Source: http://www.psc-cfp.gc.ca/abt-aps/atip-aiprp/2011/pa-lprp/index-eng.htm
Timestamp: 2017-01-17 12:54:17
Document Index: 369337405

Matched Legal Cases: ['art: 6', 'Art. 18', 'Art. 19', 'Art. 20', 'Art. 21', 'Art. 22', 'Art. 22', 'Art. 23', 'Art. 24', 'Art. 25', 'Art. 26', 'Art. 27', 'Art. 28', 'Art. 69', 'Art. 70']

Privacy Act Annual Report: 2010-2011
4.3 Complaints closed — not well founded
Appendix A — Delegation Instrument
Appendix C — 2010-2011 Annual Privacy Act Statistical Report
The Privacy Act (the "Act") extends to individuals the right to access information about them that is held by the government. This is, however, subject to specific and limited exceptions.
This Annual Report provides a summary of the management and administration of the Privacy Act within the Public Service Commission of Canada (PSC) for the fiscal year 2010-2011.
Telephone: 613-995-9032Fax: 613-996-4337
We recruit talented Canadians from across the country to the public service. We continually renew our recruitment services to meet the needs of a modern and innovative public service.
PSC strategic outcome:
To provide Canadians with a highly competent, non partisan and representative public service, able to provide service in both official languages, in which appointments are based on the values of access, fairness, transparency and representativeness
Program Activity 1.1.0 — Appointment Integrity and Political Impartiality
The Appointment Integrity and Political Impartiality activity is focused on independently safeguarding merit and non-partisanship in the federal public service. This activity includes developing and advancing strategic policy positions and directions; conducting policy research; establishing PSC policies and standards; providing advice, interpretation and guidance; and administering delegated and non-delegated authorities.
Program Activity 1.2.0 — Oversight of Integrity in Staffing
The Oversight of Integrity in Staffing activity provides an accountability regime for the implementation of the appointment policy and regulatory framework for safeguarding the integrity of public service staffing and ensuring that staffing is free from political influence. This activity includes monitoring departments' and agencies' staffing performance and compliance with legislative requirements; conducting audits and studies; carrying out investigations; and reporting to Parliament on the integrity of public service staffing.
Program Activity 1.3.0 — Staffing Services and Assessment
The Staffing Services and Assessment activity develops and maintains systems that link Canadians and public servants seeking employment opportunities in the federal public service with hiring departments and agencies. It provides assessment-related products and services in the form of research and development, consultation, assessment operations and counselling for use in recruitment, selection and development throughout the federal public service. This activity also includes delivering staffing services, programs and products to departments and agencies, to Canadians and to public servants, through client service units located across Canada.
Program Activity 2.1.0 — Internal Services
The Internal Services program activity develops and monitors corporate management planning frameworks and policies related to the Management Accountability Framework, finance, human resources (HR) management, information technology, communications and other administrative and support services; provides central services, legal services and systems in support of all PSC programs, including the offices of the President and Commissioners; and formulates and implements policies, plans, guidelines, standards, processes and procedures to support the decision-making process of the Commission.
1.2.0 Oversight of Integrity of Staffing
Under section 3 of the Privacy Act (the "Act"), the President of the Commission is designated as the head of the government institution for purposes of the administration of the Act.
The Coordinator is also responsible for related policies, systems and procedures emanating from the Act.
The ATIP Office administers the provisions of the Act for the PSC. The Manager of the ATIP Office reports to the ATIP Coordinator, who, in turn, reports to the Vice President, Legal Affairs Branch of the PSC. The ATIP Office operates with one analyst to manage the requests received within the PSC. During the course of this reporting period, the ATIP Office hired a junior officer on a casual basis for scanning and data entry. The analyst is responsible for processing Privacy Act requests and consultations and responding to complaints. The analyst is also responsible for the re-alignment of the PSC's Info Source chapter, and helps with the statistics reports in preparation for Executive Management Committees and the end of Year Annual Report to Parliament.
During more than half of the fiscal year, the ATIP Manager was replaced by counsel from PSC's Legal Services. In addition to providing legal advice and guidance to the ATIP Office on the application of the Act, the ATIP Manager/Counsel assisted the Offices of primary interest within the PSC in the delivery of their program and activities having an Access to Information Act component.
In recognition of the importance of privacy, the PSC developed a Privacy Management Framework (PMF). In keeping with the fundamentals of privacy, the objective of the PMF is to outline the way in which the PSC structures itself through policies and procedures to distribute privacy responsibilities, coordinate privacy work, manage privacy risks and ensure compliance with both the Access to Information Act and Privacy Act.
The PMF was approved by the Executive Management Committee in March 2011. A Privacy Impact Assessment Strategy, a component of the PMF, was approved in April 2011. The PMF included the development of a governance model, to clearly identify privacy responsibilities within the corporate structure of the PSC, and a PSC specific Privacy Policy.
In addition guidance documents for employees further enhance the awareness of privacy concerns among PSC employees. Such documents include the following:
Privacy Protocol for use of personal information for non-administrative purposes
Privacy Guidelines for Collection, Retention, Use and Disposal of Personal Information
The PSC also adopted a framework for managing privacy breaches which includes the following:
Policy for Privacy Breaches
Procedures for Managing Privacy Breaches
The PSC also developed the PSC Guide on Completing Privacy Impact Assessments which will facilitate and support the PSC's respect of the Directive on Privacy Impact Assessments which came into effect on April 1, 2010.
The ATIP Office intranet site has been updated and is the primary vehicle for communicating the PMF with PSC employees. In addition, the ATIP Office plans to deliver additional training for PSC employees, which will cover the PMF, to further enhance their knowledge of privacy issues.
The ATIP Office also enhanced its office procedures to ensure that ATIP analysts are informed of their obligations and responsibilities in the administration of requests under the Access to Information Act and Privacy Act. This included the adoption of the ATIP Office Process and Compliance Manual and various documents and procedures that will assist analysts.
The PSC is committed to the continuous improvement of its management fundamentals and continues to use the results of the most recent Management Accountability Framework (MAF) assessment as a benchmark. As part of the MAF, the Info Source introduction has been ever greened to reflect the PSC's Program Activity Architecture (PAA).
The PSC has extensively reviewed its Info Source chapter and followed the TBS requirements and careful attention was paid to ensure the PSC complied with the instructions of the 2010 Implementation Report. Over the course of the reported period, the PSC had submitted for final approval eight Personal Information Banks. The PSC will continue renewing its Info Source chapter to align the classes of records and personal information banks to reflect the PSC's updated PAA.
The ATIP Office Manager is also member of PSC Working Groups and Working Group Sub-Committees and offers advice related to privacy and protection of personal information in the context of these committees' activities.
The ATIP Office also participated in 7 orientation sessions where information was provided to approximately 100 new PSC employees regarding obligations under the Act.
During the reporting period, the ATIP office updated its AccessPro Case Management System software to the newest version available from the supplier. This software application and data resides on a more stable server.
During this reporting period, the ATIP Office focused its efforts on 8 PIB descriptions on PSC program activities and systems for the 2010 Info Source publication:
Mobility Provisions for Former Minister's Staff and Persons Formerly Employed at the Office of the Governor General's Secretary
Assessment by the Personnel Psychology Centre;
Applicants, Inventories and referrals; and
As part of its in-depth review and re-alignment of its Info Source chapter, the PSC is also working with program areas from the Staffing and Assessment Branch to merge related PIBs in order to simplify and streamline reporting within the PSC information holdings.
The PSC is also reviewing record retention policies and will provide updated information to TBS for review within the 2011-2012 reporting period.
The ATIP Office routinely reviews audit reports prepared by the PSC prior to their release. This is to ensure that any decision by the PSC to release personal information found in an audit report is in the public interest and that Privacy Commissioner is informed, in accordance with section 8(5) of the Act. The ATIP Office reviewed 12 audit reports over the course of the reporting period.
In 2010-2011, the ATIP Office also routinely reviewed Informatics Technology Project Initiation Forms (PIF) to:
determine if there are requirements for a Privacy Impact Assessment; and
ensure that personal information banks provide proper description.
The ATIP Office reviewed 25 PIFs over the course of the reporting period.
The ATIP Office also reviewed and provided advice regarding updates to 10 Privacy Notice Statements for various program activities over the course of this reporting period.
From April 1, 2010 to March 31, 2011, the PSC received 28 requests compared to 31 during the previous reporting period; representing a decrease of 10%. One of these requests generated over 15 000 pages for review. Given the number of pages, which on average is equivalent to an entire year's worth of Privacy Act related records to review, the PSC will not make its legislative deadline. Nevertheless, the PSC has already conducted a partial review and a partial disclosure of relevant records to the applicant. There was one request outstanding from 2009-2010.
In an attempt to increase and facilitate access, the PSC treats informally as many requests for information as possible.
The PSC completed 26 requests during the reporting period and carried forward three into the (2011-2012) reporting period. One of the three is the request mentioned above (containing over 15 000 pages for review). For a historical comparison of requests received and completed, see Appendix B.
As in previous years, the 26 completed requests covered the entire gamut of the PSC's activities. More specifically, they pertained to the following categories:
Twelve requests (46 percent) related to staffing activities. For the most part, these requests were from individuals seeking personal information collected in the context of selection processes or regarding test results obtained during the assessment parts of selection processes; including Second Language Evaluation.
Ten requests (38.5 percent) were from individuals seeking information about themselves on various issues such as priority administration files, and political candidacy requests.
Four requests (15.5 percent) were from individuals seeking information contained in investigation and audit files.
The preferred method of access reported by the PSC, as well as by departments and agencies throughout the federal government, is to receive copies of government records as opposed to simply view them.
The PSC received 6 requests for privacy consultations from other government departments and agencies. These requests amounted to a review of 111 pages of information. After a thorough review of the files, the PSC determined that for 4 of the 6 requests, the information pertaining to the PSC could be released in full, while information related to the other two requests could be disclosed in part.
The requests for consultation pertained to the Public Service Employment Act, information on staffing files, and other forms of assessment results as well as information related to PSC investigations.
The PSC itself consulted other government departments and agencies for 5 of its Privacy Act requests.
Of the 26 cases where the PSC completed the request, information was released either in whole or in part in 14 requests (53 percent).
In 8 of the 26 completed cases (30 percent), the applicants were provided with full access to the relevant records.
The PSC was compelled by the exemptive and exclusionary provisions of the Privacy Act to provide applicants partial access in 6 of the 26 completed cases, or (23 percent).
There were 2 instances (8 percent) in which the PSC was compelled by the exemptive and exclusionary provisions of the Privacy Act not to release information. These requests contained information on on-going investigations being conducted under the Public Service Employment Act.
After an initial review, the PSC was unable to process six requests (23 percent). In all of these instances, the PSC did not have any records relating to the request.
Of the 26 completed privacy requests, two (8 percent) were considered to be abandoned by the applicant. Such an action may occur at any point in the processing of a request.
Of the 26 requests only two (8 percent) were transferred to another government institution in 2010-2011.
During the reporting period, the PSC invoked exemptions under s. 22(1)(c) of the Act in five requests; s. 26 of the Act in four requests and section 27 of the Act in two requests. Information about another individual (section 26 of the Act) accounts for the majority of the exemptions applied by the PSC.
Pursuant to section 69, the Act does not apply to material that is published or available for purchase, library or museum material preserved solely for public record, material deposited with Library and Archives Canada, as well as records considered to be confidences of the Queen's Privy Council of Canada pursuant to section 70 of the Act. Therefore, no exclusions were invoked by the PSC under section 69 or section 70 during the processing of privacy requests during the reporting period.
Of the 26 requests completed during the reporting period, 5 needed to be extended for 30 days or under in accordance with section 15 of the Privacy Act. In all these 5 cases, the PSC had to consult with other government departments.
All of the 26 request completed, were completed within the prescribed legislative time frame.
Within the first thirty days, 21 (81 percent) requests were completed, while 5 (19 percent) requests were completed within 31 to 60 days.
All 14 requests in which information was released, the applicants received paper copies of the information.
There were no requests for the correction of personal information (as per section 12(2) of the Privacy Act).
The total salary costs associated with the privacy program were $126,586 and operations and maintenance costs were $13,445, for a combined total of $140,031. The associated full-time equivalent resources utilized were estimated at 1.25 for the 2010-2011 reporting period.
The Office of the Privacy Commissioner (OPC) received two complaints regarding Privacy Act requests addressed to and received by the PSC during the reporting period. The OPC carried forward one investigation from the 2009-2010 reporting period.
Both complaints addressed to and received by the PSC during the reporting period were related to allegations of inappropriate applied exemptions and missing records.
During the 2010-2011 reporting period, the OPC closed three complaints (one outstanding from the previous reporting period which was an allegation of missing records). In all three instances, the OPC considered the complaints not well founded. Their investigations revealed that the PSC did not have any other records related to the requests and that exemptions invoked were considered appropriate.
At the end of the 2010-2011 reporting period, there were no outstanding complaints from the OPC.
Although no new or completed PIAs were conducted during the fiscal reporting period, there were however, a total of 7 PSC programs in which PIAs were either being discussed and/or were at different stages of initiation/completion. Furthermore, as identified in appendix D of this report, one Privacy Impact Assessment was forwarded to the Office of the Privacy Commissioner. This PIA provided an updated version of the original PIA on the Public Service Resourcing System from 2005 and represented a major undertaking for the organization. A working subcommittee was formed in order to address the mitigating measures identified in the PIA action plan. This committee met and still meets on average every six to eight weeks. Also of note, is the ongoing update to another legacy system called the Analytical Environment (to be finalized over the course of the next reporting period). Both of these systems represent a large volume of personal information being managed as part of two major activities under the Public Service Employment Act mandate.
The ATIP Office has updated both its Intranet and Internet sites and it is expected that PSC PIA summaries will be published on these sites in the near future.
Of note, in the 2009-2010 Office of the Privacy Commissioner's (OPC) Annual Report on Privacy, the PSC was cited in the Privacy Impact Assessment (PIA) section of their report regarding the PSC's Political Impartiality Monitoring Approach (PIMA) PIA.
PIMA “… a program that would cross-reference government databases of current and former public servants with candidate lists in federal, provincial and municipal election campaigns...”
“…would also monitor the Internet, including media outlets, personal websites and social networking sites such as Facebook, for signs of potentially inappropriate political activity by public servants.”
The report further stated that the PSC had a mandate to ensure an impartial public service, however concerns were raised that this initiative could potentially yield an ongoing and unlimited database about the opinions, political affiliations, personal causes, hobbies, religious affiliations and group memberships of past and present public servants, deputy heads and Governor in Council appointees.
In response to these statements, the PSC indicated to the OPC that in monitoring the political activities of public servants, the PSC never intended to create/collect the masses of information that the OPC was suggesting in their annual report. The PSC did not, does not, nor will it have an ongoing, unlimited database as mentioned in the OPC report. This being said, the PSC is revising its Political Activities Monitoring Approach, and in the event the activity ends up collecting personal information, the PSC will consider the requirements under the PIA Directive accordingly.
Privacy Act — Delegation Order
Pursuant to section 73 of the Privacy Act, the President of the Public Service Commission of Canada hereby designates the Secretary General Commission Secretariat or in his or her absence, the Manager of the Access to Information and Privacy Office or a Senior ATIP Analyst, Legal Service Branch, to exercise or perform any of the powers, duties or functions of the Head of the government institution vested in him by the Privacy Act.
June 7, 2010Date
Report on the Privacy Act 2010-2011
Institution: Public Service Commission of CanadaReporting period: 2009-04-01 — 2010-03-31
Received during reporting period: 28Outstanding from previous period: 1Total: 29Completed during reporting period: 26Carried forward: 3
All disclosed: 8
Disclosed in part: 6
Abandoned by applicant: 2
Total: 26III. Exemptions invoked
S. Art. 18(2): 0S. Art. 19(1)(a): 0(b): 0(c): 0(d): 0S. Art. 20: 0S. Art. 21: 0S. Art. 22(1)(a): 0(b): 0(c): 5S. Art. 22(2): 0S. Art. 23(a): 0(b): S. Art. 24: 0S. Art. 25: 0S. Art. 26: 4S. Art. 27: 2S. Art. 28: 0IV. Exclusions citedS. Art. 69(1)(a): 0(b): 0S. Art. 70(1)(a): 0(b): 0(c): 0(d): 0(e): 0(f): 0
V. Completion time30 days or under: 2131 to 60 days: 561 to 120 days: 0121 days or over: 0
30 days or underInterference with operations: 0Consultation: 5Translation: 0Total: 5
31 days or overInterference with operations: 0Consultation: 0Translation: 0Total: 0
English to French: 0French to English: 0
Copies given: 14Examination: 0Copies and examination: 0
Corrections requested: 0Corrections made: 0Notation attached: 0
Financial (all reasons)Salary: $126,586Administration (O&M) : $13,445Total: $140,031
Person year utilization (all reasons)Person year (decimal format): 1.25
Additional Reporting Requirements — Privacy Act
Preliminary Privacy Impact Assessments initiated -0
Preliminary Privacy Impact Assessments completed -0
Privacy Impact Assessments initiated -0
Privacy Impact Assessments completed -0
Privacy Impact Assessments forwarded to the Office of the Privacy Commissioner (OPC) - 1
PSC Note: Although no new of completed PIAs during the fiscal reporting period, there are however, a total of 7 PSC programs in which PIAs are either being discussed and/or are at different stages of initiation /completion.
Paragraph 19(1)(e) - 0
Paragraph 19(1)(f) - 0
Subsection 22.1 - 0
Subsection 22.2 - 0
Subsection 22.3 - 0
Part IV — Exclusions cited
Subsection 69.1 - 0
Subsection 70.1 - 0