	0	0	0	0	0	0
Other	0	0	0	0	0	0	0	0
Total	8	2	0	1	0	0	0	12

7.3 Recommendations and completion time for consultations received from other organizations outside the Government of Canada

Recommendation	Number of Days Required to Complete Consultation Requests
	1 to 15 Days	16 to 30 Days	31 to 60 Days	61 to 120 Days	121 to 180 Days	181 to 365 Days	More Than 365 Days	Total
Disclosed entirely	0	0	0	0	0	0	0	0
Disclosed in part	0	0	0	0	0	0	0	0
Exempt entirely	0	0	0	0	0	0	0	0
Exclude entirely	0	0	0	0	0	0	0	0
Consult other institution	0	0	0	0	0	0	0	0
Other	0	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0	0

Section 8: Completion Time of Consultations on Cabinet Confidences

8.1 Requests with Legal Services

Number of days	Fewer than 100 Pages Processed		100-500 Pages Processed		501-1,000 Pages Processed		1,001-5000 Pages Processed		More than 5000 Pages Processed
	Number of Requests	Pages Processed	Number of Requests	Pages Processed	Number of Requests	Pages Processed	Number of Requests	Pages Processed	Number of Requests	Pages Processed
1 to 15	0	0	0	0	0	0	0	0	0	0
16 to 30	0	0	0	0	0	0	0	0	0	0
31 to 60	0	0	0	0	0	0	0	0	0	0
61 to 120	0	0	0	0	0	0	0	0	0	0
121 to 180	0	0	0	0	0	0	0	0	0	0
181 to 365	0	0	0	0	0	0	0	0	0	0
More than 365	0	0	0	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0	0	0	0

8.2 Requests with Privy Council Office

Number of days	Fewer than 100 Pages Processed		100-500 Pages Processed		501-1,000 Pages Processed		1,001-5000 Pages Processed		More than 5000 Pages Processed
	Number of Requests	Pages Processed	Number of Requests	Pages Processed	Number of Requests	Pages Processed	Number of Requests	Pages Processed	Number of Requests	Pages Processed
1 to 15	0	0	0	0	0	0	0	0	0	0
16 to 30	0	0	0	0	0	0	0	0	0	0
31 to 60	0	0	0	0	0	0	0	0	0	0
61 to 120	0	0	0	0	0	0	0	0	0	0
121 to 180	0	0	0	0	0	0	0	0	0	0
181 to 365	0	0	0	0	0	0	0	0	0	0
More than 365	0	0	0	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0	0	0	0

Section 9: Complaints and Investigation Notices Received

9.1 Investigations

Section 31	Section 33	Section 35	Court Action	Total
23	11	13	2	49

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

10.1 Privacy Impact Assessments

Number of PIAs completed	0
Number of PIAs modified	0

10.2 Institution-specific and Central Personal Information Banks

Personal Information Banks	Active	Created	Terminated	Modified
Institution-specific	16	0	0	0
Central	0	0	0	0
Total	16	0	0	0

Section 11: Privacy Breaches

11.1 Material Privacy Breaches Reported

Number of material privacy breaches reported to TBS	0
Number of material privacy breaches reported to OPC	0

11.2 Non-Material Privacy Breaches

Number of non-material privacy breaches

2

Section 12: Resources Related to the Privacy Act

12.1 Allocated Costs

Expenditures		Amount
Salaries		$1,227,385
Overtime		$2,334
Goods and Services		$9,196
Professional services contracts	$0
Other	$9,196
Total		$1,238,915

12.2 Human Resources

Resources	Person Years Dedicated to Privacy Activities
Full-time employees	14,000
Part-time and casual employees	0,000
Regional staff	0,000
Consultants and agency personnel	0,000
Students	1,000
Total	15,000

2023-2024 Supplemental Statistical Report on the Access to Information Act and the Privacy Act

Name of institution: Canadian Security Intelligence Service (CSIS)

Reporting period: 2023-04-01 to 2024-03-31

Section 1: Open Requests and Complaints under the Access to Information Act

1.1 Enter the number of open requests that are outstanding from previous reporting periods.

1.2 Enter the number of open complaints with the Information Commissioner of Canada that are outstanding from previous reporting periods.

Section 2: Open Requests and Complaints under the Privacy Act

2.1 Enter the number of open requests that are outstanding from previous reporting periods.

2.2 Enter the number of open complaints with the Privacy Commissioner of Canada that are outstanding from previous reporting periods.

Section 3: Social Insurance Number (SIN)

Section 4: Universal Access under the Privacy Act