2022–2023 Annual Report on the Privacy Act

Table of Contents

• Introduction
  • Purpose
  • Institutional mandate
• Organizational structure
• Delegation of authority
• Performance
  • Responses within legislated timelines
  • Multi-Year trends
  • Requests outstanding and carried-forward
  • Three-Year overview of sources and subjects of requests
  • Completion times for closed requests
  • Disposition of requests
  • Number of pages processed
  • Nature of information requested
  • Limits to the right of access – Exemptions and exclusions
  • Extensions
  • Consultations completed for other institutions
  • COVID-19 impacts and operational measures
  • Annual statistical report
• Training and awareness
• Operating costs
• Policies, guidelines and procedures
• Initiatives and projects to improve privacy
• Key issues and actions taken on complaints
  • Total outstanding complaint inventory by year received
• Material privacy breaches
• Privacy impact assessments
• Public interest disclosures
• Monitoring compliance
• Annex A – Annual statistical report on the Privacy Act
• Annex B – Delegation of ATIP authority

Introduction

Purpose

The Privacy Act (Revised Statutes of Canada, 1985, Chapter A‑1) was proclaimed on July 1, 1983.

The purpose of the Privacy Act is "to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution and that provide individuals with a right of access to that information." The law also protects an individual's privacy by preventing others from having access to that personal information and allows an individual specific rights concerning the collection and use of their information.

Section 72 of the Privacy Act requires that the head of every government institution prepare for submission to Parliament an annual report on the administration of the Act within the institution during each financial year.

This annual report is tabled in Parliament pursuant to section 72 of the Privacy Act and describes how Innovation, Science and Economic Development Canada (ISED) administered its responsibilities for the reporting period.

Institutional mandate

ISED helps Canadian businesses grow, innovate, and expand so they can create good-quality jobs and wealth for Canadians. It also supports science research and the integration of scientific considerations into investment and policy choices. The Department helps small businesses grow through trade and innovation and promotes increased tourism in Canada. It also works to position Canada as a global centre for innovation where investments support clean and inclusive growth, the middle class prospers through more job opportunities, and companies become global leaders.

ISED's efforts focus on improving conditions for investment, supporting science, helping small and medium‑sized businesses grow, building capacity for clean and sustainable technologies and processes, increasing Canada's share of global trade, promoting tourism, and building an efficient and competitive marketplace.

In 2022–2023, ISED supported four ministers:

• the Minister of Innovation, Science and Industry
• the Minister of International Trade, Export Promotion, Small Business and Economic Development
• the Minister of Tourism and Associate Minister of Finance
• the Minister of Rural Economic Development

The Department also supported two deputy ministers and one associate deputy minister.

For more information on the Department's organizational mandate letter commitments, see the ministers' mandate letters section of the Prime Minister's website.

Organizational structure

Access to Information and Privacy (ATIP) Services is part of the Office of the Corporate Secretary at ISED. The ATIP team has a complement of 21 employees, consisting of one director at the executive level, three managers, and 17 advisors at various levels, from team leader to junior officer, all of whom are dedicated to processing access to information (ATI) and privacy requests and performing related functions (e.g., proactive publication, policy, training, administration, and outreach). In 2022-23, five consultants were also engaged, for contracts of varying lengths, to help address backlogged policy and Access to Information case loads.

ATIP Services is responsible for the implementation and management of programs and services relating to the administration of the Access to Information Act and the Privacy Act for the Department. Specifically, ATIP Services makes decisions on the disposition of ATI and privacy requests; promotes awareness of the legislation to ensure departmental responsiveness to statutory obligations; monitors and advises on departmental compliance with the Acts, regulations, procedures, and policies; and represents ISED on ATIP matters when dealing with the Treasury Board of Canada Secretariat (TBS), the Office of the Information Commissioner of Canada, the Office of the Privacy Commissioner of Canada, the Privy Council Office, and other government institutions. ATIP Services is also responsible for consulting with other federal departments and third parties with respect to ATIP requests.

The Director of ATIP Services is responsible for the development, coordination, and implementation of effective policies, guidelines, and procedures to manage ISED's compliance with the Acts. The administration of the legislation within the Department is managed by ATIP Services, but is also facilitated at the sector, branch, and regional office levels. Each sector and corporate branch has an ATIP liaison officer (reporting to an assistant deputy minister, executive director, etc.) who coordinates activities and provides guidance on the administrative processes and procedures of the Acts. ATIP Services, which is located in Ottawa, responds to all formal requests submitted to the Department under both Acts.

Section 73.1(1) of the Privacy Act permits institutions reporting to the same minister to enter into agreements with each other for the purpose of sharing ATIP resources and capacity. However, ISED currently has no such agreements in place.

Delegation of authority

The ATIP Delegation Order in effect on the last day of this reporting period was approved on May 18, 2021. Pursuant to subsection 95(1) of the Access to Information Act and subsection 73(1) of the Privacy Act, that delegation instrument provides full authority to the Deputy Minister and Corporate Secretary as well as to the ATIP Services Director and managers (see Annex B).

Performance

ISED's mandate is focused on Canadian businesses. Departmental programs and initiatives assist in building a more productive, competitive, and knowledge‑based economy for Canada. Therefore, there are few privacy requests or privacy‑related issues.

A summarized statistical report on requests under the Privacy Act processed from April 1, 2022, to March 31, 2023, is found in Annex A of this report. An explanation and interpretation of the information provided in the statistical report is contained in this annual report.

Responses within legislated timelines

During 2022–2023, 32 privacy requests were brought to conclusion (11% fewer than last year's 36 closures). Of these, 27 were concluded within legislated timelines, resulting in an on‑time performance of 84.4% (26.1% higher than last year's on-time performance of 58.3%).

Multi-Year trends

ISED received a total of 31 privacy requests in 2022–2023. This represents a 16% decrease compared to the 37 requests received during the previous year. In addition to the 31 new requests received, 11 incomplete requests were carried over from the previous year, for a total caseload of 42 requests. Of the total 42 requests, 32 were closed during the reporting period, and 10 were carried forward to 2023-2024.

ISED received and completed two privacy consultations from other federal institutions in this reporting period.

Requests outstanding and carried-forward

Completion times for closed requests

The 32 privacy requests closed by ISED during the reporting period were completed within the following timeframes:

• 5 within 1 to 15 days (16%)
• 14 within 16 to 30 days (44%)
• 6 within 31 to 60 days (19%)
• 4 within 61 to 120 days (12%)
• 2 within 121 to 180 days (6%)
• 1 within 181 to 365 days (3%)

Disposition of requests

The disposition of the 32 completed privacy requests is as follows:

• 4 were fully disclosed (12%)
• 13 were disclosed in part (41%)
• 9 had no existing records (28%)
• 5 were abandoned (16%)
• 1 was neither confirmed nor denied (3%)

Records were fully disclosed in 12% of cases, compared to 14% in 2021–2022, while 44% were disclosed in part, compared to 42% in the previous year. No records were fully exempted or excluded, as in the previous year.

Number of pages processed

In 2022-23, ISED processed a total of 3,906 pages of information in relation to privacy requests, broken down as follows:

• 3,883 pages pertaining to Privacy Act requests
• 23 pages pertaining to Privacy Consultations received from other federal institutions

The total page count is 46% lower than the 7,223 pages processed in the previous year.

Nature of information requested

ISED sees few privacy requests because of the nature of its mandate. Therefore, these trends have remained unchanged for many years with no significant new trends being noted. See the table under three-year overview of sources and subjects of requests.

Limits to the right of access – Exemptions and exclusions

Exemptions to the disclosure of information are permitted pursuant to sections 18 through 28 of the Privacy Act. Several exempting provisions can be applied to withhold information in response to one request, and these are reported separately in the statistical report. However, the same exempting provision invoked to withhold information more than once within the same request is reported only once.

The statistics, as shown in Annex A of this report, demonstrate that ISED invoked only three of the allowable exempting provisions during the reporting period, as follows:

• 21 (International Affairs and Defence): 1 use
• 22 (Law Enforcement and Investigations): 1 use
• 26 (Personal Information of Other Individuals): 13 uses

Exclusions provided for within the Act pertain to information that is publicly available or for sale (section 69 of the Act) and information that is in the confidence of His Majesty's Privy Council for Canada (Cabinet confidences) (section 70 of the Act). However, ISED invoked no such exclusions during the reporting period.

Extensions

ISED invoked extensions on two requests concluded during the reporting period. One of these extensions was due to an extraordinary volume of information, and the other was due to a large volume of requests being processed simultaneously, which delayed its processing. Both extensions were taken for between 16 and 30 days.

Consultations completed for other institutions

ISED received and completed two privacy consultations from other federal institutions in the current reporting period. Both were completed within 15 days, and recommendations were made to disclose entirely, in both cases.

COVID‑19 impacts and operational measures

There were no impacts to ISED's ATIP Services operations this year resulting from COVID-19.

Annual statistical report

TBS prescribes requirements for annual statistical reports on the Privacy Act, which must comprise part of the corresponding annual reports to Parliament. ISED's Annual Statistical Report on the Privacy Act is enclosed with this report as Annex A.

Training and awareness

Enhanced awareness and knowledge of ATIP obligations on the part of departmental officials has shown to improve the quality of responses and ISED's rate of compliance with legal obligations.

Throughout 2022–2023, ATIP Services delivered numerous training and awareness sessions to employees across the Department on both the Access to Information Act and the Privacy Act (and their requirements). In total, 25 training sessions relating to access to information and/or privacy were delivered to 671 employees, as follows:

• ATIP 101 at ISED : An overview of the legislation, associated timelines, and processes, as well as the role of the Department, the courts, and the Information and Privacy Commissioners of Canada, combined with a more in‑depth look at the exempting and excluding provisions of the Access to Information Act, focusing on the top three such provisions used most frequently at ISED, and how to identify information pertaining to those provisions. This session is also offered in a modified format, on-demand, to focus solely on either the Access to Information Act or the Privacy Act.
  • 18 sessions, 569 participants
• Personal Information Boot Camp: Comprehensive training focused solely on the Privacy Act and its related policy requirements, including the concept of 'informed consent,' privacy notice statements, privacy impact assessments, and privacy breach administration. This includes an in depth look at the type and volume of personal information that exists within the Department and the requirements surrounding the collection and use of personal information in relation to ISED and other Government of Canada programs.
  • 3 sessions, 50 participants
• Speciality training: A number of on-demand training sessions were delivered in 2022-23, on a diverse range topics, including: PIAs; Privacy for Case Management Systems; ATIP Processing for ATIP Sector Liaison Officers; and Identifying Cabinet Confidences.
  • 4 sessions, 52 participants

Employee response to ATIP training has remained overwhelmingly positive. In 2022-2023, 87% of survey respondents indicated they would recommend the same training to another colleague, while 100% indicated their knowledge of ATIP improved moderately or substantially, by attending.

Operating costs

The cost of delivering ISED's Privacy program and services for 2022–2023 was $57,413, based on salary costs and operating expenses.

Salary costs for 2022–2023 totalled $47,103, equating to 0.536 full‑time employees (FTEs), including students, when averaged over the year. Salary costs for 2022-2023 were 22% higher than the previous year's $38,662, owing to a 13% increase in FTEs, which stood at 0.476 in the previous year.

Operating expenses for the year totalled $10,310, representing a 399% increase over last year's $2,066. Of the 399% Increase, 307% (77% of total costs) is due to costs for professional consultants engaged during 2022-2023 to assist with backlogged policy and ATIP cases, while the remaining 92% (23 of total costs) was largely due to an increased number of licences (and the related annual maintenance fees) to support those consultants, and the increase in staff members, and to a lesser extent, other administrative costs, such as stationery and postage.

Policies, guidelines and procedures

To improve the administration of the ATIP program and to ensure that TBS ATIP policies are respected and implemented, ATIP Services collaborates with both internal and external stakeholders on a continuous basis. In 2022-23, these collaborations included:

• Weekly all-staff meetings and semi-weekly management team meetings to discuss emerging and ongoing operational and policy issues
• Ongoing collaboration with ISED stakeholders on the effective processing of ATIP requests

In addition, new policies, procedures and business practices were developed (or existing ones were updated) throughout the year, as enhancements, or to comply with various TBS directives and policies. These included:

• New guidance on the issue of "control of information"
• Updated training decks to comply with TBS requirements
• Compiled a new version of Information About Programs and Information Holdings (formerly InfoSource) for June, 2023 publication
• Developed and piloted new training for Callouts and Retrievals
• Updated Privacy Impact Assessment Policy and User Guide
• New guidance on audio-visual recordings and privacy
• New guidance on the privacy requirements incumbent on service providers
• Enhanced procedures for correcting and annotating personal information
• New procedures for processing privacy requests from extranational applicants
• Developed a new Departmental Privacy Management Framework (publication pending)
• Numerous new or enhanced policies and procedures relating to the processing of Access to Information Act requests.

ATIP Services also continues to enhance its intranet site—where all departmental employees can access plans, reports, acts, regulations, policies, directives, training decks, procedures, and checklists in one convenient place.

Initiatives and projects to improve privacy

ISED became a member of the ATIP Community Development Office in 2022-23, to take advantage of centralized training and professional development programs, and to avail the department of the recruitment campaigns, learning and networking and partnership activities afforded by membership.

ISED also successfully migrated to the TBS' new ATIP Online Management Tools system during the reporting period, which contains new and improved functionalities making it easier for applicants to track the statuses of their requests, and to receive responses to their requests online.

Key issues and actions taken on complaints

Applicants have the right to register a complaint with the Office of the Privacy Commissioner regarding any matter relating to the processing of their requests, and several complaints can be linked to the same request.

ISED received two complaints on privacy requests during the reporting period. One of the complaints was in respect of a delay in processing a Privacy Act request for personal information, and the second was an allegation of improperly applied exemptions.

One complaint was resolved during the reporting period. 

In 2022-2023, the Privacy Commissioner ruled on one outstanding complaint made under the Privacy Act, which was filed in 2021-2022, and which alleged an over- and unauthorized collection of personal information resulting from the implementation of the Policy on COVID-19 Vaccination for the Core Public Administration Including the RCMP. The Commissioner ruled in favour of ISED and deemed the complaint "not well founded".

No court challenges relating to the Privacy Act were received during the reporting period, and no audits were conducted relating to the administration of privacy legislation.

Material privacy breaches

No material breaches of privacy that required reporting to the Privacy Commissioner of Canada or to TBS occurred during the reporting period.

Privacy impact assessments

Twenty seven (27) privacy impact assessment (PIA) submissions were received this year for various project activities occurring across the Department. Of these 27 submissions, an analysis concluded the following:

• 1 project did not progress
• 19 projects were for activities that were outside of PIA policy
• 7 projects were in respect of a new or substantially modified program activity (the two factors that necessitate the requirement to conduct a PIA, pursuant to TBS policy requirements) and the ATIP Services Branch began working with the relevant program areas to develop the PIAs. At the time of completion of this annual report, it is not known if all seven projects will progress, or if some will be discontinued

The following two PIAs were concluded in the 2022-2023 reporting period, and duly submitted to the TBS and the Office of the Privacy Commissioner:

• ATIP Services at ISED (as required by the Memorandum of Understanding between the TBS and ISED for the Implementation of the ATIP Online Management Tools System)
• Identity and Credential Management Solutions at ISED

Public interest disclosures

Paragraph 8(2)(m) of the Privacy Act gives heads of institutions the discretion to disclose personal information where disclosure would clearly benefit the individual to whom the information pertains or when the interest in public disclosure clearly outweighs the privacy of the concerned individual.

ISED made no such disclosures during the reporting period.

Monitoring compliance

With respect to monitoring the processing time of requests, ATIP Services has a number of measures in place.  ATIP Services has continued the following business practices:

• Managers regularly review and monitor the status of privacy requests using the ATIP case management system
• Managers conduct weekly bilateral meetings with staff to review work plans and establish priorities
• Managers report weekly to the Director on requests to be closed as well as on‑time compliance and issues delaying or otherwise affecting processing

Further:

• ATIP Services has an escalation process to address delays in responses to taskings
• ATIP training sessions address and reinforce the importance of respecting the legislated 30-day timeline

The following new and updated procedures and policy guidance issued in 2022-23 also pertains to issues of compliance:

• New guidance on the issue of "control of information"
• Updated training decks to comply with TBS requirements
• Compiled a new version of Information About Programs and Information Holdings (formerly InfoSource) for June, 2023 publication
• Developed and piloted new training for Callouts and Retrievals
• Updated Privacy Impact Assessment Policy and User Guide
• New guidance on audio-visual recordings and privacy
• New guidance on the privacy requirements incumbent on service providers
• Enhanced procedures for correcting and annotating personal information
• New procedures for processing privacy requests from extranational applicants
• Developed a new Departmental Privacy Management Framework (publication pending)

Annex A - Annual statistical report on the Privacy Act

Name of institution: Innovation, Science and Economic Development Canada

Reporting period: 2022-04-01 to 2023-03-31

Section 1: Requests under the Privacy Act:

Section 2: Informal requests

Section 3: Requests closed during the reporting period

3.5 Complexity

3.7 Deemed refusals

Section 6: Extensions

Section 7: Consultations received from other institutions and organizations

Section 8: Completion time of consultations on cabinet confidence

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

Section 11: Privacy breaches

Section 12: Resources related to the Privacy Act:

Annex B – Delegation of ATIP authority

Delegation in effect on the last day of 2022–2023:

The Department of Industry
(To be known as Innovation, Science and Economic Development Canada)

Access to Information Act and Privacy Act Delegation Order

The Minister of Industry Canada, pursuant to section 95(1) of the Access to Information Act and section 73(1) of the Privacy Act, hereby delegates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers and functions of the Minister as the head of a government institution, under the section of the Acts set out in the schedule opposite each position. This Delegation Order supersedes all previous Delegation Orders.

Dated, at the City of Ottawa, this 18^th day of May, 2021

Original signed by the Honourable François-Philippe Champagne
Minister of Industry
(to be known as Minister of Innovation, Science and Economic Development)