Language selection

OPC Logo Office of the Privacy Commissioner of Canada

Search

Failure to publish a personal information bank description on Zero-Emissions Program contravenes the Privacy Act

Complaint under the Privacy Act

February 23, 2023

Description

An individual submitted multiple concerns related to the collection of his personal information in the context of the federal “Incentives for Zero-Emission Vehicles Program”, (“iZEV”) among which was an allegation that the personal information being collected was not included in a publicly available personal information bank (“PIB”) description as required by the Privacy Act (“the Act”). In this case, Transport Canada failed to submit a PIB description to the Treasury Board Secretariat (“TBS”) for approval until 19 months after the program was launched; 25 months after that, when we issued our final report on the investigation, TBS had still not approved it. Transport Canada subsequently confirmed that the PIB description has since been approved and published it on its website, as it was required to do before launching the program.

Takeaways

  • Transparency to the public about the collection and handling of personal information is a key requirement of the Privacy Act.
  • Under Sections 10 and 11 of the Privacy Act, government institutions administering programs and the TBS have a shared responsibility to ensure that PIB descriptions available to the public are up to date and published on a timely basis.

Summary of Complaint

Background

An individual complained about the collection, use and disclosure of personal information for the administration of Transport Canada’s iZEV benefit program. Among his concerns was that the PIB that Transport Canada iZEV Privacy Notice directed individuals to was described as an inactive unrelated program.

Investigation

The Incentives for iZEV Program was launched in May of 2019 and is administered by Transport Canada. The goal of this program is to encourage the adoption of zero-emission vehicles and ultimately, to reduce transportation-related greenhouse gas emissions.

While collecting a vehicle purchased by his employer from a local car dealership, the complainant filled out the “iZEV Program Consumer Consent Form”. The complainant took issue with the consent form and the administration of the program. This confusion stemmed in part from the PIB that Transport Canada chose to reference on the form, which described an outdated service unrelated to the iZEV Program.

After consulting the PIB for the ecoAUTO Rebate Program, which did not contain any details relevant to the iZEV Program, the complainant felt that he had not been adequately informed of the manner in which Transport Canada collected, stored and used his personal information. The complainant had also consulted both Transport Canada and the Canadian Counsel of Motor Transport Administrators’ (“CCMTA”) websites, but could not find any additional details describing how his information was used.

Section 10 of the Privacy Act requires that a government institution ensures that all personal information under its control that is being used for an administrative purpose (as is the case for this program) be included in PIB. Subsection 71(4) of the Act specifies that no new PIB shall be established and no existing PIB shall be substantially modified without the approval of Treasury Board, while section 11 specifies that Treasury Board is responsible for ensuring that at least once a year, an index of PIBs, describing the banks and various required elements, is published for all government institutions.

To meet these requirements, the TBS Directive on Privacy Impact Assessment requires institutions to: (i) obtain TBS’s approval for any new or substantially modified PIB before implementing a new or modified program or activityFootnote 1, and (ii) identify, describe and publicly report their PIBsFootnote 2. The Info Source Decentralized Publishing Requirements further states that when an institution-specific PIB is developed and subsequently registered by TBS, the description of this PIB must be included by the institution in the relevant index of personal information chapter published online. This is due to the fact that, in practice, the index of personal information is decentralized, with each institution having their own specific webpage listing each of their PIBs. These indexes are also published and updated on a continual basis, with modifications being made as soon as they have been approved by TBS.

However, contrary to these obligations, we found that Transport Canada did not submit an updated PIB description to TBS until 19 months after the iZEV program was launched. Furthermore, nine months later Transport Canada had received no feedback or approval from TBS, in the context of a backlog at TBS for approval of such requests. In light of our investigation that was by then underway, Transport Canada and TBS engaged in discussions to prioritize its review and approval. However, despite work by Transport Canada and TBS in the interim, as of the completion of our report of findings nearly 4 years after the launch of the program a PIB description for the iZEV program still had not been published.

All parties acknowledged that Transport Canada’s omissions led to the lack of available iZEV Program-related PIB information for the first 19 months. However, TBS, who is responsible for approving the creation of new PIBs and for publishing their descriptions within the index of personal information, has also contributed to this issue by failing to respond to Transport Canada’s PIB approval request and ensure publication within a reasonable timeframe.

To resolve the contravention, we recommended that Transport Canada and TBS collaborate to finalize, approve and publish the PIB description for the iZEV program, and that TBS consider: (i) developing and implementing a reasonable service standard for the approval of new and modified PIBs, as well as (ii) delegating a portion of their PIB-related responsibilities to government institutions.

We note that without a timely approval process, the entire PIB regime under the Act is at risk of becoming inoperable, which would limit both: (i) the capacity of government institutions to process personal information in a responsible and accountable manner and (ii) the availability of key information to which the public is entitled and which ensures transparency regarding the personal information held and used by government institutions.

Transport Canada has subsequently confirmed that it has published a PIB for the iZEV program.

TBS did not agree to implement our recommendations citing that PIB registration and modification requests vary significantly in scope and complexity. However, it highlighted a number of business improvements being developed for their PIB approval process, which include:

  • a triage process for PIB requests from institutions;
  • active communication with the institution notifying them that TBS has begun the review, and sharing a timeframe for the review’s completion;
  • leveraging automation and modern case management tools; and
  • internal standards for review relating to requests to register new and substantially modified PIBs.

Combined with streamlined review processes and targeted temporary resource reallocations, TBS informed our Office that they were on track to process the entirety of their legacy PIB registration/modification inventory by the end of the 2022-2023 fiscal year. They subsequently confirmed that by the end of March 31, 2023, they had reviewed all PIBs that had been submitted to them more than 12 months prior. TBS stated that it will strive to process new PIB registration requests on an ongoing basis.

We appreciate that service delivery backlogs (avoiding and mitigating them) are a challenge faced by many government institutions. Overall, we are pleased to be notified of TBS’ commitment, priority and plans to address their PIB registration/modification backlog and to review new PIB requests in a timely manner. We underscore our interest in the reduction of the backlog, and will defer to TBS as to the manner by which the associated PIB delays will be reduced.

Following our investigation, our Office received updates from TBS regarding the effectiveness of their proposed approach to abate a backlog of PIB requests and to abbreviate the PIB review periods. Sustained efforts in this respect will avoid situations, as was seen in this case, where personal information is being collected by government institutions prior to PIB descriptions being available to the public.

Date modified: