Annual Report to Parliament on the Administration of the Privacy Act 2019-2020

Annual report to Parliament on the Administration of the Privacy Act 2019-2020
(PDF - 1.31 MB)

Table of Contents

• Introduction
  • Purpose of the Privacy Act
  • Mandate of Fisheries and Oceans Canada
• Organizational Structure
  • Departmental Organization
  • Access to Information and Privacy Secretariat Organization
• Delegation Order
• Highlights of the Statistical Report, 2019-20
  • Overview of 2019-20 Requests under the Privacy Act
  • Requests Closed During the Reporting Period
    • Disposition and Completion Time
    • Exemptions and Exclusions
    • Format of Information Released
    • Complexity
    • Deemed Refusals
    • Extensions
    • Consultations Received from Other Institutions and Organizations
    • Disclosures to Federal Investigative Bodies
    • Other Requests
• Training and Awareness
• Policies, Guidelines, Procedures and Initiatives
  • Strategic Collaboration
• Summary of Key Issues and Actions Taken on Complaints or Audits
• Monitoring Compliance
• Material Privacy Breaches
• Privacy Impact Assessments
• Public Interest Disclosures
• APPENDIX A: Delegation Order
• APPENDIX B: 2019-20 Statistical Report on the Privacy Act

Introduction

Purpose of the Privacy Act

The Privacy Act came into effect on July 1, 1983. The Act protects individuals’ personal information that is held by government institutions, and provides these individuals with a right of access to this information. In addition, the Privacy Act gives individuals rights over the collection, use and disclosure of their personal information.

Section 72 of the Privacy Act requires that the head of every government institution prepare and submit an annual report to Parliament, detailing the administration of the Act within the institution for each fiscal year.

This annual report describes how Fisheries and Oceans Canada (DFO) administered the Privacy Act from April 1, 2019 to March 31, 2020.

Mandate of Fisheries and Oceans Canada

The Department of Fisheries and Oceans Canada (DFO) supports strong and sustainable economic growth in our marine and fisheries sectors and contributes to a prosperous economy through global commerce by supporting exports and advancing safe maritime trade. The Department supports the innovation needed for a knowledge-based economy through research in expanding sectors such as aquaculture and biotechnology. The Department contributes to a clean and healthy environment and sustainable aquatic ecosystems for Canadians through habitat protection, oceans management and ecosystems research.

Organizational Structure

Departmental Organization

The department has a presence across Canada with the majority of employees working outside the national headquarters in one of the Department's seven DFO regions or four CCG operational regions. National objectives, policies, procedures, and standards for the Department and the Canadian Coast Guard are established at national headquarters, in Ottawa. Regions are responsible for delivering programs and activities in accordance with national and regional priorities and within national performance parameters.

Access to Information and Privacy Secretariat Organization

The Access to Information and Privacy (ATIP) Director reports to the Assistant Deputy Minister, Human Resources and Corporate Services. The ATIP Director is accountable for the development, coordination and implementation of effective ATIP-related policies, guidelines, systems and procedures. This accountability ensures that the Department’s responsibilities under the Privacy Act are met, and enables appropriate processing and proper disclosure of information.

The Assistant Deputy Minister, Human Resources and Corporate Services serves as the Chief Privacy Officer (CPO) responsible for ensuring that privacy issues are afforded visibility and considered a priority at DFO, as well as for working with senior management on strategic privacy matters. The CPO keeps abreast of legislative and policy changes to the existing federal privacy regime and ensures that the Department’s practices are in line with all legal and policy requirements.

The ATIP Secretariat is divided along two business lines; one processes requests under the Act and the other is responsible for all other activities related to the administration of the Act at DFO. The business lines are managed by Deputy Directors.

The business line responsible for processing requests and providing issues management is the Operations Division, and is supported by:

• an Intake Unit, which oversees all incoming requests and liaises with requesters, programs and regions;
• An Administrative Support Group, which handles scanning, file management and quality control; and
• a team of analysts and consultants responsible for the overall processing of requests.

The business line responsible for many of the remaining responsibilities related to the administration of the Act is the Policy and Privacy Division (PPD). PPD acts as the Department’s centre of expertise for matters concerning personal information and privacy protection. The division provides strategic issues management, develops, implements and maintains the Department’s privacy policy suite, oversees the Department’s disclosures under subsection 8(2) of the Privacy Act, investigates and responds to suspected privacy breach incidents, provides guidance to and assists program areas in conducting privacy impact assessments, maintains and updates the Department’s personal information banks, leads the privacy training program, liaises with the wider ATIP community, and monitors reviews and changes in the Privacy Act and related Regulations and policies. Other important work completed by PPD includes the provision of advice to program areas on complex privacy matters, liaising with the Office of the Privacy Commissioner, and providing disclosure recommendations related to investigations at DFO.

PPD is also responsible for tracking departmental performance, supporting the Operations Division with staffing processes, hiring contracted resources, maintaining case management technology, leading strategic projects to improve the overall delivery of the ATIP program, and coordinating the privacy awareness training program to ensure the ongoing sound application of the Act.

The ATIP Secretariat collaborates with a network of ATIP Contacts located in each region and sector who act as liaisons for their respective programs within the Department.

In total, throughout the course of this reporting period, the ATIP Secretariat employed approximately 10.63 full-time employees (FTEs) devoted to Privacy Act activities; this includes full-time employees, consultants, agency personnel and casual employees.

Delegation Order

Responsibility for the administration of the Privacy Act at DFO is delegated from the Minister to the Director and Deputy Directors of the ATIP Secretariat. A copy of the Delegation Order is found at Appendix A.

Highlights of the Statistical Report, 2019-20

The Statistical Report on the Privacy Act is prepared by government institutions to assist the Treasury Board of Canada Secretariat (TBS) to analyze trends and exercise oversight.

Overview of 2019-20 Requests under the Privacy Act

The analysis in this section compares data found in DFO’s 2019-20 Statistical Report on the Privacy Act with data from 2017-18, to produce a three-year trend analysis.

In 2019-20, DFO received 57 requests under the Privacy Act and had 12 requests outstanding from the previous reporting period. Of these 69 requests, DFO completed 64 and carried forward five into the next reporting period. As shown in Table 1 below, DFO completed 5% more requests under the Privacy Act compared to the previous reporting period.

Requests Closed During the Reporting Period

Disposition and Completion Time

Section 14 of the Act requires institutions to provide a response to the requester within 30 days of receipt of the request, or to notify the requester that an extension is required. Of the 64 requests completed during the reporting period, 42 requests (66%) were completed within 30 days and an additional 18 requests (28%) were completed within 60 days.

The 64 requests completed by the Department in 2019-20 were finalized in the following manner:

• all disclosed – for eight requests (12%), all relevant information was released in full to the requester;
• disclosed in part – for 37 requests (58%), requesters were granted partial access to information;
• all exempted – for one request (less than 2%), all relevant information was withheld from disclosure to the requester;
• no records exist – for 14 requests (22%), no relevant records existed under the control of the Department; and
• request abandoned – for four requests (6%), the requester abandoned their request.

Exemptions and Exclusions

Exemptions are provisions of the Act that allow or require the heads of federal government institutions to withhold information requested under the legislation. For requests completed during the reporting period, the Department invoked exemptions pursuant to paragraphs 19(1)(c), 22(1)(b), and sections 26 and 27 of the Privacy Act. As was the case in 2018-19, section 26 was the most frequently invoked provision. It was cited in 37 requests, and was used to protect personal information about individuals other than the requester. The second most cited exemption, invoked 17 times, was paragraph 22(1)(b), which was used to protect information which could be injurious to law enforcement and investigations.

Exclusions are provisions of the Act that remove certain records from the application of the legislation. Records excluded from the requirements of the Privacy Act include publicly available information and confidences of the Queen’s Privy Council (Cabinet Confidences) pursuant to sections 69 and 70, respectively. In 2019-2020 there were no requests for which records were excluded from the application of the Act.

Format of Information Released

When requests are complete, requesters may receive the information in paper or electronic formats, or they may view the records at any DFO office. During the reporting period, access to relevant documents was given, in whole or in part, for 45 requests. In 35 (78%) of these requests, information was released in an electronic format, and in 10 (22%) requests, information was released in paper format.

Complexity

During the reporting period, the ATIP Secretariat processed a total of 19, 874 relevant pages. Of the 19,874 pages processed, 6,624 pages (33%) were disclosed in whole or in part.

Of the requests completed, 26 requests required the processing of fewer than 100 relevant pages, 12 requests had 101-500 pages, seven requests had 501-1,000 pages, four requests had 1,001-5,000 pages, and one request had more than 5,000 pages.

The Department completed a number of requests involving other factors that increased their complexity, including:

• the review of records containing personal information about another individual that is interwoven with the personal information of the requester (50 requests);
• records located in a an office outside of national headquarters and/or audio recording containing personal information (four requests); and
• the requirement to consult with other institutions or organizations (eight requests).

Deemed Refusals

Of the 64 requests that were closed during the reporting period, the ATIP Secretariat closed only two requests past the statutory deadline. This represents a 96.9% rate of compliance which adds to the Department’s continuously high rate of compliance.

Extensions

Section 15 of the Act provides for the extension of statutory time limits if processing a request within the original time limit would unreasonably interfere with the operations of the Department, if consultations are necessary, if additional time is necessary for translation purposes, or for converting the personal information into an alternative format.

During the reporting period, 21 extensions were taken; extensions under subparagraph 15(a)(i) were taken 15 times because processing the request within the original time limit would unreasonably interfere with the operations of the Department, and six extensions were taken under subparagraph 15(a)(ii) for consultations. All extensions taken were for a period of 16 to 30 days beyond the initial 30 days statutory deadline.

Consultations Received From Other Institutions and Organizations

When other institutions and organizations retrieve information that concerns or originates from DFO in response to Privacy Act requests, they may consult the DFO ATIP Secretariat for recommendations on disclosure. Other government institutions are defined as federal institutions subject to the Privacy Act. Other organizations include the governments of the provinces, territories and municipalities, and of other countries.

In 2019-20, DFO received one consultation request consisting of 14 pages from a Government of Canada institution. The consultation request was completed within 30 days and DFO recommended a partial disclosure of the records.

No requests from other organizations were received during the reporting period.

Disclosures to Federal Investigative Bodies

Subsection 8(2) of the Privacy Act describes certain instances in which personal information under the control of a federal government institution may be disclosed without the consent of the individual to whom the information relates. Paragraph 8(2)(e) allows institutions to disclose personal information to a federal investigative body specified in Schedule II of the Privacy Regulations on the written request of the body for the purpose of enforcing any law of Canada or any province or carrying out a lawful investigation.

In 2019-20, DFO made no disclosures pursuant to paragraph 8(2)(e).

Other Requests

The ATIP Secretariat conducts a significant amount of informal privacy-related activities in addition to processing privacy requests, developing policy tools, and developing and conducting training sessions. These activities include:

• working with Departmental programs to mitigate privacy risks;
• managing and investigating potential privacy breaches;
• disclosing information pursuant to subsection 8(2) of the Privacy Act;
• reviewing and preparing advice on investigation reports;
• responding to requests for guidance from within the Department on privacy impact assessments, privacy notice statements, information sharing agreements and contracts that include the sharing of personal information; and
• releasing information outside of the prescribed formal process under the Act, where appropriate.

Table 3 below illustrates the workload associated with administering the Privacy Act apart from formal privacy requests.

Investigations completed for potential privacy breaches increased from the previous reporting period. A possible reason for the increased privacy breach investigation activity is that DFO’s proactive training efforts have increased Departmental awareness of its personal information protection responsibilities, including reporting suspected breaches. The DFO Standard on Privacy Breaches requires all suspected privacy breaches to be reported to ATIP within 24 hours. This message is reinforced in privacy training and awareness sessions.

During this reporting period, the ATIP Secretariat saw a 44% increase in the number of investigation reports reviewed before making a disclosure to the involved parties.

Training and Awareness

DFO makes significant efforts to promote awareness of federal access and privacy legislation and the corresponding responsibilities of DFO employees, providing ongoing individual and group training sessions. ATIP training is mandatory for all DFO executives and individuals acting in an executive position for more than four months. While regions, sectors and divisions are encouraged to request training as the need arises, the ATIP Secretariat also offered semi-annual awareness sessions to all employees of the Department.

The ATIP Secretariat also delivered training sessions to many sectors of the Department on the paper reduction initiative, to bring awareness to the implementation and onboarding of the new electronic transmittal process.

During the 2019-20 reporting period, the Department provided ATIP training to 805 participants. While some of the sessions were focused exclusively on access to information or privacy protection, others included elements of both access to information and privacy.

In addition to training offered by DFO, the Department encourages employees to take ATIP training offered by the Canada School of Public Service (CSPS). The ATIP Secretariat continued its efforts to promote the CSPS training in 2019-20. During this reporting period, 463 DFO and CCG participants completed CSPS ATIP-related training courses. The following table highlights all ATIP-related training activities undertaken during the reporting period.

Policies, Guidelines, Procedures and Initiatives

The Policy & Privacy Directorate of ATIP (PPD) continues to revise DFO’s ATIP policy suite where appropriate. The suite of policy tools was developed by the ATIP Secretariat to help DFO employees understand their responsibilities with regards to the protection of personal information. Included in the policy suite are the DFO Privacy Policy, Directive on Privacy Practices, the Standard on Privacy Breaches, the Standard on Permissible Disclosures of Personal Information and related tools such as Guidelines for the Informal Release of Information, the Privacy Impact Assessment: Needs Analysis, the Privacy Notice Template and privacy breach reporting forms.

PPD continued to review forms used by Internal Services within DFO and where necessary, developed privacy notice statements that meet all legislative and policy requirements. PPD also actively monitors Parliamentary questions in order to support timely and effective responses and to proactively identify potential files requiring ATIP’s review.

During the reporting period, the ATIP Secretariat also implemented a digital strategy that includes a paper reduction initiative, in order to modernize how requests under the Access to Information Act and the Privacy Act (collectively referred to as ATIP) are processed within the Department. The initiative is envisioned to increase productivity and improve the overall process for treating ATIP requests across the Department including: increased efficiency when retrieving and transmitting records relating to ATIP requests, faster response times, and significant cost savings in both human resources and material costs. The expected outcome of this initiative also includes a significant reduction in the Department’s overall paper consumption, as well as key expenses incurred when processing ATIP requests.

Strategic Collaboration

The ATIP Secretariat continues to be an active participant in the development and renewal of Departmental policy and guidance documents within DFO. Through ATIP’s participation in these processes, personal information protection principles are embedded in Departmental policy documents to ensure compliance with the Privacy Act. 

Impact of COVID-19 on the administration of the Privacy Act

Late in the reporting period when met with the challenge of the COVID-19 global pandemic, ATIP found innovative approaches to move forward on requests and policy work. The paper reduction initiative described above was launched before the pandemic and proved to be a key digital business process in the remote work environment. Another approach involves using a digital delivery platform, instead of mail, to transmit records to requesters, and ATIP has been taking steps toward implementation. The digital delivery platform will not only facilitate the electronic delivery of responsive records to requesters, it will also allow for consultation packages to be sent to other government institutions and third parties. The digital platform is expected to be fully implemented during the next reporting period, advancing ATIP farther towards a completely paperless environment.

Although privacy and access to information are quasi-constitutional rights, ATIP is not considered a critical service and function within the organization. Nevertheless, the ATIP Secretariat remains committed to continuing to provide services to Canadians during the pandemic. As the pandemic continues, ATIP is providing privacy advice on an ongoing basis to inform program initiatives and decisions.

Despite the challenges, ATIP is continuing to find ways to support access to information and privacy to serve Canadians.

Summary of Key Issues and Actions Taken on Complaints or Audits

The Department reviews the outcomes of each Privacy Commissioner investigation and audit. Where appropriate, DFO incorporates lessons learned into business processes.

Monitoring Compliance

DFO makes every effort to meet statutory deadlines and actively monitors the time taken to process privacy requests and requests for the correction of personal information. Monitoring begins as soon as a request is received by the ATIP Secretariat, entered into the case management system and assigned to an analyst. All requests, including requests for consultations, and requests for informal advice or review of records, are entered into the case management system for tracking. This electronic tracking of deadlines is essential as analysts work on numerous requests, each with multiple actions coming due, at any given time. Analysts meet with their team leaders on a weekly basis to identify issues with requests that might result in delays. Issues are raised with the ATIP management team, if necessary. The Director and Deputy Directors of the ATIP Secretariat get involved in files where they can use their authority as the Minister’s delegates under the Privacy Act to promote compliance with deadlines and deliverables.

Material Privacy Breaches

A privacy breach is defined by the Office of the Privacy Commissioner as the loss of, unauthorized access to, or disclosure of, personal information. A material privacy breach is defined by the Treasury Board Secretariat (TBS) as involving sensitive information that could reasonably be expected to cause serious injury or harm to the individual and/or involves a large number of affected individuals.

During the reporting period, one privacy breach reported to the DFO ATIP Secretariat was deemed to be material.

Although there was a large number of affected individuals (employees), the investigation of the incident revealed that the probability of impact to the individuals was low, given the type of personal information involved and the mitigations applied. DFO reported this breach to the OPC and TBS and measures were taken to avoid a recurrence.

Privacy Impact Assessments

To fulfill its mandate, many of DFO’s activities require the collection, use and disclosure of personal information. In accordance with Treasury Board Secretariat policies and directives, the Department uses Privacy Impact Assessments (PIAs) as a risk management tool to determine whether privacy risks are present in new or substantially modified Departmental programs, initiatives or projects that collect, use and retain personal information.

Public Interest Disclosures

Subsection 8(2) of the Privacy Act describes certain instances in which personal information under the control of a federal government institution may be disclosed without the consent of the individual to whom the information relates.

Paragraph 8(2)(m) allows institutions to disclose personal information in circumstances where the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure, or where disclosure would clearly benefit the individual to whom the information relates.

In 2019-20, DFO made no disclosures under paragraph 8(2)(m) .

APPENDIX A: Delegation Order

APPENDIX B: 2019-20 Statistical Report on the Privacy Act

Statistical Report on the Privacy Act

Name of institution: Fisheries and Oceans Canada

Reporting period: 2019-04-01 to 2020-03-31

Section 1: Requests Under the Privacy Act

Section 2: Requests Closed During the Reporting Period

2.5 Complexity

2.6 Closed requests

2.7 Deemed refusals

Section 3: Disclosures Under Subsections 8(2) and 8(5)

Section 4: Requests for Correction of Personal Information and Notations

Section 5: Extensions

Section 6: Consultations Received From Other Institutions and Organizations

Section 7: Completion Time of Consultations on Cabinet Confidences

Section 8: Complaints and Investigations Notices Received

Section 9: Privacy Impact Assessments (PIA) and Personal Information Banks (PIB)

Section 10: Material Privacy Breaches

Section 11: Resources Related to the Privacy Act