Source: http://www.cbsa.gc.ca/agency-agence/reports-rapports/pia-efvp/pa-lprp-20162017-eng.html
Timestamp: 2017-12-13 16:51:37
Document Index: 324735143

Matched Legal Cases: ['art 62', 'art 1', 'art 500', 'art 1', 'art 238', 'art 159', 'art 7']

Annual Report to Parliament on the Privacy Act 2016-2017
Canada Border Services Agency 2016-2017
III. New and Revised Privacy-related Policies and Procedures
V. Audits of and investigations into the privacy practices of the Canada Border Services Agency
VI. Privacy Impact Assessments
I. Requests processed under the Privacy Act
V. Privacy Breaches
The Canada Border Services Agency (CBSA) is pleased to present to Parliament, in accordance with section 72 of the Privacy Act, its annual report on the management of this Act. The report describes the activities that support compliance with the Privacy Act for the fiscal year commencing April 1, 2016, and ending March 31, 2017. During this period, the CBSA continued to build on successful practices implemented in previous years.
The purpose of this Act is to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution and that provide individuals with a right of access to that information.Footnote 1
As stated in subsection 72(1) and 72(2) of the Privacy Act, "The head of every government institution shall prepare for submission to Parliament an annual report on the administration of this Act within the institution during each financial year … Every report prepared under subsection (1) shall be laid before each House of Parliament within three months after the financial year in respect of which it is made or, if that House is not then sitting, on any of the first fifteen days next thereafter that it is sitting."Footnote 2
The CBSA carries out its responsibilities with a workforce of approximately 14,000 employees, including over 6,500 uniformed CBSA officers who provide services at approximately 1,200 points across Canada and at 39 international locations.Footnote 4
The Access to Information and Privacy (ATIP) Division is comprised of five units: an Administration section, two Case Management units, and two Policy units. The Administration section's function is to receive all incoming requests and consultations, to ensure quality control of all outgoing correspondence, and to support both Case Management units in their day-to-day business. The Case Management units assign all branches and regions with retrieval requests and provide daily operational guidance and support to CBSA employees. The ATIP Policy and Governance Unit develops policies, tools, and procedures to support ATIP requirements within the CBSA and provides training to employees. The Information Sharing and Collaborative Arrangement Policy Unit maintains the policy framework for the CBSA's information-sharing and domestic written collaborative arrangements. On average, 53 full-time equivalents, eight part-time and casual employees, and one consultant were employed in the ATIP Division during fiscal year 2016–2017.
The ATIP coordinator for the CBSA is the Director of the ATIP Division. The ATIP Division is part of the Corporate Secretariat which reports to the Vice-President of the Corporate Affairs Branch. Consistent with best practices identified by the Treasury Board of Canada Secretariat (TBS),Footnote 5 the CBSA's ATIP coordinator is positioned within three levels of the President and has full delegated authority, reporting directly to the Director General of the Corporate Secretariat, who in turn reports to the Vice-President of the Corporate Affairs Branch.
Key to maintaining compliance with the statutory time requirements of the Privacy Act is the ATIP Division's ability to obtain personal information from branches and regions in a timely and reliable manner. Supported by a network of 17 ATIP liaison officers across the CBSA, the ATIP Division is well positioned to receive, coordinate, and process requests for personal information under the Privacy Act.
Fiscal year 2016–2017 saw high volumes of privacy requests made to the CBSA. The high volumes are largely attributable to individuals seeking copies of their history of arrival dates into Canada. In fiscal year 2016–2017, 78% of all the privacy requests received by the CBSA came from individuals seeking their Traveller History Report, which contains information used to support residency requirements for programs administered by Immigration, Refugees and Citizenship Canada (IRCC) and Employment and Social Development Canada (ESDC).
The CBSA continued to see high volumes of privacy requests submitted through the Access to Information and Privacy Online Request tool. Through this tool, the Agency received 5,563 requests, which amounted to 48% of all privacy requests received by the CBSA.
The CBSA continued to offer the electronic format for responses to privacy requests. Although electronic format made up only 10.8% of all formal privacy requests that were either all disclosed or disclosed in part in fiscal year 2016–2017, these requests accounted for 48.1% of all the pages the CBSA disclosed in their entirety or disclosed in part this fiscal year.
The ATIP Division also provided case-by-case policy guidance to CBSA program areas related to the disclosure of information under section 8 of the Privacy Act and section 107 of the Customs Act. In total, the ATIP Division received 1,293 requests for guidance in fiscal year 2016–2017, representing an increase of 34% over the previous year.
In fiscal year 2016–2017, the ATIP Division continued to conduct bilingual training sessions that supported the implementation of streamlined processing procedures and built an awareness of ATIP obligations. These sessions are designed to ensure that the participants fully understand their responsibilities under the Privacy Act, with a focus on requests made pursuant to the Act and the duty-to-assist principles. Five sessions were offered, with 97 National Capital Region (NCR) and regional employees taking part.
CBSA employees also took advantage of the free online course entitled "Managing Information at the Canada Border Services Agency and the Access to Information Act and the Privacy Act." This one-hour online course was designed to provide employees with the basic principles for effectively managing information in their daily work. After completing this course, employees will have acquired the knowledge to better identify various types of information, learned how requests under the Access to Information Act and the Privacy Act are handled, and learned about their responsibilities throughout the process. A total of 653 employees completed the online training in fiscal year 2016–2017.
Moreover, the ATIP Division delivered six in-class training sessions on section 107 of the Customs Act, as well as basic information-sharing, disclosure of intelligence-related information, and business line-specific training sessions to 108 employees in the NCR and across the regions. In addition, the interactive online training course for all CBSA personnel regarding information sharing continues to be well-received.
Further, the ATIP Division developed a communications plan to raise employees' awareness of their obligations under the Privacy Act. The plan leverages key dates, such as Data Privacy Day, and other activities at the CBSA to promote ATIP tools, resources, and awareness.
During fiscal year 2016–2017, the CBSA continued to revise existing policies and to develop new ones. Of note, the internal procedures for the processing of complaints received from the Office of the Privacy Commissioner of Canada (OPC) were updated. In consultation with the OPC, the CBSA was able to put in place a procedure that provides all relevant information for the investigation while reducing the administrative burden on the analyst. These changes have helped to strengthen and build on the Agency's strong relationship with the Privacy Commissioner.
The ATIP Division has taken a number of measures to enhance and promote ATIP tools that are readily accessible to CBSA employees. One of these measures is to keep the ATIP intranet site up to date and available to all CBSA employees. This allows the ATIP Division to quickly share information and best practices and to facilitate collaboration across the Agency.
During the reporting period, the Policy and Governance Unit developed a Privacy Impact Assessment (PIA) Handbook. This handbook was designed to help program areas draft PIAs that follow the Treasury Board Directives, and it provides clear guidance on CBSA policy and procedures.
The ATIP Division continued to provide the service of informally reviewing CBSA records for internal programs as if they had been requested under the Privacy Act. The ATIP Division received 76 internal requests of this nature in fiscal year 2016–2017.
The ATIP Division closely monitors the time it takes to process privacy requests. Monthly reports, which show trends and performance, are submitted to the managers of the Case Management units, the Director of the ATIP Division, and the Director General of the Corporate Secretariat. Monthly reports consisting of statistics on the performance of the offices of primary interest are also distributed to all ATIP liaison officers. Finally, quarterly trend reports portraying the overall performance of the Agency are reviewed and discussed during meetings of the Agency's Executive CommitteeFootnote 6 and are included in the Agency Performance Summary.
The CBSA, in accordance with the Privacy Act, maintains a reading room for applicants who wish to review material in person at the CBSA. Applicants may access the reading room by contacting the CBSA's ATIP Director by telephone at 343-291-7021 or by sending an email to ATIP-AIPRP@cbsa-asfc.gc.ca. The reading room is located at:
V. Audits of, and investigations into the privacy practices of the Canada Border Services Agency
In 2016–2017, the CBSA underwent an audit by the OPC regarding its Security of Canada Information Sharing Act-related information-sharing activities, and the CBSA is currently undergoing a second audit regarding its national security-related information-sharing activities at the National Targeting Centre. The findings and recommendations are expected in fall 2017.
In addition, one audit initiated in 2015–2016 by the CBSA Internal Audit and Program Evaluation Directorate relating to the access to information and privacy practices of the CBSA was concluded. The results have been summarized below.
As part of the CBSA Risk-Based Audit Plan 2014–2015 to 2016–2017, the CBSA Internal Audit and Program Directorate completed an audit of the ATIP Division in 2016–2017. The objective of this audit was to assess the adequacy of the ATIP management control framework, including the management of human resources business processes, to evaluate ATIP's compliance with legislative timelines and the controls that mitigate the risk of disclosing exempted information.
The CBSA Internal Audit and Program Evaluation Directorate's Report to the Audit Committee on this audit was published in October 2016. Two recommendations were put forward and have been accepted by the VP of Corporate Affairs. The recommendations and response are outlined below.
The VP of Corporate Affairs Branch should ensure the user profiles within the AccessPro Case Management system are restricted, where operationally feasible, to appropriately control access to ATIP information and identify access control requirements for future ATIP-related software issues.
The Corporate Affairs Branch agrees with the audit recommendation. A feasibility assessment on the impact of more restrictive access controls in the current ATIP case management system will be undertaken. We will also work with Treasury Board of Canada Secretariat to propose enhanced access controls in future ATIP case management systems.
The VP of Corporate Affairs Branch should optimize the ATIP function which could include: determining which key functional positions within the Agency require mandatory ATIP training; establishing a human resources plan; and providing reports that are sufficiently detailed to drive process improvement.
The Corporate Affairs Branch agrees with the audit recommendation. Key positions within the Agency that require training will be identified, and the ATIP Division's human resource strategy will be aligned with its business plan. More detailed reports to support optimizing the ATIP function have already been created for internal use.
In fiscal year 2016–2017, the CBSA completed four PIAs. They were all sent to the OPC and TBS for review and comments.
The four PIAs completed by the CBSA are:
The full executive summaries of these PIAs can be found on the CBSA's website.
The Primary Inspection Kiosk (PIK) initiative represents the next evolution in automating Canada's international air ports of entry in partnership with airport authorities. The PIK initiative will introduce increased functionality in support of both facilitation and security, including complete on-screen traveller declaration and the elimination of the paper E311 declaration card, use of facial matching software to compare the photo of travellers from their passport with the current photo taken at the kiosk, and validation of ePassports for authenticity using the International Civil Aviation Organization standards. In addition, the PIK initiative will expand the population eligible to use the self-serve kiosks to visa-exempt and visa-required foreign nationals.
The Entry/Exit initiative falls under the CBSA's mandate of providing integrated border services that support national security and public safety priorities and facilitate the free flow of persons and goods that meet all requirements under the program legislation.
The Entry/Exit initiative will implement a system to exchange Biographic Entry Data between Canada and the United States (US) such that an entry into one country is considered an exit from the other, thereby establishing a common integrated approach to border management. The coordinated investments in entry and exit systems will assist the Government of Canada in meeting its objective of effectively administering and enforcing Canada's immigration program and border management practices.
NEXUS is a binational Canada–US program managed by the CBSA and US Customs and Border Protection.
NEXUS allows for customs and immigration border clearance processes to be streamlined for pre‑approved, low-risk travellers. Membership is for five years and provides expedited border clearance into Canada and the US in the land, air, and marine travel modes. NEXUS members use dedicated lanes in the highway mode, self-serve kiosks in the air mode, and, by reporting through Telephone Reporting Centres in the marine mode.
Under existing legislation, foreign nationals who are believed to be or found to be inadmissible to Canada under the Immigration and Refugee Protection Act (IRPA) on the basis of security, certain provisions relating to human or international rights violations, or organized criminality may seek a declaration of relief from the Minister of Public Safety and Emergency Preparedness under subsection 42.1(1) of IRPA. If the Minister decides to make a declaration of relief, the original groups for inadmissibility no longer apply. The foreign nationals may then pursue temporary or permanent resident status without their applications being rejected on the same grounds of inadmissibility for which relief was granted.
During the 2016–2017 fiscal year, 874 disclosures pursuant to paragraph 8(2)(e) of the Privacy Act were made by the CBSA.
During the 2016–2017 fiscal year, the CBSA made one disclosure related to immigration removals pursuant to paragraph 8(2)(m) of the Privacy Act.
It is in the public interest to demonstrate that the CBSA is carrying out its mandate. This disclosure served to demonstrate that the objectives and integrity of the immigration system and the protection of the health and safety of Canadians were being maintained. The balance between the public's need to know and protection of an individual's privacy is of utmost concern to the CBSA. In this case, it was determined that public interest in the disclosure of this individual's removal status outweighed any injury to the individual.
The OPC was notified before the disclosure was made.
The CBSA received 11,590 privacy requests in fiscal year 2016–2017, which was an increase of 3% over the previous year. Moreover, the CBSA responded to 11,791 Privacy Act requests, representing 87.3% of the total number of requests received and outstanding from the previous reporting period.
For the past five years, the CBSA has consistently been among the top government departments in terms of workload. While consistently receiving upwards of 11,000 requests each year, the CBSA has been able to streamline processes to start to eliminate the backlog of requests created in the previous five years. This year the Agency closed more requests than it received, despite an increase of 155% in the pages reviewed over last year, which shows a positive direction for the future.
Privacy Requests Received/Completed
2012-2013 13,379 13,191
2013-2014 11,890 11,420
2014-2015 12,769 12,024
2015-2016 11,247 11,400
2016-2017 11,590 11,791
As mentioned previously, this large workload is largely attributable to requests for the Traveller History Report required by IRCC as well as ESDC to process a variety of applications.
Traveller History Report Workload
Other Privacy Requests
2012-2013 3,131 10,248
2013-2014 2,062 9,828
2014-2015 2,207 10,562
2015-2016 2,470 8,777
2016-2017 2,492 9,098
II.	Outstanding requests from previous years
During this reporting period, the CBSA built on the positive steps taken last year and was able to close more files than it received. Of the 1,701 requests carried over to fiscal year 2017–2018, 1,108 were on time and 593 were late.
Of all the requests completed, the CBSA was successful in responding to 89.7% within the legislated timelines, an increase from the 88.7% achieved last fiscal year.
In total, 517 extensions were applied for in fiscal year 2016–2017. This represents a decrease of 65% in extensions in comparison to the previous fiscal year.
Subsection 29(1) of the Privacy Act describes how the OPC receives and investigates complaints from individuals regarding their personal information held by a government institution. Examples of complaints the OPC may choose to investigate include a refusal of access to personal information; an allegation that personal information about an individual that is held by a government institution has been misused or wrongfully disclosed; or failure to provide access to personal information in the official language requested by the individual.
Throughout fiscal year 2016–2017, 70 Privacy Act complaints were filed against the CBSA, which represents an increase of 55.9% compared to fiscal year 2015–2016. The reason most cited for complaints was a delay in responding to requests. It should also be noted that the number of complaints filed relate to 0.5% of the privacy requests completed during this period. The complaints received during the fiscal year were related to the following issues: time delay (41); use and disclosure (16); application of exemptions (4); refusal to disclose (3); collection (4); and extensions (2).
Of the 35 complaints resolved in fiscal year 2016–2017, 23 were deemed well-founded, seven were deemed not well-founded, and five were discontinued. Where complaints are substantiated, the matter is reviewed by the delegated managers and processes are adjusted if required.
There were no material privacy breaches reported during the 2016–2017 fiscal year.
The achievements portrayed in this report reflect the CBSA's commitment to ensuring that every reasonable effort is made to meet its obligations under the Privacy Act. The CBSA strives to provide Canadians with their personal information to which they have a right in a timely and helpful manner while protecting the privacy rights of all Canadians.
Pursuant to section 73 of the Access to Information Act and section 73 of the Privacy Act, I hereby designate the persons holding the positions set out in the schedule hereto, or a person authorized to exercise the powers or perform the duties and functions of that position, to exercise or perform the powers, duties and functions of the Minister of Public Safety and Emergency Preparedness as the head of the Canada Border Services Agency under the provisions of the Act and related regulations set out in the schedule opposite each position. This order replaces previous designation orders and comes into force on the date on which it is signed. Dated at Ottawa, Province of Ontario, this 3rd day of May, 2016.
Director, ATI Privacy Division Full Authority Full Authority
Manager, ATI Privacy Division Full Authority Full Authority
Team Leader, ATI Privacy Division Full Authority Full Authority
Received during reporting period 11,590
Outstanding from previous reporting period 1,902
Total 13,492
Closed during reporting period 11,791
Carried over to next reporting period 1,701
All disclosed 321 5,923 1,007 31 14 4 4 7,304
Disclosed in part 62 1,455 556 155 83 196 298 2,805
All exempted 0 1 1 1 0 1 1 5
No records exist 32 396 89 12 4 4 3 540
Request abandoned 844 220 21 8 3 7 31 1,134
Neither confirmed nor denied 1 1 1 0 0 0 0 3
Total 1,260 7,996 1,675 207 104 212 337 11
19(1)(a) 565
19(1)(b) 51
19(1)(c) 53
19(1)(d) 143
22(1)(a)(i) 32
22(1)(a)(iii) 6
22(1)(b) 1,532
22(1)(c) 21
23(a) 1
All disclosed 7,244 60 0
Disclosed in part 1,580 1,225 0
Total 8,824 1,285 0
All disclosed 25,870 25,870 7,304
Disclosed in part 500,659 321,388 2,805
All exempted 2,275 0 5
Request abandoned 16,959 5,920 1,134
Total 545,763 353,178 11,251
All disclosed 7,291 23,293 13 2,577 0 0 0 0 0 0
Disclosed in part 1,772 29,484 767 127,205 177 78,352 88 81,350 1 5,097
All exempted 3 0 0 0 1 0 1 0 0 0
Request abandoned 1,113 182 10 583 5 538 6 4,617 0 0
Neither confirmed nor denied 3 0 0 0 0 0 0 0 0 0
Total 10,182 52,959 790 130,265 183 78,890 95 85,967 1 5,097
Disclosed in part 238 0 2,614 2 2,854
Request abandoned 19 0 0 1 20
Total 257 0 2,614 3 2,874
1,216 1,216 0 0 0
1 to 15 days 327 25 352
16 to 30 days 69 6 74
31 to 60 days 79 17 96
61 to 120 days 85 32 117
121 to 180 days 46 21 67
181 to 365 days 144 102 246
More than 365 days 123 141 264
Total 872 344 1,216
874 1 1 876
Notations attached 39
Requests for correction accepted 5
All disclosed 7 0 1 0
Disclosed in part 159 0 307 0
All exempted 0 0 2 0
Request abandoned 3 0 27 0
Total 179 0 338 0
1 to 15 days 0 0 145 0
16 to 30 days 179 0 193 0
Received during the reporting period 77 1,571 0 0
Outstanding from the previous reporting period 6 403 0 0
Total 83 1,974 0 0
Closed during the reporting period 75 1,157 0 0
Pending at the end of the reporting period 8 817 0 0
All disclosed 9 9 1 3 0 2 0 24
Disclosed in part 7 19 7 4 1 2 0 40
All exempted 2 7 1 0 0 1 0 11
Total 18 35 9 7 1 5 0 75
70 0 35 0 105
Salaries $4,290,828
Overtime $140,407
Goods and Services $657,966
• Professional services contracts $375,847
• Other $282,119
Total $5,089,201
Full-time employees 52.62
Part-time and casual employees 7.63
Total 61.75
Privacy Act R.S., 1985, Chapter P-21. Retrieved from the Department of Justice Canada website: http://laws-lois.justice.gc.ca/eng/acts/P-21/page-1.html