Annual report to Parliament 2018-2019: Privacy Act

Table of contents

Introduction

I. Introduction

The purpose of the Privacy Act (PA) is to protect the personal information of individuals under the responsibility and control of federal institutions, and to provide individuals with a right of access to that information.

This report reflects privacy activities of Crown-Indigenous Relations and Northern Affairs Canada (CIRNAC) from April 1, 2018 to March 31, 2019.

This report, submitted to Parliament pursuant to section 72 of the PA, describes the activities of CIRNAC that support compliance with privacy legislation. The report details the activities and accomplishments of CIRNAC's Access to Information and Privacy (ATIP) Directorate, including highlights such as:

  • The creation of a Privacy/Policy team; and
  • Increased training initiatives to improve departmental ATIP capacity and awareness.

Creation of Two New Departments

In August 2017, the Prime Minister announced the dissolution of Indigenous and Northern Affairs Canada and the establishment of two new departments to better meet the needs and aspirations of First Nations, Inuit and Métis Peoples. At that time, he named two Ministers to lead these new departments: a Minister of Crown-Indigenous Relations and Northern Affairs and a Minister of Indigenous Services Canada.

The ATIP office provided shared services support for CIRNAC and Indigenous Services Canada (ISC) through a Memorandum of Understanding (MOU) between the departments.

Crown-Indigenous Relations and Northern Affairs Canada's Mandate

The Department of Crown-Indigenous Relations and Northern Affairs will accelerate the work that had already begun to renew the nation-to-nation, Inuit-Crown, and government-to-government relationship between Canada and Indigenous People. The Department will also modernize our institutional structure and governance so that First Nations, Inuit, and Métis Peoples can build capacity that supports implementation of their vision of self-determination. 

The new relationship must be based on the recognition of rights, respect, co-operation, and partnership. The Department will build on the progress that has been made already, including the establishment of rights and recognition tables across the country, the creation of bilateral mechanism with National Indigenous Organizations to make progress on shared priorities, and the progress made across government on the Truth and Reconciliation Commission Calls to Action.

CIRNAC is one of the two federal departments that are primarily responsible for meeting the Government of Canada's obligations and commitments to First Nations, Inuit and Métis, and for fulfilling the federal government's constitutional responsibilities in the North. CIRNAC's overall mandate and wide-ranging responsibilities are shaped by centuries of history and unique demographic and geographic challenges. The mandate is derived from the Constitution Act 1982, the Indian Act, the Department of Indian Affairs and Northern Development Act, territorial Acts, treaties, comprehensive claims and self-government agreements, as well as various other statutes affecting Indigenous Peoples and the North.

Most of the Department's programs, representing a majority of its spending, are delivered through partnerships with First Nation and Indigenous communities and federal-provincial or federal-territorial agreements. CIRNAC also works with urban Indigenous people, Métis and Non-Status Indians (many of whom live in rural areas).

II. Organization

ATIP Directorate at CIRNAC

The Access to Information and Privacy Directorate is responsible for the administration of requests made under the ATIA andthe PA. It was established within the Corporate Secretariat and reports to the Corporate Secretary, who is directly accountable to the Deputy Head and is a member of the CIRNAC Senior Management Team. The Directorate also coordinates and implements policies, guidelines and procedures to ensure departmental compliance with the ATIA and PA. Workshop presentations, training courses and awareness sessions designed to increase access to information and privacy capacity across the Department are also provided by the ATIP Directorate.

Under a shared service MOU, all ATIP analysts processed requests for both CIRNAC and ISC. They processed requests of varying volume and complexity based on their classification level. They also provide critical privacy advice for new initiatives, resulting in privacy protection in departmental programs. Policies and procedures continue to be established to ensure that privacy is considered throughout the life cycle of CIRNAC's programs and that informed policy decisions are made concerning the collection, sharing and/or use of personal information.

The ATIP Directorate provides advice and guidance to the Department on a number of topics:

  1. The application of the Access to Information Act (ATIA) and PA;
  2. The release of sensitive or protected information to the public;
  3. Departmental Privacy Impact Assessments (PIAs);
  4. Permissible disclosures of personal information pursuant to subsection 8(2) of the PA;
  5. Appropriate PA Statements on Data Collection Instruments (DCIs), i.e. forms, surveys, etc.;
  6. Updates to Info Source and the preparation and registration of Personal Information Banks (PIBs) and their related Classes of Records;
  7. Protocols surrounding privacy breaches;
  8. Education and awareness of access to information and privacy issues throughout the Department; and,
  9. Privacy advice in MOU.

The Intake Team triages and coordinates the receipt of requests for information under the control of the Department made pursuant to the Access to Information Act and the Privacy Act. The Operations Team ensures that a response is provided within the legislated timeframe (30 days). All requests are monitored using the tracking system Access Pro Case Management. To do so, ATIP analysts work closely with the relevant program areas in order to ensure that all responsive documents are provided and to ensure that the information contained within those documents is treated in accordance with the Acts to allow for government records to be safely disclosed to the Canadian public. The Privacy/Policy team is available to provide expert advice, maintain and monitor privacy risks as well as support ISC with the creation of privacy policy training.

In addition to the ATIP Directorate, each of the sectors and regional offices of CIRNAC are ATIP Liaison Officers (ALOs) who receive callouts from the ATIP Directorate and subsequently task the requests as appropriate to areas within their sector. ALOs plays a crucial role in ensuring requests are clear to the record retrievers and that the appropriate records, impact statements and approvals are obtained and communicated to ATIP Directorate officials within the designated time allowances.

Description of the Organizational Chart

Director's Office

The Director (EX-01), as institutional ATIP Coordinator, holds full delegated authority under the Act. The Director is supported in day-to-day administrative tasks by the Deputy Director Operations (PM-06), Deputy Director Privacy/Policy (PM-06) and an Administrative Assistant (AS-01) and in reporting and policy initiatives by the Reporting Analyst (PM-03).

Intake Team

The Intake Team is comprised of two Intake Officers (PM-01) and one Clerk (CR-04), who enter all applications into the electronic case management system, acknowledge receipt of requests, perform imaging services, interact with and respond to inquiries from the public, and are responsible for other administrative tasks.

Operations Team

The Operations Team is led by four Team Leaders (PM-05), who are responsible for the oversight of request processing by their team, including the review of completed requests. The Ops Team consists of Analysts PM-04, PM-03, and PM-02 level, who process Access and Privacy requests of varying volume and complexity, provide training and provide Access and Privacy advice.

Privacy/Policy Team

The Privacy/Policy Team is led by two Team Leaders (PM-05), who are responsible for the oversight of request processing by their team, including the review of privacy/policy requests. The Privacy/Policy Team consists of Analysts PM-04, and PM-02 level, who respond to Privacy matters (such as breaches), provide training and provide Privacy advice.

III. Delegation Order

Under section 73 of the PA, the Minister's authority may be delegated to departmental officials in order to administer the PA within CIRNAC.

During the reporting period, the delegation order signed by Minister Carolyn Bennett on March 14, 2016, was in effect
(Appendix A). Under section 73 of the Privacy Act, the order delegates full authority and responsibility for the PA to the following positions:

  • Deputy Minister
  • Associate Deputy Minister
  • Corporate Secretary
  • Departmental ATIP Coordinator

Statistics

IV. Interpretation of the Statistical Report

CIRNAC's Statistical Report was submitted to the Treasury Board Secretariat (TBS) on May 14, 2019 (Appendix B). The Report details various aspects of the requests CIRNAC received and processed during the period of April 1, 2018 to March 31, 2019. 

Part 1. Requests under the Privacy Act

In 2018-2019, CIRNAC received 115 new requests under the Privacy Act. Of the 129 requests (14 were carried over from previous reporting period), the ATIP Directorate completed 119 requests and carried 10 requests over into the 2019-2020 reporting period. (Table1.1)

Number of Requests from 2016 to 2019
Number of Requests 2016-2017 2017-2018 2018-2019
Received 178 165 115
Outstanding from last year 0 23 14
Total 178 188 129
Closed this year 155 174 119
Carried over to next year 23 14 10
Long Text Description

In this table we compare the number of requests received in the course of three fiscal years. In 2016-2017, the ATIP Office had received one-hundred-seventy-eight (178) new requests. In 2017-2018, one-hundred-sixty-five (165) new requests were received, and in 2018-2019, one-hundred-fifteen (115) new requests were received.

Twenty-three requests were carried over from 2016-2017 to 2017-2018 and fourteen (14) were carried over from 2017-2018 into 2018-2019. In addition, ten (10) requests were carried over from the past year into the current year.

The ATIP Office closed one-hundred-fifty-five requests in 2016-2017 compared to one-hundred seventy-four in 2017-2018 then the number of requests closed in 2018-2019 decreased to one-hundred-nineteen (119).

Part 2. Requests closed during the reporting period

2.1 Disposition and completion time

Of the 119 requests closed during the reporting period (Table 2.1), CIRNAC was able to fully or partially disclose records in 70 cases; that is, 58.8% of the time a request was submitted to CIRNAC, the result was a disclosure of relevant information. The majority of requests (76, or 63.8%) took 30 days or less to complete. In 2018-2019, two (2) requests took longer than 120 calendar days to be completed.

The most frequent outcome of the requests processed during the reporting period was 'Disclosed in part', which was the result for 41 requests (34.4%), and the category 'All disclosed', which occurred in 29 requests (24.3%). In 23 instances, the request was abandoned by the requester, likely because the original request was not complete or sufficient authorization for disclosure was not obtained.

Table 2.1 Disposition and completion time
Disposition of requests Completion Time
1 to 15 days 16 to 30 days 31 to 60 days De 61 to 120 days De 121 to 180 days De 181 to 365 days More than 365 days Total
All disclosed 11 9 6 3 0 0 0 29
Disclosed in part 2 14 20 4 1 0 0 41
All exempted 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0
No records exist 1 17 6 1 1 0 0 26
Request abandoned 16 6 0 1 0 0 0 23
Neither confirmed nor denied 0 0 0 0 0 0 0 0
Total 30 46 32 9 2 0 0 119
Long Text Description

This table defines the dispositions of the requests and the completion time for the completed requests in the course of the past fiscal year.

Thirty (30) requests were closed within fifteen (15) days of receipt, i.e. eleven (11) were disclosed in full, two (2) were disclosed in part, one (1) had no responsive records and sixteen (16) were abandoned by the requesters.

Forty-six (46) requests were closed within a period of 16 to 60 days of receipt, i.e. nine (9) were disclosed in full, fourteen (14) requests were disclosed in part, seventeen (17) requests had no responsive records and six (6) were abandoned by the requesters.

Thirty-two (32) requests were closed within a period of 31 to 60 days of receipt, i.e. six (6) were disclosed in full, twenty (20) were disclosed in part, six (6) had no responsive records.

Nine (9) requests were closed within a period of 61 to 120 days of receipt, i.e. three (3) were disclosed in full, four (4) were disclosed in part, one (1) had no responsive records and one (1) was abandoned by the requester.

Two (2) requests were closed within a period of 121 to 180 days of receipt, one (1) was disclosed in part and the other had no responsive records.

Within a hundred-nineteen (119) disclosures; twenty-nine (29) were disclosed in full, forty-one (41) were disclosed in part, twenty-six (26) had no responsive records, twenty-three (23) were abandoned by the requesters.

2.2 Exemptions

As seen in previous years, section 26 (information about another identifiable individual) was the most commonly utilized exemption (38 times) invoked during the reporting period. The only other exemption applied in 2018-2019 was under subsections 22(1)(b) (law enforcement and investigation), which was invoked one time. (Table 2.2)

Table 2.2 Number of requests closed where exemption provisions were invoked
Section Number of requests
18(2) 0
19(1)(a) 0
19(1)(b) 0
19(1)(c) 0
19(1)(d) 0
19(1)(e) 0
19(1)(f) 0
20 0
21 0
22(1)(a)(i) 0
22(1)(a)(ii) 0
22(1)(a)(iii) 0
22(1)(b) 1
22(1)(c) 0
22(2) 0
22.1 0
22.2 0
22.3 0
23(a) 0
23(b) 0
24(a) 0
24(b) 0
25 0
26 38
27 0
28 0
Total 39
Long Text Description

This table defines the number of requests closed where an exemption was invoked. Section 26 was applied in thirty-eight (38) requests and paragraph 22(1)(b) was applied once. Thirty-nine (39) requests were closed where an exemption was invoked.

2.3 Exclusions

No exclusion provisions were applied to requests that were closed in fiscal year 2018-2019.

2.4 Format of information released

Over the course of this reporting period, requesters received more of their response packages via paper format. CIRNAC conveyed response packages in electronic format (CD or email) for 24 requests (34.3%), and paper format for 46 requests (65.7%).

Table 2.4 Format of information released
Disposition Paper Electronic Other formmats
All disclosed 24 5 0
Disclosed in part 22 19 0
Total 46 24 0
Long Text Description

This table represents the format of disposition used by the ATIP Office in the course of the last fiscal year.

A total of forty-six (46) requests, twenty-four (24) were all disclosed and twenty-two (22) were disclosed in part, were sent in a paper format to the requesters.

A total of twenty-four (24) requests, five (5) were all disclosed and nineteen (19) were disclosed in part, were sent in an electronic format to the requesters.

No other formats were used in the course of the past fiscal year.

2.5 Complexity

The following sections detail several factors affecting the complexity of requests that were completed throughout 2018-2019.

2.5.1 Relevant pages processed and disclosed

During the reporting period, the ATIP Directorate closed 119 requests; for 26 of these, no records existed. Of the remaining 93 requests, 23 were abandoned, leaving 70 treatable requests. These requests resulted in the review of 10,625 pages of records under the control of the Department. A total of 8,076 pages were disclosed in 2018-2019. (Table 2.5.1)

Table 2.5.1 Relevant pages processed and disclosed.
Disposition of requests Number of pages
processed
Number of pages
disclosed
Number of requests
All disclosed 788 704 29
Disclosed in part 9,768 7,359 41
All exempted 0 0 0
All excluded 0 0 0
Request abandoned 69 13 23
Neither confirmed nor denied 0 0 0
Total 10,625 8,076 93
Long Text Description

This table illustrates the number of pages processed and disclosed per disposition of requests. A total of ten-thousand-six-hundred-twenty-five (10,625) pages were processed and eight-thousand-seventy-six (8,076) pages were disclosed in a total of ninety-three (93) requests.

Among the processed pages seven-hundred-eighty-eight (788) pages were fully disclosed, nine-thousand-seven-hundred-sixty-eight (9,768) pages were disclosed in part and sixty-nine (69) were processed in abandoned requests.

In addition, seven-hundred-four (704) pages were disclosed in full, seven-thousand-three-hundred-fifty-nine (7,359) pages were received and disclosed in part while thirteen pages were received and disclosed in abandoned requests.

However, no pages were processed nor disclosed for the request that were all exempted, all excluded or were the existence of records could be confirmed or not.

2.5.2 Relevant pages processed and disclosed by size of requests

Over 90% of completed requests required 100 pages of processing or less. The five (5) requests that required treatment of between 101-500 pages of records resulted in the disclosure of 1,258 pages. CIRNAC treated three (3) large (1001 to more than 5000 pages) requests of 6,000 pages in 2018-2019. With a total of 93 requests, 8,076 pages were disclosed over the course of 2018-2019. (Table 2.5.2).

Table 2.5.2 Relevant pages processed and disclosed by size of requests
Disposition Less than 100 pages processed 101-500
pages processed
501-1000
pages processed
1001-5000
pages processed
More than 5000 pages processed
Requests Pages disclosed Requests Pages disclosed Requests Pages disclosed Requests Pages disclosed Requests Pages disclosed
All disclosed 28 217 1 487 0 0 0 0 0 0
Disclosed in part 34 588 4 771 0 0 3 6000 0 0
All exempted 0 0 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0 0 0
Abandoned 23 13 0 0 0 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0 0 0 0 0 0
Total 85 818 5 1258 0 0 3 6000 0 0
Long Text Description

This table illustrates the number of relevant pages processed and disclosed per size of the requests.

Requests where less than one hundred (100) relevant pages processed are compiled as follow: twenty-eight (28) requests were completed counting a total of two-hundred-seventeen (217) relevant pages disclosed in full, thirty-four (34) requests were completed counting a total of five-hundred-eighty-eight (588) relevant pages disclosed in part and twenty-three (23) requests abandoned by the requesters had thirteen (13). Eighty-five (85) requests and eight-hundred-eighteen (818) relevant pages were processed within this category.

Requests where the number of relevant pages processed is between one-hundred-and-one (101) and five-hundred (500) are compiled as follow; one (1) request was completed counting four-hundred-eighty-seven (487) relevant pages disclosed in full and four (4) requests were completed counting seven-hundred-seventy-one (771) relevant pages disclosed in part. Five (5) requests and one-thousand-two-hundred-fifty-eight (1258) relevant pages were processed within this category.

Three requests with a total six-thousand (6,000) of relevant pages disclosed in part are part of the category of pages processed between one-thousand-one (1001) and five-thousand (5000).

2.5.3 Other complexities

The ATIP Directorate required only one external consultation with the Department of Justice resulting in the full disclosure of information.

Table 2.5.3 Other complexities
Disposition Consultation required Legal Advice Sought Interwoven Information Other Total
All disclosed 0 1 0 0 1
Disclosed in part 0 0 0 0 0
All exempted 0 0 0 0 0
All excluded 0 0 0 0 0
Abandoned 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0
Total 0 1 0 0 1
Long Text Description

The above table illustrates the number of requests where other complexity may have been part of the processing of the requests, the complexities may be for reasons as required consultations, legal advice and interwoven information/other were found within the processed files. For the past fiscal year, the ATIP office counted 1 request where legal advice was sought.

2.6 Deemed refusals

The following sections detail the number of, and reasons for which, requests were deemed in refusal throughout 2018-2019.

2.6.1 Reason for not meeting statutory deadline

During the reporting period, CIRNAC did not meet the statutory deadline in nine (9) instances with excessive workload being the reason on eight (8) of those requests (Table 2.6.1).

Tableau 2.6.1 Reasons for not meeting statutory deadlines
Number of Requests Closed Past the Statutory Deadline Principal Reason
Workload ExternalConsultation Internal Consultation Other
9 8 0 0 1
Long Text Description

The above table illustrates the number of requests that where closed past the statutory deadline. Nine (9) requests were found to meet this criterion. Eight (8) of them were late due to the ATIP Office workload and one (1) was late due to other factors.

2.6.2 Number of days past deadline

Of the nine (9) requests that were completed past the statutory deadline, six (6) were completed within 1 to 15 days. (Table 2.6.2)

Table 2.6.2 Number of days past deadline
Number of Days Past Deadline Number of Requests Past Deadline Where No Extension Was Taken Number of Requests Past Deadline Where An Extension Was Taken Total
1 to 15 days 4 2 6
16 to 30 dayss 0 1 1
31 to 60 days 0 0 0
61 to 120 days 0 2 2
121 to 180 days 0 0 0
181 to 365 days 0 0 0
More tha 365 days 0 0 0
Total 4 5 9
Long Text Description

CIRNAC identifies the number of requests closed past their deadline. In the case where no extensions were taken; four (4) requests met the criteria and were closed within fifteen (15) days past their due date. This makes a total of four (4) requests that had no extensions and passed their statutory deadline.

In addition, the above table identifies the number of requests closed past their deadline and where an extension was documented on the file. Two (2) were closed within fifteen (15) days, one (1) was closed between sixteen (16) and thirty (30) days and two (2) more between sixty-one (61) and one-hundred-twenty (120) days. This makes a total of five (5) requests that had an extensions recorded on file and still passed their statutory deadline.

2.7 Requests for translation

During the reporting period, there were no instances where requesters asked that responsive records be translated to another official language.

Part 3. Disclosure under subsections 8(2) and 8(5) of the Privacy Act

Permissible disclosure pursuant to subsection 8(2) of the PA describes the circumstances under which personal information under the control of government institutions may be disclosed without the consent of the individual to whom the information pertains. In 2018-2019, CIRNAC made 57 permissible disclosures under 8(2)(e), 8(2)(m) and 8(5). The Treasury Board of Canada requires these three permissible disclosures to be captured in the statistical report. CIRNAC ATIP, like other institutions, has processed another 706 requests under section 8(2) for a total of 763 permissible disclosures in 2018-2019.

8(2)(e) disclosures – 55 disclosures were made under paragraph 8(2)(e) pursuant to request made by investigative bodies as found in the schedule II and III of the Privacy Act.

8(2)(m) disclosures -  For the purpose of public interest. CIRNAC made one (1) disclosure under paragraph 8(2)(m) .

8(5) disclosures - Requires institutions to report 8(2)(m) to the Office of the Privacy Commissioner.  The one (1) 8(2)(m) disclosure noted above was reported to the Privacy Commissioner.

Other permissible disclosures not captured by the statistical report include:

8(2)(c) disclosures – CIRNAC has made one (1) disclosure to comply with a subpoena or warrant.

8(2)(d) disclosures – CIRNAC has made 81 disclosures to the Attorney General of Canada pursuant to legal proceedings.

8(2)(f) disclosures – Under an agreement or arrangement between the Government of Canada and provincial governments for the purpose of administering or enforcing any law or carrying out lawful investigations. CIRNAC made 543 disclosures of personal information.

8(2)(j) disclosures - CIRNAC made four (4) disclosures to research body for statistical purposes.

8(2)(k) disclosures -  Permits the disclosure of personal information to researchers involved in the process of settling native claims.  CIRNAC made 77 disclosures to researchers for native claims research.

Part 4. Requests for correction of personal information and notations

During the reporting period, there were no requests for correction of personal information or notations.

Part 5. Extensions

5.1 Reasons for extensions and disposition of requests

During 2018-2019, 30 extensions were taken under subsection 15(a) of the Privacy Act. All 30 extensions were taken under subsection 15(a)(i) (interference with operation) . Seven (7) requests were disclosed in their entirety whereas 20 requests were disclosed in part. (Table 5.1)

Table 5.1 Reasons for extensions and disposition of requests
Disposition of requests where an extension was taken 15(a)(i) Interference with Operations 15(a)(ii) Consultation 15(b) Translation or conversion
Section 70 Other
All disclosed 7 0 0 0
Disclosed in part 20 0 0 0
All exempted 0 0 0 0
All excluded 0 0 0 0
No records exist 3 0 0 0
Request abandoned 0 0 0 0
Total 30 0 0 0
Long Text Description

There are three (3) reasons for possible extension that may be taken as per the Act: Interference with Operations, Consultations and Translation or conversion. The ATIP Office identified thirty (30) requests having an extension explained by the inference of operations in order to complete the requests. Among the thirty (30), seven (7) requests were fully disclosed to the requesters, twenty (20) were disclosed in part and three (3) had no responsive documents to the requests.

5.2 Length of extensions

28 (93%) of the extensions applied during the reporting period were between 16 to 30 days in length. (Table 5.2)

Table 5.2 Length of extensions
Length of extension 15(a)(i) Interference with Operations 15(a)(ii) Consultation 15(b) Translation purposes
Section 70 Other
1 to 15 days 2 0 0 0
16 to 30 days 28 0 0 0
Total 30 0 0 0
Long Text Description

Two (2) requests with extensions were completed within fifteen (15) days after their legislative date and the other twenty-eight (28) were completed between sixteen (16) and thirty (30) days of their legislative date.

Part 6. Consultations received from other Institutions and Organizations

CIRNAC did not receive any consultation from another Government of Canada institution during 2018-2019.

Part 7. Completion time of consultations on Cabinet confidences

During the reporting period, no consultations on the application of section 70 of the PA were sent to Departmental Legal Services Unit for consultation on potential Cabinet confidences.

Part 8. Complaints and Investigations Notices Received

During the 2018-2019 reporting period, there was one (1) complaint received from the Office of the Privacy Commissioner. The Treasury Board of Canada requires institutions to also track in the statistical report section 31, 33 and 35 of the Privacy Act. These sections are not cumulative.

Table 8.1  Complaints and Investigation
Section 31 Section 33 Section 35 Court action Total
1 0 0 0 1
Long Text Description

The ATIP Office received one (1) complaint from the Office of the Privacy Commissioner (OPC)

Part 9. Privacy Impact Assessments

Privacy Impact Assessments (Appendix A of the TBS Statistical Report)

A PIA is a risk evaluation of the flow of personal information held within a program or service. This process enables the Department to determine whether new or substantially modified technologies, information systems, initiatives, and proposed programs or policies meet federal government privacy requirements.

There were no PIAs completed during the 2018-2019 reporting period.

Privacy Act Statements

The ATIP Directorate assists and reviews all CIRNAC programs in the development of appropriate Privacy Notice Statements to be included in any form(s) and/or shared during a consultation engagement process which collects personal information. Privacy Statements inform individuals what is done with their personal information. In 2018-2019, the ATIP Directorate responded to numerous requests for Privacy Statements.

The ATIP Directorate will continue to work with all CIRNAC program areas in the upcoming fiscal years to update Privacy Notice Statements for all hard copy and online DCIs, forms and/or consultation processes.

Privacy Policy Questions

The ATIP Directorate also fields questions regarding privacy protocols, policies/directives, issues and other inquiries related to the collection, use, retention and disposal, and/or sharing of personal information. During the reporting period, the ATIP Directorate responded to numerous questions from departmental clients for all CIRNAC-related privacy matters. 

Privacy Breaches

The ATIP Directorate provides support to CIRNAC officials in addressing and containing potential privacy breaches. CIRNAC reported six privacy breaches during this fiscal year that affected individuals.  The majority of breaches was of low sensitivity and caused by human error. One (1) breach was considered a Material Privacy Breach and was reported to the Office of Privacy Commissioner.

Part 10. Resources related to the Privacy Act

10.1 Costs

The ATIP Directorate functioned under a shared services model to support CIRNAC and ISC. It spent a total of $1,603,740 on staffing, goods and services and was supported by 23 human resources.

Calculations for the annual reports reflect the level of effort in support CIRNAC's responsibilities pursuant to the Acts.

In 2018-2019, CIRNAC spent $159,786 on the administration of the PA and was supported by 2.30 Human Resources.

Table 10.1 Budget figures dedicated to the administration of the Privacy Act
Expenditures Amount
Salaires $139 936 
Overtime $392 
Goods and Services $19 458 
Professional services contracts $2 238 
Other $17 220 
Total $159 786 
Long Text Description

The ATIP Directorate spent a total of $159,786 divided as follows: $139,936 on salaries, $392 on overtime and $19,458 on goods and services. Goods and services is divided into two (2) categories, professional services contracts with a total of $2,238 spent and $17,220 were spent in the other category.

10.2 Human Resources

The Privacy Operations unit within the ATIP Directorate consisted of 2.30 full-time equivalents (FTEs) (Table 10.2). Over the course of the reporting period, CIRNAC hired 0.10 students or consultants.

Table 10.2 Human resources dedicated to the administration of the Privacy Act
Resources Person Years Dedicated to Access to Information Activities
Full-time employees 2.20
Part-time and casual employees 0.00
Regional staff 0.00
Consultants and agency personnel 0.00
Students 0.10
Total 2.30
Long Text Description

In regards to human resources, the ATIP Directorate consisted of 2.3 full-time equivalents (FTEs). Which included the hiring of 0.10 students and 0.01 part-time or casual employees.

Highlights

V. 2018-2019 Points of Interest

This past fiscal year (2018-2019) was the first full year of reporting for CIRNAC under the ATIA and the PA.

CIRNAC continued to meet its obligations under the Acts by ensuring a compliance rate of 79% under the ATIA and 85% under the PA.

115 new PA requests were received and 119 closed (10 requests were carried over from the previous year). A total of 10,625 pages processed under the PA.

The most applied exemption under PA was section 26, representing personal information.

Complaints from the Office of the Privacy Commissioner fell to 1 in 2018-2019, whereas 15 complaints were received the previous fiscal year.

763 proactive disclosure requests were processed under section 8(2) of the Privacy Act which allows for the release of personal information without consent.

It should be noted that of the 763, 77 were disclosed under section 8(2)(k) identified in the Act for the purposes of researching or validating the claims, disputes or grievances of any of the aboriginal peoples of Canada.

ATIP has administered the Acts in a shared services environment for both CIRNAC and ISC since November 30, 2017.

Overall, for both departments in 2018-2019, there was an increase of 41% in new ATIA requests and an increase of 13% in PA requests.

A total of 15,066 pages processed under PA compared to the 6,565 pages processed in 2017-2018.

ATIP also trained a total of 870 employees (562 ISC/308 CIRNAC) on the ATIA and PA in 2018-2019.

The ATIP Directorate as a whole spent $1,603,740 on staffing, goods and services and was supported by 23 human resources.

CIRNAC ATIP spent $801,870 on staffing and goods and services and was supported by 11.5 Human Resources. The amount was separated 80% for the Access to Information report and 20% for the Privacy report.

Appendix A

Order of Delegation of the Privacy Act dated March 14, 2016

Privacy Act - Delegation Order

Pursuant to the powers of designation conferred upon me by Section 73 of the Privacy Act, the persons exercising the functions or positions Deputy Minister (position number 00000001), Associate Deputy Minister (position number 00000006), Corporate Secretary (position number 00012294), and the departmental Access to Information Privacy Coordinator/Director (position number 20003872), and their respective successors, including in their absence, a person or officer designated in writing to act in the place of the holder of any such functions or positions are hereby designated to exercise those powers, duties or functions of the Minister as the Head of the government institution under the Act, and as set out in the attached Schedule A.

The departmental Access to Information and Privacy Deputy Director (position number 20007504) and Team Leaders (position number 00012590 and 00012061) including in her/his absence, a person or officer designated in writing as being authorized to act in the place of the holder of any such function or position, are hereby designated to exercise those powers, duties or functions of the Minister as the Head of the government institution under the Act, and as set out in the attached Schedule B.

Original document signed on March 14, 2011

The Honourable Carolyn Bennett

Minister of Indian Affairs and Northern Development

Schedule A

Department Of Indian Affairs And Northern Development
Schedule To Delegation Order

Designation Pursuant To Section 73 Of
The Privacy Act

Sections and Powers, Duties or Functions

8(2) Disclose personal information without the consent of the individual to whom it relates

8(4) Keep copies of requests made under 8(2)(e), keep records of information disclosed pursuant to such requests and to make those records available to Privacy Commissioner

8(5) Notify the Privacy Commissioner in writing of disclosure under paragraph 8(2)(m)

9(1) Retain a record of use of personal information

9(4) Notify the Privacy Commissioner of consistent use of personal information and update index accordingly

10 Include personal information in personal information banks

11(a) Publish annually an index of all personal information banks and their respective contents

11(b) Publish annually an index of all personal information held by the institution which is not part of a bank

14 Respond to request for access, within statutory deadline; give access or give notice

15 Extend time limit and notify applicant

16 Where access is refused

17(2)(b) Language of access or alternative format of access

17(3)(b) Access to personal information in alternative format

18(2) May refuse to disclose information contained in an exempt bank

19(1) Shall refuse to disclose information obtained in confidence from another government

19(2) May disclose any information referred to in 19(1) if the other government consents to the disclosure or makes the information pubic

20 May refuse to disclose information injurious to federal-provincial affairs

21 May refuse to disclose information injurious to international affairs and/or defence

22 May refuse to disclose information injurious to law enforcement and investigation

23 May refuse to disclose information injurious to security clearances

24 May refuse to disclose information collected by the Canadian Penitentiary Service, the National Parole Service or the National Parole Board

25 May refuse to disclose information injurious to which could threaten the safety of individuals

26 May refuse to disclose information about other individuals, and shall refuse to disclose such information where disclosure is prohibited under section 8

27 May refuse to disclose information subject to solicitor-client privilege

28 May refuse to disclose information relating to an individual's physical or mental health where disclosure is contrary to the best interests of the individual

31 Receive notice of investigation by the Privacy Commissioner

33(2) Make representations to the Privacy Commissioner during an investigation

35(1) Receive the Privacy Commissioner's report of findings of the investigation and give notice of action taken

35(4) Give complainant access to information after 35(1)(b) notice

36(3) Receive Privacy Commissioner's report of findings of investigation of exempt

37(3) Receive report of Privacy Commissioner's findings after compliance investigation where the institution has not complied with sections 4 to 8

51(2)(b) Request that matter be heard and determined in National Capital Region

51(3) Request and be given right to make representations in section 51 hearing

72(1) Prepare Annual Report to Parliament

77 Carry out responsibilities conferred on the Head of the institution by the regulations made under section 77 which are not included above

Schedule B

Department Of Indian Affairs And Northern Development
Schedule To Delegation Order

Designation Pursuant To Section 73 Of The Privacy Act

Sections and Powers, Duties or Functions

10 Include personal information in personal information banks

11(a) Publish annually an index of all personal information banks and their respective
contents

11(b) Publish annually an index of all personal information held by the institution
which is not part of a bank

15 Extend time limit and notify applicant

31 Receive notice of investigation by the Privacy Commissioner

Appendix B

Statistical Report on the Privacy Act

Name of institution: Crown-Indigenous Relations and Northern Affairs Canada

Reporting period: 2018-04-01 to 2019-03-31

Part 1: Requests Under the Privacy Act

  Number of Requests
Received during reporting period 115
Outstanding from previous reporting period 14
Total 129
Closed during reporting period 119
Carried over to next reporting period 10

Part 2: Requests Closed During the Reporting Period

2.1 Disposition and completion time
Disposition of Requests Completion Time
1 to 15 Days 16 to 30 Days 31 to 60 Days 61 to 120 Days 121 to 180 Days 181 to 365 Days More Than 365 Days Total
All disclosed 11 9 6 3 0 0 0 29
Disclosed in part 2 14 20 4 1 0 0 41
All exempted 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0
No records exist 1 17 6 1 1 0 0 26
Request abandoned 16 6 0 1 0 0 0 23
Neither confirmed nor denied 0 0 0 0 0 0 0 0
Total 30 46 32 9 2 0 0 119
2.2 Exceptions
Section Number of Requests
18(2) 0
19(1)(a) 0
19(1)(b) 0
19(1)(c) 0
19(1)(d) 0
19(1)(e) 0
19(1)(f) 0
20 0
21 0
22(1)(a)(i) 0
22(1)(a)(ii) 0
22(1)(a)(iii) 0
22(1)(b) 0
22(1)(c) 0
22(2) 0
22.1 0
22.2 0
22.3 0
23(a) 0
23(b) 0
24(a) 0
24(b) 0
25 0
26 38
27 0
28 0
2.3 Exclusions
Section Number of Requests
69(1)(a) 0
69(1)(b) 0
69.1 0
70(1) 0
70(1)(a) 0
70(1)(b) 0
70(1)(c) 0
70(1)(d) 0
70(1)(e) 0
70(1)(f) 0
70.1 0
2.4 Format of information released
Disposition Paper Electronic Other formats
All disclosed 24 5 0
Disclosed in part 22 19 0
Total 46 24 0
2.5 Complexity
2.5.1 Relevant pages processed and disclosed
Disposition of Requests Number of Pages
Processed
Number of Pages
Disclosed
Number of Requests
All disclosed 788 704 29
Disclosed in part 9768 7359 41
All exempted 0 0 0
All excluded 0 0 0
Request abandoned 69 13 23
Neither confirmed nor denied 0 0 0
Total 10625 8076 93
2.5.2 Relevant pages processed and disclosed by size of requests
Disposition Less Than 100 Pages Processed 101-500
Pages Processed
501-1000
Pages Processed
1001-5000
Pages Processed
More Than 5000
Pages Processed
Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed
All disclosed 28 217 1 487 0 0 0 0 0 0
Disclosed in part 34 588 4 771 0 0 3 6000 0 0
All exempted 0 0 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0 0 0
Request abandoned 23 13 0 0 0 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0 0 0 0 0 0
Total 85 818 5 1258 0 0 3 6000 0 0
2.5.3 Other complexities
Disposition Consultation Required Legal Advice Sought Interwoven Information Other Total
All disclosed 0 1 0 0 1
Disclosed in part 0 0 0 0 0
All exempted 0 0 0 0 0
All excluded 0 0 0 0 0
Request abandoned 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0
Total 0 1 0 0 1
2.6 Deemed refusals
2.6.1 Reasons for not meeting statutory deadline
Number of Requests Closed Past the Statutory Deadline Principal Reason
Workload External Consultation Internal Consultation Other
9 8 0 0 1
2.6.2 Number of Days Past Deadline
Number of Days Past Deadline Number of Requests Past Deadline Where No Extension Was Taken Number of Requests Past Deadline Where An Extension Was Taken Total
1 to 15 Days 4 2 6
16 to 30 Days 0 1 1
31 to 60 Days 0 0 0
61 to 120 Days 0 2 2
121 to 180 Days 0 0 0
181 to 365 Days 0 0 0
More Than 365 Days 0 0 0
Total 4 5 9
2.7 Requests for translation
Translation Requests Acceptées Refusées Total
English to French 0 0 0
French to English 0 0 0
Total 0 0 0

Part 3: Disclosures Under Subsections 8(2) and 8(5)

Paragraph 8(2)(e) Paragraph 8(2)(m) Paragraph 8(5) Total
55 1 1 57

Part 4: Requests for Correction of Personal Information and Notations

Disposition for Correction Requests Received Number
Notations attached 0
Requests for correction accepted 0
Total 0

Part 5: Extensions

5.1 Reasons for extensions and disposition of requests
Disposition of Requests Where an Extension Was Taken 15(a)(i) Interference With Operations 15(a)(ii) Consultation 15(b) Translation or Conversion
Section 70 Other
All disclosed 7 0 0 0
Disclosed in part 20 0 0 0
All exempted 0 0 0 0
All excluded 0 0 0 0
No records exist 3 0 0 0
Request abandoned 0 0 0 0
Total 30 0 0 0
5.2 Length of extensions
Length of Extensions 15(a)(i) Interference with operations 15(a)(ii) Consultation 15(b) Translation purposes
Section 70 Others
1 to 15 days 2 0 0 0
16 to 30 days 28 0 0 0
Total 30 0 0 0

Part 6: Consultations Received From Other Institutions and Organizations

6.1 Consultations received from other Government of Canada institutions and other organizations
Consultations Other Government of Canada Institutions Number of Pages to Review Other Organizations Number of Pages to Review
Received during the reporting period 0 0 0 0
Outstanding from the previous reporting period 0 0 0 0
Total 0 0 0 0
Closed during the reporting period 0 0 0 0
Pending at the end of the reporting period 0 0 0 0
6.2 Recommendations and completion time for consultations received from other Government of Canada institutions
Recommendation Number of days Required to Complete Consultation Requests
1 to 15 Days 16 to 30 Days 31 to 60 Days 61 to 120 Days 121 to 180 Days 181 to 365 Days More Than 365 Days Total
All disclosed 0 0 0 0 0 0 0 17
Disclosed in part 0 0 0 0 0 0 0 0
All exempted 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0
Consult other institution 0 0 0 0 0 0 0 0
Other 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0
6.3 Recommendations and completion time for consultations received from other organizations
Recommendation Number of days Required to Complete Consultation Requests
1 to 15 Days 16 to 30 Days 31 to 60 Days 61 to 120 Days 121 to 180 Days 181 to 365 Days More Than 365 Days Total
All disclosed 0 0 0 0 0 0 0 0
Disclosed in part 0 0 0 0 0 0 0 0
All exempted 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0
Consult other institution 0 0 0 0 0 0 0 0
Other 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0

Part 7: Completion Time of Consultations on Cabinet Confidences

7.1 Requests with Legal Services
Number of Days Fewer Than 100 Pages Processed 101-500
Pages Processed
501-1000
Pages Processed
1001-5000
Pages Processed
More than 5000
Pages Processed
Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed
1 to 15 0 0 0 0 0 0 0 0 0 0
16 to 30 0 0 0 0 0 0 0 0 0 0
31 to 60 0 0 0 0 0 0 0 0 0 0
61 to 120 0 0 0 0 0 0 0 0 0 0
121 to 180 0 0 0 0 0 0 0 0 0 0
181 to 365 0 0 0 0 0 0 0 0 0 0
More than 365 0 0 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0 0 0
7.2 Requests with Privy Council Office
Number of Days Fewer Than 100
Pages Processed
101-500
Pages Processed
501-1000
Pages Processed
1001-5000
Pages Processed
More than 5000
Pages Processed
Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed
1 to 15 0 0 0 0 0 0 0 0 0 0
16 to 30 0 0 0 0 0 0 0 0 0 0
31 to 60 0 0 0 0 0 0 0 0 0 0
61 to 120 0 0 0 0 0 0 0 0 0 0
121 to 180 0 0 0 0 0 0 0 0 0 0
181 to 365 0 0 0 0 0 0 0 0 0 0
More than 365 0 0 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0 0 0

Part 8: Complaints and Investigations Notices Received

Section 31 Section 33 Section 35 Court action Total
1 0 0 0 1

Part 9: Privacy Impact Assessments (PIAs)

Number of PIA(s) completed 0

Part 10: Resources Related to the Privacy Act

10.1 Costs
Expenditures Amount
Salaires $139,936
Overtime $392
Goods and Services $19,458
Professional services contracts $2,238
Other $17,220
Total $159,786
10.2 Human Resources
Resources Person Years Dedicated to Privacy Activities
Full-time employees 2.20
Part-time and causal employees 0.00
Regional staff 0.00
Consultants and agency personnel 0.00
Students 0.10
Total 2.30
Note: Enter values to two decimal places.

Did you find what you were looking for?

What was wrong?

You will not receive a reply. Don't include personal information (telephone, email, SIN, financial, medical, or work details).
Maximum 300 characters

Thank you for your feedback

Date modified: