2023-24 Annual Report to Parliament on the Privacy Act
October 2024
Office of the Privacy Commissioner of Canada
30 Victoria Street, 1st Floor
Gatineau, Quebec
K1A 1H3
819-994-5444, 1-800-282-1376
Fax: 819-994-5424
Follow us on X (Twitter): @privacyprivee
Introduction
The Privacy Act (the Act or PA) came into effect on July 1, 1983. The Act imposes obligations on federal government departments and agencies to respect the privacy rights of individuals by limiting the collection, use and disclosure of personal information. The Act also gives individuals the right of access to their personal information and the right to request the correction of that information.
While not initially subject to the PA, the Office of the Privacy Commissioner (OPC) and other Agents of Parliament became so on April 1, 2007, when relevant provisions of the Federal Accountability Act came into force.
Section 72 of the Act requires that the head of every federal government institution submit an annual report to Parliament on the administration of the Act within their institution during the fiscal year.
The OPC is pleased to submit its seventeenth Annual Report which describes how the OPC fulfilled its responsibilities under the Privacy Act in 2023-24.
Mandate and Mission of the OPC
The mandate of the OPC is to oversee compliance with both the PA, which covers the personal information handling practices of federal government departments and agencies, and the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s private sector privacy law.
The OPC’s mission is to protect and promote the fundamental privacy rights of individuals.
The Commissioner works independently from any other part of the government to investigate privacy complaints from individuals with respect to the federal public sector and certain aspects of the private sector. With respect to public sector matters, individuals may complain to the Commissioner about any matter specified in section 29 of the PA.
For matters relating to personal information in the private sector, the Commissioner may investigate complaints under section 11 of PIPEDA except in the provinces that have adopted substantially similar privacy legislation, namely Quebec, British Columbia, and Alberta. Ontario, New Brunswick, Nova Scotia and Newfoundland and Labrador now fall into this category with respect to personal health information held by health information custodians under their health sector privacy laws. However, even in those provinces with substantially similar legislation, and elsewhere in Canada, PIPEDA applies to personal information collected, used or disclosed by all federal works, undertakings and businesses, including personal information about their employees. PIPEDA also applies to all personal data that flows across provincial or national borders, in the course of commercial activities.
The Commissioner focuses on resolving complaints through negotiation and persuasion, using mediation and conciliation if appropriate. If voluntary cooperation is not forthcoming however, the Commissioner has the power to summon witnesses, administer oaths and compel the production of evidence. In cases that remain unresolved, particularly under PIPEDA, the complainant or the Commissioner may take the matter to Federal Court and seek a court order to rectify the situation.
As the agent of Parliament responsible for the protection of the privacy rights of Canadians, the Commissioner carries out the following activities:
- Investigating complaints and issuing reports with recommendations to federal government institutions and private sector organizations to remedy situations of non-compliance, as appropriate;
- Pursuing legal action before the federal courts where appropriate to resolve outstanding matters;
- Assessing compliance with obligations contained in the PA and PIPEDA through the conduct of independent audit and review activities;
- Advising on, and reviewing, Privacy Impact Assessments (PIAs) of new and existing government initiatives;
- Providing legal and policy analysis and expertise to help guide Parliament’s review of evolving legislation to ensure respect for individuals’ right to privacy;
- Responding to inquiries from parliamentarians, individual Canadians and organizations seeking information and guidance, and taking proactive steps to inform them of emerging privacy issues;
- Promoting privacy awareness and compliance, and fostering understanding of privacy rights and obligations through proactive engagement with federal government institutions, private-sector organizations, industry associations, the legal community, academia, professional associations, and other stakeholders;
- Preparing and disseminating public education materials, positions on evolving legislation, regulations and policies, guidance documents and fact sheets for use by the general public, federal government institutions and private sector organizations;
- Conducting research and monitoring trends in technological advances and privacy practices, identifying systemic privacy issues that need to be addressed by federal government institutions and private sector organizations and promoting integration of best practices; and
- Working with privacy stakeholders from other jurisdictions in Canada and internationally to address global privacy issues that result from ever increasing transborder data flows.
Organizational Structure
The Privacy Commissioner is an Agent of Parliament who reports directly to the House of Commons and the Senate.
The core responsibility of the OPC is the protection of Canadians’ privacy rights. To do this, the OPC’s work falls into two program areas — Compliance and Promotion. Both areas are important in protecting privacy.
The OPC’s organizational structure is comprised of four sectors: Compliance; Policy and Promotion; Corporate Management and Legal Services. The work of each sector is overseen by a Deputy Commissioner. The four Deputy Commissioners report directly to the Privacy Commissioner. The Commissioner is also supported by the OPC’s Executive Secretariat.
Additional information about the OPC’s structure is provided below.
Compliance Sector
The OPC’s compliance program, headed by the Deputy Commissioner, Compliance, focuses on addressing existing privacy compliance problems through a variety of enforcement activities to ensure violations of the law are identified and that remedies are recommended. This includes initiating investigations into complaints filed by Canadians, but also a shift towards more proactive enforcement, such as proactive, Commissioner-initiated investigations or, in certain cases, audits, to review issues that are not being addressed through the complaint system.
The Compliance Sector includes three directorates: the Privacy Act Compliance Directorate (public sector), the Personal Information and Electronic Documents Act (PIPEDA) Compliance Directorate (private sector) and the Compliance, Intake and Resolution Directorate (public and private sectors).
Privacy Act Compliance Directorate
The PA Compliance Directorate investigates complaints under the Privacy Act from individuals who believe that they have not been given access to their personal information held by government institutions, or feel that their information has been inappropriately, collected, used, disclosed or managed. The Directorate also investigates complaints and conducts audits that are initiated by the Commissioner.
PIPEDA Compliance Directorate
The PIPEDA Compliance Directorate investigates complaints from individuals under the PIPEDA about the collection, use and disclosure of their personal information in the course of commercial activities. The Directorate also investigates complaints and conducts audits that are initiated by the Commissioner, including, in some cases, investigations into activities of sectors of the economy.
Compliance, Intake and Resolution Directorate
The Compliance, Intake and Resolution Directorate is responsible for receiving all complaints, and quickly resolving certain complaints received under the PIPEDA and the Privacy Act. The Directorate also:
- reviews mandatory reporting of data breaches submitted by private-sector organization and federal institutions, and tracks them;
- investigates privacy breaches; and
- ensures compliance monitoring.
On January 1, 2020, the Compliance, Intake and Resolution Directorate’s Executive Director took on the role of Chief Privacy Officer for the OPC.
Policy and Promotion Sector
The promotion program, headed by the Deputy Commissioner, Policy and Promotion, is forward-looking and aims to inform Canadians of their rights and how to exercise them, and to bring organizations into compliance with the law. This involves, for example, the development and promotion of general—yet practical—information and guidance, reviewing and commenting on Privacy Impact Assessments (PIAs), and offering industry advice on specific initiatives. The goal is to share information and advice with businesses and departments when they are designing their services so that Canadians may enjoy the benefits of innovation without undue risk to their privacy.
The Policy and Promotion Sector includes six directorates: Government Advisory; Business Advisory; Policy, Research and Parliamentary Affairs; Technology Analysis; Communications; and, the International, Provincial and Territorial Relations Directorate.
Government Advisory Directorate
The Government Advisory Directorate provides advice and recommendations to federal public sector institutions in relation to specific programs and initiatives, as well as in the review of PIAs and information sharing agreements submitted by departments and agencies. This group also undertakes various outreach initiatives with the federal public sector in order to encourage compliance with the PA.
Business Advisory Directorate
The Business Advisory Directorate provides advice to businesses subject to PIPEDA in the context of advisory services for new programs and initiatives, reviews for existing privacy practices and proactive engagements with the business community. This group also undertakes various outreach initiatives with the private sector in order to encourage compliance with PIPEDA.
Policy, Research and Parliamentary Affairs Directorate
The Policy, Research and Parliamentary Affairs Directorate develops strategic policy positions on legislative bills, government policies and private sector initiatives; supports the Commissioner’s appearances before Parliament; develops guidance for the public and private sectors; and conducts applied research on emerging privacy issues in support of this work. This Directorate also manages the OPC Contributions Program which funds external researchers and non-profit organizations to advance and apply new knowledge about data protection in the private sector.
Technology Analysis Directorate
The Technology Analysis Directorate identifies and analyzes technological trends and developments in electronic platforms and digital media; conducts research to assess the impact of technology on the protection of personal information in the digital world and provides strategic analysis and guidance on complex, varied and sensitive technological issues involving government and commercial systems that store personal information.
Communications Directorate
The Communications Directorate focuses on providing strategic advice and support for the planning and execution of public education and communications activities. This includes the production and dissemination of information for Canadians and organizations aimed at increasing awareness of privacy rights and obligations through, for example, media monitoring and analysis, public opinion polling, media relations, publications, special events, various outreach campaigns and the OPC web site. The Directorate is also responsible for responding to requests for information from the public and organizations regarding privacy rights and responsibilities through the OPC’s Information Centre.
International, Provincial and Territorial Relations
The International, Provincial and Territorial Relations Directorate serves as the focal point for the Office’s domestic and international engagement. The OPC strives to work collaboratively with its counterparts on public-sector and private-sector compliance, public education and policy matters. It has established frameworks with a number of counterparts to formalize consultation, cooperation and the sharing of relevant information. The OPC also participates in a number of international privacy protection organizations to help shape and improve privacy policies and standards around the world, which in turn leads to better protection for Canadian’s personal information.
Corporate Management Sector
The Corporate Management Sector is led by the Deputy Commissioner, Corporate Management. The Corporate Management Sector includes four directorates: Human Resources; Finance and Administration; Information Management/Information Technology; and Business Planning, Performance, Audit and Evaluation.
The Corporate Management Sector provides advice and integrated administrative services to managers and staff, in the areas of corporate planning, resource management, financial management, information management/technology, human resources and people management and general administration.
Legal Services Sector
The Legal Services Sector is led by the Deputy Commissioner and Senior General Counsel who reports directly to the Privacy Commissioner. The sector provides legal advice in relation to PIPEDA and PA investigations and audits, and in support of other operational activities across the OPC. It represents the OPC in litigation matters before the courts and in negotiations with other parties. The sector also includes the OPC’s Access to Information and Privacy Division.
In 2023-24, the ATIP Division was headed by a director supported by 2 analysts.
Under section 73(1) of the PA, the Privacy Commissioner has delegated his authority in relation to all access-related powers, duties and functions to the ATIP Director as well as to the Deputy Commissioner and Senior General Counsel with respect to the application of the Act and its Regulations. A copy of the Delegation Order is attached as Appendix A.
Privacy Commissioner, Ad Hoc / Complaint Mechanism
Given the PA’s silence regarding an independent mechanism under which PA complaints against the OPC are to be investigated, the Office has developed an alternative process to investigate OPC actions with respect to its administration of the Act.
For this purpose, the Commissioner’s powers, duties and functions set out in sections 29 through 35 and section 42 of the Act have been delegated to a Privacy Commissioner, Ad hoc in order to investigate PA complaints lodged against the OPC.
In 2023-24, the Privacy Commissioner, Ad Hoc was Anne Bertrand, K.C.. Ms. Bertrand was the Province of New Brunswick’s first Access to Information and Privacy Commissioner from 2010 to 2017. In 2016, she also served as New Brunswick’s Acting Conflict of Interest Commissioner for one year. She had previously been a practising lawyer in Fredericton for more than 24 years, working in multiple areas of the law, including administrative law, criminal law, labour law and civil litigation. She served as an arbitrator on various administrative tribunals for a number of years.
ATIP Division Activities
Training employees
Although training offered to new OPC employees has moved to an online, self-paced learning platform, the ATIP Division continues to offer ad hoc training to individuals and groups.
Privacy Act Statistical Interpretation
The OPC’s Statistical Report on the PA is attached as Appendix B.
The OPC received 101 formal requests under the PA during the fiscal year, this was in addition to two requests carried forward from the previous year, for a total of 103 requests. Of these, 101 requests were closed during the course of this reporting year and two were carried forward to the next fiscal year. All of the 101 requests closed during the reporting period were closed within legislated timelines (100%).
Requests under the Privacy Act
Text version
Requests under the Privacy Act| Year | 2021/2022 | 2022/2023 | 2023/2024 |
|---|---|---|---|
| Received | 39 | 26 | 101 |
| Processed | 37 | 77 | 101 |
Of the 101 requests received, two were carried forward to the 2024-25 reporting year in addition to the two requests carried forward from the previous year, for a total of 101 requests processed under the PA concerning information under the OPC’s control, i.e., a total of 13,569 pages of information. This represents approximately a 357% increase in the number of pages of information processed compared to the previous year. Of the 101 requests closed, 72 were completed within one to 15 days, 28 were completed within 16 to 30 days and one was completed within 61 to 120 days. Of the two requests carried over from the previous year, both were received in 2022-23 and were carried over within legislated timeframe. Of the 101 requests received, the OPC was required to claim an extension of the time limit in one case, as the volume of records that required processing was quite large and finalizing that request within the original 30-day timeframe would have unreasonably interfered with the operations of the OPC. With respect to the 101 requests processed in 2022-23:
- Information was partially disclosed in 19 instances (18.8%).
- Information was fully disclosed in six instances (5.9%).
- In eight instances, no records existed that responded to the requests (7.9%).
- In 65 instances, the requests were abandoned by the requester (64.5%).
- In three instances, all records were withheld (2.9%).
Of the 101 requests processed in the reporting year, 15 were for the contents of PA investigation files and/or content processed by the OPC. Section 22.1 of the PA prohibits the OPC from releasing information it obtained during the course of its investigations or audits even after the matter and all related proceedings have been concluded. However, subject to any applicable exemptions, the OPC cannot refuse to disclose information that it created during the course of an investigation or audit, once they and any related proceedings are completed. This exemption was applied in 15 cases during the reporting period. With respect to other exemptions, section 26 (Information about another individual) was invoked in nine cases, section 21 (International affairs and defence) was invoked in two cases, section 22(1)(b) (Law enforcement and investigation) in one case and section 27 (Solicitor-client privileged information) in three cases.
The OPC also processed two requests for consultation received from other institutions during the fiscal year within the reporting period, representing a total of 62 pages. One request was answered within the first 15 days of receipt and the other was answered within 16 to 30 days.
It is quite common for the OPC to receive broad requests seeking access to personal information held by other federal institutions. In most cases, the OPC does not have any of the requested personal information under its control. In such cases, requesters are advised to contact the relevant federal institution or to consult Info Source for a detailed listing of the personal information holdings of each federal organization and to submit requests to those most likely to have the personal information to which they seek access.
At no point during the reporting period were requests received for correction of personal information held by the OPC, nor was the OPC consulted by any federal institution with a request for correction.
Processing times for information requests are tracked on a weekly basis by the ATIP Division using the access to information management system.
COVID-19 Operational impact
Most OPC staff have been teleworking since mid-March 2020. The OPC ATIP Division was able to work at its usual capacity throughout the pandemic period.
On December 15, 2022, the Treasury Board Secretariat (TBS) announced the adoption of a common hybrid work model for the core public administration, which includes the OPC. The new model began being implemented at the beginning of 2023, and it has now been fully implemented.
The OPC’s operations were not affected by COVID-19 during this reporting period.
Privacy Act complaints against the OPC
During the reporting period covered in this report, the OPC received seven complaints made against it under the Privacy Act. Four complaints were deemed to be not well-founded by the Privacy Commissioner Ad hoc as the exemptions claimed were properly applied and no further actions were required on the part of the OPC. The other three complaints were discontinued by the Privacy Commissioner Ad hoc, as she found that further investigation was not necessary since the requesters were provided with all the information they were entitled to receive.
Report on the TBS Directive on Privacy Impact Assessment (PIA)
The Directive on Privacy Impact Assessment, which came into effect on April 1, 2010, requires that TBS monitor compliance with the Directive. Given this responsibility, institutions are asked to include pertinent statistics in their annual reports on the administration of the PA.
No privacy impact assessments were conducted during this reporting period.
The current list of OPC Privacy Impact Assessments can be found on the OPC website.
Data Sharing Activities
The OPC did not undertake any personal data sharing activities during this reporting year.
Disclosures of Personal Information
The OPC disclosed no personal information under sections 8(2) and (5) of the PA during this fiscal year.
Material Privacy Breach
The OPC was affected by the breach that occurred at BGRS which provides relocation services to public servants. The OPC reported the breach incident to TBS and to the Privacy Commissioner, Ad hoc, and took steps to notify current and former OPC employees who are affected (there are 20 in total). TBS, on behalf of government of Canada institutions, has engaged Equifax to provide credit and dark web monitoring, and identity theft insurance to affected individuals. The OPC has offered these services to affected OPC employees.
After having received a related complaint, the Privacy Commissioner, Ad hoc, launched an investigation. The OPC is actively collaborating in the conduct of her investigation.
Privacy Related Policy Instruments
No new or revised policies, guidelines, and procedures related to privacy were adopted or updated by the OPC during the reporting period.
Additional copies of this report may be obtained from:
Director, Access to Information and Privacy
Office of the Privacy Commissioner of Canada
30 Victoria Street, 1st Floor
Gatineau, Quebec
K1A 1H3
Appendix A — Privacy Act Delegation Order
Pursuant to subsection 73(1) of the Privacy Act, the Privacy Commissioner of Canada hereby delegates to the persons holding the positions set out below, or the persons occupying the positions on an acting basis, the following powers, duties, and functions of the Privacy Commissioner of Canada, as head of the institution, under the provisions of the Act and related regulations set out in the column opposite each position, as specified below:
| Position | Legislative Authority |
|---|---|
|
Director, Access to Information and Privacy (ATIP) Deputy Commissioner and Senior General Counsel |
Privacy Act: Full authority with respect to processing requests for access to, and correction of, personal information pursuant to ss. 12-28 of the Privacy Act and with respect to responding to complaints relating to such matters Privacy Regulations: Full authority with respect to processing requests for access to, and correction of, personal information pursuant to ss. 8-14 of the Privacy Regulations |
| Chief Privacy Officer | Privacy Act: Full authority with respect to all matters not delegated to the Director of ATIP or the Director of the Legal Services Directorate, with the exception of paragraph 8(2)(m) of the Privacy Act unless a disclosure under the aforementioned paragraph relates to a situation where there is a health safety or security threat or where it is believed that there is a threat of harm to self or others. Privacy Regulations: Full authority with respect to all matters not delegated to the Director, ATIP |
For greater clarity, this delegation to the positions set out above, or to the persons occupying on an acting basis these positions, includes all powers, duties, and functions as they existed prior to June 21, 2019 under section 73 of the Privacy Act to be exercised with respect to any complaint, investigation, application, judicial review or appeal that was initiated before June 21, 2019.
This delegation of authority supersedes any previous delegation of the powers, duties and functions set out herein.
Dated at the City of Gatineau, this 6th day of February 2024.
(Original signed by)
Philippe Dufresne
Privacy Commissioner of Canada
Privacy Act
| 8(2)(j) | Disclose personal information for research purposes |
|---|---|
| 8(2)(m) | Disclose personal information in the public interest or in the interest of the individual |
| 8(4) | Retain copy of 8(2)(e) requests and disclosed records |
| 8(5) | Notify Privacy Commissioner of 8(2)(m) disclosures |
| 9(1) | Retain record of use |
| 9(4) | Notify Privacy Commissioner of consistent use and amend index |
| 10 | Include personal information in personal information banks |
| 14 | Respond to request for access within 30 days; give access or give notice |
| 15 | Extend time limit for responding to request for access |
| 17(2)(b) | Decide whether to translate requested information |
| 17(3)(b) | Decide whether to give access in an alternative format |
| 18(2) | May refuse to disclose information contained in an exempt bank |
| 19(1) | Shall refuse to disclose information obtained in confidence from another government |
| 19(2) | May disclose any information referred to in 19(1) if the other government consents to the disclosure or makes the information public |
| 20 | May refuse to disclose information injurious to the conduct of federal-provincial affairs |
| 21 | May refuse to disclose information injurious to international affairs or defence |
| 22 | Series of discretionary exemptions related to law enforcement and investigations; and policing services for provinces or municipalities. |
| 22.1(1) | In force April 1, 2007 – Privacy Commissioner shall refuse to disclose information obtained or created in the course of an investigation conducted by the Commissioner. |
| 22.1(2) | In force April 1, 2007 – Privacy Commissioner shall not refuse under 22.1(1) to disclose any information created by the Commissioner in the course of an investigation conducted by the Commissioner once the investigation and related proceedings are concluded. |
| 23 | May refuse to disclose information prepared by an investigative body for security clearances. |
| 24 | May refuse to disclose information collected by the Correctional Service of Canada or the National Parole Board while individual was under sentence if conditions in section are met. |
| 25 | May refuse to disclose information which could threaten the safety of individuals. |
| 26 | May refuse to disclose information about another individual, and shall refuse to disclose such information where disclosure is prohibited under section 8. |
| 27 | May refuse to disclose information subject to solicitor-client privilege. |
| 28 | May refuse to disclose information relating to the individual’s physical or mental health where disclosure is contrary to best interests of the individual. |
| 31 | Receive notice of investigation by Privacy Commissioner. |
| 33(2) | Right to make representations to the Privacy Commissioner during an investigation. |
| 35(1) | Receive Privacy Commissioner’s report of findings of the investigation and give notice of action taken. |
| 35(4) | Give complainant access to information after 35(1)(b) notice. |
| 36(3) | Receive Privacy Commissioner’s report of findings of investigation of exempt bank. |
| 37(3) | Receive report of Privacy Commissioner’s findings after compliance investigation. |
| 51(2)(b) | Request that section 51 hearing be held in the National Capital Region. |
| 51(3) | Request and be given right to make representations in section 51 hearings. |
| 70 | Refuse to provide information that is excluded from the Act as a cabinet confidence. |
| 72(1) | Prepare annual report to Parliament. |
Privacy Regulations
| 9 | Provide reasonable facilities to examine information |
|---|---|
| 11(2) and (4) | Procedures for correction or notation of information |
| 13(1) | Disclosure of information relating to physical or mental health to qualified practitioner or psychologist |
| 14 | Require individual to examine information in presence of qualified practitioner or psychologist |
Appendix B — Statistical Report
Statistical Report on the Privacy Act
Name of institution: Office of the Privacy Commissioner of Canada
Reporting period: 2023-04-01 to 2024-03-31
Section 1: Requests Under the Privacy Act
1.1 Number of requests received
| Number of requests | ||
|---|---|---|
| Received during reporting period | 101 | |
| Outstanding from previous reporting period | 2 | |
|
2 | |
|
0 | |
| Total | 103 | |
| Closed during reporting period | 101 | |
| Carried over to next reporting period | 2 | |
|
2 | |
|
0 | |
1.2 Channels of requests
| Source | Number of requests |
|---|---|
| Online | 100 |
| 1 | |
| 0 | |
| In person | 0 |
| Phone | 0 |
| Fax | 0 |
| Total | 101 |
Section 2: Informal requests
2.1 Number of informal requests
| Number of requests | ||
|---|---|---|
| Received during reporting period | 0 | |
| Outstanding from previous reporting period | 0 | |
|
0 | |
|
0 | |
| Total | 0 | |
| Closed during reporting period | 0 | |
| Carried over to next reporting period | 0 | |
2.2 Channels of informal requests
| Source | Number of requests |
|---|---|
| Online | 0 |
| 0 | |
| 0 | |
| In person | 0 |
| Phone | 0 |
| Fax | 0 |
| Total | 0 |
2.3 Completion time of informal requests
| Completion time | |||||||
|---|---|---|---|---|---|---|---|
| 1 to 15 days | 16 to 30 days | 31 to 60 days | 61 to 120 days | 121 to 180 days | 181 to 365 days | More than 365 days | Total |
| 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
2.4 Pages released informally
| Less than 100 pages released | 100-500 pages released | 501-1000 pages released | 1001-5000 pages released | More than 5000 pages released | |||||
|---|---|---|---|---|---|---|---|---|---|
| Number of requests | Pages released | Number of requests | Pages released | Number of requests | Pages released | Number of requests | Pages released | Number of requests | Pages released |
| 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Section 3: Requests Closed During the Reporting Period
3.1 Disposition and completion time
| Disposition of requests | Completion time | |||||||
|---|---|---|---|---|---|---|---|---|
| 1 to 15 days | 16 to 30 days | 31 to 60 days | 61 to 120 days | 121 to 180 days | 181 to 365 days | More than 365 days | Total | |
| All disclosed | 1 | 5 | 0 | 0 | 0 | 0 | 0 | 6 |
| Disclosed in part | 1 | 17 | 0 | 1 | 0 | 0 | 0 | 19 |
| All exempted | 0 | 3 | 0 | 0 | 0 | 0 | 0 | 3 |
| All excluded | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| No records exist | 5 | 3 | 0 | 0 | 0 | 0 | 0 | 8 |
| Request abandoned | 65 | 0 | 0 | 0 | 0 | 0 | 0 | 65 |
| Neither confirmed nor denied | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Total | 72 | 28 | 0 | 1 | 0 | 0 | 0 | 101 |
3.2 Exemptions
| Section | Number of requests | Section | Number of requests | Section | Number of requests |
|---|---|---|---|---|---|
| 18(2) | 0 | 22(1)(a)(i) | 0 | 23(a) | 0 |
| 19(1)(a) | 0 | 22(1)(a)(ii) | 0 | 23(b) | 0 |
| 19(1)(b) | 0 | 22(1)(a)(iii) | 0 | 24(a) | 0 |
| 19(1)(c) | 0 | 22(1)(b) | 1 | 24(b) | 0 |
| 19(1)(d) | 0 | 22(1)(c) | 0 | 25 | 0 |
| 19(1)(e) | 0 | 22(2) | 0 | 26 | 9 |
| 19(1)(f) | 0 | 22.1 | 15 | 27 | 3 |
| 20 | 0 | 22.2 | 0 | 27.1 | 0 |
| 21 | 2 | 22.3 | 0 | 28 | 0 |
| 22.4 | 0 |
3.3 Exclusions
| Section | Number of requests | Section | Number of requests | Section | Number of requests |
|---|---|---|---|---|---|
| 69(1)(a) | 0 | 70(1) | 0 | 70(1)(d) | 0 |
| 69(1)(b) | 0 | 70(1)(a) | 0 | 70(1)(e) | 0 |
| 69.1 | 0 | 70(1)(b) | 0 | 70(1)(f) | 0 |
| 70(1)(c) | 0 | 70.1 | 0 |
3.4 Format of information released
| Paper | Electronic | Other | |||
|---|---|---|---|---|---|
| E-record | Data set | Video | Audio | ||
| 5 | 20 | 0 | 0 | 0 | 0 |
3.5 Complexity
3.5.1 Relevant pages processed and disclosed for paper and e-record formats
| Number of pages processed |
Number of pages disclosed |
Number of requests |
|---|---|---|
| 13569 | 5539 | 93 |
3.5.2 Relevant pages processed by request disposition for paper and e-record formats by size of requests
| Disposition | Less than 100 pages processed | 100-500 pages processed | 501-1000 pages processed | 1001-5000 pages processed | More than 5000 pages processed | |||||
|---|---|---|---|---|---|---|---|---|---|---|
| Number of requests | Pages processed | Number of requests | Pages processed | Number of requests | Pages processed | Number of requests | Pages processed | Number of requests | Pages processed | |
| All disclosed | 4 | 38 | 1 | 182 | 1 | 885 | 0 | 0 | 0 | 0 |
| Disclosed in part | 7 | 210 | 8 | 1834 | 2 | 1327 | 2 | 8983 | 0 | 0 |
| All exempted | 3 | 110 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| All excluded | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Request abandoned | 65 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Neither confirmed nor denied | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Total | 79 | 358 | 9 | 2016 | 3 | 2212 | 2 | 8983 | 0 | 0 |
3.5.3 Relevant minutes processed and disclosed for audio formats
| Number of minutes processed | Number of minutes disclosed | Number of requests |
|---|---|---|
| 0 | 0 | 0 |
3.5.4 Relevant minutes processed per request disposition for audio formats by size of requests
| Disposition | Less than 60 minutes processed | 60-120 minutes processed | More than 120 minutes processed | |||
|---|---|---|---|---|---|---|
| Number of requests | Minutes processed | Number of requests | Minutes processed | Number of requests | Minutes processed | |
| All disclosed | 0 | 0 | 0 | 0 | 0 | 0 |
| Disclosed in part | 0 | 0 | 0 | 0 | 0 | 0 |
| All exempted | 0 | 0 | 0 | 0 | 0 | 0 |
| All excluded | 0 | 0 | 0 | 0 | 0 | 0 |
| Request abandoned | 0 | 0 | 0 | 0 | 0 | 0 |
| Neither confirmed nor denied | 0 | 0 | 0 | 0 | 0 | 0 |
| Total | 0 | 0 | 0 | 0 | 0 | 0 |
3.5.5 Relevant minutes processed and disclosed for video formats
| Number of minutes processed | Number of minutes disclosed | Number of requests |
|---|---|---|
| 0 | 0 | 0 |
3.5.6 Relevant minutes processed per request disposition for video formats by size of requests
| Disposition | Less than 60 minutes processed | 60-120 minutes processed | More than 120 minutes processed | |||
|---|---|---|---|---|---|---|
| Number of requests | Minutes processed | Number of requests | Minutes processed | Number of requests | Minutes processed | |
| All disclosed | 0 | 0 | 0 | 0 | 0 | 0 |
| Disclosed in part | 0 | 0 | 0 | 0 | 0 | 0 |
| All exempted | 0 | 0 | 0 | 0 | 0 | 0 |
| All excluded | 0 | 0 | 0 | 0 | 0 | 0 |
| Request abandoned | 0 | 0 | 0 | 0 | 0 | 0 |
| Neither confirmed nor denied | 0 | 0 | 0 | 0 | 0 | 0 |
| Total | 0 | 0 | 0 | 0 | 0 | 0 |
3.5.7 Other complexities
| Disposition | Consultation required |
Legal advice sought |
Interwoven information |
Other | Total |
|---|---|---|---|---|---|
| All disclosed | 0 | 0 | 0 | 0 | 0 |
| Disclosed in part | 1 | 0 | 0 | 0 | 1 |
| All exempted | 0 | 0 | 0 | 0 | 0 |
| All excluded | 0 | 0 | 0 | 0 | 0 |
| Request abandoned | 0 | 1 | 0 | 0 | 1 |
| Neither confirmed nor denied | 0 | 0 | 0 | 0 | 0 |
| Total | 1 | 1 | 0 | 0 | 2 |
3.6 Closed requests
3.6.1 Number of requests closed within legislated timelines
| Number of requests closed within legislated timelines | 101 |
|---|---|
| Percentage of requests closed within legislated timelines (%) | 100 |
3.7 Deemed refusals
3.7.1 Reasons for not meeting legislated timelines
| Number of requests closed past the legislated timelines |
Principal reason | |||
|---|---|---|---|---|
| Interference with operations / workload |
External consultation |
Internal consultation |
Other | |
| 0 | 0 | 0 | 0 | 0 |
3.7.2 Requests closed beyond legislated timelines (including any extension taken)
| Number of days past legislated timelines |
Number of requests past legislated timeline where no extension was taken |
Number of requests past legislated timeline where an extension was taken |
Total |
|---|---|---|---|
| 1 to 15 days | 0 | 0 | 0 |
| 16 to 30 days | 0 | 0 | 0 |
| 31 to 60 days | 0 | 0 | 0 |
| 61 to 120 days | 0 | 0 | 0 |
| 121 to 180 days | 0 | 0 | 0 |
| 181 to 365 days | 0 | 0 | 0 |
| More than 365 days | 0 | 0 | 0 |
| Total | 0 | 0 | 0 |
3.8 Requests for translation
| Translation requests | Accepted | Refused | Total |
|---|---|---|---|
| English to French | 0 | 0 | 0 |
| French to English | 0 | 0 | 0 |
| Total | 0 | 0 | 0 |
Section 4: Disclosures Under Subsections 8(2) and 8(5)
| Paragraph 8(2)(e) | Paragraph 8(2)(m) | Subsection 8(5) | Total |
|---|---|---|---|
| 0 | 0 | 0 | 0 |
Section 5: Requests for Correction of Personal Information and Notations
| Disposition for correction requests received | Number |
|---|---|
| Notations attached | 0 |
| Requests for correction accepted | 0 |
| Total | 0 |
Section 6: Extensions
6.1 Reasons for extensions
| Number of requests where an extension was taken | 15(a)(i) Interference with operations | 15(a)(ii) Consultation | 15(b) Translation purposes or conversion |
|||||
|---|---|---|---|---|---|---|---|---|
| Further review required to determine exemptions | Large volume of pages | Large volume of requests | Documents are difficult to obtain | Cabinet Confidence Section (Section 70) | External | Internal | ||
| 1 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 0 |
6.2 Length of extensions
| Length of extensions | 15(a)(i) Interference with operations | 15(a)(ii) Consultation | 15(b) Translation or conversion |
|||||
|---|---|---|---|---|---|---|---|---|
| Further review required to determine exemptions |
Large volume of pages |
Large volume of requests |
Documents are difficult to obtain |
Cabinet Confidence Section (Section 70) |
External | Internal | ||
| 1 to 15 days | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 16 to 30 days | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 0 |
| 31 days or greater | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Total | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 0 |
Section 7: Consultations Received From Other Institutions and Organizations
7.1 Consultations received from other Government of Canada institutions and other organizations
| Consultations | Other Government of Canada institutions | Number of pages to review | Other organizations | Number of pages to review |
|---|---|---|---|---|
| Received during reporting period | 2 | 62 | 0 | 0 |
| Outstanding from the previous reporting period | 0 | 0 | 0 | 0 |
| Total | 2 | 62 | 0 | 0 |
| Closed during the reporting period | 2 | 62 | 0 | 0 |
| Carried over within negotiated timelines | 0 | 0 | 0 | 0 |
| Carried over beyond negotiated timelines | 0 | 0 | 0 | 0 |
7.2 Recommendations and completion time for consultations received from other Government of Canada institutions
| Recommendation | Number of days required to complete consultation requests | |||||||
|---|---|---|---|---|---|---|---|---|
| 1 to 15 days | 16 to 30 days | 31 to 60 days | 61 to 120 days | 121 to 180 days | 181 to 365 days | More than 365 days | Total | |
| Disclose entirely | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Disclose in part | 1 | 1 | 0 | 0 | 0 | 0 | 0 | 2 |
| Exempt entirely | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Exclude entirely | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Consult other institution | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Other | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Total | 1 | 1 | 0 | 0 | 0 | 0 | 0 | 2 |
7.3 Recommendations and completion time for consultations received from other organizations outside the Government of Canada
| Recommendation | Number of days required to complete consultation requests | |||||||
|---|---|---|---|---|---|---|---|---|
| 1 to 15 days | 16 to 30 days | 31 to 60 days | 61 to 120 days | 121 to 180 days | 181 to 365 days | More than 365 days | Total | |
| Disclose entirely | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Disclose in part | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Exempt entirely | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Exclude entirely | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Consult other institution | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Other | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Total | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Section 8: Completion Time of Consultations on Cabinet Confidences
8.1 Requests with Legal Services
| Number of days | Fewer than 100 pages processed | 100-500 pages processed | 501-1000 pages processed | 1001-5000 pages processed | More than 5000 pages processed | |||||
|---|---|---|---|---|---|---|---|---|---|---|
| Number of requests | Pages disclosed | Number of requests | Pages disclosed | Number of requests | Pages disclosed | Number of requests | Pages disclosed | Number of requests | Pages disclosed | |
| 1 to 15 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 16 to 30 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 31 to 60 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 61 to 120 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 121 to 180 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 181 to 365 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| More than 365 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Total | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
8.2 Requests with Privy Council Office
| Number of days | Fewer than 100 pages processed | 100-500 pages processed | 501-1000 pages processed | 1001-5000 pages processed | More than 5000 pages processed | |||||
|---|---|---|---|---|---|---|---|---|---|---|
| Number of requests | Pages disclosed | Number of requests | Pages disclosed | Number of requests | Pages disclosed | Number of requests | Pages disclosed | Number of requests | Pages disclosed | |
| 1 to 15 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 16 to 30 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 31 to 60 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 61 to 120 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 121 to 180 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 181 to 365 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| More than 365 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Total | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Section 9: Complaints and Investigations Notices Received
| Section 31 | Section 33 | Section 35 | Court action | Total |
|---|---|---|---|---|
| 7 | 5 | 7 | 0 | 19 |
Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)
10.1 Privacy Impact Assessments
| Number of PIAs completed | 0 |
|---|---|
| Number of PIAs modified | 0 |
10.2 Institution-specific and Central Personal Information Banks
| Personal Information Banks | Active | Created | Terminated | Modified |
|---|---|---|---|---|
| Institution-specific | 6 | 0 | 0 | 0 |
| Central | 0 | 0 | 0 | 0 |
| Total | 6 | 0 | 0 | 0 |
Section 11: Privacy Breaches
11.1 Material Privacy Breaches reported
| Number of material privacy breaches reported to TBS | 1 |
|---|---|
| Number of material privacy breaches reported to OPC | 1 |
11.2 Non-Material Privacy Breaches
| Number of non-material privacy breaches | 1 |
|---|
Section 12: Resources related to the Privacy Act
12.1 Allocated Costs
| Expenditures | Amount | |
|---|---|---|
| Salaries | $179,733 | |
| Overtime | $0 | |
| Goods and services | $0 | |
| Professional services contracts | $0 | |
| Other | $0 | |
| Total | $179,733 | |
12.2 Human Resources
| Resources | Person years dedicated to privacy activities |
|---|---|
| Full-time employees | 1.650 |
| Part-time and casual employees | 0.000 |
| Regional staff | 0.000 |
| Consultants and agency personnel | 0.000 |
| Students | 0.000 |
| Total | 1.650 |
| Note: Enter values to three decimal places. | |
- Date modified: