2023-2024 Annual Report on the Privacy Act

Introduction

Purpose

The Privacy Act (Revised Statutes of Canada, 1985, Chapter A‑1) was proclaimed on July 1, 1983.

The purpose of the Privacy Act is "to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution and that provide individuals with a right of access to that information." The law also protects an individual's privacy by preventing others from having access to that personal information and allows an individual specific rights concerning the collection and use of their information.

Section 72 of the Privacy Act requires that the head of every government institution prepare for submission to Parliament an annual report on the administration of the Act within the institution during each financial year.

This annual report is tabled in Parliament pursuant to section 72 of the Privacy Act and describes how Innovation, Science and Economic Development Canada (ISED) administered its responsibilities for the reporting period.

Institutional mandate

ISED helps Canadian businesses grow, innovate, and expand so they can create good-quality jobs and wealth for Canadians. It also supports science research and the integration of scientific considerations into investment and policy choices. The Department helps small businesses grow through trade and innovation and promotes increased tourism in Canada. It also works to position Canada as a global centre for innovation where investments support clean and inclusive growth, the middle class prospers through more job opportunities, and companies become global leaders.

ISED's efforts focus on improving conditions for investment, supporting science, helping small and medium‑sized businesses grow, building capacity for clean and sustainable technologies and processes, increasing Canada's share of global trade, promoting tourism, and building an efficient and competitive marketplace.

In 2023–2024, ISED supported five ministers:

• the Minister of Innovation, Science and Industry;
• the Minister of Export Promotion, International Trade and Economic Development;
• the Minister of Rural Economic Development and Minister responsible for the Atlantic Canada Opportunities Agency;
• the Minister Tourism and Minister responsible for the Economic Development Agency of Canada for the Regions of Quebec; and
• the Minister of Small Business.

The Department also supported two deputy ministers and one associate deputy minister.

The Department has no non-operational subsidiaries. All ISED Portfolio agencies and associated agencies that are subject to the Access to Information Act, will table separate reports in Parliament on their relative institutional administration of the Act.

For more information on the Department's organizational mandate letter commitments, see the ministers' mandate letters section of the Prime Minister's website.

Organizational structure

Access to Information and Privacy (ATIP) Services is part of the Office of the Corporate Secretary at ISED. The ATIP team has a complement of 22 employees, consisting of one director at the executive level, three managers, and 18 advisors at various levels, from team leader to junior officer, all of whom are dedicated to processing access to information (ATI) and privacy requests and performing related functions (e.g., proactive publication, policy, training, administration, and outreach).

ATIP Services is responsible for the implementation and management of programs and services relating to the administration of the Access to Information Act and the Privacy Act for the Department. Specifically, ATIP Services makes decisions on the disposition of ATI and privacy requests; promotes awareness of the legislation to ensure departmental responsiveness to statutory obligations; monitors and advises on departmental compliance with the Acts, regulations, procedures, and policies; and represents ISED on ATIP matters when dealing with the Treasury Board of Canada Secretariat (TBS), the Office of the Information Commissioner of Canada, the Office of the Privacy Commissioner of Canada, the Privy Council Office, and other government institutions. ATIP Services is also responsible for consulting with other federal departments and third parties with respect to ATIP requests.

The Director of ATIP Services is responsible for the development, coordination, and implementation of effective policies, guidelines, and procedures to manage ISED's compliance with the Acts. The administration of the legislation within the Department is managed by ATIP Services, but is also facilitated at the sector, branch, and regional office levels. Each sector and corporate branch has an ATIP liaison officer (reporting to an assistant deputy minister, executive director, etc.) who coordinates activities and provides guidance on the administrative processes and procedures of the Acts. ATIP Services, which is located in Ottawa, responds to all formal requests submitted to the Department under both Acts.

Section 73.1(1) of the Privacy Act permits institutions reporting to the same minister to enter into agreements with each other for the purpose of sharing ATIP resources and capacity. However, ISED currently has no such agreements in place.

Delegation of authority

The ATIP Delegation Order in effect on the last day of this reporting period was approved on May 18, 2021. Pursuant to subsection 95(1) of the Access to Information Act and subsection 73(1) of the Privacy Act, that delegation instrument provides full authority to the Deputy Minister and Corporate Secretary as well as to the ATIP Services Director and managers (Annex B).

Performance

ISED's mandate is focused on Canadian businesses. Departmental programs and initiatives assist in building a more productive, competitive, and knowledge‑based economy for Canada. As such, ISED typically sees far fewer privacy related requests, than departments whose mandates are more focused on delivering programs and services to individual citizens.

A summarized statistical report on requests under the Privacy Act processed from April 1, 2023, to March 31, 2024, is found in Annex A of this report. An explanation and interpretation of the information provided in the statistical report is contained in this annual report.

Responses within legislated timelines

During 2023–2024, 45 privacy requests were brought to conclusion (41% more than last year's 32 closures). Of these, 33 were concluded within legislated timelines, resulting in an on‑time performance of 73.33% (11.07% lower than last year's on-time performance of 84.4%).

Multi‑year trends

ISED received a total of 61 privacy requests in 2023–2024. This represents a 97% increase compared to the 31 requests received during the previous year. In addition to the 61 new requests received, 10 incomplete requests were carried over from the previous year, for a total caseload of 71 requests. Of the total 71 requests, 45 were closed during the reporting period, and 26 were carried forward to 2024-2025.

ISED received and completed two privacy consultations from other federal institutions in this reporting period.

Requests outstanding and carried-forward

Nature of information requested

ISED sees few privacy requests because of the nature of its mandate. Therefore, these trends have remained unchanged for many years with no significant new trends being noted. See the three-year overview, below.

Note: Requests from ISED employees typically pertain to personal information in relation to human resources matters, while requests from the public-at-large typically pertain to personal information in relation to the department's individual operating programs.

Completion times for closed requests

The 45 privacy requests closed by ISED during the reporting period were completed within the following timeframes:

• 18 within 1 to 15 days (40%)
• 9 within 16 to 30 days (20%)
• 8 within 31 to 60 days (18%)
• 3 within 61 to 120 days (7%)
• 1 within 121 to 180 days (2%)
• 4 within 181 to 365 days (9%)
• 2 more than 365 days (4%)

Disposition of requests

The disposition of the 45 completed privacy requests is as follows:

• 9 were fully disclosed (20%)
• 14 were disclosed in part (31%)
• 1 was all exempted (2%)
• 3 had no existing records (7%)
• 18 were abandoned (40%)

Records were fully disclosed in 20% of cases, compared to 12% in 2022–2023, while 31% were disclosed in part, compared to 44% in the previous year.

Number of pages processed

In 2023-2024, ISED processed a total of 8,792 pages of information in relation to privacy requests, broken down as follows:

• 8,634 pages pertaining to Privacy Act requests; and
• 158 pages pertaining to Privacy Consultations received from other federal institutions.

The total page count is 125% higher than the 3,906 pages processed in the previous year.

Limits to the Right of Access – Exemptions and exclusions

Exemptions to the disclosure of information are permitted pursuant to sections 18 through 28 of the Privacy Act. Several exempting provisions can be applied to withhold information in response to one request, and these are reported separately in the statistical report. However, the same exempting provision invoked to withhold information more than once within the same request is reported only once.

The statistics, as shown in Annex A of this report, demonstrate that ISED invoked only three of the allowable exempting provisions during the reporting period, as follows:

• 22 (Law Enforcement and Investigations): 1 use;
• 26 (Personal Information of Other Individuals): 13 uses; and
• 27 (Privilege and Professional Secrecy) 1 use.

Exclusions provided for within the Act pertain to information that is publicly available or for sale (section 69 of the Act) and information that is in the confidence of His Majesty's Privy Council for Canada (Cabinet confidences) (section 70 of the Act). However, ISED invoked no such exclusions during the reporting period.

Extensions

ISED invoked extensions on 11 requests concluded during the reporting period. Ten of these extensions were due to a projected high volume of pages responsive to the requests, and the other was due to a consultation. All 11 extensions were taken for between 16 and 30 days.

Consultations completed for other institutions

ISED received and completed two privacy consultations from other federal institutions in the current reporting period. Both were completed within 15 days, with one being recommended for full disclosure, and the other being withdrawn by the originating institution.

Annual statistical report

TBS prescribes requirements for annual statistical reports on the Privacy Act, which must comprise part of the corresponding annual reports to Parliament. ISED's Annual Statistical Report on the Privacy Act is enclosed with this report as Annex A.

Training and awareness

Enhanced awareness and knowledge of ATIP obligations on the part of departmental officials has shown to improve the quality of responses and ISED's rate of compliance with legal obligations.

Throughout 2023–2024, ATIP Services delivered numerous training and awareness sessions to employees across the Department on both the Access to Information Act and the Privacy Act (and their requirements). In total, 20 training sessions relating to access to information and/or privacy were delivered to 798 employees, as follows:

• ATIP 101 at ISED: An overview of the legislation, associated timelines, and processes, as well as the role of the Department, the courts, and the Information and Privacy Commissioners of Canada, combined with a more in‑depth look at the exempting and excluding provisions of the Access to Information Act, focusing on the top three such provisions used most frequently at ISED, and how to identify information pertaining to those provisions. This session is also offered in a modified format, on-demand, to focus solely on either the Access to Information Act or the Privacy Act.
  • 14 sessions, 593 participants
• Personal Information Boot Camp: Comprehensive training focused solely on the Privacy Act and its related policy requirements, including the concept of 'informed consent,' privacy notice statements, privacy impact assessments, and privacy breach administration. This includes an in‑depth look at the type and volume of personal information that exists within the Department and the requirements surrounding the collection and use of personal information in relation to ISED and other Government of Canada programs.
  • 1 session, 66 participants
• Briefing Notes for Proactive Publication: In 2023-2024, ISED launched a new training series for its Sector ATIP Liaison Officers and other Administrative Officers, on preparing briefing note titles and reference numbers for proactive publication, pursuant to Part II of the Access to Information Act. This series teaches employees how to effectively manage briefing notes in ISED's correspondence management system, how to prepare information for publication, and how to identify exceptions and exclusions to content intended for publication, such as third party information, and cabinet confidences.
  • 5 sessions, 139 participants

Employee response to ATIP training has remained overwhelmingly positive. In 2023-2024, 69% of survey respondents indicated they would recommend the same training to another colleague (the remaining 31% of survey respondents did not answer this question), while 86% indicated their knowledge of ATIP improved moderately or substantially, by attending.

Mandatory training is tracked by ISED's Human Resources practitioners and individual team managers to ensure participation, and the department has made its 'Enhanced Training for ATIP Practitioners' available on its ATIP intranet site, where all employees can access and reference the material.

Operating costs

The cost of delivering ISED's Privacy program and services for 2023–2024 was $119,356, based on salary costs and operating expenses.

Salary costs for 2023–2024 totalled $109,478 equating to 1.113 full‑time employees (FTEs), including students, when averaged over the year. Salary costs for 2023-2024 were 132% higher than the previous year's $47,103, owing to a 109% increase in FTEs, which stood at 0.531 in the previous year [as costed based on a near-doubling of Privacy Act requests received, year-over-year].

Operating expenses for the year totalled $9,878, representing a 4% decrease under last year's $10,310. Operating expenses account for software licenses, stationery, postage, etc.

Policies, guidelines, and procedures

To improve the administration of the ATIP program and to ensure that TBS ATIP policies are respected and implemented, ATIP Services collaborates with both internal and external stakeholders on a continuous basis. In 2023-2024, these collaborations included:

• Ad hoc all-staff meetings and semi-monthly management team meetings to discuss emerging and ongoing operational and policy issues;
• Ongoing collaboration with ISED stakeholders on the effective processing of ATIP requests; and
• Monthly teleconferences with the Office of the Privacy Commissioner, resulting in streamlined processes.

In addition, new policies, procedures and business practices were developed (or existing ones were updated) throughout the year, as enhancements, or to comply with various TBS directives and policies. These included:

• New policy on accessing the Microsoft Outlook email accounts of absent employees, for the purpose of responding to Access to Information requests;
• ATIP Mythbusters – Debunking ATIP Fables, Tales and Urban Legends;
• Info Source 2023 Update, for June, 2024 publication;
• New training on ATIP Extensions of Time Limits; and
• New training on Managing ATIP Call-outs and Retrievals.

Updates to the following products are planned for the current fiscal year:

• Privacy Breach Tool Kit and policy guidance (to align with 2022-2023 changes made by TBS); and
• Privacy Management Framework (depersonalizing information to be used in aggregate reporting and for audit and evaluation purposes).

ATIP Services also continues to enhance its intranet site—where all departmental employees can access plans, reports, acts, regulations, policies, directives, training decks, procedures, and checklists in one convenient place.

Initiatives and projects to improve privacy

• ISED continues to subscribe to the ATIP Online Management Tools (AOMT) platform, and to implement change management processes for each update released by the Treasury Board of Canada Secretariat.
• At the time of this report, the ATIP Services Branch is testing an artificial intelligence (AI) tool, provided by Agriculture and Agrifood Canada, to identify duplicate documents, and is working with ISED's new AI Acceleration Hub on efforts to improve the tool, to make it more efficient for ISED's needs.
• At the request of ISED employees, the ATIP Services Branch developed the following new training products in 2023-2024 and made them available to all employees on its intranet site:
• New training on ATIP Extensions of Time Limits; and
• New training on Managing ATIP Call-outs and Retrievals.

Key issues and actions taken on complaints

Applicants have the right to register a complaint with the Office of the Privacy Commissioner regarding any matter relating to the processing of their requests, and several complaints can be linked to the same request.

ISED received five privacy complaints during the reporting period. Two of the complaints were in respect of delays in processing Privacy Act requests for personal information (one for a general delay and one where the applicant believed ISED took an extension of unjustified length), and the remaining three were complaints on the use and disclosure of personal information within ISED's Corporations Canada program.

For the complaints on Privacy Act requests, the case of the unjust extension was resolved in favour of the plaintiff, and the case involving the general delay had not been resolved by the end of the reporting period.

For the three complaints on the use-and-disclosure of personal information, all three were resolved at the Commissioner's early resolution stage. All three complaints pertained to personal information that was collected and made public by Corporations Canada. Two of these cases were resolved in favour of ISED, because the Canada Business Corporations Act provided the required authority—and requirement—to place certain personal information in the public domain. The third case was closed by the Commissioner, after action taken by the plaintiff to correct information nullified the basis of the complaint.

No court challenges concerning the Privacy Act were received during the reporting period, and no audits were undertaken regarding ISED's administration of the Act.

Material privacy breaches

ISED follows Treasury Board of Canada Secretariat guidelines to determine which privacy breaches meet the threshold for notifying the Office of the Privacy Commissioner of Canada and the Treasury Board of Canada Secretariat. In 2023–2024, ISED reported two privacy breaches to these organizations.

Privacy impact assessments

Fifteen (15) privacy impact assessment (PIA) submissions were received in 2023-2024 for various project activities occurring across the Department. Of these 15 submissions, an analysis concluded the following:

• 2 projects did not progress;
• 8 projects were for activities that were deemed outside of PIA policy;
• 1 project resulted in an addendum being filed in respect of a previously completed PIA

(for ISED Identity and Credential Management Solutions at ISED);

• 1 project resulted in the creation of a Privacy Protocol in-lieu of PIA (for the recording of

IT Service Desk telephone calls); and

• 3 projects were in respect of a new or substantially modified program activity (the two factors that necessitate the requirement to conduct a PIA, pursuant to TBS policy requirements) with new PIAs being established for:
  • ATIP Services at ISED;
  • Identity and Credential Management Solutions at ISED; and
  • Corporations Canada – Beneficial Ownership Transparency.

Public interest disclosures

Paragraph 8(2)(m) of the Privacy Act gives heads of institutions the discretion to disclose personal information where disclosure would clearly benefit the individual to whom the information pertains or when the interest in public disclosure clearly outweighs the privacy of the concerned individual.

ISED made no such disclosures during the reporting period.

Monitoring compliance

With respect to monitoring the processing time of requests, ATIP Services has a number of measures in place. ATIP Services has continued the following business practices:

• Managers regularly review and monitor the status of access requests using the ATIP case management system;
• Managers regularly review the status of consultation processes on privacy requests to ensure inter-institutional consultations are only conducted when required to properly exercise discretion, or where ISED intends to disclose information;
• Managers conduct weekly bilateral meetings with staff to review work plans and establish priorities; and
• Managers report weekly to the Director on requests to be closed as well as on‑time compliance and issues delaying or otherwise affecting processing.

Further:

• ATIP Services has an escalation process to address delays in responses to taskings;
• ATIP Services management meets on a regular basis with representatives of the Office of the Privacy Commissioner to address outstanding complaints and learn new approaches that could increase compliance and avoid future complaints; and
• ATIP training sessions address and reinforce the importance of respecting the legislated 30-day timeline.

With respect to the most frequently requested types and subjects of information: On the average of the past three years, only 20% of the Privacy Act request received by ISED were from the public (with the remaining 80% being from ISED's own employees). Of the 20% of requests received from the public, the majority pertain to the Bankruptcy and Insolvency program, and the Intellectual Property program, with individuals filing requests for information that is already in the public records of the Office of the Superintendent of Bankruptcy or the Canadian Intellectual Property Office. ISED does not therefore further track or analyze the balance of its Privacy Act requests in attempts to make information more openly available by other means.

With respect to ensuring that privacy protections are included in contracts, agreements and arrangements where personal information is used, the ATIP Services Branch has published guidance to this effect on its website, where all ISED employees can access and reference the content. The ATIP Services Branch works directly with program officials on the wording that is to be included in relevant contracts, agreements and arrangements. In addition, an annual reminder of this requirement is published in ISED's internal communications bulletin.

Annex A – Annual statistical report on the Privacy Act

Name of institution: Innovation, Science and Economic Development Canada

Reporting period: 2023-04-01 to 2024-03-31

Section 1: Requests under the Privacy Act

Section 2: Informal requests

Section 3: Requests closed during the reporting period:

3.5 Complexity

3.7 Deemed refusals

Section 4: Disclosures under Subsection 8(2) and 8(5)

Section 5: Requests for correction of personal information and notations

Section 6: Extensions

Section 7: Consultations received from other institutions and organizations

Section 8: Completion time of consultations on cabinet confidence

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

Section 11: Privacy breaches

Section 12: Resources related to the Privacy Act

Annex B – Delegation of ATIP authority

Delegation in effect on the last day of 2023–2024:

The Department of Industry
(To be known as Innovation, Science and Economic Development Canada)

Access to Information Act and Privacy Act Delegation Order

The Minister of Industry Canada, pursuant to section 95(1) of the Access to Information Act and section 73(1) of the Privacy Act, hereby delegates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers and functions of the Minister as the head of a government institution, under the section of the Acts set out in the schedule opposite each position. This Delegation Order supersedes all previous Delegation Orders.

Dated, at the City of Ottawa, this 18^th day of May, 2021

Original signed by the Honourable François-Philippe Champagne
Minister of Industry
(to be known as Minister of Innovation, Science and Economic Development)