Access to Information Act, Privacy Act, Annual Report 2017-2018

Privacy Act, Access to Information Act, Annual Report 2017-2018 (PDF, 1 MB)

On this page

• Introduction
• Purpose of the Acts
  • Access to Information Act
  • Privacy Act
• About Immigration, Refugees and Citizenship Canada
• Delegation Order
• Organizational Structure
• Highlights of the Statistical Report for 2017-2018
  • Requests received
  • Sources of requests under the Access to Information Act
  • Informal access requests under the Access to Information Act
  • Exemptions
  • Exclusions
  • Disclosure of personal information under subsection 8(2)
  • Consultations
  • Extensions
• Completion times
• Complaints and audits
• Monitoring Compliance
• Appeal to the Federal Court
• Privacy Impact Assessments
• Material Privacy Breaches
• Initiatives
• Policies, Guidelines and Procedures
• Training and Awareness
• Annex A: Signed Delegation
• Annex B: Delegation Order under the Access to Information Act
• Annex C: Delegation Order under the Privacy Act
• Annex D: Statistical Report on the Access to Information Act
• Annex E: Statistical Report on the Privacy Act

Introduction

Immigration, Refugees and Citizenship Canada (IRCC) is pleased to present to Parliament its 24^th annual report on the administration of the Access to Information Act and the Privacy Act. The report describes the activities that support compliance with both Acts for the fiscal year commencing April 1, 2017, and ending March 31, 2018.

Section 72 of each Act requires that the head of every federal government institution submit an annual report to Parliament on the administration of the Access to Information Act and Privacy Act during the fiscal year. This report outlines IRCC’s accomplishments in carrying out its Access to Information and Privacy (ATIP) responsibilities during the 2017-2018 reporting period.

Purpose of the Acts

Access to Information Act

The purpose of the Access to Information Act is to provide a right of access to records under the control of a government institution. The Act maintains that government information should be available to the public, that necessary exceptions to the right of access should be limited and specific, and that decisions on the disclosure of government information should be reviewed independently of the government.

Privacy Act

The purpose of the Privacy Act is to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution and to provide individuals with a right of access to that information. The Act protects an individual’s privacy by preventing others from having unlawful access to personal information. It also permits an individual specific rights regarding the collection, use and disclosure of this information.

About Immigration, Refugees and Citizenship Canada

IRCC selects and welcomes, as permanent and temporary residents, foreign nationals whose skills contribute to Canadian prosperity. It also reunites family members.

The Department maintains Canada's humanitarian tradition by welcoming refugees and other people in need of protection, thereby upholding its international obligations and reputation.

IRCC, in collaboration with its partners, conducts the screening of potential permanent and temporary residents to protect the health, safety and security of Canadians. IRCC is also responsible for the issuance and control of Canadian passports and other documents that facilitate the travel of Canadian citizens and residents.

Lastly, the Department builds a stronger Canada by helping all newcomers settle and integrate into Canadian society and the economy, and by encouraging, granting and providing proof of Canadian citizenship.

IRCC’s mandate comes from the Department of Citizenship and Immigration Act. The Minister of Immigration, Refugees and Citizenship Canada is responsible for the Citizenship Act of 1977 and shares responsibility with the Minister of Public Safety for the Immigration and Refugee Protection Act (IRPA). Jurisdiction over immigration is shared between the federal and the provincial and territorial governments under section 95 of the Constitution Act of 1867.

Delegation Order

The Minister of Immigration, Refugees and Citizenship Canada is responsible for dealing with requests under the Access to Information Act and the Privacy Act. The Minister delegates this authority to members of departmental senior management, including the ATIP Departmental Coordinator (ATIP Director), to carry out his powers, duties, or functions under the Acts, in relation to ATIP requests. Certain authorities are delegated to particular positions in the ATIP Division at National Headquarters as shown in Annex B and Annex C of this report.

Organizational Structure

The ATIP Division is part of the Corporate Affairs Branch, which is overseen by the Director General of Corporate Affairs, situated in the Corporate Services Sector at IRCC. The Division administers the Access to Information Act and the Privacy Act for IRCC and is led by a Director, who acts as the ATIP Coordinator for the Department. Three units carry out the Division’s work in addition to 34 Liaison Officers who are responsible for coordinating the ATIP activities of IRCC branches.

ATIP Divisional Structure at IRCC

Highlights of the Statistical Report for 2017-2018

Requests received

Pages reviewed under both Acts

Sources of requests under the Access to Information Act

The business sector (mainly immigration lawyers and consultants) remains the largest source of requests, accounting for 58% of all requests. The general public accounts for 30%, and media, organizations and academia comprise 8% of requests. The remaining 4% represents requesters who decline to identify themselves.

Sources of Access to Information Requests

Informal access requests under the Access to Information Act

IRCC posts summaries of completed access to information requests pertaining to corporate records on the Open Information. In 2017-2018, IRCC closed 1,444 requests for copies of previously released requests.

Exemptions

Access to Information Act

The Department invoked exemptions on 38,707 requests (66%), and all information was provided in 16,527 of its requests (28%). The remaining 3,787 requests (6%) were transferred, abandoned, no record existed or the Department could neither confirm nor deny the existence of these records, as doing so could reveal information that is protected under the Act.

The majority of exemptions invoked by IRCC fell under 3 sections of the Act:

• Subsection 19(1), which protects personal information, was used in 25,880 cases (43%);
• Subsection 16(1), which addresses law enforcement and criminal investigations, was used in 16,447 cases (28%); and
• Subsection 15(1), which covers international relations, defence and subversive activities, was used in 12,046 cases (20%).

More than 1 section can be applied to a specific request.

Privacy Act

The Department invoked exemptions on 7,843 requests (62%), and all information was provided in 2,707 requests (21%). The remaining 2,148 requests (17%) were either transferred, abandoned or no record existed.

The majority of exemptions invoked by IRCC fell under 3 sections of the Act:

• Section 26, which protects personal information, was used in 5,474 cases (43%);
• Section 21, which covers international relations, defence and subversive activities, was used in 4,851 cases (38%); and
• Paragraph 22(1)(b), which addresses law enforcement and criminal investigations, was used in 3,013 cases (24%).

More than one section can be applied to a specific request.

Exclusions

The Access to Information Act does not apply to or excludes certain types of personal information, specifically records that are already available to the public (section 68) and confidences of the Queen’s Privy Council (section 69). Overall in the 2017-2018 fiscal year, IRCC excluded records based on section 68 on 24 occasions, and section 69 was cited in 137 instances.

The ATIP Division did not apply any exclusions under the Privacy Act during the reporting period.

Disclosure of personal information under subsection 8(2)

In accordance with subsection 8(2) of the Privacy Act, under certain circumstances, a government institution may disclose personal information under its control without the consent of the individual to whom the information relates to.

During this reporting period, IRCC disclosed personal information under subsection 8(2) in responding to 4,149 requests from investigative bodies under paragraph 8(2)(e).

In addition, 8 requests were received under paragraph 8(2)(m) of the Privacy Act that resulted in the disclosure of personal information:

• A request was received from the Office of the Central Authority for Alberta. In this case, the information was for individuals who were in a car accident. The Authority needed the information in order to contact the family. The Office of the Privacy Commissioner (OPC) was notified of this case prior to the release of the information.
• Seven requests were received from the Public Health Agency of Canada. In each case, the agency requested the contact information (such as address, phone number or any other method of contact) of individuals who had been in close proximity to a person with a communicable disease. The OPC was notified after the release of the information due to the urgency of the cases.

Consultations

In addition to processing requests, IRCC was consulted by other federal government institutions for records related to its activities in 274 cases under the Access to Information Act and 26 instances under the Privacy Act.

Extensions

Section 9 of the Access to Information Act permits the statutory time limits to be extended if consultations are necessary or if the request is for a large volume of records, and processing it within the original time limit would unreasonably interfere with the operations of the Department.

IRCC invoked a total of 2,816 extensions during the 2017-2018 reporting period. Extensions were required in 2,305 instances when IRCC consulted with other federal institutions prior to responding. Extensions were required in 493 instances to search through a large volume of records or to respond to the influx of requests, or both, which interfered with operations. The Department also invoked 18 extensions to conduct third-party notifications.

Section 15 of the Privacy Act permits the statutory time limits to be extended if consultations are necessary, if translation is required or if the request is for a large volume of records and processing it within the original time limit would unreasonably interfere with the operations of the Department.

IRCC invoked a total of 279 extensions during the 2017-2018 reporting period. Of these, 218 were deemed necessary as IRCC needed to consult with other federal institutions prior to responding. Extensions were required in a further 61 instances to search for or through a large volume of records or to respond to the influx of requests, or both, which interfered with operations. The Department did not invoke any extensions for translation purposes.

Completion Times

Complaints and Audits

Access to Information Act

During the 2017-2018 reporting period, the Department was notified of 204 access complaints received by the Office of the Information Commissioner (OIC). This represents 0.35% of all requests completed during this period. The majority of complaints were related to processing times or exemptions.

During the reporting period, ATIP processed and closed 180 complaint investigations. Of these, 52 complaints were abandoned, discontinued or deemed to be unfounded. The remaining 128 complaints were resolved to the satisfaction of the requester.

During the 2017-2018 reporting period, no audits were undertaken under the Access to Information Act.

Privacy Act

During the 2017-2018, the Department was notified of 23 privacy complaints received by the OPC. This represents 0.17% of all requests completed during this period. The majority of the OPC complaints were related to processing times.

During the reporting period, ATIP processed and closed 21 complaint investigations. Of these, 4 were deemed not well-founded, while 17 were resolved to the satisfaction of the requester.

During the 2017-2018 reporting period, no audits were undertaken under the Privacy Act.

Actions taken under both Acts

The Department has taken diverse actions aimed at reducing the number of complaints received. For instance, ATIP actively engages with the OIC at regular meetings to discuss and resolve complaints. The Division is continuing to seek ways to improve its performance in an effort to reduce response times for ATIP requests, with the end goal of decreasing complaints.

ATIP also now has 2 dedicated officers dealing with complaint resolution. In the previous fiscal year, the Division only had 1 officer responsible for dealing with complaints. IRCC works closely in conjunction with both the OIC and the OPC to ensure expectations are met and to ensure that ATIP Analysts and the Office of Primary Interest have a clear understanding of the complaint process. Tools and procedures will be developed in the new fiscal year as part of ongoing training and awareness also aimed at reducing the number of complaints.

Monitoring Compliance

The ATIP Division has established internal procedures to help facilitate the timely and efficient processing and monitoring of ATIP requests. The Division prepares 3 weekly reports pertaining to Access to Information and Privacy requests for senior management, which are disseminated at the Assistant Deputy Minister, Deputy Minister and Ministerial levels. There is a ‘snapshot’ report that contains various statistics, including the number of requests received and processed, as well as the current compliance rate under both Acts. There is also a summary report of upcoming requests soon to be disclosed under the Access to Information Act. Finally, in the last quarter of the fiscal year, ATIP instituted a weekly summary report of late files to be processed in priority. It is important to note that no personal information is disclosed to senior management in these reports.

Appeal to the Federal Court

There were no appeals to the Federal Court filed against IRCC regarding the Access to Information Act and the Privacy Act during the 2017-2018 reporting period.

Privacy Impact Assessments

To fulfil its mandate and effectively deliver its programs and services, IRCC collects, uses and discloses personal information. In accordance with Treasury Board of Canada Secretariat (TBS) policy, the Department undertakes Privacy Impact Assessments (PIAs) to determine whether privacy risks are present in all new or existing departmental programs, initiatives or projects that collect and retain personal information.

During the 2017-2018 fiscal year, IRCC completed 3 PIAs, which are described below. One PIA summary completed last fiscal year is being prepared for online publication.

Express Entry

Privacy Impact Assessment Summary: Express Entry

Launched January 1, 2015, the Express Entry program marks a key milestone in the Government of Canada’s immigration system modernization agenda. Express Entry facilitates faster and more flexible management of permanent economic immigration and positions Canada to target candidates with the skills and experience that result in positive labour market outcomes.

The objective of the PIA Report was to determine if there are privacy risks associated with the collection of personal information from candidates and applicants through the Express Entry system, and, if so, to provide recommendations on the mitigation or elimination of the risks.

The report identified some privacy risks and recommendations related to information sharing, and retention and disposition of personal information, all of which have been addressed by IRCC.

Global Visa Application Centre

The VAC Global Network was established with the signing of the 2012 VAC Global Contract. The 2018 VAC Global Contract is a continuation of some services, but also incorporates significant changes, primarily a switch in focus from the submission of applications to provision of biometric enrolment services. For this reason, the PIA Report incorporated 2 parts of the existing contract Privacy Impact Assessment: the Temporary Resident Biometrics Project - Global Visa Application Centre Network Privacy Impact Assessment (Phase 1), and the Temporary Resident Biometrics Project: Global Visa Application Centre Network Final Privacy Impact Assessment. These documents had been submitted and approved previously.

The objective of the 2017 PIA Report was to provide a comprehensive analysis of the new services and business requirements including, but not limited to Appointment Scheduling Service; Collection of Government of Canada Fees; Webchat, E-mail, SMS and Social Media; and VAC Sharing and VAC Co-location. The report identified possible low and medium privacy risks for which IRCC has taken all the necessary mitigation measures.

Regulations for Automated Biometric-based Information Sharing with Australia, New Zealand and the United Kingdom

Privacy Impact Assessment Summary: Regulations for Automated Biometric-based Information Sharing with Australia, New Zealand and the United Kingdom

The border and immigration agencies of Australia, Canada, New Zealand, the United Kingdom and the United States have a longstanding relationship.

The objective of the PIA Report was to assess privacy risks related to enabling regulations for automated, biometric-based information exchange with Australia, New Zealand and the United Kingdom. The regulations in question can be found in Division 3 of Part 19.1 of the Immigration and Refugee Protection Regulations, beginning at Section 315.36. The report noted potential privacy risks related to disclosure, over-collection and informed consent, for which mitigation strategies were identified and implemented.

Regulations for a similar capability with the United States were established in 2015.

Material Privacy Breaches

In 2017-2018, IRCC notified the OPC and TBS of 7 material privacy breaches. IRCC monitors all privacy breaches closely and has established notifications and remedial measures to address each situation.

The program areas sent apology letters to the affected individuals. The ATIP Division provided advice and guidance to departmental staff on containment and mitigation strategies to improve the protection of personal information. In addition, senior officials were notified of all material breaches to facilitate communication within the Department and raise awareness of issues that could hinder the public’s right to privacy.

The ATIP Division monitors all privacy breaches reported at IRCC. The Division also reviews how and where they are occurring within the Department. ATIP addresses trends and provides tailored privacy breach training sessions to raise awareness and increase privacy breach prevention.

Initiatives

To improve internal processes and client service under the Access to Information Act and Privacy Act, IRCC undertook the following initiatives:

• At the completion of the ATIP Division’s Lean Review, the Complex and Sensitive Issues Unit launched a pilot project on the ATIP process to streamline and improve efficiency in response times.
• The ATIP Division created and subsequently implemented an action plan that successfully eliminated a backlog of intake ATIP requests.
• During the reporting period, the Operations Unit re-organized the actions in the AccessPro Case Management system, the ATIP Division’s case tracking and reporting software to streamline the administration of ATIP requests.
• The ATIP consent form was revised to ensure that it is as clear and concise as possible for requesters in order to reduce the number of incomplete ATIP requests submitted to the Department.
• IRCC continues to develop relationships with senior officials from relevant stakeholder organizations to raise awareness about ATIP best practices. These organizations submit more than 50% of the Department’s ATIP requests and include the Canadian Bar Association, the Canadian Association of Professional Immigration Consultants, and the Immigration Consultants of Canada Regulatory Council.
• A Senior Privacy Advisor from the Privacy, Policy and Governance Unit was embedded in a departmental program area to support the implementation of privacy-protective measures during the design of an advanced analytics project.

Policies, Guidelines and Procedures

• The ATIP Division developed a new procedure to make its case management system more efficient and to better comply with the retention period for personal information as outlined by the Privacy Act.
• Over the course of the reporting period, IRCC took a number of measures to improve adherence to ATIP statutory deadlines for processing requests. For instance, spearheaded by the Division, the Department moved towards predominantly providing electronic records in response to ATIP requests.
• The ATIP Division continues to innovate through the creation of better tools to inform senior management of actions required to improve performance as well as to provide timely responses to requesters.

Training and Awareness

Through its training delivery and awareness activities, IRCC continues to work towards developing an institution-wide culture of privacy alongside a strong commitment to increasing privacy vigilance.

Mandatory training

During the reporting period, 2,755 employees participated in ATIP Division training sessions, representing nearly a two-fold increase from the previous fiscal year. ATIP provides 3 important sessions throughout the year:

1. Understanding and Managing ATIP Requests is designed to provide a greater understanding of the roles and responsibilities of the ATIP Division, the liaison officers and other departmental officials in the processing of an ATIP request. A total of 76 employees attended.
2. ATIP Training for Middle Managers and Executives provides an overview of key ATIP principles and practices, and a greater understanding of the roles and responsibilities of managers and employees. Ten managers and executives completed the course.
3. Protecting and Giving Access to Information at IRCC is a mandatory online course for all employees. It provides a brief overview of key ATIP principles and practices and fosters a greater understanding of the roles and responsibilities of all employees. During the year, 1,163 employees took the online training.

The Division also provides ad hoc and tailored training sessions and workshop presentations to reinforce and increase knowledge and understanding of access to information, privacy and personal information. These sessions are independent of mandatory courses and are given in response to a group’s specific interests such as training designed for ATIP Liaison Officers and Foreign Officers. A total of 578 employees were provided tailored ATIP training last fiscal year.

Privacy breach training

Privacy breach training sessions are designed to provide a greater understanding of what a privacy breach is, the roles and responsibilities of employees and increase awareness of emerging trends in privacy breaches.

These sessions are focused not only on how to contain a breach, but also how to evaluate it, notify internal and external stakeholders, mitigate the impact and reduce the probability of a recurrence. They provide an opportunity for program areas to ask questions pertaining to real scenarios and receive practical advice from the ATIP staff.

A total of 928 employees received privacy breach training in 2017-2018, which represents an increase of 269% over the last reporting period.

IRCC Privacy Day

On November 1, 2017, IRCC celebrated its 2^nd Annual Privacy Day. This initiative is a large-scale, department-wide event created to bolster privacy awareness and to champion the protection of personal information at IRCC. Privacy Day challenges employees to think differently about privacy and the implications it may have for the delivery of the Department’s programs and services. It underscores that privacy is a shared responsibility. As Privacy Day is held each year, it provides a forum to spotlight key issues in privacy in an often complex and rapidly changing technological environment.

On Privacy Day, IRCC organized 3 seminars dealing with privacy breaches, managing personal information and technological encroachments on individual privacy. The event was promoted on Today@IRCC, the Department’s internal electronic newsletter. Accepting ATIP’s invitation, various government institutions were in attendance at the noon hour Privacy Day seminar entitled “Technocreep: The Surrender of Privacy and the Capitalization of Intimacy”.

Data Privacy Day

On January 28, 2018, IRCC observed Data Privacy Day as part of its commitment to raise awareness about the importance of privacy and the protection of personal information. Data Privacy Day is an internationally recognized event. It is an excellent opportunity to empower and educate employees on how to manage and control their digital footprint as well as highlight the privacy risks associated with changes in technology. The ATIP Division, in collaboration with Information Management Services and Information Technology Security, hosted a joint information kiosk to answer questions from employees and provide informative materials.

Annex A: Signed Delegation

Annex B: Delegation Order under the Access to Information Act

Official Document

Delegation of Authority under the Access to Information Act and the Access to Information Regulations

Legend

DM

Deputy Minister

ADM-CS / DG-CA

ADM, Corporate Services / Director General, Corporate Affairs

ATIP / DIRECTOR

Director, Access to Information and Privacy (EX-01)

ATIP / Assistant Director

Assistant Director, ATIP Operations (OPS) (PM-06) / Assistant Director, Complex and Sensitive Issues (CSI) (PM-06)

ATIP / PM-05 OPS

Senior ATIP Administrators, ATIP Operations (OPS)

ATIP / PM-05 CSI

Senior ATIP Administrators, ATIP Complex and Sensitive Issues (CSI)

ATIP / PM-04 OPS

ATIP Administrators, ATIP Operations (OPS)

ATIP / PM-04 CSI

ATIP Administrators, ATIP Complex and Sensitive Issues (CSI)

ATIP / PM-03 OPS

ATIP Officers, ATIP Operations (OPS)

ATIP / PM–03 CSI

ATIP Officers, ATIP Complex and Sensitive Issues (CSI)

Annex C: Delegation Order under the Privacy Act

Official Document

Delegation of Authority under the Privacy Act and the Privacy Regulations

Legend

DM

Deputy Minister

ADM-CS / DG-CA

ADM, Corporate Services / Director General, Corporate Affairs

ADM-SPP / DG-RE

Associate ADM, Strategic and Program Policy / Director General, Research and Evaluation

ATIP / DIRECTOR

Director, Access to Information and Privacy (EX-01)

ATIP / ASSISTANT DIRECTOR CSI

Assistant Director, Complex and Sensitive Issues, CSI (PM-06)

ATIP /ASSISTANT DIRECTOR OPS
ATIP / PM-05 OPS

Assistant Director, ATIP Operations, OPS (PM-06)
Senior ATIP Administrator, ATIP Operations (OPS

ATIP / PM-05 CSI

Senior ATIP Administrators, Complex and Sensitive Issues (CSI)

ATIP / PM-04 OPS

ATIP Administrators, ATIP Operations (OPS)

ATIP / PM-04 CSI

ATIP Administrators, Complex and Sensitive Issues (CSI)

ATIP / PM-03 OPS

ATIP Officers, ATIP Operations (OPS)

ATIP / PM-03 CSI

ATIP Officers, ATIP Complex and Sensitive Issues (CSI)

Annex D: Statistical Report on the Access to Information Act

Name of institution: Immigration, Refugees and Citizenship Canada

Reporting period: 2017-04-01 to 2018-03-31

Part 1: Requests Under the Access to Information Act

1.1 Number of requests

1.2 Sources of requests

1.3 Informal requests

Note: All requests previously recorded as “treated informally” will now be accounted for in this section only.

Part 2: Requests Closed During the Reporting Period

2.1 Disposition and completion time

2.2 Exemptions

2.3 Exclusions

2.4 Format of information released

2.5 Complexity

2.5.1 Relevant pages processed and disclosed

2.5.2 Relevant pages processed and disclosed by size of requests

2.5.3 Other complexities

2.6 Deemed refusals

2.6.1 Reasons for not meeting statutory deadline

2.6.2 Number of days past deadline

2.7 Requests for translation

Part 3: Extensions

3.1 Reasons for extensions and disposition of requests

3.2 Length of extensions

Part 4: Fees

Part 5: Consultations Received From Other Institutions and Organizations

5.1 Consultations received from other Government of Canada institutions and organizations

5.2 Recommendations and completion time for consultations received from other Government of Canada institutions

5.3 Recommendations and completion time for consultations received from other organizations

Part 6: Completion Time for Consultations on Cabinet Confidences

6.1 Requests with Legal Services

6.2 Requests with Privy Council Office

Part 7: Complaints and Investigations

Part 8: Court Action

Part 9: Resources Related to the Access to Information Act

9.1 Costs

9.2 Human Resources

Annex E: Statistical Report on the Privacy Act

Name of institution: Immigration, Refugees and Citizenship Canada

Reporting period: 2017-04-01 to 2018-03-31

Part 1: Requests Under the Privacy Act

Part 2: Requests Closed During the Reporting Period

2.1 Disposition and completion time

2.2 Exemptions

2.3 Exclusions

2.4 Format of information released

2.5 Complexity

2.5.1 Relevant pages processed and disclosed

2.5.2 Relevant pages processed and disclosed by size of requests

2.5.3 Other complexities

2.6 Deemed refusals

2.6.1 Reasons for not meeting statutory deadline

2.6.2 Number of days past deadline

2.7 Requests for translation

Part 3: Disclosures Under Subsections 8(2) and 8(5)

Part 4: Requests for Correction of Personal Information and Notations

Part 5: Extensions

5.1 Reasons for extensions and disposition of requests

5.2 Length of extensions

Part 6: Consultations Received From Other Institutions and Organizations

6.1 Consultations received from other Government of Canada institutions and other organizations

6.2 Recommendations and completion time for consultations received from other Government of Canada institutions

6.3 Recommendations and completion time for consultations received from other organizations

Part 7: Completion Time of Consultations on Cabinet confidences

7.1 Requests with Legal Services

7.2 Requests with Privy Council Office

Part 8: Complaints and Investigations Notices Received

Part 9: Privacy Impact Assessments (PIAs)

Part 10: Resources Related to the Privacy Act

10.1 Costs

10.2 Human Resources