Annual report to Parliament 2018-2019: Privacy Act
Table of contents
Introduction
I. Introduction
The purpose of the Privacy Act (PA) is to protect the personal information of individuals under the responsibility and control of federal institutions, and to provide individuals with a right of access to that information.
This report reflects privacy activities of Crown-Indigenous Relations and Northern Affairs Canada (CIRNAC) from April 1, 2018 to March 31, 2019.
This report, submitted to Parliament pursuant to section 72 of the PA, describes the activities of CIRNAC that support compliance with privacy legislation. The report details the activities and accomplishments of CIRNAC's Access to Information and Privacy (ATIP) Directorate, including highlights such as:
- The creation of a Privacy/Policy team; and
- Increased training initiatives to improve departmental ATIP capacity and awareness.
Creation of Two New Departments
In August 2017, the Prime Minister announced the dissolution of Indigenous and Northern Affairs Canada and the establishment of two new departments to better meet the needs and aspirations of First Nations, Inuit and Métis Peoples. At that time, he named two Ministers to lead these new departments: a Minister of Crown-Indigenous Relations and Northern Affairs and a Minister of Indigenous Services Canada.
The ATIP office provided shared services support for CIRNAC and Indigenous Services Canada (ISC) through a Memorandum of Understanding (MOU) between the departments.
Crown-Indigenous Relations and Northern Affairs Canada's Mandate
The Department of Crown-Indigenous Relations and Northern Affairs will accelerate the work that had already begun to renew the nation-to-nation, Inuit-Crown, and government-to-government relationship between Canada and Indigenous People. The Department will also modernize our institutional structure and governance so that First Nations, Inuit, and Métis Peoples can build capacity that supports implementation of their vision of self-determination.
The new relationship must be based on the recognition of rights, respect, co-operation, and partnership. The Department will build on the progress that has been made already, including the establishment of rights and recognition tables across the country, the creation of bilateral mechanism with National Indigenous Organizations to make progress on shared priorities, and the progress made across government on the Truth and Reconciliation Commission Calls to Action.
CIRNAC is one of the two federal departments that are primarily responsible for meeting the Government of Canada's obligations and commitments to First Nations, Inuit and Métis, and for fulfilling the federal government's constitutional responsibilities in the North. CIRNAC's overall mandate and wide-ranging responsibilities are shaped by centuries of history and unique demographic and geographic challenges. The mandate is derived from the Constitution Act 1982, the Indian Act, the Department of Indian Affairs and Northern Development Act, territorial Acts, treaties, comprehensive claims and self-government agreements, as well as various other statutes affecting Indigenous Peoples and the North.
Most of the Department's programs, representing a majority of its spending, are delivered through partnerships with First Nation and Indigenous communities and federal-provincial or federal-territorial agreements. CIRNAC also works with urban Indigenous people, Métis and Non-Status Indians (many of whom live in rural areas).
II. Organization
ATIP Directorate at CIRNAC
The Access to Information and Privacy Directorate is responsible for the administration of requests made under the ATIA andthe PA. It was established within the Corporate Secretariat and reports to the Corporate Secretary, who is directly accountable to the Deputy Head and is a member of the CIRNAC Senior Management Team. The Directorate also coordinates and implements policies, guidelines and procedures to ensure departmental compliance with the ATIA and PA. Workshop presentations, training courses and awareness sessions designed to increase access to information and privacy capacity across the Department are also provided by the ATIP Directorate.
Under a shared service MOU, all ATIP analysts processed requests for both CIRNAC and ISC. They processed requests of varying volume and complexity based on their classification level. They also provide critical privacy advice for new initiatives, resulting in privacy protection in departmental programs. Policies and procedures continue to be established to ensure that privacy is considered throughout the life cycle of CIRNAC's programs and that informed policy decisions are made concerning the collection, sharing and/or use of personal information.
The ATIP Directorate provides advice and guidance to the Department on a number of topics:
- The application of the Access to Information Act (ATIA) and PA;
- The release of sensitive or protected information to the public;
- Departmental Privacy Impact Assessments (PIAs);
- Permissible disclosures of personal information pursuant to subsection 8(2) of the PA;
- Appropriate PA Statements on Data Collection Instruments (DCIs), i.e. forms, surveys, etc.;
- Updates to Info Source and the preparation and registration of Personal Information Banks (PIBs) and their related Classes of Records;
- Protocols surrounding privacy breaches;
- Education and awareness of access to information and privacy issues throughout the Department; and,
- Privacy advice in MOU.
The Intake Team triages and coordinates the receipt of requests for information under the control of the Department made pursuant to the Access to Information Act and the Privacy Act. The Operations Team ensures that a response is provided within the legislated timeframe (30 days). All requests are monitored using the tracking system Access Pro Case Management. To do so, ATIP analysts work closely with the relevant program areas in order to ensure that all responsive documents are provided and to ensure that the information contained within those documents is treated in accordance with the Acts to allow for government records to be safely disclosed to the Canadian public. The Privacy/Policy team is available to provide expert advice, maintain and monitor privacy risks as well as support ISC with the creation of privacy policy training.
In addition to the ATIP Directorate, each of the sectors and regional offices of CIRNAC are ATIP Liaison Officers (ALOs) who receive callouts from the ATIP Directorate and subsequently task the requests as appropriate to areas within their sector. ALOs plays a crucial role in ensuring requests are clear to the record retrievers and that the appropriate records, impact statements and approvals are obtained and communicated to ATIP Directorate officials within the designated time allowances.
III. Delegation Order
Under section 73 of the PA, the Minister's authority may be delegated to departmental officials in order to administer the PA within CIRNAC.
During the reporting period, the delegation order signed by Minister Carolyn Bennett on March 14, 2016, was in effect
(Appendix A). Under section 73 of the Privacy Act, the order delegates full authority and responsibility for the PA to the following positions:
- Deputy Minister
- Associate Deputy Minister
- Corporate Secretary
- Departmental ATIP Coordinator
Statistics
IV. Interpretation of the Statistical Report
CIRNAC's Statistical Report was submitted to the Treasury Board Secretariat (TBS) on May 14, 2019 (Appendix B). The Report details various aspects of the requests CIRNAC received and processed during the period of April 1, 2018 to March 31, 2019.
Part 1. Requests under the Privacy Act
In 2018-2019, CIRNAC received 115 new requests under the Privacy Act. Of the 129 requests (14 were carried over from previous reporting period), the ATIP Directorate completed 119 requests and carried 10 requests over into the 2019-2020 reporting period. (Table1.1)
Number of Requests | 2016-2017 | 2017-2018 | 2018-2019 |
---|---|---|---|
Received | 178 | 165 | 115 |
Outstanding from last year | 0 | 23 | 14 |
Total | 178 | 188 | 129 |
Closed this year | 155 | 174 | 119 |
Carried over to next year | 23 | 14 | 10 |
Long Text Description
In this table we compare the number of requests received in the course of three fiscal years. In 2016-2017, the ATIP Office had received one-hundred-seventy-eight (178) new requests. In 2017-2018, one-hundred-sixty-five (165) new requests were received, and in 2018-2019, one-hundred-fifteen (115) new requests were received.
Twenty-three requests were carried over from 2016-2017 to 2017-2018 and fourteen (14) were carried over from 2017-2018 into 2018-2019. In addition, ten (10) requests were carried over from the past year into the current year.
The ATIP Office closed one-hundred-fifty-five requests in 2016-2017 compared to one-hundred seventy-four in 2017-2018 then the number of requests closed in 2018-2019 decreased to one-hundred-nineteen (119).
Part 2. Requests closed during the reporting period
2.1 Disposition and completion time
Of the 119 requests closed during the reporting period (Table 2.1), CIRNAC was able to fully or partially disclose records in 70 cases; that is, 58.8% of the time a request was submitted to CIRNAC, the result was a disclosure of relevant information. The majority of requests (76, or 63.8%) took 30 days or less to complete. In 2018-2019, two (2) requests took longer than 120 calendar days to be completed.
The most frequent outcome of the requests processed during the reporting period was 'Disclosed in part', which was the result for 41 requests (34.4%), and the category 'All disclosed', which occurred in 29 requests (24.3%). In 23 instances, the request was abandoned by the requester, likely because the original request was not complete or sufficient authorization for disclosure was not obtained.
Disposition of requests | Completion Time | |||||||
---|---|---|---|---|---|---|---|---|
1 to 15 days | 16 to 30 days | 31 to 60 days | De 61 to 120 days | De 121 to 180 days | De 181 to 365 days | More than 365 days | Total | |
All disclosed | 11 | 9 | 6 | 3 | 0 | 0 | 0 | 29 |
Disclosed in part | 2 | 14 | 20 | 4 | 1 | 0 | 0 | 41 |
All exempted | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
All excluded | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
No records exist | 1 | 17 | 6 | 1 | 1 | 0 | 0 | 26 |
Request abandoned | 16 | 6 | 0 | 1 | 0 | 0 | 0 | 23 |
Neither confirmed nor denied | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Total | 30 | 46 | 32 | 9 | 2 | 0 | 0 | 119 |
Long Text Description
This table defines the dispositions of the requests and the completion time for the completed requests in the course of the past fiscal year.
Thirty (30) requests were closed within fifteen (15) days of receipt, i.e. eleven (11) were disclosed in full, two (2) were disclosed in part, one (1) had no responsive records and sixteen (16) were abandoned by the requesters.
Forty-six (46) requests were closed within a period of 16 to 60 days of receipt, i.e. nine (9) were disclosed in full, fourteen (14) requests were disclosed in part, seventeen (17) requests had no responsive records and six (6) were abandoned by the requesters.
Thirty-two (32) requests were closed within a period of 31 to 60 days of receipt, i.e. six (6) were disclosed in full, twenty (20) were disclosed in part, six (6) had no responsive records.
Nine (9) requests were closed within a period of 61 to 120 days of receipt, i.e. three (3) were disclosed in full, four (4) were disclosed in part, one (1) had no responsive records and one (1) was abandoned by the requester.
Two (2) requests were closed within a period of 121 to 180 days of receipt, one (1) was disclosed in part and the other had no responsive records.
Within a hundred-nineteen (119) disclosures; twenty-nine (29) were disclosed in full, forty-one (41) were disclosed in part, twenty-six (26) had no responsive records, twenty-three (23) were abandoned by the requesters.
2.2 Exemptions
As seen in previous years, section 26 (information about another identifiable individual) was the most commonly utilized exemption (38 times) invoked during the reporting period. The only other exemption applied in 2018-2019 was under subsections 22(1)(b) (law enforcement and investigation), which was invoked one time. (Table 2.2)
Section | Number of requests |
---|---|
18(2) | 0 |
19(1)(a) | 0 |
19(1)(b) | 0 |
19(1)(c) | 0 |
19(1)(d) | 0 |
19(1)(e) | 0 |
19(1)(f) | 0 |
20 | 0 |
21 | 0 |
22(1)(a)(i) | 0 |
22(1)(a)(ii) | 0 |
22(1)(a)(iii) | 0 |
22(1)(b) | 1 |
22(1)(c) | 0 |
22(2) | 0 |
22.1 | 0 |
22.2 | 0 |
22.3 | 0 |
23(a) | 0 |
23(b) | 0 |
24(a) | 0 |
24(b) | 0 |
25 | 0 |
26 | 38 |
27 | 0 |
28 | 0 |
Total | 39 |
Long Text Description
This table defines the number of requests closed where an exemption was invoked. Section 26 was applied in thirty-eight (38) requests and paragraph 22(1)(b) was applied once. Thirty-nine (39) requests were closed where an exemption was invoked.
2.3 Exclusions
No exclusion provisions were applied to requests that were closed in fiscal year 2018-2019.
2.4 Format of information released
Over the course of this reporting period, requesters received more of their response packages via paper format. CIRNAC conveyed response packages in electronic format (CD or email) for 24 requests (34.3%), and paper format for 46 requests (65.7%).
Disposition | Paper | Electronic | Other formmats |
---|---|---|---|
All disclosed | 24 | 5 | 0 |
Disclosed in part | 22 | 19 | 0 |
Total | 46 | 24 | 0 |
Long Text Description
This table represents the format of disposition used by the ATIP Office in the course of the last fiscal year.
A total of forty-six (46) requests, twenty-four (24) were all disclosed and twenty-two (22) were disclosed in part, were sent in a paper format to the requesters.
A total of twenty-four (24) requests, five (5) were all disclosed and nineteen (19) were disclosed in part, were sent in an electronic format to the requesters.
No other formats were used in the course of the past fiscal year.
2.5 Complexity
The following sections detail several factors affecting the complexity of requests that were completed throughout 2018-2019.
2.5.1 Relevant pages processed and disclosed
During the reporting period, the ATIP Directorate closed 119 requests; for 26 of these, no records existed. Of the remaining 93 requests, 23 were abandoned, leaving 70 treatable requests. These requests resulted in the review of 10,625 pages of records under the control of the Department. A total of 8,076 pages were disclosed in 2018-2019. (Table 2.5.1)
Disposition of requests | Number of pages processed |
Number of pages disclosed |
Number of requests |
---|---|---|---|
All disclosed | 788 | 704 | 29 |
Disclosed in part | 9,768 | 7,359 | 41 |
All exempted | 0 | 0 | 0 |
All excluded | 0 | 0 | 0 |
Request abandoned | 69 | 13 | 23 |
Neither confirmed nor denied | 0 | 0 | 0 |
Total | 10,625 | 8,076 | 93 |
Long Text Description
This table illustrates the number of pages processed and disclosed per disposition of requests. A total of ten-thousand-six-hundred-twenty-five (10,625) pages were processed and eight-thousand-seventy-six (8,076) pages were disclosed in a total of ninety-three (93) requests.
Among the processed pages seven-hundred-eighty-eight (788) pages were fully disclosed, nine-thousand-seven-hundred-sixty-eight (9,768) pages were disclosed in part and sixty-nine (69) were processed in abandoned requests.
In addition, seven-hundred-four (704) pages were disclosed in full, seven-thousand-three-hundred-fifty-nine (7,359) pages were received and disclosed in part while thirteen pages were received and disclosed in abandoned requests.
However, no pages were processed nor disclosed for the request that were all exempted, all excluded or were the existence of records could be confirmed or not.
2.5.2 Relevant pages processed and disclosed by size of requests
Over 90% of completed requests required 100 pages of processing or less. The five (5) requests that required treatment of between 101-500 pages of records resulted in the disclosure of 1,258 pages. CIRNAC treated three (3) large (1001 to more than 5000 pages) requests of 6,000 pages in 2018-2019. With a total of 93 requests, 8,076 pages were disclosed over the course of 2018-2019. (Table 2.5.2).
Disposition | Less than 100 pages processed | 101-500 pages processed |
501-1000 pages processed |
1001-5000 pages processed |
More than 5000 pages processed | |||||
---|---|---|---|---|---|---|---|---|---|---|
Requests | Pages disclosed | Requests | Pages disclosed | Requests | Pages disclosed | Requests | Pages disclosed | Requests | Pages disclosed | |
All disclosed | 28 | 217 | 1 | 487 | 0 | 0 | 0 | 0 | 0 | 0 |
Disclosed in part | 34 | 588 | 4 | 771 | 0 | 0 | 3 | 6000 | 0 | 0 |
All exempted | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
All excluded | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Abandoned | 23 | 13 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Neither confirmed nor denied | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Total | 85 | 818 | 5 | 1258 | 0 | 0 | 3 | 6000 | 0 | 0 |
Long Text Description
This table illustrates the number of relevant pages processed and disclosed per size of the requests.
Requests where less than one hundred (100) relevant pages processed are compiled as follow: twenty-eight (28) requests were completed counting a total of two-hundred-seventeen (217) relevant pages disclosed in full, thirty-four (34) requests were completed counting a total of five-hundred-eighty-eight (588) relevant pages disclosed in part and twenty-three (23) requests abandoned by the requesters had thirteen (13). Eighty-five (85) requests and eight-hundred-eighteen (818) relevant pages were processed within this category.
Requests where the number of relevant pages processed is between one-hundred-and-one (101) and five-hundred (500) are compiled as follow; one (1) request was completed counting four-hundred-eighty-seven (487) relevant pages disclosed in full and four (4) requests were completed counting seven-hundred-seventy-one (771) relevant pages disclosed in part. Five (5) requests and one-thousand-two-hundred-fifty-eight (1258) relevant pages were processed within this category.
Three requests with a total six-thousand (6,000) of relevant pages disclosed in part are part of the category of pages processed between one-thousand-one (1001) and five-thousand (5000).
2.5.3 Other complexities
The ATIP Directorate required only one external consultation with the Department of Justice resulting in the full disclosure of information.
Disposition | Consultation required | Legal Advice Sought | Interwoven Information | Other | Total |
---|---|---|---|---|---|
All disclosed | 0 | 1 | 0 | 0 | 1 |
Disclosed in part | 0 | 0 | 0 | 0 | 0 |
All exempted | 0 | 0 | 0 | 0 | 0 |
All excluded | 0 | 0 | 0 | 0 | 0 |
Abandoned | 0 | 0 | 0 | 0 | 0 |
Neither confirmed nor denied | 0 | 0 | 0 | 0 | 0 |
Total | 0 | 1 | 0 | 0 | 1 |
Long Text Description
The above table illustrates the number of requests where other complexity may have been part of the processing of the requests, the complexities may be for reasons as required consultations, legal advice and interwoven information/other were found within the processed files. For the past fiscal year, the ATIP office counted 1 request where legal advice was sought.
2.6 Deemed refusals
The following sections detail the number of, and reasons for which, requests were deemed in refusal throughout 2018-2019.
2.6.1 Reason for not meeting statutory deadline
During the reporting period, CIRNAC did not meet the statutory deadline in nine (9) instances with excessive workload being the reason on eight (8) of those requests (Table 2.6.1).
Number of Requests Closed Past the Statutory Deadline | Principal Reason | |||
---|---|---|---|---|
Workload | ExternalConsultation | Internal Consultation | Other | |
9 | 8 | 0 | 0 | 1 |
Long Text Description
The above table illustrates the number of requests that where closed past the statutory deadline. Nine (9) requests were found to meet this criterion. Eight (8) of them were late due to the ATIP Office workload and one (1) was late due to other factors.
2.6.2 Number of days past deadline
Of the nine (9) requests that were completed past the statutory deadline, six (6) were completed within 1 to 15 days. (Table 2.6.2)
Number of Days Past Deadline | Number of Requests Past Deadline Where No Extension Was Taken | Number of Requests Past Deadline Where An Extension Was Taken | Total |
---|---|---|---|
1 to 15 days | 4 | 2 | 6 |
16 to 30 dayss | 0 | 1 | 1 |
31 to 60 days | 0 | 0 | 0 |
61 to 120 days | 0 | 2 | 2 |
121 to 180 days | 0 | 0 | 0 |
181 to 365 days | 0 | 0 | 0 |
More tha 365 days | 0 | 0 | 0 |
Total | 4 | 5 | 9 |
Long Text Description
CIRNAC identifies the number of requests closed past their deadline. In the case where no extensions were taken; four (4) requests met the criteria and were closed within fifteen (15) days past their due date. This makes a total of four (4) requests that had no extensions and passed their statutory deadline.
In addition, the above table identifies the number of requests closed past their deadline and where an extension was documented on the file. Two (2) were closed within fifteen (15) days, one (1) was closed between sixteen (16) and thirty (30) days and two (2) more between sixty-one (61) and one-hundred-twenty (120) days. This makes a total of five (5) requests that had an extensions recorded on file and still passed their statutory deadline.
2.7 Requests for translation
During the reporting period, there were no instances where requesters asked that responsive records be translated to another official language.
Part 3. Disclosure under subsections 8(2) and 8(5) of the Privacy Act
Permissible disclosure pursuant to subsection 8(2) of the PA describes the circumstances under which personal information under the control of government institutions may be disclosed without the consent of the individual to whom the information pertains. In 2018-2019, CIRNAC made 57 permissible disclosures under 8(2)(e), 8(2)(m) and 8(5). The Treasury Board of Canada requires these three permissible disclosures to be captured in the statistical report. CIRNAC ATIP, like other institutions, has processed another 706 requests under section 8(2) for a total of 763 permissible disclosures in 2018-2019.
8(2)(e) disclosures – 55 disclosures were made under paragraph 8(2)(e) pursuant to request made by investigative bodies as found in the schedule II and III of the Privacy Act.
8(2)(m) disclosures - For the purpose of public interest. CIRNAC made one (1) disclosure under paragraph 8(2)(m) .
8(5) disclosures - Requires institutions to report 8(2)(m) to the Office of the Privacy Commissioner. The one (1) 8(2)(m) disclosure noted above was reported to the Privacy Commissioner.
Other permissible disclosures not captured by the statistical report include:
8(2)(c) disclosures – CIRNAC has made one (1) disclosure to comply with a subpoena or warrant.
8(2)(d) disclosures – CIRNAC has made 81 disclosures to the Attorney General of Canada pursuant to legal proceedings.
8(2)(f) disclosures – Under an agreement or arrangement between the Government of Canada and provincial governments for the purpose of administering or enforcing any law or carrying out lawful investigations. CIRNAC made 543 disclosures of personal information.
8(2)(j) disclosures - CIRNAC made four (4) disclosures to research body for statistical purposes.
8(2)(k) disclosures - Permits the disclosure of personal information to researchers involved in the process of settling native claims. CIRNAC made 77 disclosures to researchers for native claims research.
Part 4. Requests for correction of personal information and notations
During the reporting period, there were no requests for correction of personal information or notations.
Part 5. Extensions
5.1 Reasons for extensions and disposition of requests
During 2018-2019, 30 extensions were taken under subsection 15(a) of the Privacy Act. All 30 extensions were taken under subsection 15(a)(i) (interference with operation) . Seven (7) requests were disclosed in their entirety whereas 20 requests were disclosed in part. (Table 5.1)
Disposition of requests where an extension was taken | 15(a)(i) Interference with Operations | 15(a)(ii) Consultation | 15(b) Translation or conversion | |
---|---|---|---|---|
Section 70 | Other | |||
All disclosed | 7 | 0 | 0 | 0 |
Disclosed in part | 20 | 0 | 0 | 0 |
All exempted | 0 | 0 | 0 | 0 |
All excluded | 0 | 0 | 0 | 0 |
No records exist | 3 | 0 | 0 | 0 |
Request abandoned | 0 | 0 | 0 | 0 |
Total | 30 | 0 | 0 | 0 |
Long Text Description
There are three (3) reasons for possible extension that may be taken as per the Act: Interference with Operations, Consultations and Translation or conversion. The ATIP Office identified thirty (30) requests having an extension explained by the inference of operations in order to complete the requests. Among the thirty (30), seven (7) requests were fully disclosed to the requesters, twenty (20) were disclosed in part and three (3) had no responsive documents to the requests.
5.2 Length of extensions
28 (93%) of the extensions applied during the reporting period were between 16 to 30 days in length. (Table 5.2)
Length of extension | 15(a)(i) Interference with Operations | 15(a)(ii) Consultation | 15(b) Translation purposes | |
---|---|---|---|---|
Section 70 | Other | |||
1 to 15 days | 2 | 0 | 0 | 0 |
16 to 30 days | 28 | 0 | 0 | 0 |
Total | 30 | 0 | 0 | 0 |
Long Text Description
Two (2) requests with extensions were completed within fifteen (15) days after their legislative date and the other twenty-eight (28) were completed between sixteen (16) and thirty (30) days of their legislative date.
Part 6. Consultations received from other Institutions and Organizations
CIRNAC did not receive any consultation from another Government of Canada institution during 2018-2019.
Part 7. Completion time of consultations on Cabinet confidences
During the reporting period, no consultations on the application of section 70 of the PA were sent to Departmental Legal Services Unit for consultation on potential Cabinet confidences.
Part 8. Complaints and Investigations Notices Received
During the 2018-2019 reporting period, there was one (1) complaint received from the Office of the Privacy Commissioner. The Treasury Board of Canada requires institutions to also track in the statistical report section 31, 33 and 35 of the Privacy Act. These sections are not cumulative.
Section 31 | Section 33 | Section 35 | Court action | Total |
---|---|---|---|---|
1 | 0 | 0 | 0 | 1 |
Long Text Description
The ATIP Office received one (1) complaint from the Office of the Privacy Commissioner (OPC)
Part 9. Privacy Impact Assessments
Privacy Impact Assessments (Appendix A of the TBS Statistical Report)
A PIA is a risk evaluation of the flow of personal information held within a program or service. This process enables the Department to determine whether new or substantially modified technologies, information systems, initiatives, and proposed programs or policies meet federal government privacy requirements.
There were no PIAs completed during the 2018-2019 reporting period.
Privacy Act Statements
The ATIP Directorate assists and reviews all CIRNAC programs in the development of appropriate Privacy Notice Statements to be included in any form(s) and/or shared during a consultation engagement process which collects personal information. Privacy Statements inform individuals what is done with their personal information. In 2018-2019, the ATIP Directorate responded to numerous requests for Privacy Statements.
The ATIP Directorate will continue to work with all CIRNAC program areas in the upcoming fiscal years to update Privacy Notice Statements for all hard copy and online DCIs, forms and/or consultation processes.
Privacy Policy Questions
The ATIP Directorate also fields questions regarding privacy protocols, policies/directives, issues and other inquiries related to the collection, use, retention and disposal, and/or sharing of personal information. During the reporting period, the ATIP Directorate responded to numerous questions from departmental clients for all CIRNAC-related privacy matters.
Privacy Breaches
The ATIP Directorate provides support to CIRNAC officials in addressing and containing potential privacy breaches. CIRNAC reported six privacy breaches during this fiscal year that affected individuals. The majority of breaches was of low sensitivity and caused by human error. One (1) breach was considered a Material Privacy Breach and was reported to the Office of Privacy Commissioner.
Part 10. Resources related to the Privacy Act
10.1 Costs
The ATIP Directorate functioned under a shared services model to support CIRNAC and ISC. It spent a total of $1,603,740 on staffing, goods and services and was supported by 23 human resources.
Calculations for the annual reports reflect the level of effort in support CIRNAC's responsibilities pursuant to the Acts.
In 2018-2019, CIRNAC spent $159,786 on the administration of the PA and was supported by 2.30 Human Resources.
Expenditures | Amount |
---|---|
Salaires | $139 936 |
Overtime | $392 |
Goods and Services | $19 458 |
Professional services contracts | $2 238 |
Other | $17 220 |
Total | $159 786 |
Long Text Description
The ATIP Directorate spent a total of $159,786 divided as follows: $139,936 on salaries, $392 on overtime and $19,458 on goods and services. Goods and services is divided into two (2) categories, professional services contracts with a total of $2,238 spent and $17,220 were spent in the other category.
10.2 Human Resources
The Privacy Operations unit within the ATIP Directorate consisted of 2.30 full-time equivalents (FTEs) (Table 10.2). Over the course of the reporting period, CIRNAC hired 0.10 students or consultants.
Resources | Person Years Dedicated to Access to Information Activities |
---|---|
Full-time employees | 2.20 |
Part-time and casual employees | 0.00 |
Regional staff | 0.00 |
Consultants and agency personnel | 0.00 |
Students | 0.10 |
Total | 2.30 |
Long Text Description
In regards to human resources, the ATIP Directorate consisted of 2.3 full-time equivalents (FTEs). Which included the hiring of 0.10 students and 0.01 part-time or casual employees.
Highlights
V. 2018-2019 Points of Interest
This past fiscal year (2018-2019) was the first full year of reporting for CIRNAC under the ATIA and the PA.
CIRNAC continued to meet its obligations under the Acts by ensuring a compliance rate of 79% under the ATIA and 85% under the PA.
115 new PA requests were received and 119 closed (10 requests were carried over from the previous year). A total of 10,625 pages processed under the PA.
The most applied exemption under PA was section 26, representing personal information.
Complaints from the Office of the Privacy Commissioner fell to 1 in 2018-2019, whereas 15 complaints were received the previous fiscal year.
763 proactive disclosure requests were processed under section 8(2) of the Privacy Act which allows for the release of personal information without consent.
It should be noted that of the 763, 77 were disclosed under section 8(2)(k) identified in the Act for the purposes of researching or validating the claims, disputes or grievances of any of the aboriginal peoples of Canada.
ATIP has administered the Acts in a shared services environment for both CIRNAC and ISC since November 30, 2017.
Overall, for both departments in 2018-2019, there was an increase of 41% in new ATIA requests and an increase of 13% in PA requests.
A total of 15,066 pages processed under PA compared to the 6,565 pages processed in 2017-2018.
ATIP also trained a total of 870 employees (562 ISC/308 CIRNAC) on the ATIA and PA in 2018-2019.
The ATIP Directorate as a whole spent $1,603,740 on staffing, goods and services and was supported by 23 human resources.
CIRNAC ATIP spent $801,870 on staffing and goods and services and was supported by 11.5 Human Resources. The amount was separated 80% for the Access to Information report and 20% for the Privacy report.
Appendix A
Order of Delegation of the Privacy Act dated March 14, 2016
Privacy Act - Delegation Order
Pursuant to the powers of designation conferred upon me by Section 73 of the Privacy Act, the persons exercising the functions or positions Deputy Minister (position number 00000001), Associate Deputy Minister (position number 00000006), Corporate Secretary (position number 00012294), and the departmental Access to Information Privacy Coordinator/Director (position number 20003872), and their respective successors, including in their absence, a person or officer designated in writing to act in the place of the holder of any such functions or positions are hereby designated to exercise those powers, duties or functions of the Minister as the Head of the government institution under the Act, and as set out in the attached Schedule A.
The departmental Access to Information and Privacy Deputy Director (position number 20007504) and Team Leaders (position number 00012590 and 00012061) including in her/his absence, a person or officer designated in writing as being authorized to act in the place of the holder of any such function or position, are hereby designated to exercise those powers, duties or functions of the Minister as the Head of the government institution under the Act, and as set out in the attached Schedule B.
Original document signed on March 14, 2011
The Honourable Carolyn Bennett
Minister of Indian Affairs and Northern Development
Schedule A
Department Of Indian Affairs And Northern Development
Schedule To Delegation Order
Designation Pursuant To Section 73 Of
The Privacy Act
Sections and Powers, Duties or Functions
8(2) Disclose personal information without the consent of the individual to whom it relates
8(4) Keep copies of requests made under 8(2)(e), keep records of information disclosed pursuant to such requests and to make those records available to Privacy Commissioner
8(5) Notify the Privacy Commissioner in writing of disclosure under paragraph 8(2)(m)
9(1) Retain a record of use of personal information
9(4) Notify the Privacy Commissioner of consistent use of personal information and update index accordingly
10 Include personal information in personal information banks
11(a) Publish annually an index of all personal information banks and their respective contents
11(b) Publish annually an index of all personal information held by the institution which is not part of a bank
14 Respond to request for access, within statutory deadline; give access or give notice
15 Extend time limit and notify applicant
16 Where access is refused
17(2)(b) Language of access or alternative format of access
17(3)(b) Access to personal information in alternative format
18(2) May refuse to disclose information contained in an exempt bank
19(1) Shall refuse to disclose information obtained in confidence from another government
19(2) May disclose any information referred to in 19(1) if the other government consents to the disclosure or makes the information pubic
20 May refuse to disclose information injurious to federal-provincial affairs
21 May refuse to disclose information injurious to international affairs and/or defence
22 May refuse to disclose information injurious to law enforcement and investigation
23 May refuse to disclose information injurious to security clearances
24 May refuse to disclose information collected by the Canadian Penitentiary Service, the National Parole Service or the National Parole Board
25 May refuse to disclose information injurious to which could threaten the safety of individuals
26 May refuse to disclose information about other individuals, and shall refuse to disclose such information where disclosure is prohibited under section 8
27 May refuse to disclose information subject to solicitor-client privilege
28 May refuse to disclose information relating to an individual's physical or mental health where disclosure is contrary to the best interests of the individual
31 Receive notice of investigation by the Privacy Commissioner
33(2) Make representations to the Privacy Commissioner during an investigation
35(1) Receive the Privacy Commissioner's report of findings of the investigation and give notice of action taken
35(4) Give complainant access to information after 35(1)(b) notice
36(3) Receive Privacy Commissioner's report of findings of investigation of exempt
37(3) Receive report of Privacy Commissioner's findings after compliance investigation where the institution has not complied with sections 4 to 8
51(2)(b) Request that matter be heard and determined in National Capital Region
51(3) Request and be given right to make representations in section 51 hearing
72(1) Prepare Annual Report to Parliament
77 Carry out responsibilities conferred on the Head of the institution by the regulations made under section 77 which are not included above
Schedule B
Department Of Indian Affairs And Northern Development
Schedule To Delegation Order
Designation Pursuant To Section 73 Of The Privacy Act
Sections and Powers, Duties or Functions
10 Include personal information in personal information banks
11(a) Publish annually an index of all personal information banks and their respective
contents
11(b) Publish annually an index of all personal information held by the institution
which is not part of a bank
15 Extend time limit and notify applicant
31 Receive notice of investigation by the Privacy Commissioner
Appendix B
Statistical Report on the Privacy Act
Name of institution: Crown-Indigenous Relations and Northern Affairs Canada
Reporting period: 2018-04-01 to 2019-03-31
Part 1: Requests Under the Privacy Act
Number of Requests | |
---|---|
Received during reporting period | 115 |
Outstanding from previous reporting period | 14 |
Total | 129 |
Closed during reporting period | 119 |
Carried over to next reporting period | 10 |
Part 2: Requests Closed During the Reporting Period
2.1 Disposition and completion time
Disposition of Requests | Completion Time | |||||||
---|---|---|---|---|---|---|---|---|
1 to 15 Days | 16 to 30 Days | 31 to 60 Days | 61 to 120 Days | 121 to 180 Days | 181 to 365 Days | More Than 365 Days | Total | |
All disclosed | 11 | 9 | 6 | 3 | 0 | 0 | 0 | 29 |
Disclosed in part | 2 | 14 | 20 | 4 | 1 | 0 | 0 | 41 |
All exempted | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
All excluded | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
No records exist | 1 | 17 | 6 | 1 | 1 | 0 | 0 | 26 |
Request abandoned | 16 | 6 | 0 | 1 | 0 | 0 | 0 | 23 |
Neither confirmed nor denied | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Total | 30 | 46 | 32 | 9 | 2 | 0 | 0 | 119 |
2.2 Exceptions
Section | Number of Requests |
---|---|
18(2) | 0 |
19(1)(a) | 0 |
19(1)(b) | 0 |
19(1)(c) | 0 |
19(1)(d) | 0 |
19(1)(e) | 0 |
19(1)(f) | 0 |
20 | 0 |
21 | 0 |
22(1)(a)(i) | 0 |
22(1)(a)(ii) | 0 |
22(1)(a)(iii) | 0 |
22(1)(b) | 0 |
22(1)(c) | 0 |
22(2) | 0 |
22.1 | 0 |
22.2 | 0 |
22.3 | 0 |
23(a) | 0 |
23(b) | 0 |
24(a) | 0 |
24(b) | 0 |
25 | 0 |
26 | 38 |
27 | 0 |
28 | 0 |
2.3 Exclusions
Section | Number of Requests |
---|---|
69(1)(a) | 0 |
69(1)(b) | 0 |
69.1 | 0 |
70(1) | 0 |
70(1)(a) | 0 |
70(1)(b) | 0 |
70(1)(c) | 0 |
70(1)(d) | 0 |
70(1)(e) | 0 |
70(1)(f) | 0 |
70.1 | 0 |
2.4 Format of information released
Disposition | Paper | Electronic | Other formats |
---|---|---|---|
All disclosed | 24 | 5 | 0 |
Disclosed in part | 22 | 19 | 0 |
Total | 46 | 24 | 0 |
2.5 Complexity
2.5.1 Relevant pages processed and disclosed
Disposition of Requests | Number of Pages Processed |
Number of Pages Disclosed |
Number of Requests |
---|---|---|---|
All disclosed | 788 | 704 | 29 |
Disclosed in part | 9768 | 7359 | 41 |
All exempted | 0 | 0 | 0 |
All excluded | 0 | 0 | 0 |
Request abandoned | 69 | 13 | 23 |
Neither confirmed nor denied | 0 | 0 | 0 |
Total | 10625 | 8076 | 93 |
2.5.2 Relevant pages processed and disclosed by size of requests
Disposition | Less Than 100 Pages Processed | 101-500 Pages Processed |
501-1000 Pages Processed |
1001-5000 Pages Processed |
More Than 5000 Pages Processed |
|||||
---|---|---|---|---|---|---|---|---|---|---|
Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | |
All disclosed | 28 | 217 | 1 | 487 | 0 | 0 | 0 | 0 | 0 | 0 |
Disclosed in part | 34 | 588 | 4 | 771 | 0 | 0 | 3 | 6000 | 0 | 0 |
All exempted | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
All excluded | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Request abandoned | 23 | 13 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Neither confirmed nor denied | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Total | 85 | 818 | 5 | 1258 | 0 | 0 | 3 | 6000 | 0 | 0 |
2.5.3 Other complexities
Disposition | Consultation Required | Legal Advice Sought | Interwoven Information | Other | Total |
---|---|---|---|---|---|
All disclosed | 0 | 1 | 0 | 0 | 1 |
Disclosed in part | 0 | 0 | 0 | 0 | 0 |
All exempted | 0 | 0 | 0 | 0 | 0 |
All excluded | 0 | 0 | 0 | 0 | 0 |
Request abandoned | 0 | 0 | 0 | 0 | 0 |
Neither confirmed nor denied | 0 | 0 | 0 | 0 | 0 |
Total | 0 | 1 | 0 | 0 | 1 |
2.6 Deemed refusals
2.6.1 Reasons for not meeting statutory deadline
Number of Requests Closed Past the Statutory Deadline | Principal Reason | |||
---|---|---|---|---|
Workload | External Consultation | Internal Consultation | Other | |
9 | 8 | 0 | 0 | 1 |
2.6.2 Number of Days Past Deadline
Number of Days Past Deadline | Number of Requests Past Deadline Where No Extension Was Taken | Number of Requests Past Deadline Where An Extension Was Taken | Total |
---|---|---|---|
1 to 15 Days | 4 | 2 | 6 |
16 to 30 Days | 0 | 1 | 1 |
31 to 60 Days | 0 | 0 | 0 |
61 to 120 Days | 0 | 2 | 2 |
121 to 180 Days | 0 | 0 | 0 |
181 to 365 Days | 0 | 0 | 0 |
More Than 365 Days | 0 | 0 | 0 |
Total | 4 | 5 | 9 |
2.7 Requests for translation
Translation Requests | Acceptées | Refusées | Total |
---|---|---|---|
English to French | 0 | 0 | 0 |
French to English | 0 | 0 | 0 |
Total | 0 | 0 | 0 |
Part 3: Disclosures Under Subsections 8(2) and 8(5)
Paragraph 8(2)(e) | Paragraph 8(2)(m) | Paragraph 8(5) | Total |
---|---|---|---|
55 | 1 | 1 | 57 |
Part 4: Requests for Correction of Personal Information and Notations
Disposition for Correction Requests Received | Number |
---|---|
Notations attached | 0 |
Requests for correction accepted | 0 |
Total | 0 |
Part 5: Extensions
5.1 Reasons for extensions and disposition of requests
Disposition of Requests Where an Extension Was Taken | 15(a)(i) Interference With Operations | 15(a)(ii) Consultation | 15(b) Translation or Conversion | |
---|---|---|---|---|
Section 70 | Other | |||
All disclosed | 7 | 0 | 0 | 0 |
Disclosed in part | 20 | 0 | 0 | 0 |
All exempted | 0 | 0 | 0 | 0 |
All excluded | 0 | 0 | 0 | 0 |
No records exist | 3 | 0 | 0 | 0 |
Request abandoned | 0 | 0 | 0 | 0 |
Total | 30 | 0 | 0 | 0 |
5.2 Length of extensions
Length of Extensions | 15(a)(i) Interference with operations | 15(a)(ii) Consultation | 15(b) Translation purposes | |
---|---|---|---|---|
Section 70 | Others | |||
1 to 15 days | 2 | 0 | 0 | 0 |
16 to 30 days | 28 | 0 | 0 | 0 |
Total | 30 | 0 | 0 | 0 |
Part 6: Consultations Received From Other Institutions and Organizations
6.1 Consultations received from other Government of Canada institutions and other organizations
Consultations | Other Government of Canada Institutions | Number of Pages to Review | Other Organizations | Number of Pages to Review |
---|---|---|---|---|
Received during the reporting period | 0 | 0 | 0 | 0 |
Outstanding from the previous reporting period | 0 | 0 | 0 | 0 |
Total | 0 | 0 | 0 | 0 |
Closed during the reporting period | 0 | 0 | 0 | 0 |
Pending at the end of the reporting period | 0 | 0 | 0 | 0 |
6.2 Recommendations and completion time for consultations received from other Government of Canada institutions
Recommendation | Number of days Required to Complete Consultation Requests | |||||||
---|---|---|---|---|---|---|---|---|
1 to 15 Days | 16 to 30 Days | 31 to 60 Days | 61 to 120 Days | 121 to 180 Days | 181 to 365 Days | More Than 365 Days | Total | |
All disclosed | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 17 |
Disclosed in part | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
All exempted | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
All excluded | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Consult other institution | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Other | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Total | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
6.3 Recommendations and completion time for consultations received from other organizations
Recommendation | Number of days Required to Complete Consultation Requests | |||||||
---|---|---|---|---|---|---|---|---|
1 to 15 Days | 16 to 30 Days | 31 to 60 Days | 61 to 120 Days | 121 to 180 Days | 181 to 365 Days | More Than 365 Days | Total | |
All disclosed | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Disclosed in part | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
All exempted | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
All excluded | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Consult other institution | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Other | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Total | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Part 7: Completion Time of Consultations on Cabinet Confidences
7.1 Requests with Legal Services
Number of Days | Fewer Than 100 Pages Processed | 101-500 Pages Processed |
501-1000 Pages Processed |
1001-5000 Pages Processed |
More than 5000 Pages Processed |
|||||
---|---|---|---|---|---|---|---|---|---|---|
Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | |
1 to 15 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
16 to 30 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
31 to 60 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
61 to 120 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
121 to 180 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
181 to 365 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
More than 365 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Total | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
7.2 Requests with Privy Council Office
Number of Days | Fewer Than 100 Pages Processed |
101-500 Pages Processed |
501-1000 Pages Processed |
1001-5000 Pages Processed |
More than 5000 Pages Processed |
|||||
---|---|---|---|---|---|---|---|---|---|---|
Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | |
1 to 15 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
16 to 30 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
31 to 60 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
61 to 120 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
121 to 180 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
181 to 365 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
More than 365 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Total | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Part 8: Complaints and Investigations Notices Received
Section 31 | Section 33 | Section 35 | Court action | Total |
---|---|---|---|---|
1 | 0 | 0 | 0 | 1 |
Part 9: Privacy Impact Assessments (PIAs)
Number of PIA(s) completed | 0 |
---|
Part 10: Resources Related to the Privacy Act
10.1 Costs
Expenditures | Amount |
---|---|
Salaires | $139,936 |
Overtime | $392 |
Goods and Services | $19,458 |
Professional services contracts | $2,238 |
Other | $17,220 |
Total | $159,786 |
10.2 Human Resources
Resources | Person Years Dedicated to Privacy Activities |
---|---|
Full-time employees | 2.20 |
Part-time and causal employees | 0.00 |
Regional staff | 0.00 |
Consultants and agency personnel | 0.00 |
Students | 0.10 |
Total | 2.30 |
Note: Enter values to two decimal places. |