2023 to 2024 Annual Report on the Privacy Act

On this page

Introduction

The Treasury Board of Canada Secretariat (TBS) is pleased to present to Parliament its annual report on the administration of the Privacy Act (PA) for 2023–24 (April 1, 2023, to March 31, 2024).

Section 72 of the PA requires that the head of every government institution prepare and submit an annual report to Parliament on the administration of the act in the institution during the fiscal year.

Purpose of the Privacy Act

The purpose of the PA is to provide:

  • individuals with the right to access and correct personal information about themselves that is under the control of a government institution
  • the legal framework for the collection, retention, use, disclosure, disposition and accuracy of personal information in the administration of programs and activities by government institutions subject to the act

Under the PA, personal information is defined as information about an identifiable individual that is recorded in any form.

Examples include information relating to:

  • the national or ethnic origin, colour, religion, age or marital status of an individual
  • the education or the medical, criminal, financial or employment history of an individual
  • the address, fingerprints or blood type of an individual
  • any identifying number, symbol or other particular identifier assigned to an individual

Mandate of the Treasury Board of Canada Secretariat

As the administrative arm of the Treasury Board, TBS has a dual mandate:

  • to support the Treasury Board as a committee of ministers
  • to fulfill the statutory responsibilities of a central government agency and those of a line department

The Treasury Board’s mandate is derived from the Financial Administration Act.

To fulfill its mandate, TBS organizes its business and resources around 4 core responsibilities:

  • spending oversight
  • administrative leadership
  • employer
  • regulatory oversight

TBS provides advice and support to Treasury Board ministers in their role of ensuring value for money. TBS also provides oversight of the financial management functions in federal institutions.

TBS makes recommendations and provides advice to the Treasury Board on policies, directives, regulations and program expenditure proposals with respect to the management of the government’s resources. TBS is responsible for the general management of government-wide initiatives, issues and activities (as reported in the Main Estimates).

The offices of the following government officials are part of TBS:

  • the Comptroller General of Canada
  • the Chief Human Resources Officer of Canada
  • the Chief Information Officer of Canada

The Comptroller General is responsible for the comptrollership function of government and provides government-wide leadership, direction, oversight and capacity-building for financial management, internal audit, and the management of assets and acquired services.

The Chief Human Resources Officer provides government-wide leadership on people management through policies, programs and strategic engagement by centrally managing labour relations, compensation, pensions and benefits, and by contributing to the management of executives.

The Chief Information Officer provides government-wide leadership, direction, oversight and capacity-building for information management, information technology, government security (including identity management), access to information, privacy, and internal and external service delivery.

Delegation order for the Privacy Act

Pursuant to subsection 73(1) of the PA, the President of the Treasury Board has delegated the powers, duties and functions for the administration of the PA to the following TBS officials:

  • the Secretary of the Treasury Board
  • the Assistant Secretary of Strategic Communications and Ministerial Affairs
  • the Senior Director of Ministerial Services
  • the Director of Access to Information and Privacy (ATIP)
  • managers and team leaders of the ATIP office

The delegation order was signed on November 29, 2023, and a copy can be found in Appendix A.

Organization structure

The ATIP office is part of the Ministerial Services division of TBS’s Strategic Communications and Ministerial Affairs sector.

The ATIP office is responsible for:

  • implementing and managing programs and services relating to TBS’s administration of the Access to Information Act (ATIA) and the PA(the acts)
  • providing advice to TBS employees as they fulfill their obligations under the acts
  • reviewing and releasing records under Part 2 of the ATIA; specifically, briefing note titles, parliamentary committee appearance binders, Question Period notes and transition binders

Outside of the administration of the acts, the ATIP office provides support in the following areas:

  • internal reviews of documents intended for publication by sectors
  • reviews of documents subject to parliamentary production motions
  • reviews of documents related to class action lawsuits
  • training sessions on the administration of the actsfor sectors and sector officials
  • policy updates and research related to the administration of the acts
  • research and reporting on trends within the ATIP office
  • systems administration of ATIP software
  • various reports
  • privacy breach management
  • access to information and privacy advice to program sectors

The ATIP office is led by a director, who is supported by three managers. Each of these managers oversees a unit that is responsible for a different functional area. The three key units include:

  • ATIP Intake and Governance Unit
  • ATIP Operations Unit
  • Privacy Policy Unit

The ATIP Intake and Governance Unit and the ATIP Operations Unit work together to process ATIP requests, whereas the Privacy Policy Unit supports sector officials on privacy-related matters, including the review of privacy impact assessments and privacy breach management.

The ATIP office comprises employees at various levels. There was an equivalent of 18.4 full-time employees that administered the ATIA in 2023–24, consisting of 17 full-time employees, 4 casual employees and 1 student. There was an additional equivalent of 7.7 full-time employees that administered the PA in 2023–24, consisting of 7 full-time employees and 1 part-time employee. Certain employees within the ATIP office contribute to both the ATIA and the PA and these activities are recorded in the appropriate report proportional with their contributions.

Figure 1 shows the roles of the individuals and teams involved in processing ATIP requests at TBS. The ATIP office has 3 functional units. Sector liaison officers are not part of the ATIP office but play an important role in processing requests because they coordinate ATIP activities in their sector.

Figure 1: roles in processing ATIP requests
Text version below:
Figure 1 - Text version

The ATIP Director is supported by three units: the ATIP Intake and Governance Unit, the ATIP Operations Unit and the Privacy Policy Unit.

The ATIP Intake and Governance Unit coordinates and reviews documents for proactive disclosure and receives ATIP requests from the public and consultation requests from other departments. The unit also liaises with sectors to obtain and retrieve documents needed to process ATIP requests, and prepares reports on performance, using data in the ATIP software. The unit is comprised of 8 employees and 1 student.

The ATIP Operations Unit reviews documents to be sent in response to requests made under the Access to Information Act and Privacy Act and consults any required parties. The unit liaises with the Office of Information Commissioner and the Office of the Privacy Commissioner to resolve complaints and reviews records for parliamentary Motions for the Production of Papers. The Operations Unit is comprised of 9 employees.

The Privacy Policy Unit advises and supports TBS officials to ensure compliance with the Privacy Act and related policy instruments. The unit also supports TBS officials to ensure that individuals’ privacy rights are respected in the delivery of programs and activities. Lastly, the unit supports the ATIP Director in their role as delegate responsible for section 10 of the Privacy Act. The Privacy Policy Unit is comprised of 6 employees.

As aforementioned, the ATIP sector liaison officers are not part of the ATIP office. They support the ATIP program by coordinating ATIP activities in their sector.

The TBS ATIP office works with the 19 sectors across TBS that retrieve responsive records to ATIP requests. Each sector has assigned sector liaison officers that work directly with the ATIP office to efficiently process requests. The ATIP office also works in partnership with sectors across TBS to complete proactive publication requirements under Part 2 of the ATIA.

Statistical report

Statistical reports prepared by government institutions provide aggregate data on the application of the ATIA and the PA. This information is made public annually in a statistical report that is included with the annual reports on access to information and privacy tabled in Parliament by each institution. TBS’s statistical report on the PA for 2023–24 is found at Appendix B.

This year, institutions were required to report on the following additional criteria outlined below:

  • open requests from previous reporting periods
  • open complaints from previous reporting periods
  • new authorities to collect or use social insurance numbers
  • privacy requests made by foreign nationals

The 2023–24 Supplemental Statistical Report on the ATIAand PA is included at Appendix C.

The following sections contain:

  • highlights of TBS’s performance in 2023–24 in relation to its obligations under the PA
  • analyses of the notable statistical data for this year compared with previous years

Interpretation of the statistical report for the Privacy Act

In this section

Introduction

In 2023–24, TBS observed a significant increase in the number of privacy requests received and the work related to the administration of the PA. TBS cannot establish a causal relationship between the number of requests received by the institution under the PA and any particular factors.

hat is known, though, is that such fluctuations in annual workload create uncertainty with respect to the resourcing required to satisfy legislative requirements under the PA. Because operational resourcing for the PA is shared with resourcing for the ATIA, increased workload, as was seen in 2023–24, requires sharing the resources that would otherwise support the administration of the ATIA.

Because both the ATIA and the PA are equal in level of importance, ATIP offices are unable to prioritize one legislation over the other. This requires the office to share resources to respond to applicants and review the documents requested. As a result of the increased interest in TBS records, the TBS ATIP office has an insufficient number of staff to manage all legislative requests under the ATIA and the PA.

The following trends observed in the administration of the PA are key themes for the interpretation of the 2023–24 statistical report:

  • The number of requests received, completed and carried forward is increasing
  • The number of pages processed for privacy requests with records is increasing

Table 1 presents a 10-year overview of the institution’s processing of privacy requests.

Table 1: A 10-year overview of the institution’s processing of privacy requests
Fiscal year Requests received Requests completed Requests carried forward Number of pages processed Number of pages released On-time compliance rate Number of full-time employeestable 1 note 1

Table 1 Notes

Table 1 Note 1

The number of full-time employees reflects both members of the Privacy Policy Unit and members of the Operations Unit who process privacy requests.

Return to table 1 note 1 referrer

2023–24 191 184 25 19,663 8,829 94% 7.71
2022–23 105 99 18 2,914 2,207 97% 3.95
2021–22 84 78 12 7,840 5,171 97% 6.02
2020–21 66 68 6 17,455 11,250 79% 6.86
2019–20 87 88 8 4,433 3,874 99% 6.68
2018–19 77 76 9 10,165 8,842 95% 4.85
2017–18 93 93 8 5,089 4,054 98% 3.15
2016–17 97 107 8 6,112 3,520 96% 2.50
2015–16 129 116 18 6,706 5,744 87% 2
2014–15 120 123 5 3,444 3,305 98% 1.61

While the number of employees dedicated to administration of the PA is recorded as 7.71 for 2023–24, further context is required to assess the allocation of these resources and the impact on operations.

The administration of the PA includes operational processing of privacy requests, but also includes activities conducted by the Privacy Policy Unit.

The Privacy Policy Unit comprises 5 full-time employees and 1 part-time employee and is mandated to ensure departmental policy compliance with the PA rather process privacy requests.

Processing privacy requests under the PA is done with resources from the ATIP Operations Unit and the ATIP Intake and Governance Unit. This means that only 1.91 of the 7.71 (25%) employees who administered the PA processed privacy requests in 2023–24.

Part 1: requests received and carried forward

Privacy requests received and carried forward

In 2023–24, TBS received 191 requests under the PA, which represents an 82% increase from the 105 requests received in 2022–23.

The number of requests that the TBS ATIP office carried forward from previous fiscal years was 18, which is consistent with the 18 requests carried forward in 2022–23.

Figure 2 shows the number of privacy requests TBS received each year and the number of requests carried forward for 2019–20 to 2023–24.

Figure 2: privacy requests received and requests carried forward 2019–20 to 2023–24
Text version below:
Figure 2 - Text version
Fiscal year Requests received Requests carried forward
2019–20 87 8
2020–21 66 6
2021–22 84 12
2022–23 105 18
2023–24 191 25

Channels of requests

Pursuant to subsection 13(1) of the PA, requests are required to be submitted by requesters in writing.

Requests can be submitted electronically via the Access to Information and Personal Information Online Request Service (AORS) or by email.

Requests can also be sent by mail, fax or submitted in person.

Most requests that TBS receives are submitted electronically. In 2023–24, 172 requests were submitted via AORS and 11 requests were submitted by email. This represented 96% of the 191 requests received by TBS.

Part 2: requests completed

Privacy requests completed

In 2023–24, TBS completed 184 requests, which is an increase of 86% compared to the 99 requests completed in 2022–23.

Figure 3 shows the number of privacy requests TBS completed each year from 2019–20 to 2023–24.

Figure 3: privacy requests completed, 2019–20 to 2023–24
Text version below:
Figure 3 - Text version
Fiscal year Requests completed
2019–20 88
2020–21 68
2021–22 78
2022–23 99
2023–24 184

Disposition of requests completed

The following is a breakdown by disposition of the 184 requests completed in 2023–24:

  • 135 requests were abandoned by the requester
  • 18 requests had no records
  • 17 requests contained records that were partially disclosed
  • 14 requests contained records that were disclosed entirely

The 14 requests that were disclosed entirely in 2023–24 is consistent with the 13 requests disclosed entirely in 2022–23. Similarly, the 17 partially disclosed requests represent a 55% increase compared to the 11 requests partially disclosed in 2022–23.

As the President of the Treasury Board is responsible for ensuring compliance with the PA government‑wide, TBS often receives requests that fall within the mandates of other federal institutions. Such requests are registered, reviewed and closed after the requester is informed of which institution they should contact. These requests are included in the totals for “No records exist” or “Request abandoned” and represent the majority of privacy requests that TBS receives. These requests contribute to the overall compliance rate and represent 83% of all PA requests closed in 2023–24.

Figure 4 shows the percentage of privacy requests by disposition for 2023–24.

Figure 4: percentage of requests by disposition, 2023–24
Text version below:
Figure 4 - Text version
Disposition Distribution
Request abandoned 135
Disclosed in part 17
No records exist 18
All disclosed 14

Table 2 represents the number of requests and the percentage of total requests by disposition from 2021–22 to 2023–24.

Table 2: number of requests and percentage of total requests by disposition, 2021–22 to 2023–24
Disposition of requests 2021–22 2022–23 2023–24
Number of requests Percentage of total Number of requests Percentage of total Number of requests Percentage of total
All disclosed 9 12% 13 13 % 14 8%
Disclosed in part 14 18% 11 11 % 17 9%
All exempted 0 0% 0 0 % 0 0%
All excluded 0 0% 0 0 % 0 0%
Request abandoned 44 56% 62 63 % 135 73%
No records exist 11 14% 13 13 % 18 10%
Neither confirm nor deny 0 0% 0 0 % 0 0%
Total 78 100% 99 100 % 184 100%

Exemptions

The PA exempts certain information from being disclosed. In 2023–24, 17 requests contained some information that was subject to exemptions, and this information was not disclosed.

A request may have multiple exemptions applied, resulting in a greater number of exemptions invoked than redacted requests. In 2023–24, 17 requests contained information that was subject to the following exemptions:

  • personal information about individuals other than the requester (17 requests) (section 26 of the act)
  • personal information related to solicitor-client privilege (4 requests) (section 27 of the act)

Exclusions

The PA does not apply to or exclude information that is publicly available, such as government publications and material in libraries and museums. The act also excludes material such as cabinet confidences. No requests were subject to an exclusion in 2023–24.

Pages processed and disclosed

TBS completed 184 requests in 2023–24, which involved processing 19,663 pages. This represents an increase of 575% relative to the 2,914 pages processed in 2022–23. This increase in pages processed is largely due to 6 requests that accounted for approximately 15,000 pages, or 76% of all privacy request pages processed in 2023–24.

This illustrates the impact that a small number of requests can have on the administration of the PA within TBS. The ATIP office’s ability to process this increase of records is due to requests for performance management agreements, which are often voluminous but not complex. Furthermore, some information that was requested was previously reviewed by the ATIP office and thus, the review period was truncated.

While voluminous requests of this nature are the minority of privacy requests received by TBS, their impact on the ATIP Operations Unit is significant. The requirement to respond to privacy requests within a maximum of 60 calendar days requires that dedicated senior level expertise be rapidly reallocated from administration of the ATIA and further exacerbates capacity challenges within the ATIP office.

In 2023–24, 83% of closed privacy requests were abandoned or did not have responsive records. These requests are included in the calculation for the average number of pages per closed privacy request, which is shown in Figure 6 as 107 pages processed on average per closed request in 2023–24. However, when these requests are excluded from the calculation, the average number of pages processed per closed privacy request increases significantly to 596 pages.

This supports the observations made by TBS under the ATIA that the number of responsive records is increasing and demonstrates an evolving environment where additional resources with a senior level of expertise is required to process those requests. The ATIP office anticipates average volume of pages per request closed to continue to increase in upcoming fiscal years.

Figure 5 shows, for 2019–20 to 2023–24, the number of privacy requests TBS completed each year and the number of pages it processed for those requests.

Figure 5: privacy requests completed and pages processed, 2019–20 to 2023–24
Text version below:
Figure 5 - Text version
Fiscal year Requests completed Pages processed
2019–20 88 4,433
2020–21 68 17,455
2021–22 78 7,840
2022–23 99 2,914
2023–24 184 19,663

Complexity

Of the 184 requests that were closed in 2023–24, 17 were subject to exemptions and or exclusions. Among them, 16 requests (9%) contained personal information that was about another individual, and 4 (2%) contained information subject to solicitor–client privilege. These 17 requests account for 17,413 pages (89%) of the 19,663 pages processed in 2023–24. As requests can contain more than one exemption, the total number of exemptions taken may be higher than requests with exemptions.

No requests required consultation with other federal institutions before disclosure in 2023–24.

Format of information released

The ATIP office continues to provide clients with access to government records in electronic formats. In 2023–24, TBS released 28 requests for information in electronic format, and 3 requests in paper format. It is anticipated that the format of information released under the PA will continue to be predominantly electronic in upcoming fiscal years.

Requests for translation

Consistent with previous fiscal years, TBS did not receive nor did it process any requests in 2023–24 that required translation of responsive records.

Part 3: on-time compliance rate, completion times and extensions

On-time compliance rate

The on-time compliance rate is the percentage of requests responded to within their legislative timelines, including requests for which the institution invoked legislative extensions. For privacy requests, this means requests that were processed and provided to requesters within 30 days, or 60 days if a legal extension was invoked.

In 2023–24, TBS’s ATIP office achieved an on-time compliance rate of 94%.

TBS assesses that several factors contributed to this rate, such as:

  • the refinement of digital ATIP procedures
  • the issuing of weekly statistical reports on performance that encouraged staff to maintain compliance levels
  • strong case file management
  • regular information sessions with TBS officials
  • the high rate of abandoned and “no record” dispositions

The calculation for the on-time compliance rate includes 153 requests (83% of all requests closed) that did not contain records or were abandoned prior to processing records. These requests are closed within 30 days, which increases the institution’s on-time compliance rate. When these requests are removed from this calculation, the on-time compliance rate for requests that contained records was 66%. This reflects some of the significant operational challenges faced by the ATIP Operations Unit when processing privacy requests.

In instances where there are records that require processing under the PA, the volume of pages that require processing along with the limited resources means that requests cannot always be completed within their legislative deadlines, which creates the significant disparity between the overall compliance rate and the compliance rate for requests with records.

Figure 6 shows the impact of the increasing average number of pages processed for completed requests on the on-time compliance rate.

Figure 6: average number of pages processed per completed request and on-time compliance rate, 2019–20 to 2023–24
Text version below:
Figure 6 - Text version
Fiscal Year Percentage of requests completed within legislated timelines (on-time compliance rate) Average number of pages processed per completed request
2019–20 99% 50
2020–21 79% 257
2021–22 97% 96
2022–23 97% 29
2023–24 94% 107

Deemed refusals

There are a variety of reasons why TBS was unable to close requests within legislative timelines. Among them was the significant workload in the ATIP office, a labour disruption that impacted a portion of the requests processed, and delays in obtaining records from departmental officials. Like other Government of Canada institutions, there continued to be turnover during the reporting period and onboarding efforts of new staff also factored into the ability to respond to ATIP requests within legislative timelines. These factors created a challenging environment with respect to maintaining legislative compliance under the PA.

In 2023–24, TBS closed 11 requests that exceeded the legislated deadline, and therefore fell into deemed refusal. This represents a substantive increase compared to the 3 requests closed in 2022–23 that exceeded the legislated deadline.

Time required to complete requests

Of the 184 requests closed in 2023–24, 162 (or 88%) were closed within 30 days, which is a decrease of 5% from 93% recorded in 2022–23.

Given the significant increase of pages that were processed, the ATIP office’s compliance rate decreased somewhat and some requests required more time than the legislative deadline to finalize. Of the remaining 22 requests closed in 2023–24, 15 were completed within 60 days, while 7 required significantly more time to process owing to the volume of pages that required processing.

Figure 7: requests completed by time it takes to complete request, 2023–24
Text version below:
Figure 7 - Text version
Time to complete request Requests completed
1 to 15 days 136
16 to 30 days 26
31 to 60 days 15
61 to 180 days 2
121 to 120 days 4
181 to 365 days 0
More than 365 days 1

Table 3 represents the number of requests completed by time it takes to complete the request from 2021–22 to 2023–24.

Table 3: requests completed by time it takes to complete request, 2021–22 to 2023–24
Time to complete request 2021–22 2022–23 2023–24
Number of requests Percentage of total Number of requests Percentage of total Number of requests Percentage of total
1 day to 15 days 50 64% 66 67% 136 74%
16 to 30 days 13 17% 26 26% 26 14%
31 to 60 days 14 18% 5 5% 15 8%
61 to 120 days 1 1% 0 0% 4 2%
121 to 180 days 0 0% 0% 2 1%
181 to 365 days 0 0% 0 0% 0 0%
More than 365 days 0 0% 2 2% 1 1%

Reasons for extensions

The legislation sets timelines for responding to privacy requests and allows for extensions, up to a maximum of 30 days, in any of the following cases:

  • when complying with the timeline would interfere with operations as a result of:
    • a review being required to determine exemptions or exclusions
    • a large volume of pages requiring review
    • a large volume of requests
    • the documents being difficult to obtain
    • when a consultation is required
    • when documents must be translated

In 2023–24, TBS invoked extensions for 13 completed requests, or 7% of all requests completed. This represents a 2% increase in extensions compared to the previous fiscal year.

Eleven requests were extended because complying with the original time limit would have unreasonably interfered with operations, in accordance with paragraph 15(a)(i) of the act.

Of these requests:

  • 2 required further review to determine exemptions
  • 5 involved a large number of pages
  • 3 were because there was a large volume of requests
  • 1 was because documents were difficult to obtain

In 2023–24, TBS also invoked extensions for 2 requests in order to conduct consultations in accordance with paragraph 15(a)(ii):

  • 1 was for external consultations
  • 1 was for internal consultations

No extensions were invoked for requests in 2023–24 for the purposes of translating materials.

Length of extensions

In 2023–24 TBS completed 13 requests for which extensions had been invoked. All of the 13 requests for which extensions were invoked were extended by 30 calendar days.

Part 4: informal requests

Informal requests received

TBS did not receive any informal privacy requests in 2023–24.

Informal requests completed

TBS did not complete any informal privacy requests in 2023–24.

Informal pages released

TBS did not release any pages informally in 2023–24.

Part 5: consultations from other government institutions and organizations

Consultation requests received and carried forward

TBS received 1 consultation request from other government institutions in 2023–24, which is 2 fewer than the 3 consultation requests reported in 2022–23.

There were no consultation requests from other government institutions received in 2022–23 that were carried forward to 2023–24.

Consultation requests completed and pages processed

TBS completed 1 consultation request in 2023–24 and processed 15 pages for this consultation. In 2022–23, TBS completed 3 requests and processed 597 pages.

Completion time for consultations received from other Government of Canada institutions and other organizations

The only consultation request received by TBS in 2023–24 was completed within 15 days.

Part 6: consultations on cabinet confidences

Consultations with legal services

No requests processed by TBS in 2023–24 required consultation with legal services to evaluate cabinet confidences.

Consultations with the Privy Council Office

No requests processed by TBS in 2023–24 required consultation with the Privy Council Office to evaluate cabinet confidences.

Part 7: complaints and investigations

Complaints received

Requesters can file a complaint with the Office of the Privacy Commissioner of Canada (OPC) if they are not satisfied with how their request was processed. Members of the public can also submit complaints to the OPC in relation to the collection, use, disclosure, retention, or disposal of personal information as it relates to programs or initiatives conducted by the department.

In 2023–24, TBS was notified of 7 complaints received by the OPC. The miscellaneous complaint, identified in Table 4, is a departmental complaint related to a privacy breach for Brookfield Global Relocation Services and Sirva Canada. Additional information on this complaint can be found in the Departmental complaints with the Privacy Commissioner section of this report.

Table 4 shows the complaints received by type in 2023–24.

Table 4: complaints received by type, 2023–24
Complaint type Number of complaints
Time limits 0
Delay: deemed refusal 4
Refusal: exemptions 1
Refusal: exclusions 0
Refusal: missing records 1
Miscellaneous 1
Total 7

Complaint representations

The complaints process has many stages. Initially, the OPC contacts institutions to collect and review the processing file. During an investigation, the OPC must provide institutions with an opportunity to provide representations.

In 2023–24, the OPC asked TBS to provide legal representations for 4 requests.

Complaints closed

TBS closed 7 complaint investigations on privacy requests during 2023–24. Of these 7 complaint investigations, the OPC provided letters notifying TBS that it had discontinued 3 of its investigations. Of the remaining 4 investigations, the OPC issued findings: 1 was deemed not well founded, and 3 were deemed well founded.

Table 5 shows the complaint findings issued by the OPC in 2023–24.

Table 5: complaint findings issued by the OPC, 2023–24
Complaint type Complaint decision
Not well founded Well founded discontinued
Time limits 0 0 1
Delay: deemed refusal 1 1 2
Refusal: exemptions 0 1 0
Refusal: exclusion 0 0 0
Refusal: missing records 0 1 0
Miscellaneous 0 0 0

Part 8: court actions

There were no court cases filed against TBS in relation to the PA in 2023–24.

Part 9: disclosures under subsection 8(2)

Subsection 8(2) of the PA provides limited and specific circumstances under which institutions may disclose personal information without an individual’s consent. Paragraph 8(2)(e) allows for the disclosure of personal information to an investigative body specified in the regulations for the purposes of law enforcement and investigations. Paragraph 8(2)(m) allows for the disclosure of personal information when the public interest clearly outweighs any invasion of privacy or when the disclosure would benefit the individual involved.

In 2023–24, TBS processed 4 requests related to disclosures under 8(2), but did not make any disclosures pursuant to paragraphs 8(2)(e) or 8(2)(m) of the act. As a result of no disclosures being made pursuant to paragraph 8(2)(m) of the act, TBS did not have any notifications to the OPC pursuant to subsection 8(5).

Part 10: requests for correction of personal information and notations

Subsection 12(2) of the PA entitles individuals to request corrections to personal information that is erroneous or incomplete, and to request a notation to any personal information for which the individual requested a correction that was not completed by the institution.

In 2023-24, TBS did not receive any requests to correct personal information.

Part 11: privacy breaches

In 2023–24, TBS had 1 material privacy breach that was reported to the OPC. Personal information was compromised as a result of a cyber attack resulting in unauthorized access to Government of Canada employee information held on third-party systems belonging to Brookfield Global Relocation Services and Sirva Canada. Under the advice and guidance of the TBS Office of the Chief Information Officer’s Privacy and Responsible Data Division, and as the technical authority on the Government of Canada Relocation Support Services contract, TBS officials reported the breach as material.

At the departmental level, all potentially impacted individuals identified as a result of the investigation undertaken by the Royal Canadian Mounted Police (RCMP) were directly notified of the breach through various email wave notifications, press releases and internal communications. The centralized notification process managed by the TBS Policy Centre used the Government of Canada’s secure GCNotify service to provide Equifax credit and dark web monitoring, and identity theft protection service redemption codes to potentially impacted individuals.

Over the course of 2023–24, the ATIP Privacy Policy Unit also supported TBS program officials with the management of 5 non-material breaches, most of which were a result of administrative errors. In each of these circumstances, breach mitigation measures were quickly deployed, and program officials were provided with additional advice on mitigation measures to prevent re-occurrences.

Departmental complaints filed by the Privacy Commissioner 

As a result of the Brookfield Global Relocation Services and Sirva Canada privacy breach reported to the Office of the Privacy Commissioner (OPC) on October 20, 2023, the OPC exercised its discretion to initiate an investigation of TBS pursuant to subsection 29(3) of the PA. TBS was notified of the OPC’s intent to investigate on November 23, 2023. The purpose of the investigation was to examine compliance with section 8 of the PA and to request information from TBS as the technical authority for the Government of Canada Relocation Support Services contract. The TBS ATIP office privacy officials worked closely with PSPC and RCMP (as well as other stakeholders) to respond to the OPC’s initial inquiries and to ensure a consistent approach in addressing mitigation measures and ensuring that appropriate safeguards were put into place in response to the breach. At the end of the reporting period, program officials were awaiting additional guidance from the OPC. As such, in 2023–24, TBS received 1 notification of an investigation initiated by the OPC, which was registered as a departmental complaint.

Part 12: privacy impact assessments

The ATIP office provides TBS program officials with support and guidance on the privacy impact assessment (PIA) process. In accordance with the Treasury Board Directive on Privacy Impact Assessment, a PIA must be initiated for a program or activity in the following circumstances:

  • when personal information is used for or is intended to be used as part of a decision-making process that directly affects the individual(s)
  • when substantial changes are made to existing programs or activities where personal information is used or intended to be used for an administrative purpose
  • when the contracting out or the transfer of a program or activity to another level of government or to the private sector results in substantial changes to the program or activities

In 2023–24, TBS submitted the following PIAs to the OPC and the Privacy and Responsible Data Division at TBS:

The ATIP office continued to provide support to TBS program officials for numerous ongoing PIAs, including but not limited to the following key initiatives:

  • the Workplace Accessibility Passport PIA
  • emerging initiatives in the areas of artificial intelligence (Knockri PIA)
  • equity, diversity and inclusion for systemic change towards a more respectful, equitable and inclusive workspace (myIdentityExpression PIA)

Part 13: resources related to the Privacy Act

Costs

In 2023–24, TBS’s total cost for administering the PA was $880,114, which was allocated exclusively to salary costs. The cost of salaries associated for the administration of the PA increased from $325,173 in 2022–23 to $880,114 in 2023–24. This increase is primarily the result of operational analysts from the ATIP Operations Unit, who provided higher than normal activities under the PA in 2023–24. Employees who had shared efforts between the ATIA and the PA are reflected in both reports proportional with the time spent on each act.

In 2023–24, $588,547 was reported in other administrative costs. Similar to previous years, approximately $95,000 was expended for the purpose of annual maintenance of ATIP software. As part of its modernization program, the ATIP office procured new licences for ATIP software in 2023–24 totalling $493,900. While the software is used for the administration of the PA, the costs are reflected in the ATIA report.

This amount does not take into consideration the efforts undertaken by departmental officials to retrieve and provide records to the ATIP office for processing, nor does it take into account the costs associated with internal consultations of records nor legal services (when required) to process PA requests.

Human resources

In 2023–24, there were 7.71 full-time equivalents (FTEs) in the ATIP office performing work associated with the application of the PA, 4.55 more FTEs than the 3.15 recorded in 2022–23. This increase is attributed to the internal reallocation of resources from the ATIP Operations Unit to respond to the increased demand for processing requests under the PA in 2023–24. The ATIP office has placed increased emphasis in its recruitment activities to increase the overall proportion of senior analysts within its workforce. The result of this change is an increase in salary for fewer FTEs.

Non-legislative ATIP reviews

While the ATIP office completes its responsibilities under the PA, the ATIP office is often required to support the department for initiatives that fall outside the scope of the PA.

Document reviews

The ATIP office often provides departmental support by conducting document reviews of records outside of the PA. Under the PA, these document reviews are typically conducted by the Privacy Policy Unit to support the department in the review of information pertaining to the following activities:

  • publication of information
  • parliamentary questions

In 2023–24, the ATIP office conducted:

  • 8 reviews for publications made by TBS to the Open Government Portal
  • 2 reviews on responses to parliamentary questions
  • 81 reviews for proactive disclosure requests relating to travel and hospitality expense entries on the Open Government website

Privacy consultations within TBS

The Privacy Policy Unit within the ATIP office acts as a source of expertise for TBS program officials. The unit provides privacy assessment tools to ensure that program officials take appropriate measures in the planning stages of new initiatives to ensure legal and policy compliance.

Tools and guidance materials are regularly updated to adapt to the ever-changing privacy ecosystem (such as cyber security threats, use of artificial intelligence).

Over the course of 2023–24, the Privacy Policy Unit provided privacy advice on provisions and policy requirements set out in the PA on 333 occasions, representing a 42% increase compared to 2022–23. This trend is attributed to the number of new and forward-looking program initiatives involving the potential collection, use and disclosure of personal information in areas of people management, employment equity and diversity, and the increase in government-wide employee engagement and public outreach activities.

Information holdings

TBS publishes an inventory of its information holdings, as well as relevant details about personal information under its control. The information can assist individuals in making an access to information or personal information request, or in exercising their privacy rights. The inventory also supports the federal government’s commitment to transparency and facilitates access to information related to its activities.

During this reporting period, significant work was completed on the departmental Info Source chapter to align with the changes to the Info Source Online Publishing Requirements, which took effect on July 1, 2023. Also, the chapter was further updated to reflect the departmental reporting framework as reported and published in the TBS 2023–24 departmental plan.

A description of TBS’s functions, programs, activities and related information holdings can be found in Info Source: Treasury Board of Canada Secretariat.

Education, training and awareness

Each January 28, the ATIP office commemorates Data Privacy Day. This day highlights the impact technology is having on our privacy rights and underlines the importance of valuing and protecting personal information. For the 2023–24 Data Privacy Day, the ATIP office developed internal communication products and provided resources and information to employees. The Privacy Policy Unit set up a booth in the lobby of 90 Elgin to meet with employees and discuss the importance of privacy practices in their day-to-day work. More than 200 employees visited the kiosk.

Participants were also provided with complimentary reference materials provided by the OPC’s Government Advisory Services. In addition to the kiosk, more than 100 employees also participated in an online quiz to test their knowledge of privacy and the services offered by the ATIP office’s Privacy Policy Unit.

Table 6 outlines specific training initiatives conducted by the ATIP office in 2023–24.

Table 6: training initiatives conducted, 2023–24
Initiative Sector Description Responsible unit Participants
Privacy Act training All TBS Streams Video Privacy training module on Privacy awareness, roles and responsibilities Privacy Policy Unit 54
Privacy Act awareness All TBS Data Privacy day lobby kiosk Privacy Policy Unit 212

ATIP tools to support departmental officials

In 2023–24, the ATIP office implemented a digital template response form to better support departmental officials in responding to ATIP requests. The new form helps the efficient processing of ATIP requests and ensures that departmental officials understand their responsibilities when responding to ATIP requests. This includes but is not limited to ensuring that:

  • searches for responsive records are comprehensive
  • disclosure recommendations are documented and consistent with the legislation
  • submissions are approved by designated officials

The ATIP response form also reflects the recommended requirements from the Office of the Information Commissioner, which can help efficiently resolve complaints.

Policies, guidelines and procedures

Extension of the ATIP delegation order to improve efficiency

In November 2023, the ATIP delegation order was expanded to provide additional authorities to managers and team leaders of the ATIP office.

Extending the delegation order to reduce operational bottlenecks and to empower more individuals in the ATIP office is one component of the ATIP office’s modernization strategy aimed at increasing overall efficiency.

Guidance on timely provision of ATIP records

In an effort to support departmental adherence to legislative deadlines, the ATIP office provided additional guidance to departmental officials on the importance of providing responsive records promptly to the ATIP office. The guidance is one tool employed by the ATIP office to support increasing the proportion of requests completed within the initial 30 calendar days and to minimize the frequency and length of extensions invoked under the legislation. In support of this objective, the ATIP office coupled this guidance with performance monitoring and reporting activities to identify opportunities to improve sector ATIP responses. Additional details on this initiative can be found at Monitoring compliance.

Technology initiatives and projects to improve privacy

ATIP digital transition

The ATIP office continues to prioritize the digital transformation. With the implementation of Microsoft 365 and SharePoint, the ATIP office continues to explore how best to maximize these new tools to facilitate the ATIP process.

Digital client interaction for ATIP services

The Access to Information and Privacy Online Request Services (AORS) is the primary mechanism for Canadians to digitally submit PA requests. While the AORS was expanded to send secure digital response packages to clients in the summer of 2022, TBS continues to use multiple digital delivery methods to provide requesters with their records. This includes Canada Post’s Epost Connect Service and traditional email.

Departmental procurement of new ATIP request processing software

In collaboration with Public Services and Procurement Canada (PSPC), the Office of the Chief Information Officer (OCIO) within TBS has been leading the procurement process for new ATIP software over the past several years. The new ATIP processing software is intended to replace legacy software that has been in use by many government institutions for the past 10 years. The objective of the software replacement project is to provide ATIP offices with a modern application that offers enhanced automation, configurability and data analytics capabilities to increase the efficiency of processing ATIP requests.

In June 2023, the TBS ATIP office entered into a contract to procure new ATIP processing software. In the ATIP office, the procurement of new ATIP processing software provides the foundation for its overarching ATIP modernization strategy.

While the initial project plan had targeted completion by March 31, 2024, a number of challenges have postponed the implementation of the software at TBS. TBS will continue to work with PSPC, OCIO, other government institutions, and the software developer in 2024–25 on the ATIP software replacement project at TBS.

Monitoring compliance

The ATIP office produces a variety of regular and ad hoc reports to monitor TBS’s compliance with the PA. In 2023–24, the ATIP office continued its emphasis on data analytics to identify emerging trends and promote procedural efficiencies.

The ATIP office creates and distributes several reports outlining the performance of the ATIP office. These reports include:

  • quarterly reports on sector performance and quality of record retrieval
  • ATIP Performance Dashboard to senior management on the monthly performance of the ATIP office
  • service inventory

ATIP sector compliance reporting

In 2023–24, the ATIP office developed quarterly sector performance reports to inform sectors of their performance on their ATIP obligations.

This engagement with sectors is intended to support the sharing of existing compliance data and to expedite ATIP responses in sectors.

ATIP monthly performance reporting

The ATIP Dashboard is a monthly update on ATIP performance metrics and is provided to senior leadership responsible for ATIP. The report provides an overview of the work completed by the ATIP office under the PA both in the previous month and for the current fiscal year.

Service inventory

Under the Directive on Service and Digital, all departments are required to develop and annually update an inventory of services offered within their department. The purpose of this inventory is to ensure that:

  • services are client-centric
  • service standards, related targets and performance information for all services and all service delivery channels are managed and regularly reviewed
  • services are regularly reviewed to identify opportunities for improvement in client services, digital deliver and efficiency

The ATIP office measures performance primarily via on-time compliance with legislative deadlines and had a service target of 80% on-time compliance for 2023–24. This target is similar to the 90% on-time compliance target issued to all institutions by TBS. In 2023–24, the ATIP office recorded an on-time compliance rate of 94%, which is significantly higher than the 72.7% average of requests closed across the Government of Canada in 2022–23.

In addition to the monitoring of performance, the service inventory also monitors that services are digitally enabled. The ATIP office provided digital service delivery for 98% of all access to information requests received and 100% of all closed requests in 2023–24

Conclusion

The 2023–24 fiscal year was a productive year for the TBS ATIP office, both from an operational and a policy perspective. The ATIP office successfully increased its productivity while simultaneously refining its processes. The ATIP office also procured new ATIP processing software and invested significantly in its training and reporting programs to improve the efficiency of the ATIP program.

While the ATIP office recognizes its accomplishments from 2023–24, it must now embrace the challenges that await in the upcoming fiscal year.

The demand from individuals seeking to access their personal information and the need for privacy support for departmental programs navigating a digital world are anticipated to continue in upcoming fiscal years.

In order to build on its achievements from the previous fiscal year, the ATIP office has pursued increased reporting to monitor progress and areas of improvement, developed new tools and training materials to support sectors and the ATIP office, and pushed for increased digital modernization through the implementation of a new request processing system. However, TBS must continue to work to overcome the challenge of addressing increased operational and policy demands while contesting the status quo through innovation and agility.

Appendix A. Delegation Order – Privacy Act

I, undersigned, President of the Treasury Board, pursuant to section 73 of the Privacy Act hereby designate the ATIP officers, the Access to Information and Privacy Team Leader, the Access to Information and Privacy Manager, the Access to Information and Privacy Director, the Senior Director of Ministerial Services, the Assistant Secretary, Strategic Communications and Ministerial Affairs, and the Secretary, or person occupying those positions on an acting basis, to exercise signing authorities or perform any of the President’s powers, duties or function as head of institution that are specified in the attached Schedule B. This designation replaces all previous delegation orders.

Original signed by

The Honourable Anita Anand
President of the Treasury Board
Date: 2023-11-29

Position Powers, duties or functions
Secretary Full authority
Assistant Secretary, Strategic Communications and Ministerial Affairs Full authority
Senior Director, Ministerial Services Full authority, except:
Subsections: 35(1), 36(3), 37(3)
Director, Access to Information and Privacy Full authority, except:
Subsections: 35(1), 36(3), 37(3)
Manager, Access to Information and Privacy Full authority, except:
Subsections: 33(2), 35(1), 36(3), 37(3)
Team Leader, Access to Information and Privacy Full authority, except:
Subsections: 33(2), 35(1), 36(3), 37(3)
Access to Information and Privacy Officers Paragraph: 14(a)

Appendix B. Statistical report on the Privacy Act

Name of institution: Treasury Board of Canada Secretariat
Reporting period: 2023-04-01 to 2024-03-31

In this section

Section 1: requests under the Privacy Act

1.1 Number of requests received

Number of requests
Received during reporting period 191
Outstanding from previous reporting periods 18
Outstanding from previous reporting period 17
Outstanding from more than one reporting period 1
Total 209
Closed during reporting period 184
Carried over to next reporting period 25
Carried over within legislated timeline 17
Carried over beyond legislated timeline 8

1.2 Channels of requests

Channel Number of requests
Online 172
Email 11
Mail 7
In person 0
Phone 0
Fax 1
Total 191

Section 2: informal requests

2.1 Number of informal requests

  Number of requests
Received during reporting period 0
Outstanding from previous reporting periods 0
Outstanding from previous reporting period 0
Outstanding from more than one reporting period 0
Total 0
Closed during reporting period 0
Carried over to next reporting period 0

2.2 Channels of informal requests

Channel Number of requests
Online 0
Email 0
Mail 0
In person 0
Phone 0
Fax 0
Total 0

2.3 Completion time of informal requests

Completion time
1 to 15 days 16 to 30 days 31 to 60 days 61 to 120 days 121 to 180 days 181 to 365 days More than 365 days Total
0 0 0 0 0 0 0 0

2.4 Pages released informally

Less than 100 pages released 100 to 500 pages released 501 to 1,000 pages released 1,001 to 5,000 pages released More than 5,000 pages released
Number of requests Pages released Number of requests Pages released Number of requests Pages released Number of requests Pages released Number of requests Pages released
0 0 0 0 0 0 0 0 0 0

Section 3: requests closed during the reporting period

3.1 Disposition and completion time

Disposition of requests Completion time
1 to 15 days 16 to 30 days 31 to 60 days 61 to 120 days 121 to 180 days 181 to 365 days More than 365 days Total
All disclosed 4 9 1 0 0 0 0 14
Disclosed in part 0 1 9 4 2 0 1 17
All exempted 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0
No records exist 6 12 0 0 0 0 0 18
Request abandoned 126 4 5 0 0 0 0 135
Neither confirmed nor denied 0 0 0 0 0 0 0 0
Total 136 26 15 4 2 0 1 184

3.2 Exemptions

Section Number of requests
18(2) 0
19(1)(a) 0
19(1)(b) 0
19(1)(c) 0
19(1)(d) 0
19(1)(e) 0
19(1)(f) 0
20 0
21 0
22(1)(a)(i) 0
22(1)(a)(ii) 0
22(1)(a)(iii) 0
22(1)(b) 0
22(1)(c) 0
22(2) 0
22.1 0
22.2 0
22.3 0
23(a) 0
23(b) 0
24(a) 0
24(b) 0
25 0
26 17
27 4
28 0

3.3 Exclusions

Section Number of requests
69(1)(a) 0
69(1)(b) 0
69.1 0
70(1) 0
70(1)(a) 0
70(1)(b) 0
70(1)(c) 1
70(1)(d) 0
70(1)(e) 0
70(1)(f) 0
70.1 0

3.4 Format of information released

Paper Electronic record Data set Video Audio Other
3 28 0 0 0 0

3.5 Complexity

3.5.1 Relevant pages processed and disclosed for paper and electronic record formats

Number of pages processed

Number of pages disclosed

Number of requests

19,663

8,829

166

3.5.2 Relevant pages processed per request disposition for paper and electronic record formats by size of request
Disposition Less than 100 pages processed 100 to 500 pages processed 501 to 1,000 pages processed 1,001 to 5,000 pages processed More than 5,000 pages processed
Number of requests Pages processed Number of requests Pages processed Number of requests Pages processed Number of requests Pages processed Number of requests Pages processed
All disclosed 10 508 4 918 0 0 0 0 0 0
Disclosed in part 6 291 3 999 2 1,445 5 9,305 1 5,373
All exempted 0 0 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0 0 0
Request abandoned 134 81 0 0 1 743 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0 0 0 0 0 0
Total 150 880 7 1,917 3 2,188 5 9,305 1 5,373
3.5.3 Relevant minutes processed and disclosed for audio formats
Number of minutes processed Number of minutes disclosed Number of requests
0 0 0
3.5.4 Relevant minutes processed per request disposition for audio formats by size of requests
Disposition Less than 60 minutes processed 60 to 120 minutes processed More than 120 minutes processed
Number of requests Minutes processed Number of requests Minutes processed Number of requests Minutes processed
All disclosed 0 0 0 0 0 0
Disclosed in part 0 0 0 0 0 0
All exempted 0 0 0 0 0 0
All excluded 0 0 0 0 0 0
Request abandoned 0 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0 0
Total 0 0 0 0 0 0
3.5.5 Relevant minutes processed and disclosed for video formats
Number of minutes processed Number of minutes disclosed Number of requests
0 0 0
3.5.6 Relevant minutes processed per request disposition for video formats by size of requests
Disposition Less than 60 minutes processed 60 to 120 minutes processed More than 120 minutes processed
Number of requests Minutes processed Number of requests Minutes processed Number of requests Minutes processed
All disclosed 0 0 0 0 0 0
Disclosed in part 0 0 0 0 0 0
All exempted 0 0 0 0 0 0
All excluded 0 0 0 0 0 0
Request abandoned 0 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0 0
Total 0 0 0 0 0 0
3.5.7 Other complexities
Disposition Consultation required Legal advice sought Interwoven information Other Total
All disclosed 0 0 0 0 0
Disclosed in part 0 1 0 3 4
All exempted 0 0 0 0 0
All excluded 0 0 0 0 0
Request abandoned 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0
Total 0 1 0 3 4

3.6 Closed requests

3.6.1 Number of requests closed within legislated timelines
Requests closed within legislated timelines
Number of requests closed within legislated timelines 173
Percentage of requests closed within legislated timelines 94.02%

3.7 Deemed refusals

3.7.1 Reasons for not meeting legislated timelines
Number of requests closed past the legislated timelines Principal reason
Interface with operations or workload External consultation Internal consultation Other
11 5 0 0 6
3.7.2 Request closed beyond legislated timelines (including any extensions taken)
Number of days past legislated timelines Number of requests past legislated timeline where no extension was taken Number of requests past legislated timeline where an extension was taken Total
1 to 15 days 1 1 2
16 to 30 days 3 2 5
31 to 60 days 0 0 0
61 to 120 days 1 1 2
121 to 180 days 1 0 1
181 to 365 days 0 0 0
More than 365 days 0 1 1
Total 6 5 11

3.8 Requests for translation

Translation requests Accepted Refused Total
English to French 0 0 0
French to English 0 0 0
Total 0 0 0

Section 4: disclosures under subsections 8(2) and 8(5)

Paragraph 8(2)(e) Paragraph 8(2)(m) Subsection 8(5) Total
0 0 0 0

Section 5: requests for correction of personal information and notations

Disposition of correction requests received Number
Notations attached 0
Requests for correction accepted 0
Total 0

Section 6: extensions

6.1 Reasons for extensions

Number of requests where an extension was taken 15(a)(i) interference with operations 15 (a)(ii) consultation 15(b) translation purposes or conversion
Further review required to determine exemptions Large volume of pages Large volume of requests Documents are difficult to obtain Cabinet confidence section (section 70) External Internal
13 2 5 3 1 0 1 1 0

6.2 Length of extensions

Length of extensions 15(a)(i) interference with operations 15 (a)(ii) consultation 15(b) translation purposes or conversion
Further review required to determine exemptions Large volume of pages Large volume of requests Documents are difficult to obtain Cabinet confidence section (section 70) External Internal
1 to 15 days 0 0 0 0 0 0 0 0
16 to 30 days 2 5 3 1 0 1 1 0
31 days or greater 0 0 0 0 0 0 0 0
Total 2 5 3 1 0 1 1 0

Section 7: consultations received from other institutions and organizations

7.1 Consultations received from other Government of Canada institutions and other organizations

Consultations Other Government of Canada institutions Number of pages to review Other organizations Number of pages to review
Received during the reporting period 1 15 0 0
Outstanding from the previous reporting period 0 0 0 0
Total 1 15 0 0
Closed during the reporting period 1 15 0 0
Carried over within negotiated timelines 0 0 0 0
Carried over beyond negotiated timelines 0 0 0 0

7.2 Recommendation and completion time for consultations received from other Government of Canada institutions

Recommendation Number of days required to complete consultation requests
1 to 15 days 16 to 30 days 31 to 60 days 61 to 120 days 121 to 180 days 181 to 365 days More than 365 days Total
Disclose entirely 0 0 0 0 0 0 0 0
Disclosed in part 1 0 0 0 0 0 0 1
Exempt entirely 0 0 0 0 0 0 0 0
Exclude entirely 0 0 0 0 0 0 0 0
Consult other institution 0 0 0 0 0 0 0 0
Other 0 0 0 0 0 0 0 0
Total 1 0 0 0 1 0 0 1

7.3 Recommendation and completion time for consultations received from other organizations

Recommendation Number of days required to complete consultation requests
1 to 15 days 16 to 30 days 31 to 60 days 61 to 120 days 121 to 180 days 181 to 365 days More than 365 days Total
Disclose entirely 0 0 0 0 0 0 0 0
Disclosed in part 0 0 0 0 0 0 0 0
Exempt entirely 0 0 0 0 0 0 0 0
Exclude entirely 0 0 0 0 0 0 0 0
Consult other institution 0 0 0 0 0 0 0 0
Other 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0

Section 8: completion time of consultations on cabinet confidences

8.1 Consultation requests with legal services

Number of days Fewer than 100 pages processed 100 to 500 pages processed 501 to 1,000 pages processed 1,001 to 5,000 pages processed More than 5,000 pages processed
Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed
1 to 15 0 0 0 0 0 0 0 0 0 0
16 to 30 0 0 0 0 0 0 0 0 0 0
31 to 60 0 0 0 0 0 0 0 0 0 0
61 to 120 0 0 0 0 0 0 0 0 0 0
121 to 180 0 0 0 0 0 0 0 0 0 0
181 to 365 0 0 0 0 0 0 0 0 0 0
More than 365 0 0 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0 0 0

8.2 Consultation requests with Privy Council Office

Number of days Fewer than 100 pages processed 100 to 500 pages processed 501 to 1,000 pages processed 1,001 to 5,000 pages processed More than 5,000 pages processed
Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed
1 to 15 0 0 0 0 0 0 0 0 0 0
16 to 30 0 0 0 0 0 0 0 0 0 0
31 to 60 0 0 0 0 0 0 0 0 0 0
61 to 120 0 0 0 0 0 0 0 0 0 0
121 to 180 0 0 0 0 0 0 0 0 0 0
181 to 365 0 0 0 0 0 0 0 0 0 0
More than 365 0 0 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0 0 0

Section 9: complaints and investigations notices received

Section 31 Section 33 Section 35 Court action Total
7 4 5 0 16

Section 10: privacy impact assessments and personal information banks

10.1 Privacy impact assessments

Number of privacy impact assessments completed 3
Number of privacy impact assessments modified 0

10.2 Institution-specific and central personal information banks

Personal information banks Active Created Terminated Modified
Institution-specific 5 0 3 1
Central 35 1 2 7
Total 40 1 5 8

Section 11: privacy breaches

11.1 Material privacy breaches reported

Number of material privacy breaches reported to the Treasury Board of Canada Secretariat 1
Number of material privacy breaches reported to the Office of the Privacy Commissioner of Canada 1

11.2 Non-material privacy breaches

Number of non-material privacy breaches 5

Section 12: resources related to the Privacy Act

12.1 Allocated costs

Expenditures Amount
Salaries $880,114
Overtime $0
Goods and services $0
Professional services contracts $0
Other $0
Total $880,114

12.2 Human resources

Resources Person years dedicated to privacy activities
Full-time employees 6.680
Part-time and casual employees 0.960
Regional staff 0.000
Consultants and agency personnel 0.000
Students 0.000
Total 7.710

Appendix C: supplemental statistical report on the Access to Information Act and the Privacy Act

Name of institution: Treasury Board of Canada Secretariat

Reporting period: 2023-04-01 to 2024-03-31

Section 1: open requests and complaints under the Access to Information Act

1.1 Enter the number of open requests that are outstanding from previous reporting periods.

Fiscal year open request was received Open request within legislated timeline as of March 31, 2024 Open request beyond legislated timeline as of March 31, 2024 Total
Received in 2023–24 46 46 92
Received in 2022–23 2 12 14
Received in 2021–22 1 19 20
Received in 2020–21 1 8 9
Received in 2019–20 0 8 8
Received in 2018–19 1 0 1
Received in 2017–18 0 7 7
Received in 2016–17 0 0 0
Received in 2015–16 0 0 0
Received in 2014–15 or earlier 0 0 0
Total 51 100 151

1.2 Enter the number of open complaints with the Information Commissioner of Canada that are outstanding from previous reporting periods.

Fiscal year open complaints were received by institution Number of open complaints
Received in 2023–24 13
Received in 2022–23 5
Received in 2021–22 0
Received in 2020–21 0
Received in 2019–20 0
Received in 2018–19 0
Received in 2017–18 0
Received in 2016–17 1
Received in 2015–16 0
Received in 2014–15 or earlier 0
Total 19

Section 2: open requests and complaints under the Privacy Act

2.1 Enter the number of open requests that are outstanding from previous reporting periods.

Fiscal year open request was received Open request within legislated timeline as of March 31, 2024 Open request beyond legislated timeline as of March 31, 2024 Total
Received in 2023–24 17 6 23
Received in 2022–23 0 2 2
Received in 2021–22 0 0 0
Received in 2020–21 0 1 1
Received in 2019–20 0 0 0
Received in 2018–19 0 0 0
Received in 2017–18 0 0 0
Received in 2016–17 0 0 0
Received in 2015–16 0 0 0
Received in 2014–15 or earlier 0 0 0
Total 17 8 25

2.2  Enter the number of open complaints with the Privacy Commissioner of Canada that are outstanding from previous reporting periods.

Fiscal year open complaints were received by institution Number of open complaints
Received in 2023–24 6
Received in 2022–23 0
Received in 2021–22 0
Received in 2020–21 0
Received in 2019–20 0
Received in 2018–19 0
Received in 2017–18 0
Received in 2016–17 0
Received in 2015–16 0
Received in 2014–15 or earlier 0
Total 6

Section 3: social insurance number

Did your institution receive authority for a new collection or new consistent use of the social insurance number in 2023–24? No

Section 6: universal access under the Privacy Act

How many requests were received from confirmed foreign nationals outside of Canada in 2023–24? 19

Page details

Date modified: