2024 to 2025 Annual Report on the Privacy Act

On this page

• Introduction
• Purpose of the Privacy Act
• Mandate of the Treasury Board of Canada Secretariat
• Delegation order for the Privacy Act
• Organization structure
• Interpretation of the statistical report for the Privacy Act
• Initiatives and projects to improve privacy
• Privacy consultations within TBS
• Information holdings
• Education, training and awareness
• Policies, guidelines and procedures
• Monitoring compliance
• Conclusion
• Appendix A. Delegation Order – Privacy Act

Introduction

The Treasury Board of Canada Secretariat (TBS) is pleased to present to Parliament its annual report on the administration of the Privacy Act (PA) for 2024–25 (April 1, 2024, to March 31, 2025).

Section 72 of the PA requires that the head of every government institution prepare and submit an annual report to Parliament on the administration of the PA in the institution during the fiscal year.

Purpose of the Privacy Act

The purpose of the PA is to provide:

• individuals with the right to access and correct personal information about themselves that is under the control of a government institution
• the legal framework for the collection, retention, use, disclosure, disposition and accuracy of personal information in the administration of programs and activities by government institutions subject to the PA

Under the PA, personal information is defined as information about an identifiable individual that is recorded in any form.

Examples include information relating to:

• the national or ethnic origin, colour, religion, age or marital status of an individual
• the education or the medical, criminal, financial or employment history of an individual
• the address, fingerprints or blood type of an individual
• any identifying number, symbol or other particular identifier assigned to an individual

Mandate of the Treasury Board of Canada Secretariat

As the administrative arm of the Treasury Board, TBS has a dual mandate: to support the Treasury Board as a committee of ministers and to fulfill the statutory responsibilities of a central government agency and those of a line department.

The Treasury Board’s mandate is derived from the Financial Administration Act.

To fulfill its mandate, TBS organizes its business and resources around 4 core responsibilities:

• spending oversight
• administrative leadership
• employer
• regulatory oversight

TBS provides advice and support to Treasury Board ministers in their role of ensuring value for money. TBS also provides oversight of the financial management functions in federal institutions.

TBS makes recommendations and provides advice to the Treasury Board on policies, directives, regulations and program expenditure proposals with respect to the management of the government’s resources. TBS is responsible for the general management of government-wide initiatives, issues and activities (as reported in the Main Estimates).

The offices of the following government officials are part of TBS:

• the Comptroller General of Canada
• the Chief Human Resources Officer of Canada
• the Chief Information Officer of Canada

The Comptroller General is responsible for the comptrollership function of government and provides government-wide leadership, direction, oversight and capacity-building for financial management, internal audit, and the management of assets and acquired services.

The Chief Human Resources Officer provides government-wide leadership on people management through policies, programs and strategic engagement by centrally managing labour relations, compensation, pensions and benefits, and by contributing to the management of executives.

The Chief Information Officer provides government-wide leadership, direction, oversight and capacity-building for information management, information technology, government security (including identity management), access to information, privacy, and internal and external service delivery.

Delegation order for the Privacy Act

Pursuant to subsection 73(1) of the PA, the President of the Treasury Board has delegated the powers, duties and functions for the administration of the PA to the following TBS officials:

• the Secretary of the Treasury Board
• the Assistant Secretary of Strategic Communications and Ministerial Affairs
• the Senior Director of Ministerial Services
• the Director of Access to Information and Privacy (ATIP)
• managers and team leaders of the ATIP office

The delegation order was signed on November 29, 2023, and a copy can be found in Appendix A.

Organization structure

The ATIP office is part of the Ministerial Services directorate of TBS’s Strategic Communications and Ministerial Affairs sector.

The ATIP office is responsible for:

• implementing and managing programs and services relating to TBS’s administration of the Access to Information Act (ATIA) and the PA (the acts)
• providing advice to TBS employees as they fulfill their obligations under the acts
• reviewing and releasing records under Part 2 of the ATIA; specifically, briefing note titles, parliamentary committee appearance binders, question period notes and transition binders

Outside of the administration of the acts, the ATIP office provides support in the following areas:

• internal reviews of documents intended for publication by sectors
• reviews of documents subject to parliamentary production motions
• reviews of documents related to class action lawsuits
• training sessions on the administration of the acts for sectors and sector officials
• policy updates and research related to the administration of the acts
• research and reporting on trends in the ATIP office
• systems administration of ATIP software
• various reports
• privacy breach management
• access to information and privacy advice to program sectors

The ATIP office is led by a director who is supported by three managers. Each of these managers oversees a unit that is responsible for a different functional area. The three key units include:

• ATIP Intake, Governance, and Special Projects Unit
• ATIP Operations Unit
• Privacy Policy Unit

The ATIP Intake, Governance, and Special Projects Unit and the ATIP Operations Unit work together to process ATIP requests, whereas the Privacy Policy Unit supports sector officials on privacy-related matters, including the review of privacy impact assessments and privacy breach management.

The ATIP office comprises employees at various levels. There was an equivalent of 8.44 full-time employees who administered the PA in 2024–25, consisting of 7.59 full-time employees and 0.85 part-time employee. There was an additional equivalent of 15.05 full-time employees who administered the ATIA in 2024–25, consisting of 14.84 full-time employees and 0.21 casual employee. Certain employees in the ATIP office contribute to both the ATIA and the PA, and these activities are recorded in the appropriate report proportional with their contributions.

Figure 1 shows the roles of the individuals and teams involved in processing ATIP requests at TBS. The ATIP office has 3 functional units. Sector liaison officers are not part of the ATIP office but play an important role in processing requests because they coordinate ATIP activities in their respective sectors.

Figure 1 - Text version

ATIP director

ATIP Intake, Governance, and Special Projects Unit:

Coordinates and reviews documents for proactive publication under Part II of theATIA, and other processes such as parliamentary motions.

Liaises with the Offices of the Information Commissioner and the Privacy Commissioner of Canada to resolve complaints.

Offers client services to individuals that have submitted ATIP requests and liaises with sectors to obtain and retrieve documents.

Conducts monitoring, performance reporting and data analytics for ATIP requests.

ATIP Operations Unit:

Reviews documents that are responsive to ATIP requests.

Liaises with sectors to confirm recommendations, and consults with relevant stakeholders on the disclosure of records.

Privacy Policy Unit:

Advises and supports TBS officials to ensure compliance with the Privacy Act and related policy instruments.

Supports TBS officials to ensure that the privacy rights of individuals are respected when delivering programs and activities.

Supports the ATIP director in their role as the delegate responsible for section 10 of the Privacy Act.

ATIP sector liaison officers

Support the ATIP program by coordinating ATIP activities in their sector.

The TBS ATIP office works with the 19 sectors across TBS that retrieve responsive records to ATIP requests. Each sector has assigned sector liaison officers that work directly with the ATIP office to efficiently process requests. The ATIP office also works in partnership with sectors across TBS to complete proactive publication requirements under Part 2 of the ATIA.

Interpretation of the statistical report for the Privacy Act

Part 1: requests received and carried forward

Privacy requests received

In 2024–25, TBS received 173 requests under the PA, which represents an 9% decrease from the 191 requests received in 2023–24.

Privacy requests carried forward

The number of requests that the TBS ATIP office carried forward from previous fiscal years was 34, which is an increase of 36% compared to the 25 requests carried forward in 2023–24.

Figure 2 shows the number of privacy requests TBS received each year and the number of requests carried forward for 2020–21 to 2024–25.

Figure 2 - Text version

Fiscal year	2020–21	2021–22	2022–23	2023-24	2024-25
Received	66	84	105	191	173
Carried forward	6	12	18	25	34

Part 2: requests completed

Privacy requests completed

In 2024–25, TBS completed 164 requests, which is a decrease of 11% compared to the 184 requests completed in 2023–24.

Figure 3 shows the number of privacy requests TBS completed each year from 2020–21 to 2024–25.

Figure 3 - Text version

Fiscal year	2020–21	2021–22	2022–23	2023–24	2024–25
Requests completed	68	78	99	184	164

Disposition of requests completed

The following is a breakdown by disposition of the 164 requests completed in 2024–25:

• 112 requests were abandoned by the requester
• 20 requests had no records
• 20 requests contained records that were all disclosed
• 12 requests contained records that were disclosed in part

The 20 requests that were disclosed entirely in 2024–25 is an increase of 43% compared to the 14 requests disclosed entirely in 2023–24. The 12 partially disclosed requests represent a 29% decrease compared to the 17 requests partially disclosed in 2023–24.

Figure 4 shows the percentage of privacy requests by disposition for 2024–25.

Figure 4 - Text version

Request abandoned	112
Disclosed in part	12
No records exist	20
All disclosed	20

Exemptions

The PA exempts certain information from being disclosed. In 2024–25, 12 requests contained some information that was subject to exemptions, and, therefore, this information was not disclosed.

A request may have multiple exemptions applied, resulting in a greater number of exemptions invoked than the number of requests. In 2024–25, 12 requests contained information that was subject to the following exemptions:

• personal information about individuals other than the requester (11 requests) (section 26 of the PA)
• personal information related to solicitor–client privilege (6 requests) (section 27 of the PA)

Exclusions

The PA does not apply to or exclude information that is publicly available, such as government publications and material in libraries and museums. The act also excludes material such as cabinet confidences. No requests were subject to an exclusion in 2024–25.

Pages processed and disclosed

TBS completed 164 requests in 2024–25, which involved processing 15,397 pages. This represents a decrease of 22% relative to the 19,663 pages processed in 2023–24.

Figure 5 shows, for 2020–21 to 2024–25, the number of privacy requests TBS completed and the number of pages processed.

Figure 5 - Text version

Fiscal year	2020–21	2021–22	2022–23	2023-24	2024-245
Pages processed	17,455	7,840	2,914	19,663	15,397
Requests completed	68	78	99	184	164

Complexity

Some requests have additional factors that increase the complexity of the request. Examples of these complexities can be that the request requires:

• consultations outside of the institution
• legal advice
• analysis because the request contains sensitive information that can be exempted under the PA

In 2024–25, the 12 requests that were partially disclosed had the following complexities:

• consultations were required with other federal institutions (1 request)
• legal advice was required to process the request (1 request)
• analysis was required because the request contained interwoven information^{Footnote 1} (10 requests)

Format of information released

TBS continues to provide clients with access to government records in electronic formats. In 2024–25, TBS released information exclusively in electronic formats for all 32 requests for which records were disclosed.

Requests for translation

Subsection 17(2) of the PA allows requesters to request that a record be provided in a particular official language. Should the record not exist in that official language, the government institution must translate the record if it is deemed necessary to enable the individual to understand the information.

TBS did not receive or process any requests in 2024–25 that required translation of responsive records.

Part 3: on-time compliance rate, completion times and extensions

On-time compliance rate

The on-time compliance rate is the percentage of requests responded to within their legislative timelines, including requests for which the institution invoked legislative extensions. For privacy requests, this means requests were processed and provided to requesters within 30 days, or 60 days if a legal extension was invoked.

In 2024–25, TBS achieved an on-time compliance rate of 94%. This is consistent with the on-time compliance rate of 94% recorded in 2023–24.

Deemed refusals

Government institutions are required to provide access to records within legislative timelines. When an institution fails to provide access to a record within the time limits, the institution is deemed to have refused to give access.

In 2024–25, a total of 10 requests were closed past the legislated timeline for the following reasons:

• interference with operations and workload (8 requests)
• other – difficulty obtaining records (1 request)
• internal consultation (1 request)

Time required to complete requests

Of the 164 requests closed in 2024–25, 90% were closed within 30 days, which is an increase of 2 percentage points from 88% recorded in 2023–24.

Figure 6 shows the time it took to complete privacy requests in 2024–25.

Figure 6 - Text version

Time to complete requests	1-15 days	16-30 days	31-60 days	61-120 days	121-180 days	181-365 days	more than 365 days
Requests completed	126	21	9	5	2	0	1

Reasons for extensions

The legislation sets timelines for responding to privacy requests and allows for extensions, up to a maximum of 30 days, in any of the following cases:

• when complying with the timeline would interfere with operations as a result of:
  • a review being required to determine exemptions or exclusions
  • a large volume of pages requiring review
  • a large volume of requests
  • the documents being difficult to obtain
  • a consultation being required
  • documents that must be translated

In 2024–25, TBS invoked extensions for 8 completed requests, or 5% of all requests completed.

Figure 7 shows the extensions invoked for privacy requests completed in 2024–25.

Figure 7 - Text version

Type of extension	Further review required	Lage volume of pages	Large volume of requests
Number of extensions invoked	2	5	1

Length of extensions

In 2024–25, TBS completed 8 requests for which extensions had been invoked. All of the 8 requests for which extensions were invoked were extended by 30 calendar days.

Initiatives and projects to improve privacy

Privacy consultations within TBS

The Privacy Policy Unit within the ATIP office acts as a source of expertise for TBS program officials. The unit provides privacy assessment tools to ensure that program officials take appropriate measures in the planning stages of new initiatives to ensure legal and policy compliance. Tools and guidance materials are regularly updated to adapt to the ever-changing privacy ecosystem (such as cyber security threats, use of artificial intelligence).

Over the course of 2024–25, the Privacy Policy Unit provided privacy advice on provisions and policy requirements set out in the PA on 300 occasions, representing a 17% increase compared to 2023–24. This trend is attributed to the number of new and forward-looking program initiatives involving the potential collection, use and disclosure of personal information in areas of people management, employment equity and diversity, and the increase in government-wide employee engagement and public outreach activities.

Information holdings

TBS publishes an inventory of its information holdings and relevant details about personal information under its control. The information can help individuals make an access to information or personal information request, or exercise their privacy rights. The inventory also supports the federal government’s commitment to transparency and facilitates access to information related to its activities.

During this reporting period, the Info Source chapter refresh was finalized. All personal information bank and privacy impact assessment lists were updated as a result of in-depth engagement with TBS-PRDD.

A description of TBS’s functions, programs, activities and related information holdings can be found in Info Source: Treasury Board of Canada Secretariat.

Education, training and awareness

The ATIP office conducted several training activities to support departmental compliance with the PA in 2024–25.

Each January 28, the ATIP office commemorates Data Privacy Day. This day highlights the impact technology is having on our privacy rights and underlines the importance of valuing and protecting personal information. For the 2024–25 Data Privacy Day, the ATIP office launched a 4-part internal communication series on privacy.

Table 3 outlines specific training initiatives conducted by the ATIP office in 2024–25.

Policies, guidelines and procedures

Monitoring compliance

The ATIP office produces a variety of regular and ad hoc reports to monitor TBS’s compliance with the ATIA. In 2024–25, the ATIP office continued its emphasis on data analytics to identify emerging trends and promote procedural efficiencies.

The ATIP office creates and distributes several reports outlining the performance of the ATIP office and the challenges it faces. These reports include:

• quarterly reports on sector performance and quality of record retrieval
• ATIP Performance Dashboards to senior management on the monthly performance of the ATIP office
• weekly reports on requests received and requests that will be closed
• reports to the executive committee with statistics on the ATIP office, including requests received and closed, complaints and the on-time compliance rates
• service inventory
• annual statistical reports to TBS

Conclusion

The ATIA and the PA are important pillars in maintaining the accountability and transparency of federal institutions, promoting an open and democratic society, and protecting the privacy of individuals. While TBS had a productive 2024–25, it is recognized that there are outstanding challenges and additional opportunities to achieve excellence for Canadians.

Transparency and accountability are an ongoing commitment. TBS looks forward to building on the successes of 2024–25 and continuing to uphold these principles for Canadians in 2025–26.

Appendix A. Delegation Order – Privacy Act

I, undersigned, President of the Treasury Board, pursuant to section 73 of the Privacy Act hereby designate the ATIP officers; the Access to Information and Privacy Team Leader; the Access to Information and Privacy Manager; the Access to Information and Privacy Director; the Senior Director, Ministerial Services; the Assistant Secretary, Strategic Communications and Ministerial Affairs; and the Secretary, or person occupying those positions on an acting basis, to exercise signing authorities or perform any of the President’s powers, duties or function as head of institution that are specified in the attached Schedule B. This designation replaces all previous delegation orders.

Original signed by

The Honourable Anita Anand
President of the Treasury Board
Date: 2023-11-29