Annual report to Parliament 2023–2024 on the Privacy Act

Introduction

Women and Gender Equality Canada (WAGE) is pleased to present to Parliament its Annual Report on the Administration of the Privacy Act, in accordance with section 72 of the Privacy Act. The report describes how WAGE fulfilled its responsibilities and obligations for the reporting period of April 1, 2023, to March 31, 2024.

ISSN 2817-6421

Purpose of the Privacy Act

The Privacy Act provides individuals with the right of access to, and correction of, personal information about themselves that is under the control of a government institution. It also provides the legal framework for the collection, retention, use, disclosure, disposition, and accuracy of personal information in the administration of programs and activities by government institutions.

Mandate of Women and Gender Equality Canada

WAGE advances equality with respect to sex, sexual orientation, and gender identity or expression through the inclusion of women and 2SLGBTQI+ people in every aspect of Canada’s social, economic, and political life.

For more information about WAGE, click here to visit our website.

Organizational Structure

The Access to Information and Privacy (ATIP) Office is part of the Corporate Secretariat. The ATIP coordinator for WAGE is the manager of the ATIP Office, who reports directly to the Corporate Secretary.

The ATIP manager acts on behalf of the Minister for Women and Gender Equality and Youth to ensure that the Department’s responsibilities under the Access to Information Act, the Privacy Act, and the Service Fees Act are met.

The ATIP Office is responsible for the administration of the Access to Information Act and the Privacy Act, and they also serve as the centre of ATIP expertise within WAGE. Activities include:

• providing timely and complete responses to requests made under the Access to Information Act and Privacy Act, as well as assisting clients in accordance with the Principles for Assisting Requesters
• processing consultation requests received from other institutions, providing recommendations on the disclosure of information of primary interest to WAGE
• representing the Department in resolving complaints filed with the Information Commissioner and Privacy Commissioner
• providing advice and guidance to senior management and all employees of the Department on ATIP-related matters, including privacy policy advisory services related to the safeguarding of personal information
• delivering training sessions to departmental employees on their obligations under the ATIP legislation and related policies, as well as on departmental procedures
• reviewing proactive publication material and providing recommendations regarding disclosure within the spirit of the Access to Information Act

At the end of the reporting period, the ATIP Office was comprised of four members: the ATIP manager and three ATIP analysts at various levels. Additional resources for fiscal year 2023–24 included a part-time student to assist with the workload and the services of a consultant to provide privacy expertise when needed.

WAGE’s ATIP Office was not party to any service agreements under section 73.1 of the Privacy Act during the reporting period.

Delegation Order

The Minister for Women and Gender Equality and Youth has delegated the responsibilities associated with the administration of the Privacy Act to WAGE officials through a delegation order, which can be found in Appendix A. At WAGE, the ATIP manager has full delegated authority. 

Performance 2023–2024

This section highlights key information on the Department’s performance for fiscal year 2023–2024. See Appendix B for the complete statistical report and Appendix C for the supplemental ATIP statistical report.

The Access to Information and Privacy (ATIP) Office received and completed five privacy requests during the 2023–2024 fiscal year. Four were completed within the original 30-day legislative timeframe, and one was completed within the 60-day extended deadline. The extension was taken because there was a large volume of records and complying with the original time limit would have unreasonably interfered with operations. WAGE achieved 100% compliance on requests made under the Privacy Act, and no requests were active as of the last day of the reporting period. 

Of the five requests closed during the reporting period, three were disclosed in part (60%), one was closed with no records found to exist (20%), and one was closed as abandoned (20%).

No consultations were completed for other institutions for requests made under the Privacy Act, nor did WAGE consult any other institutions for such.

WAGE has no active complaints, and none were received during the reporting period.   

Training and Awareness

Within the first three months of employment, all new WAGE employees must take the Access to Information and Privacy Fundamentals course offered by the Canada School of Public Service. Topics include:

• reviewing current legislation and policies
• processing access to information requests effectively
• protecting personal information
• understanding the requirements concerning the collection, use, communication, retention, and disposal of personal information

In addition, employees are invited to participate in departmental ATIP Essentials training sessions. During the past fiscal year, the ATIP Office delivered nine training sessions to 147 employees. 

Furthermore, the ATIP Office regularly provides informal training on the application of ATIP legislation to departmental employees who retrieve and review relevant records requested under the Act, and to sectors that collect personal information. During the reporting year, the ATIP Office received 13 requests for privacy advice and guidance from internal clients.

Policies, Guidelines, Procedures, and Initiatives to Improve Access to Information

During fiscal year 2023–24, WAGE continued work on their evergreen work plan to optimize internal guidance documents, procedures, and tools to ensure compliance and efficiency. Consultations with the departmental ATIP liaison working group were conducted to assist in these efforts, as well as to foster greater understanding of each team’s unique perspective and to enhance collaboration.

WAGE acquired new request processing software (ATIPXpress) and initiated its implementation during this reporting period. Having modern technology will enable the ATIP Office to manage information more effectively, process requests more efficiently, and better equip itself to address current and future challenges. The new software should be fully operational in the next reporting period.

WAGE is committed to ATIP practices that advance Indigenous reconciliation. To facilitate access to culturally appropriate personal information services for Indigenous requesters, the ATIP Office has undertaken focused learning in alignment with Access to Information and Privacy Implementation Notice 2023-01: Advancing Reconciliation with Indigenous Peoples by Providing Culturally Appropriate Services.

Summary of Key Issues and Actions Taken on Complaints

WAGE had no complaints or audits under the Privacy Act during the reporting period.

Material Privacy Breaches

WAGE had no material privacy breaches to report to the Office of the Privacy Commissioner or to the Treasury Board of Canada Secretariat (Privacy and Responsible Data Division) during the reporting period.

During the reporting period, WAGE assisted current and past employees potentially affected by a breach involving Government of Canada information held by Brookfield Global Relocation Services’ and SIRVA Canada’s systems. The Treasury Board Secretariat led the response to this breach on behalf of government institutions, and provided services such as credit monitoring or reissuing valid passports that may have been compromised to current and former members of the public service. WAGE provided guidance on precautionary measures to take to safeguard financial and personal information online and provided timely communication on updates as received.

Privacy Impact Assessments

No new privacy impact assessments were initiated during the reporting period.

Public Interest Disclosures

There were no public interest disclosures made during the reporting period.

Monitoring Compliance

The ATIP Office meets daily to ensure that all requests are on track and that deadlines will be met. This also provides an opportunity to discuss issues that have arisen and for analysts to receive guidance on the processing of their requests.

Consistent with the requirement to provide timely access to requested records, WAGE limits inter-institutional consultation to only when required for the proper exercise of discretion or when there is an intention to disclose. For this reporting period, WAGE did not need to consult with other institutions.

As WAGE sees a low volume of requests under the Privacy Act, no frequently requested types of information were identified. 

WAGE uses standard clauses to ensure that appropriate privacy protections are included in contracts, agreements, and arrangements.

Appendix A: Delegation Order

The responsibilities associated with the administration of the Privacy Act are delegated to departmental officials through a delegation order signed by the Minister for Women and Gender Equality and Youth.

Department for Women and Gender Equality

Access to Information Act and Privacy Act Delegation

The Minister for Women and Gender Equality and Youth, pursuant to section 95 of the Access to Information Act and section 73 the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers and functions of the Minister as the head of a government institution. This Delegation Order supersedes all previous Delegation Orders.

Dated this 28 day of March 2022

Appendix B: Statistical Report on the Privacy Act

April 1, 2023-March 31,2024

Section 1: Requests under the Privacy Act

Section 2: Informal requests

Section 3: Requests Closed During the Reporting Period

3.5 Complexity

3.6 Closed requests

3.7 Deemed refusals

Section 4: Disclosures Under Subsections 8(2) and 8(5)

Section 5: Requests for Correction of Personal Information and Notations

Section 6: Extensions

Section 7: Consultations Received From Other Institutions and Organizations

Section 8: Completion Time of Consultations on Cabinet Confidences

Section 9: Complaints and Investigations Notices Received

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

Section 11: Privacy Breaches

Section 12: Resources Related to the Privacy Act

Note: Enter values to three decimal places

Appendix C: Supplemental statistical report on the Access to Information Act and the Privacy Act

April 1, 2023-March 3,2024

Section 1: Capacity to Receive Requests under the Access to Information Act and the Privacy Act

Section 2: Open Requests and Complaints Under the Privacy Act

Section 3: Social Insurance Number (SIN)

Section 4: Universal Access under the Privacy Act