2023-2024 Annual Report to Parliament: Privacy Act

Creation and Growth of the Departments

Since the creation of the Department, the Access to Information and Privacy (ATIP) Office has provided a shared service support for CIRNAC and Indigenous Services Canada (ISC) through a service level agreement (SLA).

Delegation on ministerial responsibilities for the PA remains institutionally specific.

Crown-Indigenous Relations and Northern Affairs Canada's Mandate

Crown-Indigenous Relations and Northern Affairs Canada continues to renew the nation-to-nation, Inuit-Crown, government-to-government relationship between Canada and First Nations, Inuit and Métis; modernize Government of Canada structures to enable Indigenous peoples to build capacity and support their vision of self-determination; and lead the Government of Canada's work in the North.

The relationship must be based on the recognition of rights, respect, co-operation, and partnership. CIRNAC will build on the progress that has been already made, including the establishment of rights and recognition tables across the country, the creation of permanent bilateral mechanisms with National Indigenous Organizations to make progress on shared priorities, and the progress made across government on the Truth and Reconciliation Commission Calls to Action.

CIRNAC is one of two federal departments that are primarily responsible for meeting the Government of Canada's obligations and commitments to First Nations, Inuit and Métis, and for fulfilling the federal government's constitutional responsibilities in the North. CIRNAC's overall mandate and wide-ranging responsibilities are shaped by centuries of history and unique demographic and geographic challenges. The mandate is derived from the Constitution Act 1982, the Indian Act, the Department of Crown-Indigenous Relations and Northern Affairs Act (preceded by the Department of Indian Affairs and Northern Development Act), territorial Acts, treaties, comprehensive claims and self-government agreements, as well as various other statutes affecting Indigenous Peoples and the North.

The Administration of the Privacy Act at Crown-Indigenous Relations and Northern Affairs Canada

CIRNAC's ATIP Office handles requests made under the Access to Information Act (ATIA) and the PA. CIRNAC's Corporate Secretary is directly accountable to the Deputy Head. The Corporate Secretary is a member of the CIRNAC Senior Management Committee. The Corporate Secretary also manages the SLA for CIRNAC. The ATIP Office also coordinates and implements policies, guidelines and procedures to ensure departmental compliance with the ATIA and PA.

Workshop presentations, training courses and awareness sessions designed to increase access to information and privacy capacity across the Department are provided by the ATIP Office.

Under a shared service model, ATIP analysts processed requests for both CIRNAC and ISC. Requests varied in volume and complexity.

CIRNAC, in part, carries forth the record collection responsibility of its predecessor institutions: Indigenous and Northern Affairs Canada, Department of Indian Affairs and Northern Development, etc. As such, the Minister for Crown-Indigenous Relations and Northern Affairs Canada has prioritized addressing the legacy of residential schools, which entails the sharing of information under the control of the Department. Analysts with privacy expertise are engaged with sectors to provide advice related to record sharing activities.

The ATIP Office provides advice and guidance to the Department on a number of topics:

1. The application of the ATIA and PA;
2. The release of sensitive or protected information to the public;
3. Education and awareness of access to information and privacy issues throughout the Department;
4. Proactive publications;
5. Departmental Privacy Impact Assessments (PIAs);
6. Permissible disclosures of personal information pursuant to subsection 8(2) of the PA;
7. Appropriate PA Statements on Data Collection Instruments, i.e. forms, surveys, recorded events, etc.;
8. Updates to Info Source and the preparation and registration of Personal Information Banks and their related Classes of Records;
9. Protocols surrounding privacy breaches; and
10. Privacy advice in Memoranda of Understanding, Information Sharing Agreements and more complicated Multi-Jurisdictional Information Sharing Agreements (MISAs).

The Intake Team triages and coordinates the receipt of requests for records under the control of the Department, made pursuant to the ATIA and PA.

The Operations team ensures that a response is provided within the legislated timeframe. All requests are monitored using the AccessPro case management tracking system.

The Privacy/Policy team provides expert advice, maintains and monitors privacy risks, and assists with the creation of privacy training material. The Privacy/Policy team also supports CIRNAC in the development of departmental policies that reflect the Department's unique relationship with its clients and Indigenous partners, all while ensuring the Department meets its obligations under the PA.

The privacy specialists provided critical advice for new and evolving programs and information sharing initiatives, supporting privacy protection in the department.

Policies and procedures continue to be established, under an evolving multi-jurisdictional reality, to ensure that privacy is considered throughout the life cycle of CIRNAC's programs. As such, informed policy decisions are made concerning the collection, sharing and/or use of personal information.

In addition to the ATIP Office, within each of the sectors and regional offices of CRINAC are ATIP Liaison Officers (ALOs) who receive callouts from the ATIP Office and subsequently task the requests as appropriate to areas within their sector.

ALOs play a crucial role in ensuring the appropriate records, impact statements and approvals are obtained and communicated to the ATIP Office within the designated time allowances.

The ATIP Office will be transitioning away from an unsupported and sunsetting case management solution and as such CIRNAC and ISC procured a new case management solution: ATIPXpress. This solution was chosen in the hopes that it will increase efficiency, reduce processing times, and streamline the processing of requests. This in turn could reduce the number of complaints we receive, alleviating pressures from both the Office of the Information Commissioner, and the Privacy Commissioners of Canada. and improve service to the public.

This new case management system provides a supported, stable, and technologically contemporary tool that provides the ability to manage both department's workloads fluidly within one system, further cutting down processing time. The solution is expected to be implemented in fiscal 2024-2025.

ATIP Operations has created and implemented a Developmental Program. The program is based on predetermined performance benchmarks that that clearly state the expectations at each level from CR-04 to PM-06. An employee can choose to participate to develop their skills and build experience. With guidance from the team leaders, employees can advance within the organization.

This program was created to be open and transparent in order to develop and retain current staff and provide growth opportunities within the ATIP Office. The Developmental Program is highly successful and each year more and more analysts graduate to higher PM levels, this reporting period, eleven analysts were promoted or provided acting opportunities based on their success in the program.

The Department is committed to transparency and accountability under the Act and continues to work to improve its performance to deliver the highest standards of service for access to information requests.

The Department continued to use the Microsoft Office 365 tools, to communicate internally and engage with key stakeholders. The ATIP office also leveraged these tools for the transfer of information with sectors to allow for business continuity within the hybrid workplace structure.

To better serve our clients, the Department participates in the Access to Information and Privacy Online Request Service. Our clients can submit requests under the Act through this online channel administered by TBS.

In April 2023 the ATIP Office returned on-site in a hybrid model. Pandemic response conditions substantially reduced the use of paper. During this reporting period, the office mostly received electronic requests and records, and in most cases provided release packages electronically to applicants with the use of E-post Connect, which was implemented in February 2020.

The Department continues to use electronic tools to facilitate the collection, consultation and processing of information even with the return to work.

Director's Office

The Director (EX-01), as institutional ATIP Coordinator, holds full delegated authority under the ATIA. The Director is supported in day-to-day administrative tasks by the Deputy Director Operations (PM-06), Deputy Director Privacy/Policy (PM-06), an Administrative Assistant (AS-01) and is also supported in reporting by the Systems Administrator (AS-04).

Privacy/Policy Team

The Privacy/Policy Team is led by two Team Leaders (PM-05), who are responsible for ensuring the department is adhering to the collection, use and disclosure of personal information holdings as per the PA. They also ensure all policies for Access and Privacy align with Treasury Board policies and directives. The Privacy/Policy Team consists of Analysts at the PM-04, PM-03 and PM-02 levels who respond to privacy policy matters (such as privacy breaches, court ordered disclosure requests, Privacy Assessments, etc.) and provide training and Privacy advice. They are supported by an Intake Clerk (CR-04).

Operations Team

The Operations Team is led by three Team Leaders (PM-05), who are responsible for the overview of request processing by their team, including the review of completed requests. The Operations Team consists of Analysts at the PM-04, PM-03, and PM-02 levels who process Access and Privacy requests of varying volume and complexity, as well as provide training.

Intake Team

The Intake Team is led by one Team Lead (PM-5) and is comprised of various Intake Officers (PM-01s and CR-04s), who enter all applications into the electronic case management system, acknowledge receipt of requests, perform imaging services, interact with and respond to inquiries from the public.

1. Requests under the Privacy Act

In 2023-2024, CIRNAC received 47 requests with another 6 requests carried over from the previous year. This reflected a total of 53 requests to be processed in the course of the reporting period. The Department completed 46 requests and carried 7 requests into the next reporting period (2024-2025).

2. Informal requests

An informal request is defined as a request for copies of previously processed and released privacy requests. No Informal requests were received pursuant to the Privacy Act (PA) in 2023-2024.

3. Requests closed during the reporting period

3.1 Disposition and completion time

Of the 46 requests closed during the reporting period, CIRNAC was able to fully or partially disclose records in 16 cases (34% of the requests) . The most frequent outcome of requests processed during the reporting period was that no records existed, which occurred in 16 cases or 34% of the time. Records were fully exempt in 1 instance. In 13 instances, requests were abandoned by the requester, likely because the original request was not complete or sufficient authorization for disclosure was not obtained (Table 3.1.1).

Text alternative for Table 3.1.1 Percentage of completed files relevant to each disclosures

Dispositions	Percentage of requests
All disclosed	15%
Disclosed in part	20%
All exempted	2%
No records exist	35%
Request abandoned	28%

In the course of the current reporting period, 20 requests were processed and completed within the initial 15 days of receipt and another 8 were closed within 30 days, resulting in 61% of requests completed within 30 days. An additional 9 files were completed between 31 and 60 days of receipt, with or without an extension recorded on the file. The remaining 9 files were finalized in 61 or more days. (Table 3.1.2).

Table 3.1.2 Disposition and completion time

Disposition of requests	Completion time (days)
	1 to 15	16 to 30	31 to 60	61 to 120	121 to 180	181 to 365	>365	Total
All disclosed	0	3	2	1	0	1	0	7
Disclosed in part	0	0	4	3	1	1	0	9
All exempted	0	0	0	0	1	0	0	1
All excluded	0	0	0	0	0	0	0	0
No records exist	8	4	3	1	0	0	0	16
Request abandoned	12	1	0	1	0	0	0	13
Neither confirmed nor denied	0	0	0	0	0	0	0	0
Total	20	8	9	5	2	2	0	46

4. Disclosure under subsections 8(2) and 8(5)

Permissible disclosure pursuant to subsection 8(2) of the PA describes the circumstances under which personal information under the control of government institutions may be disclosed without the consent of the individual to whom the information pertains. In 2023-2024, CIRNAC made no permissible disclosures under 8(2)(e) or 8(2)(m). The Treasury Board of Canada Secretariat requires these permissible disclosures to be captured in the statistical report.

There were no disclosures authorized under 8(2)(e) pursuant to requests made by investigative bodies as found in the Privacy Act. The PA permits the disclosure of personal information to an investigative body specified in the regulations, on the written request of the body, for the purpose of enforcing any law of Canada or a province or carrying out a lawful investigation, if the request specifies the purpose and describes the information to be disclosed.

There were no disclosures authorized under 8(2)(m) where the head of the institution found that the public interest in disclosure clearly outweighed any invasion of privacy that could result from the disclosure. The PA permits disclosure under 8(2)(m) pursuant to any purpose where, in the opinion of the head of the institution, the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure, or disclosure would clearly benefit the individual to whom the information relates.

The Office of the Privacy Commissioner must be informed of communications pursuant to paragraph 8(2) m) as required by section 8(5) PA. This was not necessary in 2023-2024.

Other permissible disclosures not captured by the statistical report include:

There were thirteen (13) disclosures authorized under 8(2)(d) pursuant to a request from the Department of Justice. The PA permits the disclosure of personal information to the Attorney General of Canada for use in legal proceedings involving the Crown in right of Canada or the Government of Canada.

There were two (2) disclosures authorized under 8(2)(f) pursuant to an agreement or arrangement between the Government of Canada and another jurisdiction for the purpose of administering or enforcing any law or carrying out a lawful investigation.

There was one (1) disclosures authorized under 8(2)(j) pursuant to requests to undertake research or statistical activities. The PA permits the disclosure personal information to any person or body for research or statistical purposes with specific provisions.

There were 45 disclosures authorized under 8(2)(k) pursuant to requests from the authorized researchers identified in the PA. The PA permits the disclosure of personal information for the purpose of researching or validating the claims, disputes or grievances of any of the aboriginal peoples of Canada.

The ATIP office authorized a combined total of 64 requests under section 8(2) of the Privacy Act in 2023-2024.

5. Requests for Correction of Personal Information and Notations

During the reporting period, there were no requests for correction of personal information or notations.

6. Extensions

Order of Delegation of the Privacy Act dated January 28, 2021

Designation Pursuant to Section 73 of the Access to Information Act

6

Advise requesters that we need additional information to proceed with their request

7(a)

Give written notice to requestor that we can proceed with the request

8(1)

Transfer request to another institution or accept transfer from another institution

9

Extend time limits

10

Refuse to acknowledge or deny the existence of records

11

Charge additional fees

12

Provide access in alternate format

13

Exempt information obtained in confidence

14

Exempt information pertaining to federal-provincial affairs

15

Exempt information pertaining to international affairs and/or defence

16

Exempt information pertaining to law enforcement and investigations

17

Exempt information pertaining to the safety of individuals

18

Exempt information pertaining to the economic interests of Canada

19

Exempt personal information

20

Exempt or disclose third party information

21

Exempt information pertaining to advice, decision-making processes of government plans and positions etc.

22

Exempt information pertaining to testing procedures or audits

23

Exempt information pertaining to solicitor-client privilege

24

Exempt information subject to statutory prohibitions or other Acts of Parliament

25

Sever information

26

Exempt information to be published within 90 days

27(1)(4)

Notify third parties of their rights to provide comments/representations regarding the disclosure of their records

28

Receive third party representations; make a decision as to whether to disclose the record or part thereof; and, notify third party of right to appeal to Federal Court

29(1)

Disclose information on Information Commissioner's recommendation

33

Advise the Information Commissioner of any third-party involvement

35(2)

Make representations to the Information Commissioner during an investigation

37(4)

Release information to complainant

43(1)

Issue a notice to a third party of an application for Court review

44(2)

Issue a notice to an applicant that a third party has applied for Court review

52

Request special rules for hearings

69

Exclude Cabinet Confidences

71

Inspect and exempt information in manuals

72(1)

Prepare Annual Report to Parliament

77

Carry out responsibilities conferred to the Head of the institution by the regulations made under section 77 which are not included in the above

Delegation of Authority Schedule

Please see Access to Information Act for more information on the Access to Information Act.

Designation Pursuant to Section 73 of the Privacy Act

Sections and Powers, Duties or Functions

8(2)

Disclose personal information without the consent of the individual to whom it relates

8(4)

Keep copies of requests made under 8(2)(e), keep records of information disclosed pursuant to such requests and to make those records available to Privacy Commissioner

8(5)

Notify the Privacy Commissioner in writing of disclosure under paragraph 8(2)(m)

9(1)

Retain a record of use of personal information

9(4)

Notify the Privacy Commissioner of consistent use of personal information and update index accordingly

10

Include personal information in personal information banks

11(a)

Publish annually an index of all personal information banks and their respective contents

11(b)

Publish annually an index of all personal information held by the institution which is not part of a bank

14

Respond to request for access, within statutory deadline; give access or give notice

15

Extend time limit and notify applicant

16

Where access is refused

17(2)(b)

Language of access or alternative format of access

17(3)(b)

Access to personal information in alternative format

18(2)

May refuse to disclose information contained in an exempt bank

19(1)

Shall refuse to disclose information obtained in confidence from another government

19(2)

May disclose any information referred to in 19(1) if the other government consents to the disclosure or makes the information pubic

20

May refuse to disclose information injurious to federal-provincial affairs

21

May refuse to disclose information injurious to international affairs and/or defence

22

May refuse to disclose information injurious to law enforcement and investigation

23

May refuse to disclose information injurious to security clearances

24

May refuse to disclose information collected by the Canadian Penitentiary Service, the National Parole Service or the National Parole Board

25

May refuse to disclose information injurious to which could threaten the safety of individuals

26

May refuse to disclose information about other individuals, and shall refuse to disclose such information where disclosure is prohibited under section 8

27

May refuse to disclose information subject to solicitor-client privilege

28

May refuse to disclose information relating to an individual's physical or mental health where disclosure is contrary to the best interests of the individual

31

Receive notice of investigation by the Privacy Commissioner

33(2)

Make representations to the Privacy Commissioner during an investigation

35(1)

Receive the Privacy Commissioner's report of findings of the investigation and give notice of action taken

35(4)

Give complainant access to information after 35(1)(b) notice

36(3)

Receive Privacy Commissioner's report of findings of investigation of exempt

37(3)

Receive report of Privacy Commissioner's findings after compliance investigation where the institution has not complied with sections 4 to 8

51(2)(b)

Request that matter be heard and determined in National Capital Region

51(3)

Request and be given right to make representations in section 51 hearing

72(1)

Prepare Annual Report to Parliament

77

Carry out responsibilities conferred on the Head of the institution by the regulations made under section 77 which are not included above

Delegation of Authority Schedule

Please see Privacy Act for more information on the Privacy Act

Statistical Report on the Privacy Act

Name of institution: Crown-Indigenous Relations and Northern Affairs Canada

Reporting period: 4/1/2023 to 3/31/2024