2021 to 2022 Annual Report on the Privacy Act

On this page

• Introduction
• Purpose of the Privacy Act
• Mandate of the Treasury Board of Canada Secretariat
• Delegation order
• Organizational structure
• Statistical report
• Interpretation of the Statistical Report on the Privacy Act
• Impact of COVID‑19-related measures
• Impact of TBS’s COVID‑19 initiatives
• Education, training and awareness
• Monitoring
• Departmental complaints with the Office of the Privacy Commissioner of Canada
• Information about programs and information holdings
• Appendix A: Delegation Order – Privacy Act
• Appendix B: Statistical Report on the Privacy Act
• Appendix C: Supplemental Statistical Report on the Access to Information Act and the Privacy Act

Introduction

The Treasury Board of Canada Secretariat (TBS) is pleased to present to Parliament its annual report on the administration of the Privacy Act for 2021–22 (April 1, 2021, to March 31, 2022).

This report is prepared and tabled in accordance with section 72 of the Privacy Act which requires that the head of every federal institution prepare and submit an annual report to Parliament on the administration of the act in the institution during the fiscal year.

Purpose of the Privacy Act

The purpose of the Privacy Act is to provide:

• individuals with the right to access and correct personal information about themselves that is under the control of a government institution
• the legal framework for the collection, retention, use, disclosure, disposition and accuracy of personal information in the administration of programs and activities by government institutions subject to the act

Under the Privacy Act, personal information is defined as “information about an identifiable individual that is recorded in any form.”

Examples include information relating to:

• the national or ethnic origin, colour, religion, age or marital status of an individual
• the education or the medical, criminal, financial or employment history of an individual
• the address, fingerprints or blood type of an individual
• any identifying number, symbol or other particular identifier assigned to an individual

Mandate of the Treasury Board of Canada Secretariat

As the administrative arm of the Treasury Board, TBS has a dual mandate to support the Treasury Board as a committee of ministers and to fulfill the statutory responsibilities of a central government agency. The Treasury Board’s mandate is derived from the Financial Administration Act.

To fulfill its mandate, TBS organizes its business and resources around four core responsibilities:

• spending oversight
• administrative leadership
• employer
• regulatory oversight

TBS provides advice and support to Treasury Board ministers in their role of ensuring value for money. TBS also provides oversight of the financial management functions in federal institutions.

TBS makes recommendations and provides advice to the Treasury Board on policies, directives, regulations, and program expenditure proposals with respect to the management of the government’s resources. TBS is responsible for the general management of government-wide initiatives, issues and activities (as reported in the Main Estimates).

The offices of the following government officials are part of TBS:

• the Comptroller General of Canada
• the Chief Human Resources Officer of Canada
• the Chief Information Officer of Canada

The Comptroller General is responsible for the comptrollership function of government and provides government-wide leadership, direction, oversight and capacity‑building for financial management, internal audit, and the management of assets and acquired services.

The Chief Human Resources Officer provides government-wide leadership:

• on people management through policies, programs and strategic engagement
• by centrally managing labour relations, compensation, pensions and benefits
• by contributing to the management of executives

The Chief Information Officer provides government-wide leadership, direction, oversight and capacity‑building for information management, information technology, government security (including identity management), access to information, privacy and internal and external service delivery.

Delegation order

Pursuant to subsection 73(1) of the Privacy Act, the President of the Treasury Board has delegated the powers, duties and functions for the administration of the Privacy Act to the following TBS officials:

• the Secretary of the Treasury Board
• the Assistant Secretary of Strategic Communications and Ministerial Affairs
• the Senior Director of Ministerial Services
• the Director of Access to Information and Privacy
• managers of the Access to Information and Privacy (ATIP) office (sections 26 and 27)
• team leaders of the ATIP office (sections 26 and 27)

Certain administrative functions are also delegated to managers, team leaders and officers to accelerate the processing of requests.

The delegation order was signed on February 2, 2022, and a copy can be found in Appendix A.

Organizational structure

The ATIP office is part of the Ministerial Services Division of TBS’s Strategic Communications and Ministerial Affairs Sector.

The ATIP office is responsible for:

• implementing and managing programs and services relating to TBS’s administration of the Access to Information Act and the Privacy Act
• providing advice to TBS employees as they fulfill their obligations under both acts

The ATIP office is led by a director, who is supported by three managers. Each of these managers oversees a unit that is responsible for a different functional area:

• Intake and Governance Unit
• Operations Unit
• Privacy Policy Unit

The Intake and Governance Unit and the Operations Unit work together closely to process ATIP requests whereas the Privacy Policy Unit supports sector officials on privacy‑related matters.

In total, 23 full‑time employees at various levels administered the Access to Information Act and the Privacy Act in 2021–22, with the support of one part-time university student.

There were significant changes in 2021–22 as TBS welcomed a new:

• President of the Treasury Board
• Secretary of the Treasury Board
• Chief Information Officer of Canada
• Chief Human Resources Officer of Canada

The most significant change impacting the ATIP office this year was a change in directorship in November 2021.

Figure 1 shows the roles of the individuals and teams involved in processing ATIP requests at TBS. The ATIP office has three functional units. Sector liaison officers, although not part of the ATIP office, also play an important role in processing requests because they coordinate ATIP activities in their sector.

Figure 1 - Text version

The ATIP Director is supported by three units: the ATIP Intake and Governance Unit, the ATIP Operations Unit and the Privacy Policy Unit.

The ATIP Intake and Governance Unit coordinates and reviews documents for proactive disclosure and receives ATIP requests from the public and consultation requests from other departments. The unit also liaises with sectors to obtain and retrieve documents needed to process ATIP requests, and prepares reports on performance, using data in the ATIP software. The unit is comprised of 8 employees and 1 student.

The ATIP Operations Unit reviews documents to be sent in response to requests made under the Access to Information Act and Privacy Act and consults any required parties. The unit liaises with the Office of Information Commissioner and the Office of the Privacy Commissioner to resolve complaints and reviews records for parliamentary Motions for the Production of Papers. The Operations Unit is comprised of 9 employees.

The Privacy Policy Unit advises and supports TBS officials to ensure compliance with the Privacy Act and related policy instruments. The unit also supports TBS officials to ensure that individuals’ privacy rights are respected in the delivery of programs and activities. Lastly, the unit supports the ATIP Director in their role as delegate responsible for section 10 of the Privacy Act. The Privacy Policy Unit is comprised of 6 employees.

As aforementioned, the ATIP sector liaison officers are not part of the ATIP office. They support the ATIP program by coordinating ATIP activities in their sector.

Statistical report

Statistical reports prepared by government institutions provide aggregate data on the application of the Access to Information Act and the Privacy Act. This information is made public annually in a statistical report that is included with the annual reports on access to information and privacy tabled in Parliament by each institution. TBS’s statistical report on the Privacy Act for 2021–22 is in Appendix B.

This year, institutions were required to report on the following additional criteria outlined below:

• their capacity to receive requests and process records
• open requests from previous reporting periods
• open complaints from previous reporting periods
• new authorities to collect or use social insurance numbers

The 2021–22 Supplemental Statistical Report on the Access to Information Act and Privacy Act is found at Appendix C.

The following sections contain:

• highlights of TBS’s performance in 2021–22 in relation to its obligations under the Privacy Act
• analyses of the notable statistical data for this year compared with previous years

Interpretation of the Statistical Report on the Privacy Act

Part 1: requests received and carried forward

Privacy Act requests

In 2021–22, TBS received a total of 84 requests, which represents a 27% increase from the 2020–21 total of 66. This increase is not attributed to any specific trend and is consistent with normal year-to-year variability.

The number of requests carried forward increased from six in 2020–21 to 12 in 2021–22. While this increase appears to be significant, nine of these requests were received at the end of 2021–22 and were within legislated deadlines.

Figure 2 shows the number of privacy requests TBS received each year and the number of requests carried forward for 2017–18 to 2021–22.

Figure 2 - Text version

Fiscal year	Requests received	Requests carried forward
2017–18	93	8
2018–19	77	9
2019–20	87	8
2020–21	66	6
2021–22	84	12

Channels of requests

Pursuant to subsection 13(1) of the Privacy Act, requests are required to be submitted by applicants in writing.

Requests can be submitted via the Access to Information and Personal Information Online Request Service (AORS) or by email. Requests can also be sent by mail or submitted in person.

Most requests are submitted electronically to TBS. In 2021–22, 60 requests were submitted via AORS and 23 requests were submitted by email, and this represented 99% of the 84 requests received by TBS.

Part 2: requests completed

In 2021–22, TBS completed 78 requests, which is an increase of 15% compared to the 68 requests completed in 2020–21.

Figure 3 shows the number of privacy requests TBS completed each year from 2017–18 to 2021–22.

Figure 3 - Text version

Fiscal year	Requests completed
2017–18	93
2018–19	76
2019–20	88
2020–21	68
2021–22	78

Disposition of requests completed

The following is a breakdown by disposition of the 78 requests completed in 2021–22:

• 11 requests had no records
• 44 requests were abandoned
• 14 requests contained records that were partially disclosed
• 9 requests were disclosed entirely

This is comparable to the 13 requests partially disclosed and the 11 requests disclosed entirely in 2020–21.

Because the President of the Treasury Board is responsible for ensuring compliance with the Privacy Act government‑wide, TBS often receives requests that fall within the mandates of other federal institutions. Such requests are registered, reviewed and closed after the requester is informed of which institution they should contact. These requests are included in the totals for “No records exist” or “Request abandoned.”

Figure 4 shows the percentage of privacy requests by disposition for 2021–22.

Figure 4 - Text version

Disposition	Distribution
Request abandoned	56%
Disclosed in part	18%
No records exist	14%
All disclosed	12%

Note: No requests were all exempted, all excluded or neither confirmed nor denied. As a result, these dispositions are not found in the pie chart.

Table 1: number of requests and percentage of total requests by disposition, 2019–20 to 2021–22

Disposition of request	2019–20		2020–21		2021–22
	Number of requests	Percentage of total	Number of requests	Percentage of total	Number of requests	Percentage of total
All disclosed	14	16%	11	16%	9	12%
Disclosed in part	14	16%	13	19%	14	18%
All exempted	0	0%	0	0%	0	0%
All excluded	0	0%	0	0%	0	0%
Request abandoned	10	11%	17	25%	44	56%
No records exist	50	57%	27	40%	11	14%
Neither confirmed nor denied	0	0%	0	0%	0	0%
Total	88	100%	68	100%	78	100%

Exemptions

The Privacy Act allows and, in certain instances, requires that some personal information be exempt from release, such as information related to law enforcement investigations, information about other individuals, or information that is subject to solicitor‑client privilege.

In 2021–22, 14 requests were subject to exemptions under the Privacy Act. Requests requiring exemptions involved records that contained the following information:

• personal information about individuals other than the requester (14 applications) (section 26 of the act)
• personal information related to solicitor‑client privilege (6 applications) (section 27 of the act)

Each request may have multiple exemptions, resulting in a greater number of exemptions invoked compared to the number of redacted requests.

Exclusions

The Privacy Act does not apply to information that is publicly available, such as government publications and material in libraries and museums. The act also excludes material such as Cabinet confidences. No records were subject to exclusions in 2021–22.

Pages processed and disclosed

TBS completed 78 requests in 2021–22, which involved the processing of 7,840 pages. This represents a decrease of 55% relative to the 17,455 pages processed in 2020–21. The decrease is primarily attributed to the fact that in 2020–21, there were eight voluminous requests closed that exceeded 500 pages and that collectively accounted for 9,366 pages. In contrast, in 2021–22, only two requests were closed that exceeded 500 pages and that collectively accounted for 4,618 pages.

Figure 5 shows, for 2017–18 to 2021–22, the number of privacy requests TBS completed each year and the number of pages it processed for those requests.

Figure 5 - Text version

Fiscal year	Requests completed	Pages processed
2017–18	93	5089
2018–19	76	10165
2019–20	88	4433
2020–21	68	17455
2021–22	78	7840

Complexity

Of the 78 requests that were closed in 2021–22, 14 requests (18%) contained personal information that was either about another individual or subject to solicitor-client privilege. These 14 requests account for 6,942 pages (89%) of the 7,840 pages processed in 2021–22.

In addition to these 14 requests, three requests required consultation with other federal institutions before disclosure and three requests involved interwoven personal information.

Format of information released

The ATIP office has continued to provide clients with access to government records in electronic formats. In 2021–22, TBS released information in electronic format for 16 requests and in paper format for 7 requests. It is anticipated that the format of information released under the Privacy Act will continue to be predominantly electronic in upcoming fiscal years.

Requests for translation

Consistent with previous fiscal years, TBS did not receive, nor did it process any requests in 2021–22 that required translation of responsive records.

Part 3: on-time compliance rate, completion times and extensions

On-time compliance rate

The on-time compliance rate is the percentage of requests responded to within their legislative timelines, including requests for which the institution invoked legislative extensions.

In 2021–22, TBS’s ATIP office achieved a 97.4% on-time compliance rate. Several factors contributed to this rate, such as:

• the refinement of digital ATIP procedures
• the issuing of weekly statistical reports on performance
• strong case file management
• regular information sessions with TBS officials

Figure 6 shows the impact of the increasing average number of pages processed for completed requests on the on‑time compliance rate.

Figure 6 - Text version

Fiscal Year	Percentage of requests completed within legislated timelines (on-time compliance rate)	Average number of pages processed per completed request
2017–18	98%	55
2018–19	95%	134
2019–20	99%	50
2020–21	79%	257
2021–22	97%	96

Deemed refusals

In 2021–22, TBS closed two requests that exceeded the legislated deadline and that were in deemed refusal. This represents an 86% decrease compared to the 14 requests in deemed refusal that were closed in 2020–21. This decrease is primarily attributed to the eight voluminous requests closed in 2020–21 that exceeded 500 pages and collectively accounted for 9,366 pages. One of the requests exceeded the legislated deadline because of high workload and the other request exceeded the deadline because external consultations were required to complete the request.

Time it takes to complete requests

Of the 78 requests closed this year, 63 (or 81%) were closed within 30 days, which is a significant increase from last year’s rate of 71%. This increase is primarily attributed to the higher volume of pages processed in 2020–2021.

Figure 7 shows the time it took to complete privacy requests in 2021–22.

Figure 7 - Text version

Time to complete request	Requests completed
1 to 15 days	50
16 to 30 days	13
31 to 60 days	14
61 to 120 days	1

Table 2: requests completed by time it takes to complete request, 2019–20 to 2021–22

Time to complete request	2019–20		2020–21		2021–22
	Number of requests	Percentage of total	Number of requests	Percentage of total	Number of requests	Percentage of total
1 to 15 days	27	31%	29	43%	50	64%
16 to 30 days	43	49%	19	28%	13	17%
31 to 60 days	17	19%	8	12%	14	18%
61 to 120 days	0	0%	3	4%	1	1%
121 to 180 days	0	0%	2	3%	0	0%
181 to 365 days	1	1%	5	7%	0	0%
More than 365 days	0	0%	2	3%	0	0%

Reasons for extensions

The legislation sets timelines for responding to privacy requests and allows for extensions, up to a maximum of 30 days, in any of the following cases:

• when complying with the timeline would interfere with operations as a result of:
  • a review being required to determine exemptions or exclusions
  • a large volume of pages requiring review
  • a large volume of requests
    • or
  • the documents being difficult to obtain
• when a consultation is required
  • or
• when documents must be translated

In 2021–22, TBS invoked extensions for 14 completed requests or 18% of all requests completed.

Of the 14 requests that were extended, 12 (86%) were extended because complying with the original time limit would have unreasonably interfered with operations, in accordance with paragraph 15(a)(i) of the act. The remaining two requests were extended for the purpose of conducting external consultations in accordance with paragraph 15(a)(ii).

Of the 12 requests extended in accordance with paragraph 15(a)(i):

• three required further review to determine exemptions
• three involved a large number of pages
• three were a result of a large volume of requests
• three were for cases where documents were difficult to obtain

No extensions were invoked in 2021–22 for the purposes of translating materials.

Figure 8 shows the different types of extensions invoked for privacy requests completed in 2021–22.

Figure 8 - Text version

Reasons for Extension	Number of requests
Interference with operations (paragraph 15(a)(i) of the act)	86%
Consultation (paragraph 15(a)(ii) of the act)	14%

Length of extensions

In 2021–22, TBS completed 14 requests for which extensions had been invoked. All of the 14 requests for which extensions were invoked were extended by 30 calendar days.

Impact of COVID‑19-related measures

In response to the public health measures implemented to minimize the effects of the COVID‑19 pandemic, TBS primarily operated remotely in 2021–22. The ATIP office had unrestricted access to TBS’s virtual private network (VPN) and ATIP office employees were able to work onsite for operational reasons. The ATIP office was at full operational capacity throughout the year with the exception of four weeks in winter 2022 as a result of demonstrations in the National Capital Region. During this four-week period, the ATIP office’s capacity to receive paper documentation or process documents classified at the secret level was reduced.

The ATIP office continued to modernize and enhance its procedures to:

• reflect the realities of a new digital environment
• ensure that requests were processed efficiently and within legislative deadlines to the extent possible

The procedural adaptations and digital transformation that occurred in 2020–21 as a result of the COVID‑19 pandemic and associated public health measures enabled the ATIP office to:

• mitigate the impacts of the COVID‑19 pandemic on TBS’s operations in 2021–22
• meet or exceed pre-pandemic levels of productivity

The ATIP office has put in place many procedural efficiencies, and it is seeking to recruit additional staff to support its operations and develop technical solutions that will permit the ATIP office to continue to meet service standards.

Impact of TBS’s COVID‑19 initiatives

In support of the Government of Canada’s response to the COVID‑19 pandemic, TBS implemented or supported a number of significant initiatives that had a high impact on Canadians in 2021–22. Any initiatives involving the collection, use, disclosure, and retention of personal information require support and guidance from the ATIP office to ensure adherence to the Privacy Act.

The implementation of the Policy on COVID‑19 Vaccination for the Core Public Administration Including the Royal Canadian Mounted Policeon October 6, 2021, required the collection of sensitive medical information from all employees within the core public administration. It also involved storing this information within the Government of Canada Vaccination Attestation Tracking System (GC-VATS).

The policy also allowed individuals to request exemptions under the Canadian Human Rights Act, including for medical and religious reasons, that introduced additional privacy considerations.

TBS’s Privacy Policy Unit provided privacy support throughout the development and implementation of the policy. In this role, the Privacy Policy Unit assisted in responding to 11 informal complaints filed against TBS in relation to the privacy considerations of the policy throughout 2021–22

While the policy was suspended on June 22, 2022, the Privacy Policy Unit continues to be implicated in addressing complaints registered with the OPC in relation to the privacy considerations of the policy. Additional information about these complaints can be found in the Departmental complaints with the Privacy Commissioner section of this report.

Education, training and awareness

In 2021–22, the ATIP office continued to provide regular advice and guidance to sector officials while also expanding the outreach activities and formal training sessions offered to TBS employees. In addition to the regular support that the ATIP office provided to sectors processing ATIP requests, the ATIP office was formally consulted on 142 initiatives in 2021–22. Furthermore, 17 separate sessions on access to information and privacy legislation as they relate to ATIP requests were delivered to 446 TBS employees. Some of these sessions were tailored to the needs of specific teams and sectors.

As part of its training program, the ATIP office launched its ATIP sector liaison officer engagement strategy in 2021–22. The strategy aims to promote awareness and provide tools to sector officials to increase the efficiency of the ATIP process. Under this strategy, the ATIP office developed several tutorial videos to help sector officials prepare responses to the ATIP office. The ATIP office also held quarterly information sessions with ATIP coordinators throughout TBS in collaboration with officials in information management with the intention of promoting awareness of ATIP activities. These sessions ensured the broad distribution of ATIP-related tools and were delivered to 122 participants.

In promotion of International Right to Know Day and Data Privacy Day, the ATIP office conducted sessions to promote access to information and privacy management practices and principles.

Table 4 outlines the specific training initiatives conducted by the ATIP office in 2021–22.

Monitoring

The ATIP office produces a variety of regular and ad hoc reports to monitor TBS’s compliance with the Access to Information Act and the Privacy Act. In 2021–22, the ATIP office increased its emphasis on data analytics with the intent of identifying emerging trends and promoting procedural efficiencies. In this regard, the ATIP office developed individualized sector performance reports aimed at creating awareness within sectors of their performance with respect to their ATIP obligations. The ATIP office also worked closely with sectors that experience high volumes of ATIP requests in an effort to coordinate and expedite responses from those sectors. This new engagement with sectors is intended to support the sharing of existing compliance data, which were shared weekly with program areas and senior management in previous years.

Departmental complaints with the Office of the Privacy Commissioner of Canada

As the employer for the core public administration, the Treasury Board is responsible for establishing the terms and conditions of employment for employees. The Office of the Chief Human Resources Officer of Canada (OCHRO) supports the President of the Treasury Board and the Treasury Board ministers by:

• leading research, policy developing and collective bargaining
• developing the strategies and tools to ensure that institutions can effectively manage human resources
• acting as the people management business owner

On October 6, 2021, OCHRO implemented the Policy on COVID‑19 Vaccination for the Core Public Administration Including the Royal Canadian Mounted Police. On October 28, 2021, the OPC notified TBS that it had received three complaints alleging that the collection of personal information relating to vaccination status is improper and that individuals should not be required to share this information. One complaint also alleged that the personal information bank outlining the framework for handling personal information collected under the policy was at the time under development and not available for individuals to review. On December 13, 2021, the OPC notified TBS that it had received an additional two complaints with similar allegations.

While the policy was suspended on June 22, 2022, TBS continues to work in close collaboration with the OPC in resolving these complaints. It is anticipated that these complaints will be resolved in 2022–23.

Information about programs and information holdings

TBS publishes an inventory of its information holdings, as well as relevant details about personal information under its control.

The primary purpose of this inventory is to assist individuals in exercising their rights under the Access to Information Act and the Privacy Act. The inventory also supports the federal government’s commitment to facilitate access to information on its activities, since it is available to the public on the Internet, free of charge.

A description of TBS’s functions, programs, activities and related information holdings can be found in Sources of Federal Government and Employee Information (Info Source): Treasury Board Secretariat.

In addition to completing the annual update of its inventory of information holdings, on May 21, 2021, TBS completed the realignment of all the information in the inventory with the 2019–20 Departmental Results Framework. As a result of this activity, nine personal information banks were deregistered, and 37 classes of records were also deregistered.

Appendix A: Delegation Order – Privacy Act

I, undersigned, President of the Treasury Board, pursuant to section 73 of the Privacy Act hereby designate the ATIP Advisors, the Access to Information and Privacy Team Leader, the Access to Information and Privacy Manager, the Access to Information and Privacy Director of Ministerial Services, the Assistant Secretary, Strategic Communications and Ministerial Services and the Secretary, or person occupying those positions on an acting basis, to exercise signing authorities or perform any of the President’s powers, duties or functions as head of institution that are specified in the attached Schedule B. This designation replaces all previous delegation orders.

Original signed by

The Honourable Mona Fortier
President of the Treasury Board
Date: 2022-02-02

Appendix B: Statistical Report on the Privacy Act

Name of institution: Treasury Board of Canada Secretariat

Reporting period: 2021-04-01 to 2022-03-31

Appendix C: Supplemental Statistical Report on the Access to Information Act and the Privacy Act

Name of institution: Treasury Board of Canada Secretariat

Reporting period: 2021-04-01 to 2022-03-31

© His Majesty the King in Right of Canada, represented by the President of the Treasury Board, 2022,
Catalogue No.BT23-1E-PDF, ISSN: 2371-3038