2017 to 2018 Annual Report on the Privacy Act

On this page

• Mandate of the Treasury Board of Canada Secretariat
• Organization
• Delegation Order
• Interpretation of the statistical report for requests under the Privacy Act
• Other requests
• Disposition of completed requests
• Completion time and extensions
• Exemptions invoked
• Exclusions invoked
• Costs
• Education and training
• Policies, guidelines, procedures and initiatives
• Complaints, investigations and federal court cases
• Monitoring of compliance and requests for corrections
• Summary of material privacy breaches
• Privacy Impact Assessments
• Disclosures under paragraph 8(2)(m) of the Privacy Act
• Information about programs and information holdings
• Appendix A: Statistical Report on the Privacy Act
• Appendix B: Delegation Order

2. Mandate of the Treasury Board of Canada Secretariat

As the administrative arm of the Treasury Board, the Secretariat has a dual mandate: to support the Treasury Board as a committee of ministers and to fulfill the statutory responsibilities of a central government agency. The Treasury Board’s mandate is derived from the Financial Administration Act.

To fulfill its mandate, the Secretariat has 3 roles:

• a challenge and oversight role, which includes supporting Cabinet decision making, reporting on the government’s management and budgetary performance, and developing government-wide management policies and directives
• a community enabling role, which involves helping organizations improve management performance and program results
• a leadership role, which involves driving and modelling excellence in public sector practices

The Secretariat is tasked with providing advice and support to Treasury Board ministers in their role of ensuring value-for-money, as well as providing oversight of the financial management functions in departments and agencies.

The Secretariat makes recommendations and provides advice to the Treasury Board on policies, directives, regulations, and program expenditure proposals with respect to the management of the government's resources. Its responsibilities for the general management of the government affect initiatives, issues, and activities that cut across all policy sectors managed by federal departments and organizational entities (as reported in the Main Estimates). The Secretariat is also responsible for the comptrollership function of government.

Within the Secretariat, the Comptroller General of Canada provides government-wide leadership, direction, oversight and capacity building for financial management, internal audit and the management of assets and acquired services. The Chief Human Resources Officer provides government-wide leadership on people management through policies, programs and strategic engagements, and by centrally managing labour relations, compensation, pensions and benefits, and contributing to the management of executives. The Chief Information Officer provides government-wide leadership, direction, oversight and capacity building for information management, information technology, government security (including identity management), access to information, privacy, and internal and external service delivery.

3. Organization

The Access to Information and Privacy (ATIP) Office is part of the Ministerial Services Division of the Secretariat’s Strategic Communications and Ministerial Affairs Sector. This office is responsible for implementing and managing programs and services relating to the Secretariat’s administration of the Access to Information Act and Privacy Act, as well as providing advice to its employees as they fulfill their obligations under both acts.

In fiscal year 2017 to 2018, the ATIP Office was comprised of a director supported by ATIP officers at various levels and a part-time university student. A consultant and a part-time casual employee were also hired for 6-month contracts to assist with the backlog of operational files. There were 2 categories of responsibility, which included the following key activities:

ATIP Policy and Processes (3.15 officers)

• Provided expertise on privacy policy to internal clients
• Developed procedures to optimize operations performance
• Produced privacy awareness and training program material
• Coordinated and reviewed updates to the Secretariat’s Info Source chapter
• Oversaw day-to-day issues management
• Prepared the Secretariat’s annual reports to Parliament on the administration of the acts
• Provided advice and review of proactive disclosures and C-58 preparation

Operations (9 officers, 1 consultant (6-month contract) and 1 part-time student)

• Provided training and expertise on access to information to internal clients
• Provided database administration via an intake unit
• Processed access to information and privacy requests
• Carried out consultations with government organizations or third parties
• Responded to calls and informal requests for information
• Maintained dialogue with sectors and other federal government institutions
• Acted as the point of contact to resolve formal complaints by oversight bodies

4. Delegation Order

Delegation orders set out what powers, duties and functions for the administration of the Privacy Act have been delegated by the head of the institution, and to whom. The ATIP Delegation Order was updated in February 2016.

The President has delegated most of the responsibilities of the Privacy Act to the following Secretariat officials: the Assistant Secretary of Strategic Communications and Ministerial Affairs, the Senior Director of Ministerial Services, and the Director of ATIP. The Secretary has been delegated responsibilities for addressing complaints not resolved between the ATIP Office and investigators from the Office of the Privacy Commissioner. In an effort to streamline the ATIP process, sections of the Delegation Order that allow for time extensions in the processing of requests have been extended to senior officers within the ATIP Office.

A copy of the approved Secretariat Delegation Order can be found in Appendix B.

5. Interpretation of the statistical report for requests under the Privacy Act

Statistical reporting on the administration of the Access to Information Act and the Privacy Act has been in place since 1983. The statistical reports prepared by government institutions provide aggregate data on the application of the Access to Information Act and Privacy Act legislation. This information is compiled on an annual basis in a statistical information bulletin and is included with the annual reports on access to information and privacy, which are tabled in Parliament by each institution.

The Secretariat’s statistical report on the Privacy Act for fiscal year 2017 to 2018 is provided in Appendix A.

Table 1 presents an overview of the statistics for fiscal year 2017 to 2018 on the Secretariat’s processing of privacy requests in relation to statistics for the previous 3 years.

In the reporting period from April 1, 2017, to March 31, 2018, the Secretariat received a total of 93 new requests under the Privacy Act. This represents a decrease of 4 requests (4%) from last year’s total of 97. In addition to the new requests, 8 requests were carried forward from the 2016 to 2017 fiscal year.

Many of the new requests filed under the Privacy Act were from current and former federal public service employees. Requests had to do with personnel or staff relations issues that required the Secretariat’s involvement.

In fiscal year 2017 to 2018, the Secretariat’s ATIP Office responded to a total of 93 requests for personal information under the Privacy Act, involving the review of 5,089 pages. Although 14 fewer requests (15% less) were completed compared to last year, the number of pages processed was comparable to the total of 6,112 pages reviewed in fiscal year 2016 to 2017.

Of the 93 requests completed, 63 were either abandoned by the applicant (22 requests or 24%) or categorized as “no records exist” (41 requests or 44%) as most were related to subjects within the mandates of other federal institutions. In these cases, the ATIP Office communicated with the requester to redirect them to the institution of greater interest as part of its duty to assist.

Of the remaining 30 requests completed, a total of 30 requests (32%) were fully or partially disclosed with a release of 4,054 pages in total. Records were sought and provided on paper in 8 cases and in electronic format in 22 cases. The release of records in electronic format increased by 17% compared to the previous year where 8 requests were provided electronically.

A total of 8 requests were carried over to the next reporting period. This is the same as last year’s total. Furthermore, 2 requests were late (deemed refusals) compared to last year’s total of 4.

Although the number of staffing activities continued to present a challenge within the ATIP Office again this year, the Secretariat was successful in achieving a 98% on-time compliance rate, an improvement of 2% over last year.

6. Other requests

During the reporting period, the Secretariat responded to 9 Privacy consultation requests under the Privacy Act from other government institutions involving Secretariat records or issues.

As in previous years, the ATIP Office acted as a source of expertise for Secretariat officials, providing advice and guidance on the provisions of the legislation on 270 occasions. The Office was consulted regularly on the disclosure and collection of data on a wide range of subjects, and provided advice to ensure transparency and compliance with the legislation. This included consultations on publications to be posted on the Open Government website, surveys and forms, and proactive disclosures on travel and hospitality; advice on information management and security of information; and the review of audits to be posted on the Internet.

Throughout the year, the ATIP Office continued to receive frequent telephone calls and emails from the general public seeking guidance on how to obtain information under the Access to Information Act and the Privacy Act, and where to forward their requests. Many of these enquiries were redirected to other federal government institutions, and occasionally, to provincial Freedom of Information and Privacy offices.

7. Disposition of completed requests

In fiscal year 2017 to 2018, a total of 93 requests were completed. Table 2 provides an overview of the disposition of the completed requests.

Given that the President of the Treasury Board is responsible for ensuring compliance with the Access to Information Act and the Privacy Act government-wide, the Secretariat often receives requests that fall within the mandates of other federal organizations. Such requests are registered, reviewed and closed after advising the requester of the appropriate organization. In Table 2, these requests are included in the totals for the “No records exist” category.

8. Completion time and extensions

The legislation sets timelines for responding to privacy requests and allows for extensions when the response requires the review of a large amount of information, consultations with other organizations, or extra time for translation purposes.

Table 3 presents the response times for the 93 requests that the Secretariat completed in fiscal year 2017 to 2018.

The Secretariat received a large number of requests that fell within the mandates of other government organizations; these requests were addressed within the first 15 days following conversations with the requester.

Of the 93 completed requests, 91 (98%) were completed within the prescribed time limits, including all extensions, which were taken in accordance with sub-paragraphs 15(a)(i) and 15(a)(ii) of the Privacy Act. Compared to the previous reporting period, this represents an overall increase of 2% in the on-time response rate. Two requests were completed beyond the prescribed time limits: one concerned information of a sensitive nature and was large and complex, requiring a review of over 1,000 pages and lengthy consultations with other government institutions; the other was late due to work load and staff turnover.

For 13 requests (14%), the Secretariat sought extensions to the prescribed time limits in order to consult with other government organizations.

9. Exemptions invoked

The Privacy Act allows, and in certain instances, requires that some personal information, such as information related to law enforcement investigations, information about other individuals or information that is subject to solicitor-client privilege, be exempted and not released.

In fiscal year 2017 to 2018, the Secretariat invoked a total of 25 exemptions as per specific sections of the Privacy Act, as follows:

• Section 25: Exempting records that could threaten the safety of individuals (2)
• Section 26: Exempting personal information about individuals other than the requester (19)
• Section 27: Exempting personal information related to solicitor-client privilege (4)

10. Exclusions invoked

The Privacy Act does not apply to information that is already publicly available, such as government publications and material in libraries and museums. It also excludes material such as Cabinet confidences.

Consistent with the act, information was excluded twice under subsections 70(1) and 70(1)(e) of the act for Confidences of the Queen’s Privy Council for Canada.

11. Costs

During fiscal year 2017 to 2018, the ATIP Office incurred $265,500 in salary costs and $13,873 in administrative costs (software licences, office equipment and supplies, training) to ensure appropriate implementation of the Privacy Act.

12. Education and training

During the 2017 to 2018 fiscal year, the ATIP Office continued to expand on its outreach activities by offering training sessions to the Secretariat’s employees on a regular basis. 22 sessions were provided to 595 staff (doubling last year’s efforts). Some of these sessions were adapted to the specific needs of divisional teams and sectors of the Secretariat, including an ATIP privacy presentation at the Executive Town Hall. This presentation provided senior program officials at the executive level with an overview of privacy practices, on the importance of sound information management practices and writing for openness and transparency. The ATIP Office also provided a presentation to a federal/provincial committee on open publication protocols. In support of Right to Know Week, the ATIP Office also held an open door day to showcase its services and promote sound information management and privacy practices. In addition, the ATIP Office further engaged with sector liaison officers to discuss best practices, expectations and the implementation of a number of new initiatives.

13. Policies, guidelines, procedures and initiatives

During the 2017 to 2018 reporting period, the ATIP Office implemented a number of initiatives both within its operational unit and with stakeholders in the institution. These initiatives were in keeping with a continued approach to streamlining its operational processes. Part of these initiatives included leveraging secure IT solutions to reduce transition times between various units in the processing of ATIP requests.

The ATIP Office policy unit continued to provide ongoing support to Secretariat programs on open government initiatives, including increased engagement with Canadians and with industry stakeholders. This support also included review and assessment of records destined to be published on the Open Government Portal. The ATIP Office privacy unit also worked closely with the Information and Privacy Policy Division within the Chief Information Officer Branch on a number of pan-government initiatives, including a workshop and guidance materials on disclosure of briefing note titles in preparation for Bill C-58 implementation. ATIP Office officials are pursuing a plan to add capacity to these functions going forward.

Furthermore, there are a number of new program initiatives involving the potential for personal information collection, use and disclosure. With growing interest in the use of cloud technologies, and the increase in public engagement activities, the ATIP Office will work closely with the Secretariat’s Internal Audit and Evaluation Branch this year to undertake a department-wide privacy audit/evaluation. We look forward to reporting a summary of results for this assessment in next year’s annual report.

Finally, in order to ensure continued compliance with the act and related policies, the ATIP Office disseminated a variety of tools and checklists, and held face-to-face meetings with program officials to ensure compliance with relevant policy and legislative requirements.

14. Complaints, investigations and federal court cases

Requesters are entitled to file a complaint with the Office of the Privacy Commissioner of Canada (OPC) regarding the processing of their request.

Clients of the Secretariat filed 3 new complaints with the OPC in fiscal year 2017 to 2018. Following is a summary of the new complaints received under the Privacy Act.

• 2 of the new complaints received were related to delay and refusal of access. 1 of these complaints was considered well-founded and resolved by the OPC. The other complaint remains active in the investigation phase.
• 1 complaint was a departmental complaint pertaining to TBS’s Standard on Security Screening and the collection of personal information, bringing the total number of departmental complaints received to 9 since its implementation. The OPC has suspended their investigation into these complaints pending litigation before the Federal Court of Appeal.

There remains 1 active Privacy Act complaint from previous reporting periods.

There were no new court cases in fiscal year 2017 to 2018. There have been no court cases against the Secretariat in relation to the Access to Information Act and the Privacy Act since 2004.

15. Monitoring of compliance and requests for corrections

The ATIP Office distributes weekly compliance statistics that are shared with the program areas and senior management for all access to information requests.

There were no TBS requests for corrections of personal information over the reporting period.

16. Summary of material privacy breaches

The Secretariat did not incur any material privacy breaches over the reporting period.

17. Privacy Impact Assessments

The ATIP Office provides TBS program officials with support and guidance on the Privacy Impact Assessment (PIA) process. In accordance with the TBS Directive on Privacy Impact Assessment, a PIA must be initiated for a program or activity in the following circumstances:

• when personal information is used for or is intended to be used as part of a decision-making process that directly affects the individual
• upon substantial modifications to existing programs or activities where personal information is used or intended to be used for an administrative purpose
• when the contracting out or the transfer of a program or activity to another level of government or to the private sector results in substantial modifications to the program or activities

During fiscal year 2017 to 2018, a number of PIAs were initiated and are currently in various stages of development. It is expected that a number of these PIAs will be completed and submitted to the Office of the Privacy Commissioner of Canada and to the Information and Privacy Policy Division at the Secretariat in the 2018 to 2019 fiscal year.

18. Disclosures under paragraph 8(2)(m) of the Privacy Act

Subsection 8(2) of the Privacy Act provides limited and specific circumstances under which institutions may disclose personal information without an individual’s consent. Paragraph 8(2)(m) allows for the disclosure of personal information when the public interest clearly outweighs any invasion of privacy or when the disclosure would benefit the individual involved. In the 2017 to 2018 reporting period, there were no disclosures pursuant to paragraph 8(2)(m) of the Privacy Act.

19. Information about programs and information holdings

TBS publishes an inventory of its information holdings, as well as relevant details about personal information under their control.

The primary purpose of this publication is a series of publications containing information about, and collected by, the Government of Canada to assist individuals in exercising their rights under the Access to Information Act and the Privacy Act. It also supports the federal government’s commitment to facilitate access to information regarding its activities.

A description of the Secretariat’s functions, programs, activities and related information holdings can be found in Treasury Board Secretariat - Sources of Federal Government and Employee Information (Info Source).

Fiscal year 2017 to 2018 was the final year of a 3-year action plan to update the Secretariat’s publication. In the coming year, the ATIP Office will update its publication on TBS information holdings found both in classes of records and within institution-specific personal information banks. These updates are based on feedback provided by program sectors and by the Information and Privacy Policy Division during their last annual review.

All these publications are available online free of charge.

Appendix A: Statistical Report on the Privacy Act

Name of institution: Treasury Board of Canada Secretariat

Reporting period: 2017-04-01 to 2018-03-31