Annual Report on the Administration of the Privacy Act 2022‑2023

Table of contents

• Introduction
• Organizational Structure
• Delegation of Authority
• Statistics
• Interpretation of the Statistical Report on the Privacy Act for 2022-2023
  • Section 1. Requests Under the Privacy Act
  • Section 2. Informal Requests
  • Section 3. Requests Closed During the Reporting Period
  • Section 4. Disclosures Under Subsections 8(2) and 8(5)
  • Section 5. Requests for Corrections Received of Personal Information and Notations
  • Section 6. Extensions
  • Section 7. Consultations Received from Other Institutions and Organizations
  • Section 8. Completion Time of Consultations on Cabinet Confidences
  • Section 9. Complaints and Investigations Notices Received
  • Section 10. Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)
  • Section 11. Privacy Breaches
  • Section 12. Resources Related to the Privacy Act
• Highlights
  • Training and Awareness
  • Policies, Guidelines, Procedures, and Directives
  • Complaints
  • Monitoring Compliance
• Appendix A: Delegation Order
• Appendix B: Statistical Report on the Privacy Act for 2022-2023
• Appendix C: Supplementary Statistical Report on the Access to Information Act and Privacy Act for 2022-2023

Introduction

The Privacy Act (Revised Statutes of Canada, Chapter A-1, 1985) was proclaimed on July 1, 1983. The Privacy Act (the Act) extends to individuals the right of access to information about themselves held by the government, subject to specific and limited exceptions. The Act also protects an individual's privacy by preventing others from having access to personal information and gives individuals substantial control over its collection, use and disclosure.

This annual report describes how the Canada School of Public Service (the School) administered its responsibilities under the Act during the 2022-2023 fiscal year. The School is pleased to present its Annual Report to Parliament in accordance with section 72 of the Act.

Established on April 1, 2004, under the Public Service Modernization Act and operating under the authority of the Canada School of Public Service Act (CSPS Act), the School supports deputy head responsibilities in providing leadership and professional development across the public service by identifying organizational needs and designing and delivering high-quality, practical programs that address the key development requirements of public service employees.

The School, a departmental corporation, is mandated under the CSPS Act to:

• encourage pride and excellence in the public service
• foster a common sense of purpose, values, and traditions in the public service
• assist deputy heads in meeting the learning needs of their organizations
• conduct research and encourage greater awareness of public management, administration, and innovation

The School parallels that of a corporate training and development institution for its client organizations. It supports common public service learning at all levels and across more than 90 federal departments and agencies, while federal organizations focus on mandate-specific training and development. It has a legislative mandate to provide a broad range of learning activities to build public sector capacity at all levels, including management excellence, within the public service. It plays a key role in helping public servants serve Canadians with excellence in a digital age, where Canadians expect their government to be effective, transparent, and open by default.

Organizational Structure

The School's access to information and privacy (ATIP) management falls under the responsibility of the ATIP, Parliamentary and Cabinet Affairs, and Special Projects Unit. This unit reports to the Director General, Communications and Engagement, and is led by a Manager, also the School's ATIP Coordinator, as well as two Senior Advisors, one Advisor and two Analysts. These employees form the dedicated resources allocated to the administration of the Privacy Act.

In addition to its activities related to parliamentary affairs and government accountability, the responsibilities of the School's ATIP, Parliamentary and Cabinet Affairs, and Special Projects Unit (the School) include the following:

• processing requests for information submitted under the Access to Information Act and requests for personal information pursuant to the Privacy Act in accordance with legislation, regulations and Treasury Board of Canada Secretariat (TBS) policies and guidelines
• responding to ATIP consultations received from other government institutions and organizations
• providing advice and guidance to requesters on the application of ATIP legislation, as well as promoting awareness and training to School employees
• collaborating with the Office of the Information Commissioner and the Office of the Privacy Commissioner on the resolution of complaints
• reviewing departmental documents prior to their proactive disclosure on public facing websites
• ensuring that the School's information holdings (classes of records and personal information banks) are updated annually in its Info Source chapter
• preparing the statistical reports and the annual reports on the administration of the Access to Information Act and on the administration of the Privacy Act
• participating in ATIP community activities, such as the Treasury Board Secretariat-led ATIP coordinators' and ATIP practitioners' meetings and working groups
• raising awareness on a variety of access to information and privacy-related matters to ensure compliance with access to information and privacy legislation.

Section 73.1 of the Privacy Act allows government institutions to provide services related to access to personal information to another government institution that is presided over by the same minister. In 2022-23, the Canada School of Public Service's ATIP Office (the ATIP Office) did not provide any such services.

Delegation of autority

In July 2022, the School's President delegated full authority for the purposes of the Act to the Director General, Communications and Engagement, and to the ATIP, Parliamentary and Cabinet Affairs, and Special Projects Unit's Manager, the ATIP Coordinator. A copy of the signed delegation instrument under the Act took effect on July 12, 2022, and is included as Appendix A.

Statistics

Interpretation of the Statistical Report on the Privacy Act for 2022-2023

The following outlines the information contained in the Statistical Report on the Privacy Act for 2022-2023 reporting period, which is included as Appendix B.

Section 1. Requests Under the Privacy Act

1.1 Number of requests received

During this reporting period (2022-2023), the Canada School of Public Service's ATIP Office (the ATIP Office) received eight new requests and carried forward three requests from the previous reporting period (2021-2022), for a total of 11 requests – of which 10 were closed.

Of the three requests carried forward from the previous reporting period (2021-2022), all three were carried forward within their legislative timelines (including extensions).

The ATIP Office carried forward one request into the 2023-2024 reporting period; which was within its legislative timeline. This one request was from the 2021-2022 reporting period.

1.2 Channels of requests

Of the eight requests received, five were received from the TBS Online Portal and three were received by email.

Section 2. Informal Requests

An informal request is defined as a request for information made to the ATIP Office of a Government of Canada institution that is either not made or not processed under the Act. There are no timelines for responding under the Act for informal requests. The requester also has no statutory right of complaint to the Privacy Commissioner of Canada.

2.1 Number of informal requests

The ATIP Office received six informal requests during this reporting period.

2.2 Channels of informal requests

All six informal requests were received by email.

2.3 Completion time of informal requests

All six informal requests required less than 15 days to complete.

2.4 Pages released informally

The six informal requests resulted in 23 pages processed and released informally.

Pages released informally are requests for documents that were not previously released by the institution in response to a formal request pursuant to the Act.

Section 3. Requests Closed During the Reporting Period

3.1 Disposition and completion time

Of the 10 requests closed during this reporting period: eight (or 80%) were completed within 30 days; one (or 10%) required 31 to 60 days to complete; and one (or 10%) required 61 to 120 days to complete.

Of the 10 requests closed: no relevant records existed under the control of the School for three request (or 30%); and two requests (or 20%) were abandoned by the requester. The remaining five requests were released in the following manner: three (or 30%) were disclosed in part; and two (or 20%) were all disclosed.

3.2 Exemptions

The only invoked exemption cited in three closed requests was section 26 of the Act (protection of personal information)

Section 26 - the head of a government institution may refuse to disclose any personal information requested under subsection 12(1) about an individual other than the individual who made the request, and shall refuse to disclose such information where the disclosure is prohibited under section 8.

3.3 Exclusions

No exclusion provisions were applied to requests that were closed in this reporting period.

3.4 Format of information released

Of the 10 requests closed: five were released in electronic format; the remaining five requests were either abandoned or generated no responsive records.

Of the five requests released in electronic format, one also contained video recordings.

3.5 Complexity

The following sections detail several factors impacting the complexity of requests that were completed during this reporting period.

3.5.1 Relevant pages processed and disclosed for paper and e-records formats

Of the 10 requests closed: seven requests (includes five that had responsive records and two that were abandoned) generated 3,057 pages processed; and three had no responsive records. The total amount of relevant pages disclosed was 1,110 (in full or in part). The remaining 1,947 pages were either withheld pursuant to exemptions under the Act or were considered not relevant and/or duplicate documents.

3.5.2 Relevant pages processed by request disposition for paper and e-records formats

Of the eight closed requests that generated responsive records: three required processing of 100 pages or less, resulting in a total of 79 pages processed; one request fell within the 101-500 pages processed criteria, resulting in the processing of a total of 177 pages; three requests fell within the 1001-5000 pages processed criteria, resulting in the processing of a total of 7,040 pages; and one request fell within the more than 5000 pages processed criteria, resulting in the processing of a total of 5,801 pages.

3.5.3 Relevant minutes processed and disclosed for audio formats

The ATIP Office did not process any relevant minutes in audio format.

3.5.4 Relevant minutes processed and disclosed for audio formats by size of requests

The ATIP Office did not process nor disclose any relevant minutes in audio format for any requests.

3.5.5 Relevant minutes processed and disclosed for video formats

The ATIP Office processed one request that produced video recordings as well as documents. Of this one request, 26 minutes of video recordings were processed and 25 minutes were released.

3.5.6 Relevant minutes processed per request disposition for video formats by size of requests

The video file included 26 minutes of recordings processed and resulted in 25 minutes of video recordings disclosed, which fell within the "less than 60 minutes processed" criteria.

3.5.7 Other complexities

There were no complexities to any of the requests closed.

3.6 Closed requests

The following section details the number of requests closed within the legislated timelines.

3.6.1 Number of requests closed within legislated timelines

Of the 10 requests closed, all were completed within their legislative timelines – indicating a compliance rate of 100.00%.

Table 3.6.1 Requests closed within legislative timelines - Multi year overview

3.7 Deemed refusals

The following sections provide context on the rationales applied to requests considered deemed refusal during this reporting period.

3.7.1 Reasons for not meeting legislated timelines

There were no requests closed past the legislative timeline. This demonstrates the ATIP Office's ongoing commitment to ensuring timely access to records and compliance with the legislation.

3.7.2 Request closed beyond legislated timelines (including any extension taken)

There were no requests closed beyond the legislative timeline.

3.8 Requests for translation

During the reporting period, there were no instances where a requester asked for responsive records be translated to another official language.

3.8 Requests for translation

There were no instances where a requester requested that the responsive records be translated to another official language.

Section 4. Disclosures Under Subsections 8(2) and 8(5)

Permissible disclosure pursuant to subsection 8(2) of the Actdescribes the circumstances under which personal information under the control of government institutions may be disclosed without the consent of the individual to whom the information pertains.

During this reporting period, the ATIP Office did not treat any requests for information to be disclosed pursuant to subsections 8(2) and 8(5).

Section 5. Requests for Correction of Personal Information and Notations

The ATIP Office did not receive any requests for correction of personal information or notations.

Section 6. Extensions

6.1 Requests for extensions

Subsection 15 of the Privacy Act allows the head of a government institution to extend the initial period under the following circumstances:

1. maximum of thirty days if:
   1. meeting the original time limit would unreasonably interfere with the operations of the government institution, or
   2. consultations are necessary to comply with the request that cannot reasonably be completed within the original time limit

A total of two extensions were taken on requests closed during this reporting period, pursuant to subsection 15(a) of the Privacy Act, one was due to further review required to determine exemptions, and one was due to a large volume of records

6.2 Length of extensions

The ATIP Office applied two extensions during this reporting period, which fell within the criteria of 16 to 30 days.

Section 7. Consultations received from other Government of Canada institutions and other organizations

7.1 Consultations received from other Government of Canada institutions and other organizations

The ATIP Office did not receive any requests for consultations from another Government of Canada institution or from other organizations.

7.2 Recommendations and completion time for consultations received from other Government of Canada institutions

The ATIP Office did not receive any requests for consultations from another Government of Canada institution.

7.3 Recommendations and completion time for consultations received from other organizations

The ATIP Office did not receive any requests for consultation from other organizations including any governments of provinces, territories, municipalities and of other countries.

Section 8. Completion Time of Consultations on Cabinet Confidences

8.1 Requests with legal services

The ATIP Office did not send any consultation requests on Cabinet Confidences to the Department of Justice.

8.2 Requests with Privy Council Office

The ATIP Office did not send any consultation requests to the Privy Council Office.

Section 9. Complaints and Investigations Notices Received

At the start of this reporting period, the ATIP Office had two active complaints outstanding from previous reporting periods: one from the 2019-2020 reporting period; and one from the 2020-2021 reporting period.

The ATIP Office received one formal report of findings which was resolved in collaboration with the OPC, the request was closed as well-founded.

There is currently one outstanding complaint from the 2020-2021 reporting period, which is being carried forward to the 2023-2024 reporting period.

The annual statistical report requires institutions to identify sections of the Act under complaint:

• Section 31: captures a new formal complaint from the OPC
• Section 33: requires the institution to make representations against a complaint to the OPC
• Section 35: is the formal finding of the OPC and closure of the complaint

Section 10. Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

10.1 Privacy Impact Assessments

A Privacy Impact Assessment (PIA) is a risk evaluation of the flow of personal information held within a program or service. This process enables the Department to determine whether new or substantially modified technologies, information systems, initiatives, and proposed programs or policies meet federal government privacy requirements.

During this reporting period, the ATIP Office developed, approved and implemented actions in relation to one PIA, and two PIAs were modified. All were submitted to the OPC and TBS for review and suggestions, and all executive summaries were published on the School's website.

Table 10.1 Privacy Impact Assessments - Multi year overview

10.2 Institution-specific and central personal information banks

The ATIP Office currently has five institution-specific Personal Information Banks.

Section 11. Privacy Breaches

11.1 Material privacy breached reported

The ATIP Office supports the Department in investigating potential privacy breaches. The ATIP Office reported no material privacy breaches during this reporting period. 

Material privacy breaches are at the highest risk and impact and are defined as: involving sensitive personal information and could reasonably cause serious injury or harm to the individual and/or involves a large number of impacted individuals.

11.2 Non-material privacy breached reported

The ATIP Office addressed five non-material privacy breaches.

Section 12. Resources Related to the Privacy Act

12.1 Allocated costs

During the reporting period, the ATIP Office spent a total of $172,566. This amount does not include the resources required  of the School's program areas to meet the requirements of the Act.

12.2 Human resources

A total of 1.999 combined full-time equivalents (FTEs) were dedicated to privacy-related activities.

Highlights

2022-2023 Points of interest

Training and Awareness

The ATIP, Parliamentary and Cabinet Affairs, and Special Projects Unit (ATIP Office) informs and guides employees and requesters regarding the administration and the requirements of the Privacy Act through various forms of communication. During the reporting period, the ATIP Office responded to a significant amount of requests for advice and guidance on various subjects pertaining to the Act.

The ATIP Office's intranet site is continuously updated as more resources are developed to provide School employees and liaison officers with key information on access to information and privacy, and to ensure individual and institutional accountabilities in the accordance with the Act.

In addition to the material developed by the ATIP Office, the development and provision of institutional training on the Basics of Access to Information and Privacy and on the Privacy and its Policies have been provided to School employees; a total of four sessions have been held, in both official languages:

• four sessions on the Basics of Access to Information and Privacy: 18 participants

Data Privacy Day Activities (January 26, 2023)

• Privacy Impact Assessments (PIA 101): 34 participants

Privacy Awareness Week 2022 Activities (May 2-8, 2022)

• OPC Presentation offered to all federal government employees: Publicly available personal information – Privacy as the foundation of trust: 500 participants
• Test Your Knowledge Quiz

Policies, Guidelines, Procedures, and Initiatives

The ATIP Office's focus has been on raising awareness, and developing and revising all its guidelines and procedures over the last two years. In the last year specifically, it has developed and implemented the following:

• Development of presentation: The Basics of Access to Information and Privacy;
• Development of presentation: Privacy and its Policies : A Toolbox for you;
• The revision of PIA Checklist and templates;
• The revision of the Privacy Breach Protocol;
• The revision of the CSPS Privacy Protocol;
• Job aids were developed for School employees to support requirements set out in the administration of the Act.

Complaints

At the start of this reporting period, the ATIP Office had two active complaints outstanding from previous reporting periods: one from the 2019-2020 reporting period; and one from the 2020-2021 reporting period.

The ATIP Office received one formal report of findings which was resolved in collaboration with the OPC, the request was closed as well-founded.

There is currently one outstanding complaint from the 2020-2021 reporting period, which is being carried forward to the 2023-2024 reporting period.

Monitoring Compliance

Since the School is a small institution with a relatively low number of requests in comparison with other institutions, senior management is kept informed of the time to process access to information requests by means of a weekly report and through ongoing verbal briefings. The ATIP Office meets to discuss the weekly report with the Director General, Communications and Engagement, on a weekly basis. These reports are also shared with the President, Vice-Presidents, Directors General and liaisons officers on a weekly basis.

Requests closed within legislative timelines - Multi year overview

COVID Impacts

Due to social distancing measures in place for School employees, we have had partial capacity in regards to processing paper records responsive to ATIP requests. As such, there was only minimal impact to our institution's ability to fulfill its Access to Information Act and Privacy Act responsibilities. The mitigation measures applied included, in part, providing extensions to our Offices of Primary Interest to provide the responsive records for several requests.

Appendix A: Delegation order

Privacy Act

The President of the Canada School of Public Service, pursuant to section 73 of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the President, as the head of the Canada School of Public Service, under the provisions of the Act and related regulations set out in the schedule opposite each position. This designation replaces all previous delegation orders.

Appendix B: Statistical Report on the Privacy Act for 2022-2023

Name of institution: Canada School of Public Service

Reporting period: 2022-04-01 to 2023-03-31

Section 1: Requests Under the Privacy Act

Section 2: Informal Requests

Section 3: Requests Closed During the Reporting Period

3.5 Complexity

3.6 Closed requests

3.7 Deemed refusals

Section 4: Disclosures Under Subsections 8(2) and 8(5)

Section 5: Requests for Correction of Personal Information and Notations

Section 6: Extensions

Section 7: Consultations received from other Government of Canada institutions and other organizations

Section 8: Completion Time of Consultations on Cabinet

Section 9: Complaints and Investigations Notices Received

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

Section 11: Privacy Breaches

Section 12: Resources Related to the Privacy Act

Note: Enter values to three decimal places.

Appendix C: Supplementary Statistical Report on the Access to Information Act and Privacy Act for 2022-2023

Name of institution: Canada School of Public Service

Reporting period: 2022-04-01 to 2023-03-31

Section 1: Capacity to Receive Requests under the Access to Information Act and the Privacy Act

Enter the number of weeks your institution was able to receive ATIP requests through the different channels.

Section 2: Capacity to Process Records under the Access to Information Act and the Privacy Act

Section 3: Open Requests and Complaints Under the Access to Information Act

Section 4: Open Requests and Complaints Under the Privacy Act

Section 5: Social Insurance Number (SIN)

Section 6: Universal Access under the Privacy Act

Contact us Subscribe to the GCLearning newsletter

---

Features

Event: Recognizing the Resilience of Indigenous Women and the 2SLGBTQIA+ Community

(May 3, 2024)

Event: GBA Plus in Action: Respect, Relationships, and Intersectional Leadership in Gwaii Haanas

(May 6, 2024)

Event: Privacy Awareness Week 2024: Navigating Privacy in the Digital Workplace

(May 8, 2024)

Follow:

• Twitter
• YouTube
• LinkedIn
• GCLearning newsletter
• RSS