Language selection

Government of Canada / Gouvernement du Canada

Search

2022 to 2023 Annual Report on the Privacy Act

From: Treasury Board of Canada Secretariat

On this page

Introduction

The Treasury Board of Canada Secretariat (TBS) is pleased to present to Parliament its annual report on the administration of the Privacy Act for 2022–23 (April 1, 2022, to March 31, 2023).

Section 72 of the Privacy Act requires that the head of every government institution prepare and submit an annual report to Parliament on the administration of the act in the institution during the fiscal year.

Purpose of the Privacy Act

The purpose of the Privacy Act is to provide:

  • individuals with the right to access and correct personal information about themselves that is under the control of a government institution
  • the legal framework for the collection, retention, use, disclosure, disposition, and accuracy of personal information in the administration of programs and activities by government institutions subject to the act

Under the Privacy Act, personal information is defined as “information about an identifiable individual that is recorded in any form.”

Examples include information relating to:

  • the national or ethnic origin, colour, religion, age, or marital status of an individual
  • the education or the medical, criminal, financial or employment history of an individual
  • the address, fingerprints or blood type of an individual
  • any identifying number, symbol or other particular identifier assigned to an individual

Mandate of the Treasury Board of Canada Secretariat

As the administrative arm of the Treasury Board, TBS has a dual mandate to support the Treasury Board as a committee of ministers and to fulfill the statutory responsibilities of a central government agency. The Treasury Board’s mandate is derived from the Financial Administration Act.

To fulfill its mandate, TBS organizes its business and resources around four core responsibilities:

  • spending oversight
  • administrative leadership
  • employer
  • regulatory oversight

TBS provides advice and support to Treasury Board ministers in their role of ensuring value for money. The department also provides oversight of the financial management functions in federal institutions.

TBS makes recommendations and provides advice to the Treasury Board on policies, directives, regulations, and program expenditure proposals with respect to the management of the government’s resources. It is responsible for the general management of government-wide initiatives, issues and activities (as reported in the Main Estimates).

The offices of the following government officials are part of TBS:

  • the Comptroller General of Canada
  • the Chief Human Resources Officer of Canada
  • the Chief Information Officer of Canada

The Comptroller General is responsible for the comptrollership function of government and provides government-wide leadership, direction, oversight and capacity-building for financial management, internal audit, and the management of assets and acquired services.

The Chief Human Resources Officer provides government-wide leadership on people management through policies, programs, and strategic engagement. It manages labour relations, compensation, pensions and benefits, and contributes to the management of executives.

The Chief Information Officer provides government-wide leadership, direction, oversight and capacity building for information management, information technology, government security (including identity management), access to information, privacy and internal and external service delivery.

Delegation order for the Privacy Act

Pursuant to section 73(1) of the Privacy Act, the President of the Treasury Board has delegated the powers, duties and functions for the administration of the Privacy Act to the following TBS officials:

  • the Secretary of the Treasury Board
  • the Assistant Secretary of Strategic Communications and Ministerial Affairs
  • the Senior Director of Ministerial Services
  • the Director of Access to Information and Privacy
  • managers of the Access to Information and Privacy (ATIP) office (sections 26 and 27)
  • team leaders of the ATIP office (sections 26 and 27)

Certain administrative functions are also delegated to managers, team leaders and officers to accelerate the processing of requests.

The delegation order was signed on February 2, 2022, and a copy can be found in Appendix A.

Organizational structure

The ATIP office is part of the Ministerial Services Division of TBS’s Strategic Communications and Ministerial Affairs sector.

The ATIP office is responsible for:

  • implementing and managing programs and services relating to TBS’s administration of the Access to Information Act and the Privacy Act (the acts)
  • providing advice to TBS employees as they fulfill their obligations under the acts

Outside of the administration of the acts, the ATIP office provides support in the following areas:

  • providing reviews of TBS held documents related to class action lawsuits
  • facilitating training sessions on the administration of the actsfor sectors and sector officials
  • updating and researching policies related to the administration of the acts
  • conducting research and reporting on trends within the ATIP office
  • systems administration of ATIP software and the creation of various reports
  • privacy breach management and the provision of access to information and privacy advice to program sectors

The ATIP office is led by a director, who is supported by three managers. Each of these managers oversees a unit that is responsible for a different functional area. The three key units include:

  • Intake and Governance Unit
  • Operations Unit
  • Privacy Policy Unit

The Intake and Governance Unit and the Operations Unit work together closely to process ATIP requests whereas the Privacy Policy Unit supports sector officials on privacy related matters including the review of privacy impact assessments.

In total, 23 full-time employees (FTE) at various levels administered the acts in 2022–23. In total, 23 full-time employees at various levels administered the acts in 2022-23. Though the ATIP office made efforts to staff additional positions, it was challenged by employee retention in 2022–23, resulting in consistency regarding the number of FTEs that worked in the ATIP office during the reporting period.

Figure 1 shows the roles of the individuals and teams involved in processing ATIP requests at TBS. The ATIP office has three functional units. Sector liaison officers, although not part of the ATIP office, also play an important role in processing requests because they coordinate ATIP activities in their sector.

Figure 1: roles in processing ATIP requests at TBS
Text version below:
Figure 1 - Text version

The ATIP Director is supported by three units: the ATIP Intake and Governance Unit, the ATIP Operations Unit and the Privacy Policy Unit.

The ATIP Intake and Governance Unit coordinates and reviews documents for proactive disclosure and receives ATIP requests from the public and consultation requests from other departments. The unit also liaises with sectors to obtain and retrieve documents needed to process ATIP requests, and prepares reports on performance, using data in the ATIP software. The unit is comprised of 8 employees and 1 student.

The ATIP Operations Unit reviews documents to be sent in response to requests made under the Access to Information Act and Privacy Act and consults any required parties. The unit liaises with the Office of Information Commissioner and the Office of the Privacy Commissioner to resolve complaints and reviews records for parliamentary Motions for the Production of Papers. The Operations Unit is comprised of 9 employees.

The Privacy Policy Unit advises and supports TBS officials to ensure compliance with the Privacy Act and related policy instruments. The unit also supports TBS officials to ensure that individuals’ privacy rights are respected in the delivery of programs and activities. Lastly, the unit supports the ATIP Director in their role as delegate responsible for section 10 of the Privacy Act. The Privacy Policy Unit is comprised of 6 employees.

As aforementioned, the ATIP sector liaison officers are not part of the ATIP office. They support the ATIP program by coordinating ATIP activities in their sector.

Statistical report

Statistical reports prepared by government institutions provide aggregate data on the application of the ATIA and the Privacy Act. This information is made public annually in a statistical report that is included with the annual reports on access to information and privacy tabled in Parliament by each institution. TBS’s statistical report on the Privacy Act for 2022–23 is found at Appendix B.

This year, institutions were required to report on the following additional criteria outlined below:

  • their capacity to receive requests and process records
  • open requests from previous reporting periods
  • open complaints from previous reporting periods
  • new authorities to collect or use social insurance numbers
  • privacy requests made by foreign nationals

The 2022–23 Supplemental Statistical Report on the Access to Information Act and Privacy Act is included at Appendix C.

The following sections contain:

  • highlights of TBS’s performance in 2022–23 in relation to its obligations under the Privacy Act
  • analyses of the notable statistical data for this year compared with previous years

Interpretation of the Statistical Report on the Privacy Act

In this section

Part 1: requests received and carried forward

Privacy Act requests

In 2022–23, TBS received a total of 105 formal privacy requests, which represents a 25% increase from the 2021–22 total of 84. This increase represents an increased interest amongst applicants for their personal information.

The number of requests that the TBS ATIP office carried forward from previous fiscal years increased from 12 in 2021–22 to 18 in 2022–23. While this increase appears to be significant compared to the proportional number of requests carried over in previous year, 16 of these requests were received at the end of 2022–23 and were active within legislated deadlines.

Figure 2 shows the number of privacy requests TBS received each year and the number of requests carried forward for 2018–19 to 2022–23.

Figure 2: privacy requests received and requests carried forward, 2018–19 to 2022–23
Text version below:
Figure 2 - Text version
Fiscal year Requests received Requests carried forward
2018–19 77 9
2019–20 87 8
2020–21 66 6
2021–22 84 12
2022–23 105 18

Channels of requests

Pursuant to subsection 13(1) of the Privacy Act, requests are required to be submitted by applicants in writing.

Requests can be submitted via the Access to Information and Personal Information Online Request Service (AORS) or by email. Requests can also be sent by mail or submitted in person.

Most requests that TBS receives are submitted electronically. In 2022–23, 87 requests were submitted via AORS and 13 requests were submitted by email. This represented 95% of the 105 requests received by TBS.

Part 2: requests completed

In 2022–23, TBS completed 99 requests, which is an increase of 27% compared to the 78 requests completed in 2021–22.

Figure 3 shows the number of privacy requests TBS completed each year from 2018–19 to 2022–23.

Figure 3: privacy requests completed, 2018–19 to 2022–23
Text version below:
Figure 3 - Text version
Fiscal year Requests completed
2018–19 76
2019–20 88
2020–21 68
2021–22 78
2022–23 99

Disposition of requests completed

The following is a breakdown by disposition of the 99 requests completed in 2022–23:

  • 13 requests had no records
  • 62 requests were ultimately abandoned by the applicant
  • 11 requests contained records that were partially disclosed
  • 13 requests were disclosed entirely

This is comparable to the 14 requests partially disclosed and the 9 requests disclosed entirely in 2021–22, representing a small uptick in requests that were processed with responsive records.

As the President of the Treasury Board is responsible for ensuring compliance with the Privacy Act government-wide, TBS often receives requests that fall within the mandates of other federal institutions. Such requests are registered, reviewed and closed after the requester is informed of which institution they should contact. These requests are included in the totals for “No records exist” or “Request abandoned” and represent the majority of privacy requests that TBS receives. These requests contribute to the overall compliance rate.

Figure 4 shows the percentage of privacy requests by disposition for 2022–23.

Figure 4: percentage of requests by disposition, 2022–23
Text version below:
Figure 4 - Text version
Disposition Distribution
Request abandoned 63%
Disclosed in part 11%
No records exist 13%
All disclosed 13%
Table 1: number of requests and percentage of total requests by disposition, 2020–21 to 2022–23
Disposition of requests 2020–21 2021–22 2022–23
Number of requests Percentage of total Number of requests Percentage of total Number of requests Percentage of total
All disclosed 11 16% 9 12% 13 13%
Disclosed in part 13 19% 14 18% 11 11%
All exempted 0 0% 0 0% 0 0%
All excluded 0 0% 0 0% 0 0%
Request abandoned 17 25% 44 56% 62 63%
No records exist 27 40% 11 14% 13 13%
Neither confirm nor deny 0 0% 0 0% 0 0%
Total 68 100% 78 100% 99 100%

Exemptions

The Privacy Act allows and, in certain instances, requires that some personal information be exempt from release, such as information related to law enforcement investigations, information about other individuals, or information that is subject to solicitor–client privilege.

In 2022–23, 11 requests were subject to exemptions under the Privacy Act. Requests requiring exemptions involved records that contained the following information:

  • personal information about individuals other than the requester (11 requests impacted) (section 26 of the act)
  • personal information related to solicitor-client privilege (3 requests impacted) (section 27 of the act)

Each request may have multiple exemptions, resulting in a greater number of exemptions invoked compared to the number of redacted requests.

Exclusions

The Privacy Act does not apply to or excludes information that is publicly available, such as government publications and material in libraries and museums. The act also excludes material such as Cabinet confidences. One request was subject to an exclusion in 2022–23 related to deliberations or decisions of Council (section 70(1)(c) of the act).

Pages processed and disclosed

TBS completed 99 requests in 2022–23, which involved processing 2,914 pages. This represents a decrease of 63% relative to the 7,840 pages processed in 2021–22. The decrease is primarily attributed to the fact that in 2021–22, there were two voluminous requests closed that exceeded 500 pages and that collectively accounted for 4,618 pages. In contrast, in 2022–23, only one requests was closed that exceeded 500 pages and that collectively accounted for 672 pages.

Figure 5 shows, for 2018–19 to 2022–23, the number of privacy requests TBS completed each year and the number of pages it processed for those requests.

Figure 5: privacy requests completed and pages processed, 2018–19 to 2022–23
Text version below:
Figure 5 - Text version
Fiscal year Requests completed Pages processed
2018–19 76 10,165
2019–20 88 4,433
2020–21 68 17,455
2021–22 78 7,840
2022–23 99 2,914

While in previous years the ATIP office received fewer requests than this fiscal year, many of the requests were extremely voluminous, containing more that 500 pages, and in some instances, over 2,000 pages. In 2022–23, the majority of requests were abandoned, or did not have responsive records, and therefore there was a decrease in the number of pages processed.

Complexity

Of the 99 requests that were closed in 2022–23, 11 were subject to exemptions and or exclusions. Eleven requests (11%) contained personal information that was either about another individual, 3 (3%) contained information subject to solicitor–client privilege, 2 (2%) included information subject to right of access and 1 (1%) included information subject to decisions of Council. These 11 requests account for 1,837 pages (63%) of the 2,914 pages processed in 2022–23.

No requests required consultation with other federal institutions before disclosure.

Format of information released

The ATIP office has continued to provide clients with access to government records in electronic formats. In 2022–23, TBS only released information in electronic format, for a total of 24 requests. It is anticipated that the format of information released under the Privacy Act will continue to be predominantly electronic in upcoming fiscal years.

Requests for translation

Consistent with previous fiscal years, TBS did not process any requests in 2022–23 that required translation of responsive records.

Part 3: on-time compliance rate, completion times and extensions

On-time compliance rate

The on-time compliance rate is the percentage of requests responded to within their legislative timelines, including requests for which the institution invoked legislative extensions.

In 2022–23, TBS’s ATIP office achieved a 96.9% on-time compliance rate. Several factors contributed to this rate, such as:

  • the refinement of digital ATIP procedures
  • the issuing of weekly statistical reports on performance that encouraged staff to maintain compliance levels
  • strong case file management
  • regular information sessions with TBS officials
  • the high rate of abandoned and “no record” dispositions

Figure 6 shows the impact of the increasing average number of pages processed for completed requests on the on-time compliance rate.

Figure 6: average number of pages processed per completed request and on-time compliance rate, 2018–19 to 2022–23
Text version below:
Figure 6 - Text version
Fiscal Year Percentage of requests completed within legislated timelines (on-time compliance rate) Average number of pages processed per completed request
2018–19 95% 134
2019–20 99% 50
2020–21 79% 257
2021–22 97% 96
2022–23 97% 29

Deemed refusals

In 2022–23, TBS closed 3 requests that exceeded the legislated deadline and therefore fell into deemed refusal. This number is consistent with the 3 deemed refusals reported in fiscal year 2021-22.

Completion times

Of the 99 requests closed this year, 92 (or 93%) were closed within 30 days, which is a significant increase from last year’s rate of 81%. This increase is primarily attributed to the fact that TBS received an increased number of requests for which records did not exist or where the applicant abandoned the request. Of the remaining 7 requests closed in 2022–23, 5 were completed within 60 days while 2 required significantly more time to process due to consultations with four other government departments.

Figure 7 shows the time it took to complete privacy requests in 2022–23.

Figure 7: requests completed by time it takes to complete request, 2022–23
Text version below:
Figure 7 - Text version
Time to complete request Requests completed
1 to 15 days 66
16 to 30 days 26
31 to 60 days 5
More than 365 days 2
Table 2: requests completed by time it takes to complete request, 2020–21 to 2022–23
Time to complete request 2020–21 2021–22 2022–23
Number of requests Percentage of total Number of requests Percentage of total Number of requests Percentage of total
1 day to 15 days 29 43% 50 64% 66 67%
16 to 30 days 19 28% 13 17% 26 26%
31 to 60 days 8 12% 14 18% 5 5%
61 to 120 days 3 4% 1 1% 0 0%
121 to 180 days 2 3% 0 0% 0 0%
181 to 365 days 5 7% 0 0% 0 0%
More than 365 days 2 3% 0 0% 2 2%

Reasons for extensions

The legislation sets timelines for responding to privacy requests and allows for extensions, up to a maximum of 30 days, in any of the following cases:

  • when complying with the timeline would interfere with operations as a result of:
    • a review being required to determine exemptions or exclusions
    • a large volume of pages requiring review
    • a large volume of requests
    • the documents being difficult to obtain
  • when a consultation is required
  • when documents must be translated

In 2022–23, TBS invoked extensions for 6 completed requests or 6% of all requests completed. This represents a 43% decrease in extensions compared to the previous fiscal year.

All 6 were extended because complying with the original time limit would have unreasonably interfered with operations, in accordance with paragraph 15(a)(i) of the act.

Of the 6 requests extended in accordance with paragraph 15(a)(i):

  • two required further review to determine exemptions
  • two involved a large number of pages
  • two were for cases where documents were difficult to obtain

No extensions were invoked in 2022–23 for the purposes of translating materials.

Length of extensions

In 2022–23, TBS completed 6 requests for which extensions had been invoked. All of the 6 requests for which extensions were invoked were extended by 30 calendar days.

Part 4: informal requests

Informal requests received

Consistent with previous years, TBS did not receive any informal privacy requests in 2022–23.

Informal requests completed

TBS did not complete any informal privacy requests in 2022–23.

Informal pages released

TBS did not release any pages informally in 2022–23.

Part 5: consultations from other government institutions and organizations

Consultations received and carried forward

TBS received three consultation requests from other government institutions in 2022–23, which is consistent with the three consultation requests reported in fiscal year 2021–22.

There were no consultation requests from other government institutions received in 2021–22 that were carried forward to 2022–23.

Consultations completed and pages processed

TBS completed three consultation requests in 2022–23 and processed 597 pages during these consultations compared to the three requests and 118 pages processed in 2021–22. The volume of requests completed, and the number of pages processed is consistent with previous years.

Completion time

Of the three consultation requests completed in 2022–23, two were completed within 30 days and one was completed within 180 days.

Part 6: consultations on Cabinet confidences

Consultations with legal services

No requests processed by TBS in 2022–23 required consultation with legal services to evaluate Cabinet confidences.

Consultations with the Privy Council Office

No requests processed by TBS in 2022–23 required consultation with the Privy Council Office to evaluate Cabinet confidences.

Consultations within TBS

The Privacy Policy Unit (PPU) within the ATIP office acted as a source of expertise for TBS officials. PPU provides privacy advice on the provisions and policies set out in the Privacy Act on 234 occasions in 2022–23. PPU was further consulted on the collection and disclosure of data on a wide range of subjects and for the review of 60 proactive disclosure requests relating to travel and hospitality expense entries on the Open Government website as well as on audit reports to be published. The ATIP office’s Intake and Governance unit also worked closely with its colleagues in PPU on the proactive disclosure files.

In 2022–23, there was a notable increase in internal requests from TBS program officials for privacy-related advice and guidance. This trend is attributed to the number of new and forward-looking program initiatives involving the potential collection, use and disclosure of personal information, an increase in individuals trained in privacy practices, a growing interest in the use of cloud technologies and the increase in government-wide employee engagement and public outreach activities. PPU supported programs across TBS sectors, including several initiatives undertaken by the Office of the Chief Human Resources Officer in its efforts to maintain privacy compliance and privacy best practices. The ATIP office also shared a variety of tools and checklists and held face-to-face meetings with program officials to ensure compliance with relevant policy and legislative requirements.

Part 7: complaints and investigations

Complaints received

Requesters can file a complaint with the Office of the Privacy Commissioner of Canada (OPC) if they are not satisfied with the processing of their requests. Members of the public can submit complaints to the OPC in relation to the collection, use, disclosure, retention, or disposal of personal information as it relates to programs or initiatives conducted by the department.

In 2022–23, TBS was notified of 2 complaints received by the OPC. Departmental complaints received from the OPC can be found in the Departmental complaints with the Privacy Commissioner section of this report.

Table 3 shows the complaints received by type in 2022–23.

Table 3: complaints received by type, 2022–23
Complaint type Number of complaints
Time limits 0
Delay: deemed refusal 2
Refusal: exemptions 0
Refusal: exclusions 0
Refusal: missing records 0
Miscellaneous 0
Total 2

Complaint representations

The OPC must allow implicated departments an opportunity to provide representations during the course of an investigation.

In 2022–23, TBS was not asked to provide representations to the OPC for complaints, which is consistent with 2021–22.

Complaints closed

The OPC did not issue any findings on complaints during 2022–23.

Part 8: court actions

There have been no court cases against TBS in relation to the Access to Information Act or the Privacy Act since 2004.

Part 9: disclosures under subsection 8(2)

Subsection 8(2) of the Privacy Act provides limited and specific circumstances under which institutions may disclose personal information without an individual’s consent. Paragraph 8(2)(e) allows for the disclosure of personal information to an investigative body specified in the regulations for the purposes of law enforcement and investigations. Paragraph 8(2)(m) allows for the disclosure of personal information when the public interest clearly outweighs any invasion of privacy or when the disclosure would benefit the individual involved.

In 2022–23, TBS did not make any disclosures pursuant to paragraphs 8(2)(e) or 8(2)(m) of the act. As a result of no disclosures being made pursuant to paragraph 8(2)(m) of the act, TBS did not have any notifications to the OPC pursuant to subsection 8(5).

Part 10: requests for correction of personal information and notations

Subsection 12(2) of the Privacy Act entitles individuals to request corrections to personal information that is erroneous or incomplete, and to request a notation to any personal information for which the individual requested a correction that was not completed by the institution.

In 2022–23, TBS did not receive any requests to correct personal information.

Part 11: privacy breaches

In 2022–23, TBS had one material privacy breach that was reported to the OPC where personal information was unintentionally shared with a different individual. The individuals involved were promptly notified of the error, the information was immediately contained and the OPC was informed of the incident. In addition, TBS reported 5 non-material privacy breaches in the 2022–23 fiscal year. The non-material privacy breaches reviewed by the ATIP office were administrative and caused by human error. Email addresses were included in the carbon copy (cc) field instead of the blind carbon copy (bcc) field, revealing the identity of all recipients. Therefore, personal information was unintentionally sent by email to all recipients. 

Part 12: privacy impact assessments

The ATIP office provides TBS program officials with support and guidance on the privacy impact assessment (PIA) process. In accordance with the TBS Directive on Privacy Impact Assessment, a PIA must be initiated for a program or activity in the following circumstances:

  • when personal information is used for or is intended to be used as part of a decision-making process that directly affects the individual(s)
  • when substantial changes are made to existing programs or activities where personal information is used or intended to be used for an administrative purpose
  • when the contracting out or the transfer of a program or activity to another level of government or to the private sector results in substantial changes to the program or activities

In 2022–23, TBS submitted the following PIAs with the OPC and to the Privacy and Responsibility Data Division (PRDD):

  • Claims Process for the Phoenix pay system issues (Phase 3)
  • The Online Regulatory Consultation System (ORCS)
  • The Government of Canada Vaccination Attestation Tracking System (GC-VATS)

In addition, the ATIP office continued to provide support to TBS program officials for ongoing PIAs, including the Self-Identification Modernization Project PIA, the Social Media monitoring PIA, the Workplace Accessibility Passport PIA and the Claims Office Integrated PIA.

Part 13: resources related to the Privacy Act

Costs

In 2022–23, TBS’s total cost for administering the Privacy Act was $325,173 which was allocated to salaries, overtime, and goods and services.

Human resources

In 2022–23, there were four full-time equivalents in the ATIP office performing work associated with the application of the act.

Hybrid work environment

Easing out of the public health measures implemented to minimize the effects of the COVID-19 pandemic, TBS primarily operated in a hybrid work model in 2022–23. The ATIP office had unrestricted access to TBS’s virtual private network (VPN) and ATIP office employees were able to work onsite and from their homes. On December 15, 2022, the Government of Canada announced that federal employees would return to the office for 2–3 days by March 31, 2023. The ATIP team at TBS implemented this return to office plan prior to the official policy, with employees returning to the office for a minimum of two days per week in the summer of 2022.

Government of Canada procurement of new ATIP software

In collaboration with Public Services and Procurement Canada, OCIO has been leading the procurement process for new ATIP software over the past several years. The process concluded with the awarding of contracts in the summer of 2022. In support of this process over the last four fiscal years, the ATIP office has regularly provided access to resources with the expertise required to:

  • evaluate vendor submissions
  • articulate the business requirements of ATIP offices across the Government of Canada

As the contact has been awarded, the ATIP office has worked collaboratively with OCIO and the vendor to begin the implementation and migration process to phase out the current ATIP software. The new software application is expected to be implemented by the TBS ATIP office in the 2023–24 fiscal year.  

The ATIP office has put in place many procedural efficiencies, and it is seeking to recruit additional staff to support its operations and provide exceptional support to requesters and to departmental program areas seeking to leverage the skillsets and advice of the ATIP office.

Technology and innovation

The ATIP office continues to prioritize the digital transformation of the office that was advanced during the COVID-19 pandemic.

With the implementation of Microsoft 365 and SharePoint across the government, the ATIP office continues to find ways to leverage these tools to create new and effective processes and methods of communication. These development towards further technological innovation and integration are expected to continue into the 2023–24 fiscal year.

Impact of TBS’s COVID-19 initiatives

In support of the Government of Canada’s response to the COVID-19 pandemic, TBS implemented or supported a number of significant initiatives that had a high impact on Canadians in 2022–23. Any initiatives involving the collection, use, disclosure and retention of personal information require support and guidance from the ATIP office to ensure adherence to the Privacy Act.

The implementation of the Policy on COVID-19 Vaccination for the Core Public Administration Including the Royal Canadian Mounted Police on October 6, 2021, required the collection of sensitive medical information from all employees within the core public administration. It also involved storing this information within the Government of Canada Vaccination Attestation Tracking System (GC-VATS) and completing its PIA in 2022–23.

The policy also allowed individuals to request exemptions under the Canadian Human Rights Act, including for medical and religious reasons, which introduced additional privacy considerations.

The ATIP office’s PPU provided privacy support throughout the development and implementation of the policy. While the policy was suspended on June 22, 2022, the ATIP office assisted in responding to 8 departmental complaints in relation to the privacy considerations of the policy throughout 2022–23.

Education, training and awareness

In 2022–23, the ATIP office continued to provide regular advice and guidance to sector officials while also expanding the outreach activities and formal training sessions provided to TBS employees. In addition to the regular support provided by the ATIP office to sectors processing ATIP requests, the ATIP office was formally consulted on 142 initiatives in 2022–23. Furthermore, 8 separate sessions on access and privacy legislation as they relate to ATIP requests were provided to 565 employees. Some of the sessions were tailored to the needs of specific teams and sectors.

As part of its training program, the ATIP office continued to apply its ATIP sector liaison officer engagement strategy in 2022–23. The strategy aims to promote awareness and provide tools to sector officials to increase the efficiency of the ATIP process. Under this strategy, the ATIP office developed several tutorial videos to help sector officials prepare responses to the ATIP office. The ATIP office also held quarterly information sessions with ATIP coordinators throughout TBS and information management officials in order to promote awareness of ATIP activities. These sessions ensured the broad distribution of ATIP-related tools and were delivered to 200 participants.

For International Right to Know Day and Data Privacy Day, the ATIP office conducted sessions to promote principles related to access to information and privacy. Forty-five percent of the ATIP office also attended the annual Canadian Access and Privacy Association (CAPA) conference, which promotes, transparency of government, knowledge and understanding of access and privacy laws in Canada.

Table 4 outlines specific training initiatives conducted by the ATIP office in 2022–23.

Table 4: training initiatives conducted by the ATIP office in 2022–23
Initiative Sector Description Responsible unit Participants
Privacy training session Corporate Services Sector Training on sound practices in the management of personal information Privacy Policy Unit (PPU) 25
ATIP Training Session Office of the Chief Human Resources Officer – Employee Relations and Total Compensation Joint ATI and Privacy Introductory Session ATIP office 200
Individual access to the Online Privacy Training presentation Multiple TBS sector employees Online self-paced presentation on the Privacy Act and related policies PPU 62
Data Privacy Day All sectors Promotion of Data Privacy Day via internal communications to TBS employees PPU n/a
ATIP training session Office of the Comptroller General   Intake and Governance Unit 35
ATIP training session Office of the Comptroller General   Intake and Governance Unit 21
ATIP training session Office of the Chief Human Resources Officer – Employee Relations and Total Compensation   Intake and Governance Unit 197

Table 5 outlines specific training provided to the ATIP office in 2022–23.

Table 5: Specific training provided to the ATIP office in 2022–23
Initiative Description Provider Participants
CAPA Conference Promotion of knowledge and understanding of ATI and Privacy laws and experiences in Canada Canadian Access and Privacy Association 10
The Access to Information and Privacy Community Development Office training on section 21 of the ATIA Training on section 21 of the Access to Information Act The Access to Information and Privacy Community Development Office (TBS OCIO) 6
Association of Access to Information and Privacy Professionals – Module A Introductory training module for New ATIP professionals The Association of Access to Information and Privacy Professionals 7
ATIP introduction to Lean Management Training on processes and efficiency Lean Agility 23
ATIP Introduction to Time Management Training on effective time management Lean Agility 23
Coaching and Professional Development Individual and group coaching sessions on work responsibilities and pressures Charron Training 23

Monitoring

The ATIP office produces a variety of regular and ad hoc reports to monitor TBS’s compliance with the Access to Information Act and the Privacy Act. In 2022–23, the ATIP office increased its emphasis on data analytics with the intent of identifying emerging trends and promoting procedural efficiencies. In this regard, the ATIP office developed individualized sector performance reports aimed at creating awareness within sectors of their performance with respect to their ATIP obligations. The ATIP office also worked closely with sectors that experience high volumes of ATIP requests in an effort to coordinate and expedite responses from those sectors. This new engagement with sectors is intended to support the sharing of existing compliance data, which were shared weekly with program areas and senior management in previous years.

Departmental complaints with the Privacy Commissioner

As the employer for the core public administration, the Treasury Board is responsible for establishing the terms and conditions of employment for employees. The Office of the Chief Human Resources Officer of Canada (OCHRO) supports the President of the Treasury Board, and the Treasury Board ministers by:

  • leading research, policy developing and collective bargaining
  • developing the strategies and tools to ensure that institutions can effectively manage human resources
  • acting as the people management business owner

On October 6, 2021, OCHRO implemented the Policy on COVID-19 Vaccination for the Core Public Administration Including the Royal Canadian Mounted Police. While the policy was suspended on June 22, 2022, TBS received 3 separate complaints with the OPC in 2022–23 regarding the administration of the COVID-19 vaccination status attestations. The additional 3 complaints related to COVID-19 vaccination brings the total to 8 complaints since the implementation of the policy. Processing these complaints required the work of 2 FTEs and took on average a month and a half to complete. One additional complaint was filed with the OPC regarding the use and disclosure of personal information in the ATIP Online Request Portal hosted by TBS.

Information holdings

TBS publishes an inventory of its information holdings, as well as relevant details about personal information under its control.

The primary purpose of this inventory is to assist individuals in exercising their rights under the Access to Information Act and the Privacy Act. The inventory also supports the federal government’s commitment to facilitate access to information on its activities, since it is available to the public on the Internet, free of charge.

A description of TBS’s functions, programs, activities and related information holdings can be found in Sources of Federal Government and Employee Information (Info Source): Treasury Board Secretariat.

The 2022–23 fiscal year was a productive year for the TBS ATIP office on formal privacy requests as well as privacy policy initiatives. The office processed 25% more privacy requests than the previous year. While a significant portion of the requests that were initiated were ultimately abandoned by the applicants, it appears that there is a greater level of interest among individuals to gain access to their personal information. The TBS ATIP office continues to strive for a high compliance rate. The Privacy Policy Unit in the ATIP office processed several departmental complaints, supported the development and completion of several Privacy Impact Assessments, and investigated privacy breaches. The ATIP office is client service-focused and will continue to focus on the administration of the Privacy Act and will continue its responsibilities to provide privacy advice to sector officials. The ATIP office is also aware of the increased pressures on the team to support departmental programs and leverage its expertise in other initiatives that fall outside of the requirements of the ATIA and Privacy Act.

Appendix A: delegation order

I, undersigned, President of the Treasury Board, pursuant to section 73 of the Privacy Act hereby designate the ATIP Advisors, the Access to Information and Privacy Team Leader, the Access to Information and Privacy Manager, the Access to Information and Privacy Director of Ministerial Services, the Assistant Secretary, Strategic Communications and Ministerial Services and the Secretary, or person occupying those positions on an acting basis, to exercise signing authorities or perform any of the President’s powers, duties or functions as head of institution that are specified in the attached Schedule B. This designation replaces all previous delegation orders.

Original signed by

The Honourable Mona Fortier
President of the Treasury Board
Date: 2022-02-02

Position Powers, duties or functions
Secretary Full authority
Assistant Secretary, Strategic Communications and Ministerial Affairs Full authority
Senior Director, Ministerial Services Full authority, except: subsections: 33(2), 35(1), 36(3), 37(3)
Director, Access to Information and Privacy Full authority, except: subsections: 33(2), 35(1), 36(3), 37(3)
Manager, Access to Information and Privacy Sections: 14, 15, 26, 27
Team Leader, Access to Information and Privacy Sections: 15, 26, 27 Paragraph: 14(a)
Access to Information and Privacy Officers Paragraph: 14(a)

Appendix B: statistical report on the Privacy Act

Name of institution: Treasury Board of Canada Secretariat

Reporting period: 2022-04-01 to 2023-03-31

In this section

Section 1: requests under the Privacy Act

1.1 Number of requests received

Number of requests
Received during reporting period 105
Outstanding from previous reporting periods 12
Outstanding from previous reporting period 11
Outstanding from more than one reporting period 1
Total 117
Closed during reporting period 99
Carried over to next reporting period 18
Carried over within legislated timeline 16
Carried over beyond legislated timeline 2

1.2 Channels of requests

Channel Number of requests
Online 87
Email 13
Mail 4
In person 0
Phone 0
Fax 1
Total 105

Section 2: informal requests

2.1 Number of informal requests

Number of requests
Received during reporting period 0
Outstanding from previous reporting periods 0
Outstanding from previous reporting period 0
Outstanding from more than one reporting period 0
Total 0
Closed during reporting period 0
Carried over to next reporting period 0

2.2 Channels of informal requests

Channel Number of requests
Online 0
Email 0
Mail 0
In person 0
Phone 0
Fax 0
Total 0

2.3 Completion time of informal requests

Completion time
1 to 15 days 16 to 30 days 31 to 60 days 61 to 120 days 121 to 180 days 181 to 365 days More than 365 days Total
0 0 0 0 0 0 0 0

2.4 Pages released informally

Less than 100 pages released 100 to 500 pages released 501 to 1,000 pages released 1,001 to 5,000 pages released More than 5,000 pages released
Number of requests Pages released Number of requests Pages released Number of requests Pages released Number of requests Pages released Number of requests Pages released
0 0 0 0 0 0 0 0 0 0

Section 3: requests closed during the reporting period

3.1 Disposition and completion time

Disposition of requests Completion time
1 to 15 days 16 to 30 days 31 to 60 days 61 to 120 days 121 to 180 days 181 to 365 days More than 365 days Total
All disclosed 4 7 2 0 0 0 0 13
Disclosed in part 0 6 3 0 0 0 2 11
All exempted 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0
No records exist 3 10 0 0 0 0 0 13
Request abandoned 59 3 0 0 0 0 0 62
Neither confirmed nor denied 0 0 0 0 0 0 0 0
Total 66 13 5 0 0 0 2 99

3.2 Exemptions

Section Number of requests
18(2) 0
19(1)(a) 0
19(1)(b) 0
19(1)(c) 0
19(1)(d) 0
19(1)(e) 0
19(1)(f) 0
20 0
21 0
22(1)(a)(i) 0
22(1)(a)(ii) 0
22(1)(a)(iii) 0
22(1)(b) 0
22(1)(c) 0
22(2) 0
22.1 0
22.2 0
22.3 0
23(a) 0
23(b) 0
24(a) 0
24(b) 0
25 0
26 11
27 3
28 0

3.3 Exclusions

Section Number of requests
69(1)(a) 0
69(1)(b) 0
69.1 0
70(1) 0
70(1)(a) 0
70(1)(b) 0
70(1)(c) 1
70(1)(d) 0
70(1)(e) 0
70(1)(f) 0
70.1 0

3.4 Format of information released

Paper Electronic record Data set Video Audio Other
0 24 0 0 0 0

3.5 Complexity

3.5.1 Relevant pages processed and disclosed for paper and electronic record formats
Number of pages processed Number of pages disclosed Number of requests
2,914 2,207 86
3.5.2 Relevant pages processed per request disposition for paper and electronic record formats by size of request
Disposition Less than 100 pages processed 100 to 500 pages processed 501 to 1,000 pages processed 1,001 to 5,000 pages processed More than 5,000 pages processed
Number of requests Pages processed Number of requests Pages processed Number of requests Pages processed Number of requests Pages processed Number of requests Pages processed
All disclosed 10 329 3 748 0 0 0 0 0 0
Disclosed in part 4 131 6 1,034 1 672 0 0 0 0
All exempted 0 0 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0 0 0
Request abandoned 62 0 0 0 0 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0 0 0 0 0 0
Total 76 460 9 1,782 1 672 0 0 0 0
3.5.3 Relevant minutes processed and disclosed for audio formats
Number of minutes processed Number of minutes disclosed Number of requests
0 0 0
3.5.4 Relevant minutes processed per request disposition for audio formats by size of requests
Disposition Less than 60 minutes processed 60 to 120 minutes processed More than 120 minutes processed
Number of requests Minutes processed Number of requests Minutes processed Number of requests Minutes processed
All disclosed 0 0 0 0 0 0
Disclosed in part 0 0 0 0 0 0
All exempted 0 0 0 0 0 0
All excluded 0 0 0 0 0 0
Request abandoned 0 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0 0
Total 0 0 0 0 0 0
3.5.5 Relevant minutes processed and disclosed for video formats
Number of minutes processed Number of minutes disclosed Number of requests
0 0 0
3.5.6 Relevant minutes processed per request disposition for video formats by size of requests
Disposition Less than 60 minutes processed 60 to 120 minutes processed More than 120 minutes processed
Number of requests Minutes processed Number of requests Minutes processed Number of requests Minutes processed
All disclosed 0 0 0 0 0 0
Disclosed in part 0 0 0 0 0 0
All exempted 0 0 0 0 0 0
All excluded 0 0 0 0 0 0
Request abandoned 0 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0 0
Total 0 0 0 0 0 0
3.5.7 Other complexities
Disposition Consultation required Legal advice sought Interwoven information Other Total
All disclosed 0 0 0 0 0
Disclosed in part 3 0 0 0 3
All exempted 0 0 0 0 0
All excluded 0 0 0 0 0
Request abandoned 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0
Total 3 0 0 0 3

3.6 Closed requests

3.6.1 Number of requests closed within legislated timelines
Requests closed within legislated timelines
Number of requests closed within legislated timelines 96
Percentage of requests closed within legislated timelines 97%

3.7 Deemed refusals

3.7.1 Reasons for not meeting legislated timelines
Number of requests closed past the legislated timelines Principal reason
Interface with operations or workload External consultation Internal consultation Other
3 1 2 0 0
3.7.2 Request closed beyond legislated timelines (including any extensions taken)
Number of days past legislated timelines Number of requests past legislated timeline where no extension was taken Number of requests past legislated timeline where an extension was taken Total
1 to 15 days 1 0 1
16 to 30 days 0 0 0
31 to 60 days 0 0 0
61 to 120 days 0 0 0
121 to 180 days 0 0 0
181 to 365 days 0 0 0
More than 365 days 0 2 2
Total 1 2 3

3.8 Requests for translation

Translation requests Accepted Refused Total
English to French 0 0 0
French to English 0 0 0
Total 0 0 0

Section 4: disclosures under subsections 8(2) and 8(5)

Paragraph 8(2)(e) Paragraph 8(2)(m) Subsection 8(5) Total
0 0 0 0

Section 5: requests for correction of personal information and notations

Disposition of correction requests received Number
Notations attached 0
Requests for correction accepted 0
Total 0

Section 6: extensions

6.1 Reasons for extensions

Number of requests where an extension was taken 15(a)(i) interference with operations 15 (a)(ii) consultation 15(b) translation purposes or conversion
Further review required to determine exemptions Large volume of pages Large volume of requests Documents are difficult to obtain Cabinet confidence section (section 70) External Internal
6 2 2 0 2 0 0 0 0

6.2 Length of extensions

Length of extensions 15(a)(i) interference with operations 15 (a)(ii) consultation 15(b) translation purposes or conversion
Further review required to determine exemptions Large volume of pages Large volume of requests Documents are difficult to obtain Cabinet confidence section (section 70) External Internal
1 to 15 days 0 0 0 0 0 0 0 0
16 to 30 days 2 2 0 2 0 0 0 0
31 days or greater 0 0 0 0 0 0 0 0
Total 2 2 0 2 0 0 0 0

Section 7: consultations received from other institutions and organizations

7.1 Consultations received from other Government of Canada institutions and other organizations

Consultations Other Government of Canada institutions Number of pages to review Other organizations Number of pages to review
Received during the reporting period 3 597 0 0
Outstanding from the previous reporting period 0 0 0 0
Total 3 597 0 0
Closed during the reporting period 3 597 0 0
Carried over within negotiated timelines 0 0 0 0
Carried over beyond negotiated timelines 0 0 0 0

7.2 Recommendation and completion time for consultations received from other Government of Canada institutions

Recommendation Number of days required to complete consultation requests
1 to 15 days 16 to 30 days 31 to 60 days 61 to 120 days 121 to 180 days 181 to 365 days More than 365 days Total
Disclose entirely 0 2 0 0 0 0 0 2
Disclosed in part 0 0 0 0 1 0 0 1
Exempt entirely 0 0 0 0 0 0 0 0
Exclude entirely 0 0 0 0 0 0 0 0
Consult other institution 0 0 0 0 0 0 0 0
Other 0 0 0 0 0 0 0 0
Total 0 2 0 0 1 0 0 3

7.3 Recommendation and completion time for consultations received from other organizations

Recommendation Number of days required to complete consultation requests
1 to 15 days 16 to 30 days 31 to 60 days 61 to 120 days 121 to 180 days 181 to 365 days More than 365 days Total
Disclose entirely 0 0 0 0 0 0 0 0
Disclosed in part 0 0 0 0 0 0 0 0
Exempt entirely 0 0 0 0 0 0 0 0
Exclude entirely 0 0 0 0 0 0 0 0
Consult other institution 0 0 0 0 0 0 0 0
Other 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0

Section 8: completion time of consultations on Cabinet confidences

8.1 Consultation requests with legal services

Number of days Fewer than 100 pages processed 100 to 500 pages processed 501 to 1,000 pages processed 1,001 to 5,000 pages processed More than 5,000 pages processed
Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed
1 to 15 0 0 0 0 0 0 0 0 0 0
16 to 30 0 0 0 0 0 0 0 0 0 0
31 to 60 0 0 0 0 0 0 0 0 0 0
61 to 120 0 0 0 0 0 0 0 0 0 0
121 to 180 0 0 0 0 0 0 0 0 0 0
181 to 365 0 0 0 0 0 0 0 0 0 0
More than 365 0 0 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0 0 0

8.2 Consultation requests with Privy Council Office

Number of days Fewer than 100 pages processed 100 to 500 pages processed 501 to 1,000 pages processed 1,001 to 5,000 pages processed More than 5,000 pages processed
Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed
1 to 15 0 0 0 0 0 0 0 0 0 0
16 to 30 0 0 0 0 0 0 0 0 0 0
31 to 60 0 0 0 0 0 0 0 0 0 0
61 to 120 0 0 0 0 0 0 0 0 0 0
121 to 180 0 0 0 0 0 0 0 0 0 0
181 to 365 0 0 0 0 0 0 0 0 0 0
More than 365 0 0 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0 0 0

Section 9: complaints and investigations notices received

Section 31 Section 33 Section 35 Court action Total
2 0 0 0 2

Section 10: privacy impact assessments and personal information banks

10.1 Privacy impact assessments

Number of privacy impact assessments completed 3
Number of privacy impact assessments modified 0

10.2 Institution-specific and central personal information banks

Personal information banks Active Created Terminated Modified
Institution-specific 8 0 0 0
Central 35 2 0 0
Total 43 2 0 0

Section 11: privacy breaches

11.1 Material privacy breaches reported

Number of material privacy breaches reported to the Treasury Board of Canada Secretariat 1
Number of material privacy breaches reported to the Office of the Privacy Commissioner of Canada 1

11.2 Non-material privacy breaches

Number of non-material privacy breaches 5

Section 12: resources related to the Privacy Act

12.1 Allocated costs

Expenditures Amount
Salaries $317,958
Overtime $744
Goods and services $6,471
Professional services contracts $0
Other $6,471
Total $325,173

12.2 Human resources

Resources Person years dedicated to privacy activities
Full-time employees 3.150
Part-time and casual employees 0.800
Regional staff 0.000
Consultants and agency personnel 0.000
Students 0.000
Total 3.950

Appendix C: supplemental statistical report on the Access to Information Act and the Privacy Act

Name of institution: Treasury Board of Canada Secretariat

Reporting period: 2022-04-01 to 2023-03-31

In this section

Section 1: capacity to receive requests under the Access to Information Act and the Privacy Act

1.1 Enter the number of weeks your institution was able to receive ATIP requests through different channels.

Number of weeks
Able to receive requests by mail 52
Able to receive requests by email 52
Able to receive requests through the digital request service 52

Section 2: capacity to process records under the Access to Information Act and the Privacy Act

2.1    Enter the number of weeks your institution was able to process paper records in different classification levels.

No capacity Partial capacity Full capacity Total
Unclassified paper records 0 0 52 52
Protected B paper records 0 0 52 52
Secret and top secret paper records 0 0 52 52

2.2    Enter the number of weeks your institution was able to process electronic records in different classification levels.

No capacity Partial capacity Full capacity Total
Unclassified electronic records 0 0 52 52
Protected B electronic records 0 0 52 52
Secret and top secret electronic records 0 0 52 52

Section 3: open requests and complaints under the Access to Information Act

3.1    Enter the number of open requests that are outstanding from previous reporting periods.

Fiscal year open request was received Open requests within legislated timeline as of March 31, 2022 Open requests beyond legislated timeline as of March 31, 2022 Total
Received in 2022–23 58 37 95
Received in 2021–22 1 23 24
Received in 2020–21 2 10 12
Received in 2019–20 0 10 10
Received in 2018–19 0 1 1
Received in 2017–18 0 7 7
Received in 2016–17 or earlier 0 0 0
Total 61 88 149

3.2    Enter the number of open complaints with the Information Commissioner of Canada that are outstanding from previous reporting periods.

Fiscal year open complaints were received by institution Number of open complaints
Received in 2022–23 18
Received in 2021–22 0
Received in 2020–21 1
Received in 2019–20 0
Received in 2018–19 1
Received in 2017–18 0
Received in 2016–17 or earlier 0
Total 20

Section 4: open requests and complaints under the Privacy Act

4.1    Enter the number of open requests that are outstanding from previous reporting periods.

Fiscal year open request was received Open requests within legislated timeline as of March 31, 2022 Open requests beyond legislated timeline as of March 31, 2022 Total
Received in 2022–23 16 1 17
Received in 2021–22 0 0 0
Received in 2020–21 0 1 1
Received in 2019–20 0 0 0
Received in 2018–19 0 0 0
Received in 2017–18 0 0 0
Received in 2016–17 or earlier 0 0 0
Total 16 2 18

4.2    Enter the number of open complaints with the Privacy Commissioner of Canada that are outstanding from previous reporting periods.

Fiscal year open complaints were received by institution Number of open complaints
Received in 2022–23 0
Received in 2021–22 0
Received in 2020–21 0
Received in 2019–20 1
Received in 2018–19 1
Received in 2017–18 0
Received in 2016–17 or earlier 0
Total 2

Section 5: social insurance number

Did your institution receive authority for a new collection or new consistent use of the social insurance number in 2022–23? No

Section 6: universal access under the Privacy Act

How many requests were received from confirmed foreign nationals outside of Canada in 2022–23? 5

© His Majesty the King in Right of Canada, represented by the President of the Treasury Board, 2023,
Catalogue No. BT1-5/2E-PDF, ISSN: 2371-3038

Page details

Date modified: