OPC encourages informal disclosure as a way to improve timeliness of access to personal information

November 22, 2019

Office of the Privacy Commissioner of Canada Privacy Alerts are intended to offer lessons learned, best practices and other important privacy news, trends and information related to privacy protection in the federal public sector. We encourage you to share this information with colleagues.

---

Issue:

Federal government institutions are often unable to process requests for personal information under the Privacy Act within the prescribed legal time limits – a matter that has become the most common type of complaint our office receives.

We believe institutions can use informal disclosures to shorten processing times and reduce backlogs, and, ultimately, better serve Canadians.

The Privacy Act gives individuals a right to have access to their personal information held by federal institutions upon written request. Federal institutions are generally obliged to meet those requests, although there are exceptions.

More than half (56%) the complaints our office received in 2017-18 related to time limits, compared to access (24%) and privacy (21%). These complaints involved institutions exceeding the statutory time to respond to a request, often by months, if not years.

Most of these complaints were well-founded, which gives our office serious cause for concern.

By the end of the 2017-18 fiscal year, the backlog of unanswered access requests had increased to more than 12,600 across the federal public service. 

To that end, we have been working with institutions to explore the viability of providing more informal access to Canadians, where appropriate. This involves providing their personal information to those who request it outside the formal Privacy Act process.

In April, we held a roundtable discussion with Access to Information and Privacy (ATIP) coordinators and officials from program areas, representing a dozen large federal departments that handle a significant number of Privacy Act requests. It was an opportunity to share effective practices for making informal disclosures. Below are some potential solutions that emerged from the discussion, which we believe could be helpful to the public service at large.

Advice for Institutions:

• Provide clearer information on websites to better inform individuals about where and how to start searching for their personal information. Individuals seeking to access their personal information aren’t always sure how to proceed and can have difficulties navigating government websites.
• Create or assign a dedicated team within your ATIP shop to process informal requests.
• Use risk management approaches or triage mechanisms to determine which requests can be treated informally and which require a more thorough, formal treatment.
• Use new technologies to organize and direct requests.
• Change business practices to include proactive sharing of information so people don’t have to request it. For example, self-serve solutions where individuals can directly access, via an online portal, their personal information held by federal institutions.
• Implement well-defined processes for common or frequent requests, such as self-serve solutions or detailed request forms that help to narrow the scope of a request.
• “Go upstream” by understanding what drives individuals to make requests in the first place. Anticipate when and why they ask for information and make changes that will help them access it more easily.

Sign up for future Privacy Alerts by subscribing to our RSS feed. Privacy alerts are also posted on our website.