Annual report to Parliament 2022-2023: Privacy Act

Creation and Growth of the New Departments

In June 2019, the Department of Crown-Indigenous Relations and Northern Affairs Act and the Department of Indigenous Services Act received royal ascent formalizing the creation of the two new departments. The Access to Information and Privacy (ATIP) Directorate has since provided shared services support for CIRNAC and Indigenous Services Canada (ISC) through a Memorandum of Understanding (MOU) and Service Level Agreement (SLA) between the departments.

Delegation on ministerial responsibilities for the PA remains institutionally specific. However, the delegation of the ministerial responsibilities for the Access to Information Act remains within CIRNAC and ISC respectively.

Crown-Indigenous Relations and Northern Affairs Canada's Mandate

Crown-Indigenous Relations and Northern Affairs Canada continues to renew the nation-to-nation, Inuit-Crown, government-to-government relationship between Canada and First Nations, Inuit and Métis. Its mandate is to modernize Government of Canada structures to enable Indigenous peoples to build capacity and support their vision of self-determination; and lead the Government of Canada's work in the North.

The relationship must be based on the recognition of rights, respect, co-operation, and partnership. CIRNAC will build on the progress that has been already made, including the establishment of rights and recognition tables across the country, the creation of permanent bilateral mechanisms with National Indigenous Organizations to make progress on shared priorities, and the progress made across government on the Truth and Reconciliation Commission Calls to Action.

CIRNAC is one of two federal departments that are primarily responsible for meeting the Government of Canada's obligations and commitments to First Nations, Inuit and Métis, and for fulfilling the federal government's constitutional responsibilities in the North. CIRNAC's overall mandate and wide-ranging responsibilities are shaped by centuries of history and unique demographic and geographic challenges. The mandate is derived from the Constitution Act 1982, the Indian Act, the Department of Crown-Indigenous Relations and Northern Affairs Act (preceded by the Department of Indian Affairs and Northern Development Act), territorial Acts, treaties, comprehensive claims and self-government agreements, as well as various other statutes affecting Indigenous Peoples and the North.

Access to Information and Privacy Directorate at CIRNAC

The ATIP Directorate is responsible for the administration of requests made under the Access to Information Act (ATIA) and the PA. It was established within the Corporate Secretariat and reports to the Corporate Secretary, who is directly accountable to the Deputy Head. The Directorate also coordinates and implements policies, guidelines and procedures to ensure departmental compliance with the ATIA and PA.

Workshop presentations, training courses and awareness sessions designed to increase access to information and privacy capacity across the Department are provided by the ATIP Directorate.

Under a shared service agreement, ATIP analysts processed requests for both CIRNAC and ISC. Requests varied in volume and complexity based on their classification level.

CIRNAC, in part, carries forth the record collection responsibility of its predecessor institutions: Indigenous and Northern Affairs Canada, Department of Indian Affairs and Northern Development, etc. As such, the Minister for Crown-Indigenous Relations and Northern Affairs Canada has prioritized addressing the legacy of residential schools, which entails the sharing of information under the control of the Department. Analysts with privacy expertise are engaged with sectors to provide advice related to record sharing activities.

Additionally, the privacy specialists provided critical advice for new initiatives, resulting in privacy protection in departmental programs.

Policies and procedures continue to be established, under an evolving multi-jurisdictional reality, to ensure that privacy is considered throughout the life cycle of CIRNAC's programs. As such, informed policy decisions are made concerning the collection, sharing and/or use of personal information.

The ATIP Directorate provides advice and guidance to the Department on a number of topics:

1. The application of the ATIA and PA;
2. The release of sensitive or protected information to the public;
3. Education and awareness of access to information and privacy issues throughout the Department;
4. Proactive publications;
5. Departmental Privacy Impact Assessments (PIAs);
6. Permissible disclosures of personal information pursuant to subsection 8(2) of the PA;
7. Appropriate PA Statements on Data Collection Instruments, i.e. forms, surveys, recorded events, etc.;
8. Updates to Info Source and the preparation and registration of Personal Information Banks and their related Classes of Records;
9. Protocols surrounding privacy breaches; and
10. Privacy advice in Memoranda of Understanding, Information Sharing Agreements and more complicated Multi-Jurisdictional Information Sharing Agreements (MISAs).

The Intake Team triages and coordinates the receipt of requests for records under the control of the Department, made pursuant to the ATIA and PA.

The Operations team ensures that a response is provided within the legislated timeframe. All requests are monitored using the AccessPro case management tracking system.

ATIP analysts in these two teams work closely with the relevant program areas to ensure that all responsive documents are provided, and the information contained within those documents are treated in accordance with the Acts, to allow for government records to be safely disclosed to the Canadian public.

The Privacy/Policy team provides expert advice, maintains and monitors privacy risks, and assists with the creation of privacy training material. The Privacy/Policy team also supports CIRNAC in the development of departmental policies that reflect the Department's unique relationship with its clients and Indigenous partners, all while ensuring the Department meets its obligations under the PA.

In addition to the ATIP Directorate, each CIRNAC sector and regional office has ATIP Liaison Officers (ALOs) who receive requests for records from the ATIP Directorate and subsequently task the requests, as appropriate. The ALOs play a crucial role in ensuring appropriate records, impact statements and approvals are obtained and communicated to ATIP Directorate officials within the legislated timelines.

1. Requests under the Privacy Act

In 2022-2023, CIRNAC received 622 requests with another 52 requests carried over from the previous year. This reflected a total of 674 requests to be processed in the course of the reporting period. The Department completed 668 requests, 7% more than received, and carried 6 requests, a decrease of 88%, into the next reporting period (2023-2024).

2. Informal requests

An informal request is defined as a request for copies of previously processed and released privacy requests. No Informal requests were received pursuant to the Privacy Act (PA) in 2022-2023.

3. Requests closed during the reporting period

3.1 Disposition and completion time

Of the 668 requests closed during the reporting period, CIRNAC was able to fully or partially disclose records in 434 cases (65% of the requests) (Table 3.1.1). The most frequent outcome of requests processed during the reporting period was a partial disclosure, which occurred in 268 cases or 40% of the time. No records existed in 192 cases or 29% of the time. In 42 instances, requests were abandoned by the requester, likely because the original request was not complete or sufficient authorization for disclosure was not obtained (Table 3.1.2).

Text alternative for Table 3.1.1 Percentage of completed files relevant to each disclosures

Dispositions	Percentage
All disclosed	25%
Disclosed in part	40%
Request abandoned	6%
No records exist	29%

In the course of the current reporting period, 96 requests were processed and completed within the initial 15 days of receipt and another 418 were closed within 30 days, resulting in 77% of requests completed within 30 days. An additional 117 files were completed between 31 and 60 days of receipt, with or without an extension recorded on the file. The remaining 37 files were finalized in 61 or more days.

Table 3.1.2 Disposition and completion time

Disposition of requests	Completion time (days)
	1 to 15	16 to 30	31 to 60	61 to 120	121 to 180	181 to 365	More than 365	Total
All disclosed	13	116	35	1	1	0	0	166
Disclosed in part	6	158	74	21	3	4	2	268
All exempted	0	0	0	0	0	0	0	0
All excluded	0	0	0	0	0	0	0	0
No records exist	37	143	8	3	1	0	0	192
Request abandoned	40	1	0	1	0	0	0	42
Neither confirmed nor denied	0	0	0	0	0	0	0	0
Total	96	418	117	26	5	4	2	668

4. Disclosure under subsections 8(2) and 8(5)

Permissible disclosure pursuant to subsection 8(2) of the PA describes the circumstances under which personal information under the control of government institutions may be disclosed without the consent of the individual to whom the information pertains. In 2022-2023, CIRNAC made no permissible disclosures under 8(2)(e) or 8(2)(m). The Treasury Board of Canada Secretariat requires these permissible disclosures to be captured in the statistical report.

There were no disclosures authorized under 8(2)(e) pursuant to requests made by investigative bodies as found in the Privacy Act. The PA permits the disclosure of personal information to an investigative body specified in the regulations, on the written request of the body, for the purpose of enforcing any law of Canada or a province or carrying out a lawful investigation, if the request specifies the purpose and describes the information to be disclosed.

There were no disclosures authorized under 8(2)(m) where the head of the institution found that the public interest in disclosure clearly outweighed any invasion of privacy that could result from the disclosure. The PA permits disclosure under 8(2)(m) pursuant to any purpose where, in the opinion of the head of the institution, the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure, or disclosure would clearly benefit the individual to whom the information relates.

The Office of the Privacy Commissioner must be informed of communications pursuant to paragraph 8(2) m) as required by section 8(5) PA. This was not necessary in 2022-2023.

Other permissible disclosures not captured by the statistical report include:

There were three (3) disclosures authorized under 8(2)(d) pursuant to a request from the Department of Justice. The PA permits the disclosure of personal information to the Attorney General of Canada for use in legal proceedings involving the Crown in right of Canada or the Government of Canada.

There were 45 disclosures authorized under 8(2)(k) pursuant to requests from the authorized researchers identified in the PA. The PA permits the disclosure of personal information for the purpose of researching or validating the claims, disputes or grievances of any of the aboriginal peoples of Canada.

The Department processed a combined total of 48 requests under section 8(2) of the Privacy Act in 2022-2023.

5. Requests for Correction of Personal Information and Notations

During the reporting period, there were no requests for correction of personal information or notations.

6. Extensions

7. Consultations received from Other Institutions and Organizations

CIRNAC received one (1) consultation from another Government of Canada institution during 2022-2023.

8. Completion Time of Consultations on Cabinet confidences

During the reporting period, no consultations on the application of section 70 of the PA were sent to the departmental Legal Services Unit for consultation on potential Cabinet confidences.

9. Complaints and Investigations Notices Received

During the 2022-2023 reporting period, there was one complaint received from the Office of the Privacy Commissioner under section 31. There was one complaint closed, resulting in no action required by the Department under section 35. The Treasury Board of Canada requires institutions to track sections 31, 33 and 35 of the Privacy Act in the statistical report (Table 9).

10. Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

11. Privacy Breaches

12. Resources Related to the Privacy Act

12.2 Human Resources

In 2022-2023, CIRNAC allocated 1.519 full time employees (FTE) on the administration of the Privacy Act (Table 12.2).

Text alternative for Table 12.2 Human resources

Expenditures	Amount
Full-time employees	1.246
Consultants and agency personnel	0.273

Delegation Order

Section 1: Requests Under the Privacy Act

Section 2: Informal requests

Section 3: Requests Closed During the Reporting Period

Section 4: Disclosures Under Subsections 8(2) and 8(5)

Section 5: Requests for Correction of Personal Information and Notations

Section 6: Extensions

Section 7: Consultations Received From Other Institutions and Organizations

Section 8: Completion Time of Consultations on Cabinet Confidences

Section 9: Complaints and Investigations Notices Received

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

Section 11: Privacy Breaches

Section 12: Resources Related to the Privacy Act