2021–2022 Annual Report on the Privacy Act

Table of Contents

• Introduction
  • Purpose
  • Institutional Mandate
• Organizational Structure
• Delegation of Authority
• Performance
  • Responses Within Legislated Timelines
  • Multi-Year Trends
  • Requests Outstanding and Carried-Forward
  • Three-Year Overview of Sources and Subjects of Requests
  • Completion Times for Closed Requests
  • Disposition of Requests
  • Nature of Information Requested
  • Limits to the Right of Access – Exemptions and Exclusions
  • Extensions
  • Consultations Completed for Other Institutions
  • COVID-19 Impacts and Operational Measures
  • Annual Statistical Report
• Operating Costs
• Training and Awareness
• Policies, Guidelines, Procedures, and Initiatives
• Key Issues and Actions Taken on Complaints
  • Total Outstanding Complaint Inventory by Year Received
• Monitoring Compliance
• Material Privacy Breaches
• Privacy Impact Assessments
• Public Interest Disclosures
• Annex A – Annual Statistical Report for TBS
• Annex B – Delegation of ATIP Authority

Introduction

Purpose

The Privacy Act (Revised Statutes of Canada, 1985, Chapter A‑1) was proclaimed on July 1, 1983.

The purpose of the Privacy Act is "to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution and that provide individuals with a right of access to that information." The law also protects an individual's privacy by preventing others from having access to that personal information and allows an individual specific rights concerning the collection and use of their information.

Section 72 of the Privacy Act requires that the head of every government institution prepare for submission to Parliament an annual report on the administration of the Act within the institution during each financial year.

This annual report is tabled in Parliament pursuant to section 72 of the Privacy Act and describes how Innovation, Science and Economic Development Canada ( ISED ) administered its responsibilities for the reporting period.

Institutional Mandate

ISED helps Canadian businesses grow, innovate, and expand so they can create good-quality jobs and wealth for Canadians. It also supports science research and the integration of scientific considerations into investment and policy choices. The Department helps small businesses grow through trade and innovation and promotes increased tourism in Canada. It also works to position Canada as a global centre for innovation where investments support clean and inclusive growth, the middle class prospers through more job opportunities, and companies become global leaders.

ISED 's efforts focus on improving conditions for investment, supporting science, helping small and medium‑sized businesses grow, building capacity for clean and sustainable technologies and processes, increasing Canada's share of global trade, promoting tourism, and building an efficient and competitive marketplace.

In 2021–2022, ISED supported four ministers:

• the Minister of Innovation, Science and Industry;
• the Minister of International Trade, Export Promotion, Small Business and Economic Development;
• the Minister of Tourism and Associate Minister of Finance; and
• the Minister of Rural Economic Development.

The Department also supported one deputy minister and one associate deputy minister.

For more information on the Department's organizational mandate letter commitments, see the ministers' mandate letters section of the Prime Minister's website.

Organizational Structure

Access to Information and Privacy ( ATIP ) Services is part of the Office of the Corporate Secretary of ISED . The ATIP team has a complement of 23 employees, consisting of one director at the executive level, three managers, and 17 advisors at various levels, from team leader to junior officer, all of whom are dedicated to processing access to information (ATI) and privacy requests and performing related functions (e.g. proactive publication, policy, training, administration, and outreach).

Multiple new employees were engaged over the past year to help address multi‑year high attrition levels, with most of those newly engaged staff being at entry or junior levels. The recruitment and retention of staff at senior levels continues to be a challenge, affecting not only ISED but also the entire federal ATIP  community. Efforts to engage additional staff at more senior levels are ongoing.

ATIP Services is responsible for the implementation and management of programs and services relating to the administration of the Access to Information Act and the Privacy Act for the Department. Specifically, ATIP Services makes decisions on the disposition of ATI and privacy requests; promotes awareness of the legislation to ensure departmental responsiveness to statutory obligations; monitors and advises on departmental compliance with the Acts, regulations, procedures, and policies; and represents ISED on ATIP matters when dealing with the Treasury Board of Canada Secretariat ( TBS ), the Office of the Information Commissioner of Canada, the Office of the Privacy Commissioner of Canada ( OPC ), the Privy Council Office, and other government institutions. ATIP Services is also responsible for consulting with other federal departments and third parties with respect to ATIP requests.

The Director of ATIP Services is responsible for the development, coordination, and implementation of effective policies, guidelines, and procedures to manage ISED 's compliance with the Acts. The administration of the legislation within the Department is managed by ATIP  Services, but is also facilitated at the sector, branch, and regional office levels. Each sector and corporate branch has an ATIP liaison officer (reporting to an assistant deputy minister, executive director, etc.) who coordinates activities and provides guidance on the administrative processes and procedures of the Acts. ATIP Services, which is located in Ottawa, responds to all formal requests submitted to the Department under both Acts.

Section 73.1(1) of the Privacy Act permits institutions reporting to the same minister to enter into agreements with each other for the purpose of sharing ATIP resources and capacity. However, ISED currently has no such agreements in place.

Delegation of Authority

The ATIP Delegation Order in effect on the last day of this reporting period was approved on May 18, 2021. Pursuant to subsection 95(1) of the Access to Information Act and subsection 73(1) of the Privacy Act, that delegation instrument provides full authority to the Deputy Minister and Corporate Secretary as well as to the ATIP Services Director and managers (see Annex B).

Performance

ISED 's mandate is focused on Canadian businesses. Departmental programs and initiatives assist in building a more productive, competitive, and knowledge‑based economy for Canada. Therefore, there are few privacy requests or privacy‑related issues.

A summarized statistical report on requests under the Privacy Act processed from April 1, 2021, to March 31, 2022, is found in Annex A of this report. An explanation and interpretation of the information provided in the statistical report is contained in this annual report.

Responses Within Legislated Timelines

During 2021–2022, 36 privacy requests were brought to conclusion (125% more than last year's 16 closures). Of these, 21 were concluded within legislated timelines, resulting in an on‑time performance of 58.3% (29.2% lower than last year's on-time performance of 87.5%).

Multi‑Year Trends

ISED received a total of 37 privacy requests in 2021–2022. This represents a 76% increase compared to the 21 requests received during the previous year. In addition to the 37 new requests received, ten incomplete requests were carried over from the previous year, for a total caseload of 47 requests. Of the total 47 requests, 36 were closed during the reporting period, and 11 were carried forward to 2022-2023.

As in the previous year, ISED received no privacy consultations from other federal or non‑federal institutions in this reporting period.

Requests Outstanding and Carried-Forward

Completion Times for Closed Requests

The 36 privacy requests closed by ISED during the reporting period were completed within the following timeframes:

• 8 within 1 to 15 days (22%)
• 7 within 16 to 30 days (20%)
• 3 within 31 to 60 days (8%)
• 8 within 61 to 120 days (22%)
• 3 within 121 to 180 days (8%)
• 5 within 181 to 365 days (14%)
• 2 more than 365 days (6%)

Disposition of Requests

The disposition of the 36 completed privacy requests is as follows:

• 5 were fully disclosed (14%)
• 15 were disclosed in part (42%)
• 8 had no existing records (22%)
• 7 were abandoned (19%)
• 1 was neither confirmed nor denied (3%)

Records were fully disclosed in 14% of cases, compared to 31% in 2020–2021, while 42% were disclosed in part, compared to 12.5% in the previous year. No records were fully exempted or excluded, as in the previous year.

Nature of Information Requested

ISED sees few privacy requests because of the nature of its mandate. Therefore, these trends have remained unchanged for many years with no significant new trends being noted. See the table under: Three-Year Overview of Sources and Subjects of Requests, on the previous page.

Limits to the Right of Access – Exemptions and Exclusions

Exemptions to the disclosure of information are permitted pursuant to sections 18 through 28 of the Privacy Act. Several exempting provisions can be applied to withhold information in response to one request, and these are reported separately in the statistical report. However, the same exempting provision invoked to withhold information more than once within the same request is reported only once.

The statistics, as shown in Annex A of this report, demonstrate that ISED invoked only four of the allowable exempting provisions during the reporting period, as follows:

• 21 (International Affairs and Defence): 1 use
• 22 (Law Enforcement and Investigations): 1 use
• 26 (Personal Information of Other Individuals): 13 uses
• 27 (Protected Information – solicitors, advocates and notaries): 1 use

Exclusions provided for within the Act pertain to information that is publicly available or for sale (section 69 of the Act) and information that is in the confidence of Her Majesty's Privy Council for Canada (Cabinet confidences) (section 70 of the Act). However, ISED invoked no such exclusions during the reporting period.

Extensions

ISED invoked extensions on seven requests concluded during the reporting period. Four of these extensions were due to an extraordinary volume of information, one was due to a large volume of requests being processed simultaneously, which delayed its processing, and two were due to the responsive information being difficult to obtain, both of which involved extensive searches for historic human resources information and detailed calculations relating to pay and compensation. All seven extensions were taken for between 16 and 30 days.

Consultations Completed for Other Institutions

As in the previous year, ISED received no privacy consultations from other federal or non‑federal institutions in the current reporting period.

COVID‑19 Impacts and Operational Measures

In March 2020, the emerging pandemic necessitated a full‑scale shift in the workplace, which included implementation of telework practices, coupled with the rapid adoption of the use of remote working tools and technology. Through this change, ISED took steps to protect the safety of its employees by respecting the pandemic‑related health orders and recommendations issued by all levels of government. New safety measures were put in place for those employees who periodically needed to be physically present in the office for work.

The ATIP Services team continued to ensure that it delivered effectively on its core mandate responsibilities in light of the COVID‑19 pandemic. Telework operations that went into effect in March 2020 remained in effect throughout 2021–2022, with ATIP Services team members working on-site as needed and permitted by restrictions. This allowed ATIP operations to continue at near full capacity, to intake new requests and process information to respond to ongoing requests. New communication tools that better explain to applicants the delays and other issues in responding to their requests as a result of the pandemic (i.e., why a partial response may have been provided on an interim basis) continued to be used throughout 2021-2022.

As mentioned, while multiple ATIP Services Team members are now working on-site more frequently, partial limits remain on the extent to which consultations with departmental employees and third parties can be carried out. This includes limits on the ability to conduct consultations with other departments and organizations, including third-party stakeholders.

At the time of this report, ISED is beginning to transition to a fully hybrid workplace model, which will result in daily on-site attendance of all ATIP team members on a rotational basis. This transition is expected to fully restore processing capacity to a pre-pandemic level.

While 2021-22 saw the introduction of solutions to challenges posed by the pandemic, the upcoming year will see the department continue to enhance its management of the ATIP process for the benefit of Canadians.  This includes exploring emerging technological solutions, the hiring of temporary external capacity where appropriate, ongoing engagement with the ATIP community to share best practices, and engaging across the department to strengthen ATIP timeliness and responsiveness.

Annual Statistical Report

TBS prescribes requirements for annual statistical reports on the Privacy Act, which must comprise part of the corresponding annual reports to Parliament. ISED 's Annual Statistical Report on the Privacy Act is enclosed with this report as Annex A.

Operating Costs

The cost of delivering ISED 's Privacy program and services for 2021–2022 was $40,728, based on salary costs and operating expenses.

Salary costs for 2021–2022 totalled $38,662, equating to 0.476 full‑time employees, including students, when averaged over the year.

Operating expenses for the year totalled $2,066, the majority of which were for licensing fees for two case management systems. Other expenses included in this total are stationery, postage, and other administrative costs.

Training and Awareness

Enhanced awareness and knowledge of ATIP obligations on the part of departmental officials has shown to improve the quality of responses and ISED 's rate of compliance with legal obligations.

Throughout 2020–2021, ATIP Services delivered numerous training and awareness sessions to employees across the Department on both the Access to Information Act and the Privacy Act (and their requirements). In total, 41 training sessions relating to access to information and/or privacy were delivered to 1,299 employees (220% more than the 405 employees trained last year), as follows:

• ATIP 101 at ISED : An overview of the legislation, associated timelines, and processes, as well as the role of the Department, the courts, and the Information and Privacy Commissioners of Canada, combined with a more in‑depth look at the exempting and excluding provisions of the Access to Information Act, focusing on the top three such provisions used most frequently at ISED , and how to identify information pertaining to those provisions. This session is also offered in a modified format, on-demand, to focus solely on either the Access to Information Act or the Privacy Act.
  • 37 sessions, 1,242 participants
• ATIP for Ministers' Offices: Training for staff in Ministers' Offices, providing a high‑level overview of legislative requirements and interpretations, and how the ATIP function works within the Department.
  • 1 session, 10 participants
• Personal Information Boot Camp: Comprehensive training focused solely on the Privacy Act and its related policy requirements, including the concept of 'informed consent,' privacy notice statements, privacy impact assessments, and privacy breach administration. This includes an in‑depth look at the type and volume of personal information that exists within the Department and the requirements surrounding the collection and use of personal information in relation to ISED and other Government of Canada programs.
  • 3 sessions, 47 participants

Employee response to ATIP training has remained overwhelmingly positive. In 2021-2022, 77% of survey respondents indicated they would recommend the same training to another colleague, 92% indicated their knowledge of ATIP improved moderately or substantially, and 100% indicated they learned something new by attending.

Policies, Guidelines, Procedures, and Initiatives

To improve the administration of the ATIP program and to ensure that TBS ATIP policies are respected and implemented, ATIP Services traditionally develops and updates various internal guidelines, procedures, and business practices and makes them available to ATIP and departmental staff throughout the year. This included the following:

• Continued to use various texts developed in the previous year, to allow ATIP employees to more effectively communicate to applicants the COVID‑19‑related circumstances that may impact responses to their requests (such as why a response is delayed or why a partial response is being provided on an interim basis);
• Held weekly all-staff meetings and semi-weekly management team meetings to discuss emerging and ongoing operational and policy issues;
• Maintained ongoing collaboration with ISED stakeholders to assess and potentially mitigate the impact of the pandemic on the effective processing of ATIP requests;
• Contributed input to stage two of the Access to Information Act review activities being led by TBS ;
• Held monthly teleconferences with the Office of Access to Information Commissioner, resulting in streamlined processes; and,
• Developed guidance on the development and application of non-disclosure agreements vis-à-vis the Access to Information Act.

Finally, ATIP Services continued to enhance its intranet site—where all departmental employees can access plans, reports, acts, regulations, policies, directives, training decks, procedures, and checklists in one convenient place.

Key Issues and Actions Taken on Complaints

Applicants have the right to register a complaint with the Office of the Privacy Commissioner regarding any matter relating to the processing of their requests, and several complaints can be linked to the same request.

ISED received two complaints under the Privacy Act during the reporting period. One of the complaints was in respect of a delay in processing a Privacy Act request for personal information, and the second was in respect of a multi-department allegation of over- and unauthorized collections of personal information resulting from the implementation of the Policy on COVID-19 Vaccination for the Core Public Administration Including the RCMP.

The Privacy Commissioner of Canada issued findings on four complaints during the reporting period. Three of these were on complaints relating to Privacy Act requests (the one from the current reporting period, mentioned above, and two others from the previous fiscal year). The fourth related to a Privacy Act request, the complaint for which had been outstanding from 2013.

The 2013 complaint respecting ISED 's handling of personal information, was withdrawn by the applicant and deemed resolved. The remaining three complaints, in respect of Privacy Act requests, were all in respect of delays, two of which were deemed well-founded and resolved, and the third of which was deemed well-founded, but had not yet been resolved by the end of the reporting period.

The complaint on the allegation of over- and unauthorized collection of personal information resulting from the implementation of the Policy on COVID-19 Vaccination for the Core Public Administration Including the RCMP had yet to be resolved by end of the reporting period.

No court challenges relating to the Privacy Act were received during the reporting period, and no audits were conducted relating to the administration of privacy legislation.

Monitoring Compliance

With respect to monitoring the processing time of requests, ATIP Services has continued the following business practices:

• Managers regularly review and monitor the status of access requests using the ATIP case management system;
• Managers regularly review the status of consultation processes on access requests using the ATIP case management system;
• Managers conduct weekly operational meetings with staff to review work plans and establish priorities; and
• Managers report weekly to the Director on requests to be closed as well as on‑time compliance and issues delaying or otherwise affecting processing.

Material Privacy Breaches

No material breaches of privacy that required reporting to the Privacy Commissioner of Canada or to TBS occurred during the reporting period.

Privacy Impact Assessments

Twenty (20) privacy impact assessment (PIA) submissions were received this year for various project activities occurring across the Department. Of these 20 submissions, an analysis concluded that only three requests were in respect of a new or substantially modified program activity (the two factors that necessitate the requirement to conduct a PIA, pursuant to TBS policy requirements).

PIAs were therefore completed and duly submitted to the Office of the Privacy Commissioner and to TBS for review for the following activities:

• The Canada Digital Adoption Program
• Staffing with VidCruiter

A third PIA, for the Investment Canada Act Review System, was in progress, but had yet to be completed by the end of the reporting period.

Public Interest Disclosures

Paragraph 8(2)(m) of the Privacy Act gives heads of institutions the discretion to disclose personal information where disclosure would clearly benefit the individual to whom the information pertains or when the interest in public disclosure clearly outweighs the privacy of the concerned individual.

ISED made no such disclosures during the reporting period.

Annex A – Annual Statistical Report on the Privacy Act

Name of institution: Innovation, Science and Economic Development Canada

Reporting period: 2021-04-01 to 2022-03-31

Section 1: Requests Under the Privacy Act:

Section 2: Informal Requests

Section 3: Requests Closed During the Reporting Period

3.5 Complexity

3.7 Deemed refusals

Section 6: Extensions

Section 7: Consultations Received From Other Institutions and Organizations

Section 8: Completion Time of Consultations on Cabinet Confidence:

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

Section 11: Privacy Breaches

Section 12: Resources Related to the Privacy Act:

Annex B – Delegation of ATIP Authority

Delegation in effect on the last day of 2021–2022:

The Department of Industry
(To be known as Innovation, Science and Economic Development Canada)

Access to Information Act and Privacy Act Delegation Order

The Minister of Industry Canada, pursuant to section 95(1) of the Access to Information Act and section 73(1) of the Privacy Act, hereby delegates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers and functions of the Minister as the head of a government institution, under the section of the Acts set out in the schedule opposite each position. This Delegation Order supersedes all previous Delegation Orders,

Dated, at the City of Ottawa, this 18^th day of May, 2021

Original signed by the Honourable François-Philippe Champagne
Minister of Industry
(to be known as Minister of Innovation, Science and Economic Development)