2024-2025 Annual Report on the Privacy Act

Introduction

Purpose

The Privacy Act (Revised Statutes of Canada, 1985, Chapter A-1) was proclaimed on July 1, 1983.

The purpose of the Privacy Act is "to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution and that provide individuals with a right of access to that information." The law also protects an individual's privacy by preventing others from having access to that personal information and allows an individual specific rights concerning the collection and use of their information.

Section 72 of the Privacy Act requires that the head of every government institution prepare for submission to Parliament an annual report on the administration of the Act within the institution during each financial year.

This annual report is tabled in Parliament pursuant to section 72 of the Privacy Act and describes how ISED administered its responsibilities for the reporting period.

Institutional mandate

ISED helps Canadian businesses grow, innovate, and expand so they can create good-quality jobs and wealth for Canadians. It also supports science research and the integration of scientific considerations into investment and policy choices. The Department helps small businesses grow through trade and innovation and promotes increased tourism in Canada. It also works to position Canada as a global centre for innovation where investments support clean and inclusive growth, the middle class prospers through more job opportunities, and companies become global leaders.

ISED's efforts focus on improving conditions for investment, supporting science, helping small and medium-sized businesses grow, building capacity for clean and sustainable technologies and processes, increasing Canada's share of global trade, promoting tourism, and building an efficient and competitive marketplace.

ISED supports the following ministers and secretaries of state:

• the Minister of Industry;
• the Minister of Artificial Intelligence and Digital Innovation;
• the Secretary of State for Small Business and Tourism; and
• the Secretary of State for Rural Development.

The Department also supports two deputy ministers and one associate deputy minister.

The Department has four wholly owned, operational subsidiaries, which do not report separately, and for which results are included in this report. These include: the Canadian Intellectual Property Office; the Competition Bureau; Measurement Canada; and the Office of the Superintendent of Bankruptcy. The department has no non-operational subsidiaries.

Organizational structure

Access to Information and Privacy (ATIP) Services is part of the Office of the Corporate Secretary at ISED. The ATIP team has a complement of 20 employees, consisting of one director at the executive level, three managers, and 16 advisors at various levels, from team leader to junior officer, all of whom are dedicated to processing access to information (ATI) and privacy requests and performing related functions (e.g., proactive publication, policy, training, administration, and outreach).

ATIP Services is responsible for the implementation and management of programs and services relating to the administration of the Access to Information Act and the Privacy Act for the Department. Specifically, ATIP Services makes decisions on the disposition of ATI and privacy requests; promotes awareness of the legislation to ensure departmental responsiveness to statutory obligations; monitors and advises on departmental compliance with the Acts, regulations, procedures, and policies; and represents ISED on ATIP matters when dealing with the Treasury Board of Canada Secretariat (TBS), the Office of the Information Commissioner of Canada, the Office of the Privacy Commissioner of Canada, the Privy Council Office, and other government institutions. ATIP Services is also responsible for consulting with other federal departments and third parties with respect to ATIP requests.

The Director of ATIP Services is responsible for the development, coordination, and implementation of effective policies, guidelines, and procedures to manage ISED's compliance with the Acts, including with proactive publication requirements, pursuant to part II of the Access to Information Act. The administration of the legislation within the Department is managed by ATIP Services, but is also facilitated at the sector, branch, and regional office levels. Each sector and corporate branch has an ATIP liaison officer (reporting to an assistant deputy minister, executive director, etc.) who coordinates activities and provides guidance on the administrative processes and procedures of the Acts. ATIP Services, which is located in Ottawa, responds to all formal requests submitted to the Department under both Acts.

Section 73.1(1) of the Privacy Act permits institutions reporting to the same minister to enter into agreements with each other for the purpose of sharing ATIP resources and capacity. However, ISED currently has no such agreements in place.

Delegation of authority

The ATIP Delegation Order in effect on the last day of this reporting period was approved by the former Minister of Innovation, Science and Industry, on May 18, 2021. Pursuant to subsection 95(1) of the Access to Information Act and subsection 73(1) of the Privacy Act, that delegation instrument provides full authority to the Deputy Minister and Corporate Secretary as well as to the ATIP Services Director and managers (see Annex B).

Performance

ISED's mandate is focused on Canadian businesses. Departmental programs and initiatives assist in building a more productive, competitive, and knowledge-based economy for Canada. As such, ISED typically sees far fewer privacy related requests, than departments whose mandates are more focused on delivering programs and services to individual citizens.

A summarized statistical report on requests under the Privacy Act processed from April 1, 2024, to March 31, 2025, is found in Annex A of this report. An explanation and interpretation of the information provided in the statistical report is contained in this annual report.

Responses within legislated timelines

During 2024–2025, 62 privacy requests were brought to conclusion (38% more than last year's 41 closures). Of these, 41 were concluded within legislated timelines, resulting in an on-time performance of 66.13% (7.2% lower than last year's on-time performance of 73.33%).

Multi-year trends

ISED received a total of 54 privacy requests in 2024–2025. This represents an 11.5% decrease below the 61 requests received during the previous year. In addition to the 54 new requests received, 26 incomplete requests were carried over from the previous year, for a total caseload of 80 requests. Of the total 80 requests, 62 were closed during the reporting period, and 18 were carried forward to 2025-2026.

ISED also received and completed one privacy consultation from another federal institution in this reporting period.

Requests outstanding and carried-forward

Three-year overview of sources and subjects of requests

ISED sees few privacy requests because of the nature of its mandate. Therefore, these trends have remained unchanged for many years with no significant new trends being noted. See the three-year overview, below.

Note: Requests from ISED employees typically pertain to personal information in relation to human resources matters, while requests from the public-at-large typically pertain to personal information in relation to the department's individual operating programs.

Completion times for closed requests

The 62 privacy requests closed by ISED during the reporting period were completed within the following timeframes:

• 17 within 1 to 15 days (27%)
• 13 within 16 to 30 days (22%)
• 7 within 31 to 60 days (11%)
• 11 within 61 to 120 days (18%)
• 4 within 121 to 180 days (6%)
• 7 within 181 to 365 days (11%)
• 3 more than 365 days (5%)

Disposition of requests

The disposition of the 62 completed privacy requests is as follows:

• 10 were fully disclosed (16%)
• 27 were disclosed in part (43%)
• 1 was all exempted (2%)
• 5 had no existing records (8%)
• 19 were abandoned (31%)

Records were fully disclosed in 16% of cases, compared to 20% in 2023–2024, while 43% were disclosed in part, compared to 31% in the previous year.

Number of pages processed

In 2024-2025, ISED processed a total of 26,677 pages of information in relation to privacy requests, broken down as follows:

• 26,672 pages pertaining to Privacy Act requests; and
• 5 pages pertaining to Privacy Consultations received from other federal institutions.

The total page count is 203% higher than the 8,792 pages processed in the previous year.

Limits to the right of access – Exemptions and exclusions

Exemptions to the disclosure of information are permitted pursuant to sections 18 through 28 of the Privacy Act. Several exempting provisions can be applied to withhold information in response to one request, and these are reported separately in the statistical report. However, the same exempting provision invoked to withhold information more than once within the same request is reported only once.

The statistics, as shown in Annex A of this report, demonstrate that ISED invoked only four of the allowable exempting provisions during the reporting period, as follows:

• 22 (Law Enforcement and Investigations): 1 use;
• 25 (Safety of Individuals): 1 use;
• 26 (Personal Information of Other Individuals): 27 uses; and
• 27 (Privilege and Professional Secrecy) 1 use.

Exclusions provided for within the Act pertain to information that is publicly available or for sale (section 69 of the Act) and information that is in the confidence of His Majesty's Privy Council for Canada (Cabinet confidences) (section 70 of the Act). However, ISED invoked no such exclusions during the reporting period.

Extensions

ISED invoked extensions on 12 requests that were concluded during the reporting period. Nine of these extensions were due to a projected high volume of pages responsive to the requests, and the other was due to additional time being required to determine appropriate exemptions. All 12 extensions were between 16 and 30 days in duration.

Consultations completed for other institutions

ISED received and completed one privacy consultations from another federal institution in the current reporting period. That consultation was completed within 15 days, with ISED recommending a further consultation with another federal institution.

Annual statistical report

TBS prescribes requirements for annual statistical reports on the Privacy Act, which must comprise part of the corresponding annual reports to Parliament. ISED's Annual Statistical Report on the Privacy Act is enclosed with this report as Annex A.

Training and awareness

Enhanced awareness and knowledge of ATIP obligations on the part of departmental officials has shown to improve the quality of responses and ISED's rate of compliance with legal obligations.

Throughout 2024–2025, ATIP Services delivered numerous training and awareness sessions to employees across the Department on both the Access to Information Act and the Privacy Act (and their requirements). In total, 24 training sessions relating to access to information and/or privacy were delivered to 571 employees, as follows:

• ATIP 101 at ISED: An overview of the legislation, associated timelines, and processes, as well as the role of the Department, the courts, and the Information and Privacy Commissioners of Canada, combined with a more in-depth look at the exempting and excluding provisions of the Access to Information Act, focusing on the top three such provisions used most frequently at ISED, and how to identify information pertaining to those provisions. This session is also offered in a modified format, on-demand, to focus solely on either the Access to Information Act or the Privacy Act.
  • 18 sessions, 356 participants
• Personal Information Boot Camp: Comprehensive training focused solely on the Privacy Act and its related policy requirements, including the concept of 'informed consent,' privacy notice statements, privacy impact assessments, and privacy breach administration. This includes an in-depth look at the type and volume of personal information that exists within the Department and the requirements surrounding the collection and use of personal information in relation to ISED and other Government of Canada programs.
  • 3 sessions, 171 participants
• Speciality (on-demand) training: In 2024-2025, ISED delivered training on two specifically requested topics including operational processing training for Liaison Officers responsible for facilitating ATIP requests in their respective sectors (two sessions), and training for ATIP officers on how to create and analyze data queries pertaining to ATIP statistics (one session).
  • 3 sessions, 44 participants

Mandatory training is tracked by ISED's Human Resources practitioners and individual team managers to ensure participation, and the department has made its 'Enhanced Training for ATIP Practitioners' available on its ATIP intranet site, where all employees can access and reference the material.

Operating costs

The cost of delivering ISED's Privacy program and services for 2024–2025 was $68,935, based on salary costs and operating expenses.

Salary costs for 2024–2025 totalled $64,809 equating to 0.715 full-time employees (FTEs), including students, when averaged over the year. Salary costs for 2024-2025 were 41% lower than the previous year's $109,478, owing to a 36% decrease in FTEs, which stood at 1.113 in the previous year [as costed based on a reduction of Privacy Act requests received, year-over-year].

Operating expenses for the year totalled $4,126, representing a 58% decrease under last year's $9,878. Operating expenses account for software licenses, stationery, postage, etc.

Policies, guidelines, and procedures

To improve the administration of the ATIP program and to ensure that TBS ATIP policies are respected and implemented, ATIP Services collaborates with both internal and external stakeholders on a continuous basis. In 2024-2025, these collaborations included:

• Ad hoc all-staff meetings and semi-monthly management team meetings to discuss emerging and ongoing operational and policy issues;
• Ongoing collaboration with ISED stakeholders on the effective processing of ATIP requests; and
• Monthly teleconferences with the Office of the Privacy Commissioner, resulting in streamlined processes.

In addition, new policies, procedures and business practices were developed (or existing ones were updated) throughout the year, as enhancements, or to comply with various TBS directives and policies. These included:

• Appropriate safeguards for contracts, information-sharing agreements and information-sharing arrangements (December 2024);
• Notice concerning Microsoft Co-Pilot (May 2024);
• Annotated guide to privacy impact assessments and privacy protocols (December 2024);
• Annotated guide to personal information banks and classes of personal information (December 2024);
• Enhanced privacy terms and conditions for web analytics [in collaboration with ISED's Strategic Communications and Marketing Sector] (November 2024);
• Enhanced policy (and guidelines) on using personal information for non-administrative purposes [in collaboration with ISED's Chief Data Office] (March 2025); and
• ISED Privacy Management Framework [update] (March 2025).

Compliance updates to ISED's Privacy Breach Tool Kit, which were originally planned for 2024-2025, were deemed unnecessary; following release of the new Directive on Privacy Practices (October 2024) by the TBS, a review concluded that ISED's present Privacy Breach Tool Kit was already compliant with the TBS requirements.

ATIP Services also continues to enhance its intranet site—where all departmental employees can access plans, reports, acts, regulations, policies, directives, training decks, procedures, and checklists in one convenient place.

Initiatives and projects to improve privacy

• ISED continues to subscribe to the ATIP Online Management Tools (AOMT) platform, and to implement change management processes for each update released by the Treasury Board of Canada Secretariat.
• The ATIP Services Branch worked with ISED's new AI Acceleration Hub on efforts to evaluate the AI components included within the two ATIP case management systems newly offered for procurement, and to choose the correct system for ISED's future needs.
• At the request of ISED's Human Resources Branch, the ATIP Services Branch is (at the time of this report) developing new training on the processing of ATIP cases relating to labour relations issues. This new training session will be released later in 2025-2026.
• At the time of this report, the ATIP Services Branch is developing a new interactive template for ISED employees working in departmental programs that use personal information. The new template will help employes more easily develop TBS-compliant Privacy Notice Statements for use on hardcopy and web intake forms where personal information is collected. The new interactive template is expected to launch later in 2025-2026.

Key issues and actions taken on complaints

Applicants have the right to register a complaint with the Office of the Privacy Commissioner regarding any matter relating to the processing of their requests, and several complaints can be linked to the same request.

ISED received 12 privacy complaints during the reporting period, that arose from completed Privacy Act requests for information (seven more than the previous year's five complaints). Ten of the complaints were in respect of delays in processing Privacy Act requests for personal information, and the remaining two were in respect of exemptions that were applied to information that was released.

For the complaints on Privacy Act requests: In respect of the ten complaints pertaining to delays, six were deemed well-founded, two were resolved (with the requested information being released) during the investigation process, and two had not yet been concluded by the end of the reporting period. In respect of the two complaints pertaining to exemptions, both were resolved (with the release of additional information) during the investigation process.

In addition to complaints arising from completed Privacy Act requests, the Office of the Privacy Commissioner of Canada also notified ISED of five additional Privacy Act complaints pertaining to inappropriate use and disclosure of personal information. Three of these complaints pertained to public record requirements (two concerning Corporations Canada [and the Canada Business Corporations Act], and one concerning the Canadian Intellectual Property Office [and the Trademarks Act]). A further complaint alleged that the Office of the Superintendent of Bankruptcy Canada had inappropriately used personal information, overstepping its authority under the Bankruptcy and Insolvency Act, and the final complaint alleged that ISED had both collected and changed an individual's medical information, without adequate consent. All five of these additional complaints were closed by the Office of the Privacy Commissioner at the early resolution stage, with all five being ruled in favour of ISED, and none requiring any further action on the part of the department.

No court challenges concerning the Privacy Act were received during the reporting period, and no audits were undertaken regarding ISED's administration of the Act.

Total outstanding complaint inventory by year received

Material privacy breaches

ISED follows Treasury Board of Canada Secretariat guidelines to determine which privacy breaches meet the threshold for notifying the Office of the Privacy Commissioner of Canada and the Treasury Board of Canada Secretariat. In 2024–2025, ISED experienced no privacy breaches that met this threshold.

Privacy impact assessments

ISED contended with 29 privacy impact assessment (PIA) submissions during 2024-2025, for various project activities occurring across the Department, including two for which work had began in prior years. Of these 29 submissions, analysis resulted in the following actions:

• 2 projects did not progress;
• 18 projects were for activities that were deemed outside of PIA policy;
• 1 submission was eliminated, as it was a duplicate, submitted in error;
• 1 project has resulted in the requirement to create a Privacy Protocol, and new Personal Information Bank (in-lieu of a PIA);
• 5 projects are in respect of a new or substantially modified program activity (the two factors that necessitate the requirement to conduct a PIA, pursuant to TBS policy requirements), for which work is ongoing at the time of this report; and
• 2 evergreen PIA (updates) were completed (an enterprise PIA for the Canadian Intellectual Property Office, and a evergreen PIA for the Canada Digital Adoption Program), the summaries for which, have been published at the following location:
  • Canada Digital Adoption Program: Evergreen PIA Update
  • Canadian Intellectual Property Office – Evergreen Enterprise-Level Privacy Impact Assessment

Public interest disclosures

Paragraph 8(2)(m) of the Privacy Act gives heads of institutions the discretion to disclose personal information where disclosure would clearly benefit the individual to whom the information pertains or when the interest in public disclosure clearly outweighs the privacy of the concerned individual.

ISED made no such disclosures during the reporting period.

Monitoring compliance

With respect to monitoring the processing time of requests, ATIP Services has a number of measures in place. ATIP Services has continued the following business practices:

• Managers regularly review and monitor the status of access requests using the ATIP case management system;
• Managers regularly review the status of consultation processes on privacy requests to ensure inter-institutional consultations are only conducted when required to properly exercise discretion, or where ISED intends to disclose information;
• Managers conduct weekly bilateral meetings with staff to review work plans and establish priorities; and
• Managers report weekly to the Director on requests to be closed as well as on-time compliance and issues delaying or otherwise affecting processing.

Further:

• ATIP Services has an escalation process to address delays in responses to taskings;
• ATIP Services management meets on a regular basis with representatives of the Office of the Privacy Commissioner to address outstanding complaints and learn new approaches that could increase compliance and avoid future complaints; and
• ATIP training sessions address and reinforce the importance of respecting the legislated timelines of requests.

With respect to the most frequently requested types and subjects of information: On the average of the past three years, only 18% of the Privacy Act request received by ISED were from the public (with the remaining 82% being from ISED's own employees). Of the 18% of requests received from the public, the majority pertain to the Bankruptcy and Insolvency program, and the Intellectual Property program—with individuals filing requests for information that is already in the public records of the Office of the Superintendent of Bankruptcy or the Canadian Intellectual Property Office—and to a lesser extent, to matters pertaining to the Competition Bureau, many of which are exempt from disclosure. ISED therefore does not further track or analyze the balance of its Privacy Act requests in attempts to make information more openly available by other means.

With respect to ensuring that privacy protections are included in contracts, agreements and arrangements where personal information is used, the ATIP Services Branch has published guidance to this effect on its website, where all ISED employees can access and reference the content. The ATIP Services Branch works directly with program officials on the wording that is to be included in relevant contracts, agreements and arrangements. In addition, an annual reminder of this requirement is published in ISED's internal communications bulletin.

Annex A – Annual statistical report on the Privacy Act

Name of institution: Innovation, Science and Economic Development Canada

Reporting period: 2024-04-01 to 2025-03-31

Section 1: Requests Under the Privacy Act:

Section 2: Informal requests:

Section 3: Requests closed during the reporting period:

3.5 Complexity

3.7 Deemed refusals

Section 6: Extensions:

6.1 Reasons for extensions

6.2 Length of extensions

Section 7: Consultations received from other institutions and organizations:

Section 8: Completion time of consultations on cabinet confidence:

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs):

Section 11: Privacy breaches:

Section 12: Resources related to the Privacy Act:

Annex B – Delegation of ATIP authority

Delegation in effect on the last day of 2024–2025:

The Department of Industry
(To be known as Innovation, Science and Economic Development Canada)

Access to Information Act and Privacy Act Delegation Order

The Minister of Industry Canada, pursuant to section 95(1) of the Access to Information Act and section 73(1) of the Privacy Act, hereby delegates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers and functions of the Minister as the head of a government institution, under the section of the Acts set out in the schedule opposite each position. This Delegation Order supersedes all previous Delegation Orders.

Dated, at the City of Ottawa, this 18^th day of May, 2021

Original signed by the Honourable François-Philippe Champagne
Minister of Industry
(to be known as Minister of Innovation, Science and Economic Development)