Annual Report on the Privacy Act 2023‑2024

Table of contents

• Introduction
• Organizational Structure
• Delegation of Authority
• Statistics
• Interpretation of the Statistical Report
  • Section 1. Requests Under the Privacy Act
  • Section 2. Informal Requests
  • Section 3. Requests Closed During the Reporting Period
  • Section 4. Disclosures Under Subsections 8(2) and 8(5)
  • Section 5. Requests for Corrections Received of Personal Information and Notations
  • Section 6. Extensions
  • Section 7. Consultations Received from Other Institutions and Organizations
  • Section 8. Completion Time of Consultations on Cabinet Confidences
  • Section 9. Complaints and Investigations Notices Received
  • Section 10. Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)
  • Section 11. Privacy Breaches
  • Section 12. Resources Related to the Privacy Act
• Highlights
  • Training and Awareness
  • Policies, Guidelines, Procedures, and Directives
  • Complaints
  • Monitoring Compliance
• Appendix A: Delegation Order
• Appendix B: Statistical Report on the Privacy Act
• Appendix C: Supplementary Statistical Report on the Access to Information Act and Privacy Act

Introduction

The Canada School of Public Service (the School) is pleased to present to Parliament its annual report on the administration of the Privacy Act (the Act). This report is prepared and tabled in Parliament in accordance with section 72 of the Act and describes how the School administered and fulfilled its obligations under the Act between April 1, 2023 and March 31, 2024.

Purpose of the Privacy Act

The purpose of the Act is to provide:

• individuals with the right to access and correct personal information about themselves that is under the control of a government institution;
• the legal framework for the collection, retention, use, disclosure, disposition, and accuracy of personal information in the administration of programs and activities by government institutions subject to the Act.

Under the Act, personal information is defined as "information about an identifiable individual that is recorded in any form." Examples include information relating to:

• the national or ethnic origin, colour, religion, age, or marital status of an individual;
• the education or the medical, criminal, financial or employment history of an individual;
• the address, fingerprints or blood type of an individual;
• any identifying number, symbol or other particular identifier assigned to an individual.

The Privacy Act (R.S.C. 1985, c. P-21) was proclaimed into force on July 1, 1983.

About the Canada School of Public Service

Background

The Canada School of Public Service (the School) was created on April 1, 2004, when the legislative provisions of Part IV of the Public Service Modernization Act came into force. The School has been part of the Treasury Board Portfolio since July 2004. Operating under the authority of the Canada School of Public Service Act, the School was created from an amalgamation of the following three organizations: the Canadian Centre for Management Development, Training and Development Canada, and Language Training Canada. It reports to Parliament through the Minister of the Treasury Board, who is the Minister responsible for the School.

Read more about the School's mandate

Responsibilities

The School has the legislative mandate to provide a range of enterprise‐wide learning activities to build individual and organizational capacity and management excellence within the core public service. Using a broad ecosystem of learning products, delivery approaches, and an online learning platform, the School provides public servants with the foundational knowledge, skills, and competencies now and in the future, to serve Canadians with excellence.

The School has one strategic outcome: Federal public service employees have the common knowledge, skills and competencies to fulfil their responsibilities in serving Canadians.

For information about the School's core responsibilities, planned results and resources, reporting framework and more, consult our Departmental Plan 2024-2025.

Organizational Structure

The School's Access to Information and Privacy (ATIP) Office is responsible for the coordination and implementation of policies, guidelines, and procedures to ensure departmental compliance with the Access to Information Act as well as the Privacy Act. The ATIP Office is also responsible for responding to requests made under the Acts.

The ATIP and Parliamentary and Cabinet Affairs Office is housed within the Communications and Engagement Directorate (C&E). When fully staffed, the School's ATIP Office has a total of six employees.

In addition to activities related to the Privacy Act, the responsibilities of the School's ATIP, Parliamentary and Cabinet Affairs Unit include the following:

• processing requests for information submitted under the Access to Information Act and requests for personal information pursuant to the Privacy Act in accordance with legislation, regulations and Treasury Board of Canada Secretariat (TBS) policies and guidelines;
• responding to ATIP consultations received from other government institutions and organizations;
• providing advice and guidance to requesters on the application of ATIP legislation, as well as promoting awareness and training to School employees;
• collaborating with the Office of the Information Commissioner and with the Office of the Privacy Commissioner on the resolution of complaints;
• reviewing departmental documents prior to their proactive disclosure on the public facing websites;
• ensuring that the School's information holdings (classes of records and personal information banks) are updated annually in its Info Source chapter;
• preparing the statistical reports and the annual reports on the administration of the Access to Information Act and on the administration of the Privacy Act;
• participating in ATIP community activities, such as the Treasury Board Secretariat-led ATIP coordinators' and ATIP practitioners' meetings and working groups;
• raising awareness on a variety of access to information and privacy-related matters to ensure compliance with access to information and privacy legislation.

The ATIP Office works closely with eight departmental ATIP liaison officers who are responsible for ensuring that requests are handled promptly and that relevant records are forwarded to the ATIP Office within prescribed deadlines.

Section 73.1 of the Privacy Act allows government institutions to provide services related to access to personal information to another government institution that is presided over by the same minister. In 2023–24, the Canada School of Public Service's ATIP Office did not provide any such services.

Further to reporting requirements for non-operational "paper" subsidiaries, the School did not have any such entities during this reporting period.

Delegation of Authority

Pursuant to section 73(1) of the Privacy Act, the School's President delegated full authority for the purposes of the Act, to the Director General of the Communications and Engagement Directorate. A copy of the signed delegation instrument for the Act, which took effect on September 21, 2023, can be found as Appendix A.

Statistics

Interpretation of the Statistical Report Report

The following outlines the information contained in the Statistical Report on the Privacy Act for the 2023–2024 reporting period, which is included as Appendix B.

Section 1. Requests Under the Privacy Act

1.1 Number of requests

During this reporting period (2023-2024), the School's ATIP Office received 13 new requests and carried forward one request from the previous reporting period (2022-2023), for a total of 14 requests – of which all 14 were closed during the reporting period.

Of the one request carried forward from the previous reporting period (2022-2023), it was carried forward within its legislative timeline (including extensions).

The ATIP Office did not carry forward any requests into the 2024-2025 reporting period.

1.2 Channels of requests

Of the 13 requests received, 11 were received via the TBS Online Portal and two were received by email.

Section 2. Informal Requests

An informal request is defined as a request for information made to the ATIP Office of a government institution that does not follow the formal procedures outlined in the Act. There are no prescribed timelines for responding and the requestor has no statutory right of complaint to the Privacy Commissioner of Canada.

2.1 Number of informal requests

The ATIP Office did not receive any informal requests during the reporting period.

2.2 Channels of informal requests

The ATIP Office did not receive any informal requests during this reporting period; consequently there are no channels of informal requests to report.

2.3 Completion time of informal requests

The ATIP Office did not receive any informal requests during this reporting period; consequently there is no completion time of informal requests to report.

2.4 Pages released informally

The ATIP Office did not receive any informal requests during this reporting period; consequently no pages were processed and released informally.

Section 3. Requests Closed During the Reporting Period

3.1 Disposition and completion time

Of the 14 requests closed during this reporting period: 10 (72%) were completed within 30 days; two (14%) required 31 to 60 days to complete; and two (14%) required 61 to 120 days to complete.

Of the 14 requests closed: no relevant records existed under the control of the School for three request (21%); and five requests (36%) were abandoned by the requester. The remaining six requests were released in the following manner: four (29%) were disclosed in part; and two (14%) were all disclosed.

3.2 Exemptions

The only invoked exemption cited in four closed requests was section 26 of the Act (protection of personal information).

Section 26 - the head of a government institution may refuse to disclose any personal information requested under subsection 12(1) about an individual other than the individual who made the request, and shall refuse to disclose such information where the disclosure is prohibited under section 8.

3.3 Exclusions

No exclusion provisions were applied to requests that were closed in this reporting period.

3.4 Format of information released

Of the 14 requests closed: six were released in electronic format; the remaining eight requests were either abandoned or generated no responsive records.

3.5 Complexity

The following sections detail several factors impacting the complexity of requests that were completed during this reporting period.

3.5.1 Relevant pages processed and disclosed for paper and e-record formats

Of the 14 requests closed: 11 requests (includes six that had responsive records and five that were abandoned) generated 5,501 pages processed; and three had no responsive records. The total amount of relevant pages disclosed was 1,792 (in full or in part).

With one request, 2,676 pages of records were processed but subsequently never released as the request was abandoned.

3.5.2 Relevant pages processed per request disposition for paper and e-record formats

Of the seven requests that generated records: two fell within the 100 pages or less criteria (totaling four pages processed); two fell within the 101-500 pages processed criteria (totaling 438 pages processed); one fell within the 501-1000 pages processed criteria (totaling 760 pages processed); and two fell within the 1001-5000 pages processed criteria (totaling 4,299 pages processed).

3.5.3 Relevant minutes processed and disclosed for audio formats

The ATIP Office did not process any relevant minutes in audio format.

3.5.4 Relevant minutes processed and disclosed for audio formats by size of requests

The ATIP Office did not process nor disclose any relevant minutes in audio format for any requests.

3.5.5 Relevant minutes processed and disclosed for video formats

The ATIP Office did not process any relevant minutes in video format.

3.5.6 Relevant minutes processed and disclosed for video formats by size of requests

The ATIP Office did not process nor disclose any relevant minutes in video format for any requests.

3.5.7 Other complexities

There were no complexities to any of the requests closed.

3.6 Closed requests

The following section details the number of requests closed within the legislated timelines.

3.6.1 Requests closed within legislated timelines

Of the 14 requests closed, all were completed within legislative timelines – indicating a compliance rate of 100.00%.

Table 3.6.1 Requests closed within legislative timelines - Multi year overview

3.7 Deemed refusals

The following sections provide context on the rationales applied to requests considered deemed refusal throughout this reporting period.

3.7.1 Reasons for not meeting legislative timelines

There were no requests closed past the legislative timeline. This demonstrates the ATIP Office's ongoing commitment to ensuring timely access to records and compliance with the legislation.

3.7.2 Requests closed beyond legislated timelines (including any extension taken)

There were no requests closed beyond legislative timelines.

3.8 Requests for translation

The ATIP Office did not receive or process any requests for translation of responsive records during this reporting period.

Section 4. Disclosures Under Subsections 8(2) and 8(5)

Permissible disclosure pursuant to subsection 8(2) of the Act describes the circumstances under which personal information under the control of government institutions may be disclosed without the consent of the individual to whom the information pertains.

The ATIP Office did not receive any requests for the application of subsections 8(2) or 8(5) during this reporting period.

Section 5. Requests for Correction of Personal Information and Notations

The ATIP Office did not receive any requests for correction of personal information or notations

Section 6. Extensions

6.1 Requests for extensions

Section 15 of the Privacy Act allows the head of a government institution to extend the time period in respect to a request under the following circumstances:

• a maximum of thirty days if
  • (i) meeting the original time limit would unreasonably interfere with the operations of the government institution, or
  • (ii) consultations are necessary to comply with the request that cannot reasonably be completed within the original time limit.

Due to a large volume of records, a total of four extensions were invoked under paragraph 15(a)(i) of the Act during this reporting period.

6.2 Length of extensions

The ATIP Office applied four extensions during this reporting period, which fell within the 16 to 30 day criteria.

Section 7. Consultations Received from Other Institutions and Other Organizations

7.1 Consultations received from other Government of Canada institutions and other organizations

The ATIP Office did not receive any requests for consultations from other Government of Canada institutions or from other organizations.

7.2 Recommendations and completion time for consultations received from other Government of Canada institutions

The ATIP Office did not receive any requests for consultations from other Government of Canada institutions.

7.3 Recommendations and completion time for consultations received from other organizations

The ATIP Office did not receive any requests for consultation from other organizations.

Section 8. Completion Time of Consultations on Cabinet Confidences

8.1 Requests with legal services

The ATIP Office did not send any consultation requests on Cabinet Confidences to the Department of Justice.

8.2 Requests with Privy Council Office

The ATIP Office did not send any consultation requests to the Privy Council Office.

Section 9. Complaints and Investigations Notices Received

At the start of this reporting period, the ATIP Office had one active complaint outstanding from the 2020-2021 reporting period, which was subsequently closed as well-founded.

There are currently no outstanding complaints pursuant to the Act.

The annual statistical report requires institutions to identify sections of the Act under complaint:

• Section 31 captures a new formal complaint received from the OPC
• Section 33 requires the institution to make representations against a complaint to the OPC
• Section 35 is the formal finding of the OPC and closure of the complaint

Section 10. Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

10.1 Privacy Impact Assessments

A Privacy Impact Assessment (PIA) is a risk evaluation of the flow of personal information held within a program or service. This process enables the Department to determine whether new or substantially modified technologies, information systems, initiatives, and proposed programs or policies meet federal government privacy requirements.

During this reporting period, the ATIP Office developed, approved and implemented actions in relation to one PIA, and two PIAs were modified. All were submitted to the OPC and TBS for review and comment, and all executive summaries were published on the School’s website.

New PIA submitted to TBS and the OPC:

• Azure

Modified PIA submitted to TBS and the OPC:

• Microsoft 365
• Brightspace

Table 10.1 Privacy Impact Assessments – Multi-year overview

10.2 Court actions on third party notifications under paragraph 28(1)(b)

The School has eight institution-specific personal information banks (PIB):

• 6 Particular PIBs – Describing personal information about federal employees (current and former) that are contained in Schools records; and
• 2 Central Employee PIBs - Records describing information about employees from other government institutions.

Section 11. Privacy Breaches

11.1 Material privacy breaches reported

A material privacy breach is an incident involving the unauthorized collection, use or disclosure of personal information that could reasonably be expected to create a real risk of significant harm to an individual.

The ATIP Office reported no material privacy breaches during this reporting period.

11.2 Non-material privacy breached reported

A non-material privacy breach is defined as the improper or unauthorized creation, collection, use, disclosure, retention, or disposition of personal information. A privacy breach that does not attain the status of a material privacy breach is a non-material privacy breach, or simply a privacy breach.

The ATIP Office addressed five non-material privacy breaches during this reporting period.

Section 12. Resources Related to the Privacy Act

12.1 Allocated costs

During the reporting period, the ATIP Office spent a total of $105,251, which was allocated to salaries and goods and services. This amount does not include the resources required of the School's program areas to meet the requirements under the Act.

12.2 Human Resources

A total of 1.135 combined full-time equivalents (FTEs) were dedicated to privacy-related activities.

Highlights

2023-2024 Points of interest

Training and Awareness

The 2023–24 fiscal year was a productive year for the School's ATIP Office. In addition to processing requests, it strove to improve internal processes and services, providing robust guidance to its Offices of Primary Interest and School officials. The ATIP Office is client service-focused and continues to make efforts to maintain on-time compliance for the requests that are active in its queue. The Office also supports departmental programs and shares its expertise in support of other initiatives that fall outside of the requirements of the Access to Information and Privacy Acts.

The ATIP Office strives to improve and enhance its information products and resources - providing School employees and liaison officers with essential and up-to-date information regarding access to information and privacy. This effort aims to uphold both individual and institutional accountabilities in accordance with both Acts.

In 2023–24, the ATIP Office expanded its outreach activities and formal training sessions. In addition to the regular support and guidance provided to sectors processing ATIP requests, 4 bilingual information sessions on access and privacy legislation were provided to 32 employees. Some of the sessions were tailored to the needs of specific teams and sectors.

In addition, the following School-wide sessions were held to increase privacy awareness among employees:

Data Privacy Day Activities (January 30, 2024)

• A Guide to Managing Privacy Breaches: 1037 participants

Privacy Awareness Week 2023 Activities (May 8-12, 2023)

• OPC Presentation offered to all federal government employees: What is Public May still be Personal: 877 participants
• Test Your Knowledge Quiz

Policies, Guidelines, Procedures, and Initiatives

The ATIP Office's focus has been on raising awareness, and developing and revising all its guidelines and procedures over the last two years. In the last year specifically, updates were conducted on the following:

• PIA Checklist and templates;
• Privacy Breach Protocol;
• CSPS Privacy Protocol;
• Job aids for School employees to support requirements set out in the administration of the Act.

Ensuring alignment with Treasury Board policy requirements, in 2023-2024 the School developed strategies to streamline and improve proactive publication procedures, including the development of an interactive management system to track and monitor proactive disclosures.

Complaints

At the start of this reporting period, the ATIP Office had one active complaint outstanding from the 2020-2021 reporting period, which was subsequently closed as well-founded.

There are currently no outstanding complaints pursuant to the Act.

Monitoring Compliance

Due to the School's smaller size and lower volume of requests compared to other institutions, senior management receives regular updates on active access to information requests. This includes a weekly report and ongoing verbal briefings with senior executives and liaison officers.

In alignment with the Access to Information Implementation Notice on Inter-institutional Consultations, the School's ATIP Office continues to advocate the need to reduce ATI consultations with other government institutions.

Of the 14 requests closed, all were completed within legislative timelines – indicating a compliance rate of 100.00%.

Information Holdings

The School publishes an inventory of its information holdings, as well as relevant details about personal information under its control.

The primary purpose of this inventory is to assist individuals in exercising their rights under the Access to Information Act and the Privacy Act. The inventory also supports the federal government's commitment to facilitate access to information on its activities, since it is available to the public on the Internet, free of charge.

A description of the School’s functions, programs, activities and related information holdings can be found here: Info-Source: Sources of Federal Government and Employee Information.

Appendix A: Delegation order

Privacy Act

The President of the Canada School of Public Service, pursuant to section 73 of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the President, as the head of the Canada School of Public Service, under the provisions of the Act and related regulations set out in the schedule opposite each position. This designation replaces all previous delegation orders.

Schedule

Appendix B: Statistical Report on the Privacy Act

Name of institution: Canada School of Public Service

Reporting period: 2023-04-01 to 2024-03-31

Section 1: Requests Under the Privacy Act

Section 2: Informal Requests

Section 3: Requests Closed During the Reporting Period

3.5 Complexity

3.6 Closed requests

3.7 Deemed refusals

Section 4: Disclosures Under Subsections 8(2) and 8(5)

Section 5: Requests for Correction of Personal Information and Notations

Section 6: Extentions

Section 7: Consultations Received From Other Institutions and Organizations

Section 8: Completion Time of Consultations on Cabinet Confidences

Section 9: Complaints and Investigations Notices Received

Section 10: Court Action

Section 11: Privacy Breaches

Section 12: Resources Related to the Privacy Act

Note: Enter values to three decimal places.

Appendix C: Supplementary Statistical Report on the Access to Information Act and Privacy Act

Name of institution: Canada School of Public Service

Reporting period: 2023-04-01 to 2024-03-31

Section 1: Open Requests and Complaints Under the Access to Information Act

Section 2: Open Requests and Complaints Under the Privacy Act

Section 3: Social Insurance Number

Section 4: Universal Access under the Privacy Act

Contact us Subscribe to the GCLearning newsletter

---

Features

Policy and Service Conference: Delivering Impact Through Collaboration (FON1-E32)

(November 13 and 14, 2024)

GC INNOVEX GC 2024: What if? (WMT2-E15)

(November 19, 2024)

2024 Government of Canada Workplace Charitable Campaign: Quiz for a Cause – DM Trivia (WMT2-E16)

(November 28, 2024)

Follow:

• Twitter
• YouTube
• LinkedIn
• GCLearning newsletter
• RSS