Annual Report to Parliament 2024–2025 on the Privacy Act

Introduction

Women and Gender Equality Canada (WAGE) is pleased to present to Parliament its Annual Report on the Administration of the Privacy Act, in accordance with section 72 of the Privacy Act. The report describes how WAGE fulfilled its responsibilities and obligations for the reporting period of April 1, 2024, to March 31, 2025.

Purpose of the Privacy Act

The Privacy Act provides individuals with the right of access to, and correction of, personal information about themselves that is under the control of a government institution. It also provides the legal framework for the collection, retention, use, disclosure, disposition, and accuracy of personal information in the administration of programs and activities by government institutions.

Mandate of Women and Gender Equality Canada

WAGE advances equality with respect to sex, sexual orientation, and gender identity or expression through the inclusion of women and 2SLGBTQI+ people in every aspect of Canada’s social, economic, and political life.

For more information about WAGE, please visit our website.

Organizational Structure

The Access to Information and Privacy (ATIP) Office is part of the Corporate Secretariat. The ATIP coordinator for WAGE is the Manager of the ATIP Office, who reports directly to the Corporate Secretary.

Structure of the Access to Information and Privacy Office

The ATIP Manager acts on behalf of the Minister for Women and Gender Equality and Youth to ensure that the Department’s responsibilities under the Access to Information Act, the Privacy Act, and the Service Fees Act are met.

The ATIP Office is responsible for the administration of the Access to Information Act and the Privacy Act, and they also serve as the centre of ATIP expertise within WAGE. Activities include:

• providing timely and complete responses to requests made under the Access to Information Act and Privacy Act, as well as assisting clients in accordance with the Principles for Assisting Requesters
• processing consultation requests received from other institutions, providing recommendations on the disclosure of information of primary interest to WAGE
• representing the Department in resolving complaints filed with the Information Commissioner and Privacy Commissioner
• providing advice and guidance to senior management and all employees of the Department on ATIP-related matters, including privacy policy advisory services related to the safeguarding of personal information
• delivering training sessions to departmental employees on their obligations under the ATIP legislation and related policies, as well as on departmental procedures
• reviewing proactive publication material and providing recommendations regarding disclosure within the spirit of the Access to Information Act

At the end of the reporting period, the ATIP Office was comprised of four members: the ATIP Manager and three ATIP analysts at various levels. Additional resources for fiscal year 2024–25 included the services of a consultant to provide privacy expertise when needed.

WAGE’s ATIP Office was not party to any service agreements under section 73.1 of the Privacy Act during the reporting period.

Delegation Order

The Minister for Women and Gender Equality and Youth has delegated the responsibilities associated with the administration of the Privacy Act to WAGE officials through a delegation order, which can be found in Appendix A. At WAGE, the ATIP Manager has full delegated authority. 

Performance 2024–2025

This section highlights key information on the Department’s performance for fiscal year 2024–2025. See Appendix B for the complete statistical report and Appendix C for the supplemental ATIP statistical report.

The Access to Information and Privacy (ATIP) Office received and completed four privacy requests during the 2024–2025 fiscal year. Two of the four were completed within their extended 60-day legislative timeframe, and two were completed after their 60-day extended deadline. In three of the requests, an extension was taken because there was a large volume of records and complying with the original time limit would have unreasonably interfered with operations. In the other, an extension was taken to facilitate external consultation.  WAGE achieved 50% compliance on requests made under the Privacy Act, and no requests were active as of the last day of the reporting period. 

Each of the four requests closed during the reporting period were disclosed in part (100%).

No consultations were completed for other institutions for requests made under the Privacy Act, and WAGE consulted Legal Services on two of the four requests.

WAGE has no active complaints, and none were received during the reporting period.  No requests were sent for translation.  

Training and Awareness

Within the first three months of employment, all new WAGE employees must take the Access to Information and Privacy Fundamentals course offered by the Canada School of Public Service. Topics include:

• reviewing current legislation and policies
• processing access to information requests effectively
• protecting personal information
• understanding the requirements concerning the collection, use, communication, retention, and disposal of personal information

No formal training sessions were delivered by the ATIP Office during the reporting period, in lieu of informal training on the application of Privacy legislation to departmental employees who retrieve and review relevant records requested under the Act, and to sectors that collect personal information or utilize personal information banks.

During the reporting year, the ATIP Office received 16 requests for privacy advice and guidance from internal clients. As WAGE has seen a year-over-year increase in requests for advice on privacy, including Privacy-by-design implementation, one-on-one trainings and awareness building sessions have been provided by the ATIP Coordinator to senior officials and project leads including ExCom, the overarching senior level committee at WAGE, and the department’s Program and Policy Committee.

Policies, Guidelines, Procedures, and Initiatives to Improve Privacy

During fiscal year 2024–25, WAGE continued work on their evergreen work plan to optimize internal guidance documents, procedures, and tools to ensure compliance and efficiency. Consultations with the departmental ATIP liaison working group were conducted to assist in these efforts, as well as to foster greater understanding of each team’s unique perspective and to enhance collaboration, including raising awareness of Privacy concerns and how to prevent breaches.  Training was provided to senior leadership to Increase awareness of  on privacy breach reporting and containment after the updated toolkit was launched in June 2024.

WAGE acquired new request processing software (ATIPXpress) and initiated its implementation during the previous reporting period. Having modern technology will enable the ATIP Office to manage information more effectively, process requests more efficiently, and better equip itself to address current and future challenges. Installation and configuration were completed during this reporting period.  WAGE will also engage in User Acceptance Training, moving toward having the new software fully operational in the next reporting period.

WAGE is committed to ATIP practices that advance Indigenous reconciliation. To facilitate access to culturally appropriate personal information services for Indigenous requesters, the ATIP Office has undertaken focused learning in alignment with Access to Information and Privacy Implementation Notice 2023-01: Advancing Reconciliation with Indigenous Peoples by Providing Culturally Appropriate Services.

Summary of Key Issues and Actions Taken on Complaints

WAGE had no complaints or audits under the Privacy Act during the reporting period.

Material Privacy Breaches

A privacy breach is defined by the Office of the Privacy Commissioner as the loss of, unauthorized access to, or disclosure of, personal information. A material privacy breach is defined by TBS as involving sensitive information that could reasonably be expected to cause serious injury or harm to the individual and/or involves a large number of affected individuals.

WAGE had two material privacy breaches to report to the Office of the Privacy Commissioner and the Treasury Board of Canada Secretariat (Privacy and Responsible Data Division) during the reporting period.

The breaches were the result of unauthorized and improper transmission of personal information outside of WAGE. It was discovered during this reporting period but occurred prior to it.  WAGE collaborated with transmitter to contain the breach and ensure completion of relevant privacy training.

Privacy Impact Assessments

No new privacy impact assessments were initiated during the reporting period.

Public Interest Disclosures

There were no public interest disclosures made during the reporting period.

Monitoring Compliance

The ATIP Office meets daily to ensure that all requests are on track and that deadlines will be met. This also provides an opportunity to discuss issues that have arisen and for analysts to receive guidance on the processing of their requests.

Consistent with the requirement to provide timely access to requested records, WAGE limits inter-institutional consultation to only when required for the proper exercise of discretion or when there is an intention to disclose. For this reporting period, WAGE did not need to consult with other institutions.

As WAGE sees a low volume of requests under the Privacy Act, no frequently requested types of information were identified.

WAGE uses standard clauses to ensure that appropriate privacy protections are included in contracts, agreements, and arrangements.

Appendix A: Delegation Order

The responsibilities associated with the administration of the Privacy Act are delegated to departmental officials through a delegation order signed by the Minister for Women and Gender Equality and Youth.

Department for Women and Gender Equality

Access to Information Act and Privacy Act Delegation Order

The Minister for Women and Gender Equality and Youth, pursuant to section 95 of the Access to Information Act and section 73 the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers and functions of the Minister as the head of a government institution. This Delegation Order supersedes all previous Delegation Orders.

Dated this 28 day of March 2022