Annual Report to Parliament on the Administration of the Privacy Act 2023 to 2024

Introduction

This report is tabled in Parliament in accordance with section 72 of the Privacy Act under the direction of the Minister of Public Safety. The report describes how Public Safety Canada (Public Safety) administered and fulfilled its obligations under the Privacy Act between April 1, 2023, and March 31, 2024.

Purpose of the Privacy Act

The Privacy Act came into force on July 1, 1983, in order to protect the privacy of individuals by imposing obligations on government institutions subject to the Act. These obligations limit the collection, retention, use, disclosure and disposal of personal information held by these government institutions. It also gives individuals the right of access to their own personal information, with limited and specific exemptions, and the rights to request the correction of that information. Individuals who are not satisfied with an institution’s handling of their personal information or any matter related to a formal request made under the Privacy Act are entitled to complain to the Privacy Commissioner of Canada.

Mandate of Public Safety

Public Safety was created in 2003 to ensure coordination across all federal departments and agencies responsible for national security and the safety of Canadians. Our mandate is to keep Canadians safe from a range of risks such as natural disasters, crime and terrorism. Our mission is to build a safe and resilient Canada. Our vision is to, through outstanding leadership, achieve a safe and secure Canada and strong and resilient communities.

Legislation governing the department sets out three essential roles:

1. Support the Minister’s responsibility for all matters related to public safety and emergency management not assigned to another federal organization
2. Exercise leadership at the national level for national security and emergency preparedness
3. Support the Minister’s responsibility for the coordination of entities within the Public Safety Portfolio

Organizational Structure

Public Safety

During the 2023-24 fiscal year, the department was organized into seven branches: Emergency Management and Programs, Crime Prevention, Portfolio Affairs and Communications, National and Cyber Security, Corporate Management, Firearms Compensation Program and the Indigenous Affairs Secretariat. The department also has a Chief Audit and Evaluation Executive and is supported by the Legal Services Unit.

Five Regional Offices represent the Atlantic, Quebec and Nunavut, Ontario, the Prairies and Northwest Territories, and British Columbia and Yukon. These offices are the primary point of contact for the department at the regional level. They deliver a coordinated federal response to emergencies; facilitate the effective delivery of emergency management, Indigenous policing and crime prevention programs; and improve partnerships with other levels of government and key regional stakeholders.

The Public Safety Portfolio: Partner Agencies and Review Bodies

The Canada Border Services Agency (CBSA) manages the nation's borders by enforcing Canadian laws governing trade and travel, as well as international agreements and conventions. CBSA facilitates legitimate cross-border traffic and supports economic development while stopping people and goods that pose a potential threat to Canada.

The Canadian Security Intelligence Service (CSIS) investigates and reports on activities that may pose a threat to the security of Canada. CSIS also provides security assessments, on request, to all federal departments and agencies.

The Correctional Service of Canada (CSC) helps protect society by encouraging offenders to become law-abiding citizens while exercising reasonable, safe, secure and humane control. CSC is responsible for managing offenders sentenced to two years or more in federal correctional institutions and under community supervision.

The Parole Board of Canada (PBC) is an independent body that grants, denies or revokes parole for inmates in federal prisons and provincial inmates in provinces without their own parole board. The PBC helps protect society by facilitating the timely reintegration of offenders into society as law-abiding citizens.

The Royal Canadian Mounted Police (RCMP) is Canada’s national police service and is the police of jurisdiction for all provinces and territories except Ontario and Quebec. The RCMP works at the community, provincial, territorial and federal levels to prevent crime; enforce the law; investigate offences; keep Canadians, and their interests, safe and secure; and assist Canadians in emergency situations/incidents. The RCMP also offers expertise at the international level by providing specialized training for police officers; conducting international policing activities, including peacekeeping; and sharing intelligence with trusted partners to support investigations, as well as disrupt and dismantle criminal operations.

The Civilian Review and Complaints Commission for the Royal Canadian Mounted Police (CRCC) investigates complaints from the public about the conduct of members of the RCMP in an open, independent and objective manner. The Commission also holds public hearings and conducts research and policy development to improve the public complaints process.

The Office of the Correctional Investigator (OCI) conducts independent, thorough and timely investigations about issues related to the Correctional Service of Canada. The OCI may initiate an investigation based on a complaint from (or on behalf of) an offender, as the result of a ministerial request, or on its own initiative.

The RCMP External Review Committee (ERC) is an independent agency that promotes fair and equitable labour relations within the RCMP. The Committee conducts an independent review of appeals in disciplinary, discharge and demotion matters, as well as certain kinds of grievances.

The Access to Information and Privacy (ATIP) Office

The department’s Access to Information and Privacy (ATIP) Office is responsible for the coordination and implementation of policies, guidelines, and procedures to ensure departmental compliance with the Access to Information Act as well as the Privacy Act. The ATIP Office is also responsible for responding to requests made under the Acts. In keeping with the department’s role to support the Minister in the coordination of entities within the Public Safety Portfolio, it also plays a leadership role with respect to ensuring alignment of approach with the ATIP Offices of other Public Safety Portfolio organizations, where appropriate.

The ATIP Office is housed within the department’s Portfolio Affairs and Communications Branch, and is headed by the Director of ATIP and Executive Services, who is also responsible for Ministerial Correspondence and Secretariat Services. It is divided into two teams, the ATIP Operations Unit and the Privacy Policy and Governance Unit (PPGU), each of which is headed by a Manager who reports to the Director of ATIP and Executive Services. In 2023-24, the ATIP Office consisted of 17 full-time employees.

Public Safety was not a party to any service agreements to provide services to other organizations under section 73.1 of the Privacy Act during the fiscal year.

Delegation Order

Public Safety’s current delegation order for the Privacy Act and related regulations was signed by the Minister of Public Safety and Emergency Preparedness on May 23, 2024. As of October 26, 2021, the responsibilities of the Minister of Public Safety and Emergency Preparedness were divided between two Ministers: the Minister of Public Safety and the Minister of Emergency Preparedness. Despite this change, the current Delegation Order remained valid for all exercise of delegated authorities by employees of the department under the Privacy Act and can be found in Annex A.

The following authorities are granted under this delegation order:

• Full authority is granted to the Deputy Minister of Public Safety, the Associate Deputy Minister, the Assistant Deputy Minister of Portfolio Affairs and Communication Branch, the Director General of Cabinet and Parliamentary Affairs and Executive Services, the Director of ATIP and Executive Services, as well as the Manager of ATIP Operations
• ATIP Operations Team Leaders and ATIP Analysts possess authority under Sections 15 of the Privacy Act and Assistant Deputy Ministers as well as Chief Audit Executives possess authority under Section 9(4) and 10 of the Privacy Act

Performance 2023-24

The following sections provide an overview of key data on Public Safety’s processing of Privacy Act requests between April 1, 2023, and March 31, 2024. The full statistical report can be found in Annex B, and the Supplemental Statistical Report can be found in Annex C.

Response within Legislated Timelines

During the 2023-2024 fiscal year, Public Safety saw a record number of requests received and closed under both the Access to Information Act (ATIA) and the Privacy Act.^{Footnote 1} In 2022-2023, Public Safety received 48 requests under the Privacy Act, a 30% increase compared to the previous year (37 requests). During the year, the department completed 50 requests, a 25% increase compared to the previous year (40 requests).

Of the 48 Privacy Act requests that were received during the year, 39 (78%) were completed on time, a decrease compared to the previous year (87.5%). The decrease was linked to the high overall volume of requests under both Acts, and the resulting increase in overall workload being handled by the ATIP Office.

Completion Times

A total of 50 files were completed during the fiscal year. Due to the focus on completing backlog files delayed by the pandemic, there was a slight increase in files with longer completion times (greater than 180 days), as seen in the table below.

Active Requests Outstanding from Previous Reporting Periods

At the end of the fiscal year, Public Safety had a total of 4 active requests that were carried over to the next reporting period. Of these, one was within the legislated timeline, while three were beyond the legislated timeline. The three files that were beyond the legislated timeline were related to the circumstances of the pandemic.

Active Complaints Outstanding from Previous Reporting Periods

At the end of the fiscal year, Public Safety did not have any active complaints that were carried over to the next reporting period. The ATIP Office worked closely with the Office of the Privacy Commissioner during the year to ensure all complaints were addressed, and no significant issues were flagged.

Reasons for Extensions

A total of 6 extensions were taken during the fiscal year.

Consultations from Other Institutions

Public Safety completed one consultation for another institution, which was responded to in under 15 days.

Disposition of Requests

Of the 50 completed requests, 6% had records that were entirely disclosed, and 26% had records that were disclosed in part. The remaining requests were either abandoned, or no records existed corresponding to the request.

Training and Awareness

Public Safety remains committed to promoting awareness and providing ongoing training opportunities to all employees. During the year, the ATIP Office continued their outreach to the department to reinforce knowledge and understanding of the legislation and ATIP processes among policy and program areas. The ATIP Office provided 16 training and information sessions on the Access to Information Act and Privacy Act. A variety of subject matter was presented, including strategies for retrieving records and applying exemptions, as well as requirements for proactive publication. A total of 244 people attended these sessions.

The PPGU also provides outreach and awareness concerning the department’s privacy obligations, through department-wide communication modes such as Info Bulletin and the Administrative Professionals Network Newsletter, and by participating on various internal working groups and other fora. The PPGU has also promoted Privacy Impact Assessment (PIA) training hosted by the Office of the Privacy Commissioner. The PPGU routinely meets with new departmental programs to ensure the unit’s visibility and promote the importance of privacy principles.

Policies, Guidelines, and Procedures

The PPGU continued to incorporate privacy by design principles in its advice and guidance to various programs within Public Safety. New and existing programs, surveys, and outreach activities are required to complete a Privacy Analysis Checklist (PAC), and in cases where there is evidence that the program will involve a new collection, use, or disclosure of personal information, or changes to an existing collection, use, or disclosure, a PIA will be initiated. The PPGU worked with contracting in the review of privacy implications with the issuance of contracts through the department, and also provided privacy review and analysis for both Treasury Board Submissions and Memoranda to Cabinet.

Initiatives and Projects to Improve Privacy

During the year, the PPGU team continued to connect with a range of new internal clients, in order to increase opportunities to provide independent advice to Public Safety programs to support the safeguarding of personal information. The PPGU is also a member of the department’s 3rd Party Solutions Approval Team (3PSAT), which reviews applications for new software and digital tools proposed for use by the department, and provides advice and guidance to ensure that “Privacy by Design” principles are taken into account during the approval of new digital solutions. 

Summary of Key Issues and Actions Taken on Complaints

During the year, Public Safety’s ATIP Office maintained a constructive relationship with the Office of the Privacy Commissioner (OPC). The ATIP Office received three complaints in relation to Privacy Act requests during the year, and closed three complaints. Of these, two complaints were deemed not well-founded, and one complaint was deemed well-founded. The OPC did not identify any concerns with the ATIP Office’s handling of complaints during the year.

Material Privacy Breaches

Public Safety experienced one privacy breach in 2023-24. Once PPGU was made aware of the breach, the team quickly took the appropriate steps, including alerting the OPC, conducting an extensive review of the breach and ensuring proper notifications were sent.

Privacy Impact Assessments

No Privacy Impact Assessments (PIAs) were completed during the reporting period, although several PIAs pertaining to PS programs and initiatives were in progress during the year.

Public Interest Disclosures Pursuant to Paragraph 8(2)(m) of the Privacy Act

Paragraph 8(2)(m) of the Privacy Act provides the head of the institution with the authority to disclose personal information where the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure, or where the disclosure would clearly benefit the individual to whom the information relates.

No disclosures pursuant to paragraph 8(2)(m) of the Privacy Act were made by Public Safety this fiscal year.

Monitoring Compliance

In an effort to monitor compliance, the department’s weekly ATIP report includes the list of new Privacy Act requests and deadlines for retrieval of materials. This report is shared with the Deputy Minister, Assistant Deputy Ministers, and other senior officials, and discussed at senior management meetings as required. In addition, ATIP performance is monitored at the ADM level through their Performance Management Agreements to ensure ATIP is a priority within the department. The PPGU reviews contracts and information sharing agreements when required and provides advice and guidance with respect to privacy protections.

Annex A: Privacy Act Delegation Order

The Minister of Public Safety, Democratic Institutions and Intergovernmental Affairs, pursuant to section 73(1) of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Minister as the head of the Department of Public Safety and Emergency Preparedness, under the provisions of the Privacy Act and related regulations set out in the schedule opposite each position.  This designation replaces all previous delegation orders.

Dated, at the City of Ottawa, this 23 day of May, 2024.

The Honourable Dominic LeBlanc, P.C., K.C., M.P.
Minister of Public Safety, Democratic Institutions and Intergovernmental Affairs

Annex B: Statistical Report on the Privacy Act

Name of the Institution:

Public Safety Canada

Reporting period:

2023-04-01 to 2024-03-31

Section 1: Requests Under the Privacy Act

Section 2: Information Requests

Section 3: Requests Closed During the Reporting Period

3.5 Complexity

3.6 Closed requests

3.7 Deemed refusals

Section 4: Disclosures Under Subsection 8(2) and 8(5)

Section 5: Request for Correction of Personal Information and Notations

Section 6: Extensions

Section 7: Consultations Received From Other Institutions and Organizations

Section 8: Completion time of Consultations on Cabinet Confidences

Section 9: Complaints and Investigations Notices Received

Section 10: Privacy Impact Assessments (PIAs) and Personal Information (PIBs)

Section 11: Privacy Breaches

Section 12: Resources Related to the Access to Information Act

Annex C: Statistical Report on the Access to Information Act and Privacy Act

Name of the Institution:

Public Safety Canada

Reporting period:

2023-04-01 to 2024-03-31

Section 1: Open Requests and Complaints Under the Access to Information Act

Section 2: Open Requests and Complaints Under Privacy Act

Section 3: Social Insurance Number

Has your institution begun a new collection or a new consistent use of the SIN in 2023-24?

No

Section 4: Universal Access under the Privacy Act

How many requests were received from foreign nationals outside of Canada in 2023-24?

0

Date modified:

2025-01-28