Source: https://www.priv.gc.ca/en/about-the-opc/opc-access-to-information-and-privacy/annual-reports-on-the-access-to-information-and-privacy/2011-2012/ar_201112_atip/
Timestamp: 2018-04-19 21:18:11
Document Index: 396042865

Matched Legal Cases: ['art 25', 'art 3', 'Art. 22', 'Art. 22', 'Art. 23', 'Art. 24', 'Art. 25', 'Art. 26', 'Art. 27', 'Art. 28']

2011-12 Annual Reports on the Access to Information Act and the Privacy Act (ATIP) - Office of the Privacy Commissioner of Canada
2011-12 Annual Reports on the Access to Information Act and the Privacy Act (ATIP)
Appendix B – Additional Reporting Requirements
When the Federal Accountability Act received Royal Assent on December 12, 2006, the Office of the Privacy Commissioner (OPC) was added to Schedule I of the ATIA along with other Agents of Parliament. So, while not initially subject to the ATIA, the OPC became so, on April 1, 2007.
The OPC is pleased to submit its fifth Annual Report which describes how we fulfilled our responsibilities under the ATIAduring the fiscal year 2011-2012.
The mandate of the OPC is to oversee compliance with both the Privacy Act (PA) which covers the personal information-handling practices of federal government departments and agencies, and the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s private sector privacy law.
For matters relating to personal information in the private sector, the Commissioner may investigate complaints under Section 11 of PIPEDA except in the provinces that have adopted substantially similar privacy legislation, namely Québec, British Columbia, and Alberta. Ontario and New Brunswick now fall into this category with respect to personal health information held by health information custodians under their health sector privacy laws. However, even in those provinces with substantially similar legislation, and elsewhere in Canada, PIPEDA continues to apply to personal information collected, used or disclosed by all federal works, undertakings and businesses, including personal information about their employees. PIPEDA also applies to all personal data that flows across provincial or national borders, in the course of commercial transactions involving organizations subject to PIPEDA or to substantially similar legislation.
The Commissioner focuses on resolving complaints through negotiation and persuasion, using mediation and conciliation if appropriate. However, if voluntary co-operation is not forthcoming, the Commissioner has the power to summon witnesses, administer oaths and compel the production of evidence. In cases that remain unresolved, particularly under PIPEDA, the Commissioner may take the matter to Federal Court and seek a court order to rectify the situation.
Assessing compliance with obligations contained in the PA and PIPEDA through the conduct of independent audit and review activities, and publicly reporting on findings;
Responding to inquiries of Parliamentarians, individual Canadians and organizations seeking information and guidance and taking proactive steps to inform them of emerging privacy issues;
Promoting public awareness and compliance, and fostering understanding of privacy rights and obligations through: proactive engagement with federal government institutions, industry associations, legal community, academia, professional associations, and other stakeholders;
Preparing and disseminating public education materials, positions on evolving legislation, regulations and policies, guidance documents and research findings for use by the general public, federal government institutions and private sector organizations;
Working with privacy stakeholders from other jurisdictions in Canada and on the international scene to address global privacy issues that result from ever-increasing trans-border data flows.
The Privacy Commissioner is an Officer of Parliament who reports directly to the House of Commons and the Senate. The Commissioner is assisted by an Assistant Commissioner, who has delegated responsibilities under both the PA and PIPEDA.
The OPC is comprised of eight distinct branches:
The PA Investigations Branch receives and investigates complaints from individuals who claim a breach of the PA, or complaints that are initiated by the Commissioner. The Branch also receives notifications of breaches from federal government organizations, and receives and reviews public interest disclosures made by them. The Branch is headed by Ms. Sue Lajoie, Director General, PA Investigations.
The PIPEDA Investigations Branch is divided between Ottawa and Toronto. In Ottawa, the Branch receives and investigates all complaints of national scope by individuals or initiated by the Commissioner, from anywhere in Canada except from the Greater Toronto Area (GTA). In Toronto, the Branch investigates complaints from the GTA and coordinates public education and stakeholder outreach activities in the GTA. The Branch is headed by Mr. Brent Homan, Director General, PIPEDA, and the Toronto Office is headed by Mr. Lorne MacDougall, Director.
The Audit and Review Branch audits organizations to assess their compliance with the requirements set out in the two federal privacy laws. The Branch also analyses and provides recommendations on (PIAs) submitted to the OPC pursuant to the Treasury Board Secretariat Policy on Privacy Impact Assessments (PIAs). The Branch is headed by Mr. Steven Morgan, Director General.
The Communications Branch focuses on providing strategic advice and support for communications and public education activities for the OPC. In addition, the Branch plans and implements a variety of public education and communications activities through media monitoring and analysis, public opinion polling, media relations, publications, special events, outreach activities and the OPC web sites. The Branch is also responsible for the OPC’s Information Centre, which responds to requests for information from the public and organizations regarding privacy rights and responsibilities. The Branch is headed by Ms. Anne-Marie Hayden, Director General.
The Legal Services, Policy and Research Branch (LSPR) provides strategic legal and policy advice and conducts research on emerging privacy issues in Canada and internationally. More specifically, the Branch provides strategic legal advice to the Commissioners and various Branch Heads on the interpretation and application of the PA and PIPEDA in investigations and audits, as well as general legal counsel on a broad range of corporate and communication matters. The Branch represents the OPC in litigation matters before the courts and in negotiations with other parties both nationally and internationally. It reviews and analyzes legislative bills, government programs, public and private sector initiatives and provides strategic advice to the Commissioners on appropriate policy positions to protect and advance privacy rights in Canada. The Branch prepares for, represents and supports the office in appearances before Parliament and in its relations with Parliamentarians. The Branch conducts applied research on the privacy implications of emerging societal and technological issues to support and inform the development of OPC policy guidance and best practices for relevant stakeholders. The Branch administers the research contribution program, which was launched in 2004, to advance knowledge and understanding of privacy issues and to promote enhanced protection of personal information. Also housed in the Branch is the OPC Access to Information and Privacy (ATIP) Unit responsible for responding to formal requests for information from the public pursuant to the Access to Information and Privacy Acts. The ATIP Unit is also responsible for internal policies relative to these Acts. The Director of the ATIP Unit is also the Chief Privacy Officer for the OPC. The Branch is headed by Ms. Patricia Kosseim, Senior General Counsel and Director General.
The Human Resources Management Branch is responsible for the provision of strategic advice, management and delivery of comprehensive human resource management programs in areas such as staffing, classification, staff relations, human resource planning, learning and development, employment equity, official languages and compensation. The Branch is headed by Ms. Maureen Munhall, Director.
The Corporate Services Branch provides advice and integrated administrative services such as corporate planning, resource management, financial management, information management/technology and general administration to managers and staff. The Branch is headed by Mr. Daniel Nadeau, Director General and Chief Financial Officer.
Technology Analysis Branch
The Technology Analysis Branch identifies and analyzes technological trends and developments in electronic platforms and digital media. The Branch conducts research to assess the impact of technology on the protection of personal information in the digital world. It also provides strategic analysis and guidance on complex, varied and sensitive technological issues involving breaches in the security of government and commercial systems that store personal information. As a corporate centre of expertise, the Branch analyzes current and emerging issues and trends in national security and public safety. The electronic media and their impact upon the privacy rights of Canadians represent another key area of interest for the Branch. The technological expertise concentrated in the Branch also supports core functions of the OPC, including audits, investigations and PIA reviews. The Branch is headed by Mr. Noël Lachance, Director.
The ATIP Unit is housed within the LSPR. ATIP is headed by a Director who is supported by one Senior Analyst.
Under section 73 of the ATIA the Privacy Commissioner, as the head of the OPC, has delegated her authority to the Senior General Counsel / Director General of the LSPR Branch and to the ATIP Director with respect to the application of the ATIA and its Regulations. A copy of that Delegation Order is attached as Appendix A.
In the reporting fiscal year, PA Awareness Sessions were given to new OPC employees, and it is our goal to provide refresher ATIP training to 85% of the existing employees before the end of fiscal year 2012-2013.
As the OPC is a relatively small organization, sessions are also given on an as-needed basis as well.
Throughout the year the ATIP Unit has been active in providing advice to all OPC staff with respect to informal requests for information. ATIP has also continued to support the Information Management function by providing input concerning proper information handling practices.
During the final quarter of the year, the ATIP Unit successfully completed an overall system upgrade with respect to the method of processing files. This was completed through the implementation of an electronic file tracking and redaction system which allows documents to be processed electronically rather than manually.
The ATIP Director sits on the OPC’s Policy Development Committee and has played a collaborative role in the planning, development and updating of OPC policies, procedures and directives in order to ensure that the Access to Information Act is respected.
The OPC’s statistical Report on the ATIA is attached at Appendix B.
The OPC received 64 formal requests under the ATIA during the fiscal year, which is one more than the previous year. Of those, 21 sought access to records which were not under the control of the OPC and they were therefore transferred to the appropriate federal institutions for processing. The majority of transfers were made to the Canada Border Service Agency, Citizenship and Immigration Canada, Canada Revenue Agency, Correctional Service Canada, Human Resources and Skills Development Canada and the Royal Canadian Mounted Police.
Of the 43 requests for records under the OPC’s control (none had been carried over from the previous reporting period), the ATIP Unit had responded to 37 requests by the end of the fiscal year—six were carried forward to the next fiscal year. The 37 completed requests constituted 3,655 pages of information.
Extensions were claimed with respect to 22 requests, 20 of which were for more than 30 days. In all, the OPC responded to 36 requests within the first 30 days and 22 requests within the extended time period.
Of the 43 requests completed during the fiscal year, approximately ten were for copies of OPC Briefing Notes and related material, six were for the contents of PA or PIPEDA investigation files, one was for legal bills and travel accommodation, one for event planning services, two for information relating to human resources and the remainder were for miscellaneous information.
The OPC released all of the requested documents in seven cases and made partial releases in 25 cases. In regards to the other requests, in no instances was the information all exempted, in no instances was the request abandoned by the applicant and in five cases, no records existed. Four requests were treated informally.
Section 16.1 of the ATIA requires that the OPC protect the information obtained during the course of its investigations or audits even after the matter and all related proceedings have been concluded. So, with respect to requests for access to PA and PIPEDA investigation files, none were released in their entirety—all had some information withheld under section 16.1 and, in some cases, information was withheld under one or more of sections 19(1), 21(1)(a), 21(1)(b) and 23 as well.
As was the case in the last reporting year, the exemption provision invoked most often was section 19(1) concerning the personal information of others, followed closely by section 16.1 with respect to information the OPC received or created during the course of an investigation and section 23 with respect to solicitor-client information. However, in other cases this year the OPC also withheld information under one or more of sections 13(1)(a), 20(1)(b), 20(1)(c) and sections 21(1)(a) and (b) of the ATIA.
Of the 64 requests received this fiscal year, 27 were submitted by the public (42.2 %), ten by the media (15.6 %), 21 by businesses (32.8 %), five by academia (7.8 %) and one by an organization (1.6 %).
The OPC was notified of 14 complaints under the ATIA during the fiscal year compared to one the previous fiscal year. The findings by the Information Commissioner’s Office with respect to these complaints have not yet been issued.
In addition to processing its own ATIA requests, the OPC was consulted on 13 occasions on a total of 655 pages. Treasury Board Secretariat consulted us on two occasions, Veterans Affairs on two occasions and we were consulted once by each of the following institutions: Office of the Information Commissioner, Human Resources and Skills Development Canada, Royal Canadian Mounted Police, Industry Canada, Canada Revenue Agency, International Centre for Human Rights and Democratic Development, Canada Border Services Agency, Financial Transaction and Reports Analysis Centre of Canada, and Canadian Air Transport Security Authority. In seven cases, the ATIP division recommended full disclosure of the requested records.
With respect to application fees, they amount to $185.00. None of the requests required the assessment of reproduction fees, search fees, preparation fees or computer processing time.
In most cases where records were provided, paper copies were given to the individuals. No one asked to be given access by viewing the records. Fifteen requesters asked to receive records electronically and we provided them by CD.
Senior General Counsel/Director General, Legal Services, Policy and Research
Director, ATIP Act: 7(a), 8(1), 9, 11(2) to (6), 12(2) and (3), 13 to 24, 25, 26, 27(1) and (4), 28(1), (2) and (4), 29(1), 33, 35(2), 37(1) and (4), 43(1), 44(2), 52(2) and (3), 71(2), 72(1); and
In order to ensure independence of decision-making by the Senior General Counsel/Director General, Legal Services, Policy and Research, when exercising the powers under this delegation instrument, legal advice for the institution on specific matters included herein shall be provided by the Director, Legal Services and Senior Counsel.
Dated at the City of Ottawa, this 24th day of April, 2012.
Exempt information may be severed from manuals
Paragraph 13(1)(e)
Subsection 16.1(1)(a)
Subsection 16.1(1)(b)
Subsection 16.1(1)(c)
Subsection 16.1(1)(d)
This subsection was invoked in 5 requests
Subsection 16.2(1)
Subsection 16.3
Subsection 16.4(1)(a)
Subsection 16.4(1)(b)
Subsection 16.5
Subsection 18.1(1)(a)
Subsection 18.1(1)(b)
Subsection 18.1(1)(c)
Subsection 18.1(1)(d)
Subsection 20(1)(b.1)
Subsection 20.1
Subsection 20.2
Subsection 20.4
Subsection 22.1(1)
Subsection 68.1
Subsection 68.2(a)
Subsection 68.2(b)
Subsection 69.1(1)
04/01/2011 to 03/31/2012
10 5 21 1 27
I Requests under the Access to Information Act
Received during reporting period 64
Outstanding from previous period 0
Completed during reporting period 58
Carried Forward 6
II Disposition of request completed
1. All Disclosed 7
2. Disclosed in part 25
4. Nothing disclosed (exempt) 0
5. Unable to process 21
6. Abandonned by applicant 5
7. Abandoned by applicant 0
III Exemptions invoked
S. 13(1)(a) 1
S. 14 0
S. 16(1)(a) 0
S. 16(2) 0
S. 16(3) 0
S. 17 0
S. 18(a) 0
S. 18(b) 0
S. 19(1) 24
S. 20(1)(a) 0
S. 21(1)(a) 18
S. 22 0
S. 23 12
S. 24 0
S. 25 0
IV Exclusions cited
S. 68(a) 0
S. 69(1)(a) 0
S. 69(1)(c) 0
V Completion time
30 days or under 36
31 to 60 days 6
61 to 120 days 2
121 days or over 14
VI Extentions
VIII Method of access
Copies given 21
IX Fees
$25.00 or under 1 $5.00
Over $25.00 0 $0.00
$88,907.93
$72,649.11
$161,557.04
The Privacy Act came into effect On July 1, 1983. This Act imposes obligations on federal government departments and agencies to respect the privacy rights of individuals by limiting the collection, use and disclosure of personal information. The Act also gives individuals the right of access to their personal information and the right to request the correction of that information.
When the Federal Accountability Act received Royal Assent on December 12, 2006, the Office of the Privacy Commissioner (OPC) was added to the Schedule of the Privacy Act along with other Agents of Parliament. So, while not initially subject to the Act, the OPC became so on April 1, 2007.
The OPC is pleased to submit its fifth Annual Report which describes how we fulfilled our responsibilities under the Privacy Act during the fiscal year 2011-2012.
The PIPEDA Investigations Branch is divided between Ottawa and Toronto. In Ottawa, the Branch receives and investigates all complaints of national scope by individuals or initiated by the Commissioner, from anywhere in Canada except from the Greater Toronto Area (GTA). In Toronto, the Branch investigates complaints from the GTA and coordinates public education and stakeholder outreach activities in the GTA. The Branch is headed by Mr. Brent Homan, Director General, PIPEDA Investigations, and the Toronto Office is headed by Mr. Lorne MacDougall, Director.
The Audit and Review Branch audits organizations to assess their compliance with the requirements set out in the two federal privacy laws. The Branch also analyses and provides recommendations on PIAs submitted to the OPC pursuant to the Treasury Board Secretariat Policy on Privacy Impact Assessments (PIAs). The Branch is headed by Mr. Steven Morgan, Director General.
The Technology Analysis Branch identifies and analyzes technological trends and developments in electronic platforms and digital media. The Branch conducts research to assess the impact of technology on the protection of personal information in the digital world. It also provides strategic analysis and guidance on complex, varied and sensitive technological issues involving breaches in the security of government and commercial systems that store personal information. As a corporate centre of expertise, the Branch analyzes current and emerging issues and trends in national security and public safety. The electronic media and their impact upon the privacy rights of Canadians represent another key area of interest for the Branch. The technological expertise concentrated in the Branch also supports core functions of theOPC, including audits, investigations andPIA reviews. The Branch is headed by Mr. Noël Lachance, Director.
The ATIP Unit is housed within the LSPR Branch. ATIP is headed by a Director who is supported by one Senior Analyst.
Under section 73 of the PA the Privacy Commissioner, as the head of the OPC, has delegated her authority to the Senior General Counsel and Director General of the LSPR Branch and to the ATIP Director with respect to the application of the Act and its Regulations. With respect to public interest disclosures under section 8(2)(m) of the Act, the Commissioner has delegated her authority to the Assistant Commissioner for those decisions. A copy of the Delegation Order is attached as Appendix A.
Given the silence of the Federal Accountability Act with respect to an independent mechanism under which PA complaints against the OPC would be investigated, we have developed an alternative mechanism to investigate OPC actions with respect to its administration of the Act.
For this purpose, the Commissioner has delegated her powers, duties and functions as set out in sections 29 through 35 and section 42 of the Act to a Privacy Commissioner Ad Hoc in order that he could investigate PA complaints lodged against the OPC.
The current Privacy Commissioner, Ad Hoc is Mr. John H. Sims. Mr. Sims is a member of the Ontario Bar, and retired from the Public Service of Canada on April 2, 2010 after 32 years, five as Deputy Minister of Justice and Deputy Attorney General of Canada. Throughout his career, Mr. Sims has been recognized for outstanding achievements, high standards of ethical and professional conduct, excellence in leadership and preeminent public service. In 2010, the Prime Minister presented Mr. Sims with the prestigious Outstanding Achievement Award of the Public Service of Canada.
The ATIP Director sits on the OPC’s Policy Development Committee and has played a collaborative role in the planning, development and updating of OPC policies, procedures and directives in order to ensure that the PA is respected.
The OPC received 79 formal requests under the PA for the fiscal year. However, the vast majority of those requests—68 of them—sought access to personal information under the control of other government institutions. They were therefore re-directed for processing to those institutions, including to the Canada Revenue Agency, Correctional Service Canada, Human Resources and Skills Development Canada, National Defense, Canada Border Services Agency and the RCMP.
61 105 79
45 90 68
During the last reporting year, the OPC received 14 PA requests for personal information under our control and we processed some 6,257 pages of information. This fiscal year was quite different from the previous year in that we received 11 such requests which comprised 14,375 pages. All requests were submitted by the individual themselves.
An extension was claimed with respect to one request and it was completed within the extended timeframe.
One request was carried over to the next fiscal year.
Of the ten PA requests completed, three were for the contents of PA or PIPEDA investigation files. In two instances, our investigations and all related proceedings were closed; therefore, the information in those files was processed and released to the requesters subject to applicable exemptions. In the two cases some information was withheld under section 22.1(1).
Section 22.1 of the PA requires that the OPC protect the information that we obtained during the course of our investigations or audits, even after the matter and all related proceedings have been concluded. This exemption was applied in three cases during the reporting period.
With regards to other exemptions, section 26 was claimed in three cases and section 27 in two instances.
All information was released in two instances and partially in three cases. In two cases the information requested did not exist and in two other cases, the request was abandoned. In one case, all information was exempted entirely.
No requests were received for correction of personal information held within the OPC.
The OPC received three complaints against it under the PA in this reporting year. The investigations by the Privacy Commissioner Ad Hoc were completed. Two complaints were not well founded, and one was resolved.
Finally, the OPC received four consultations from other federal institutions this fiscal year.
The Directive on Privacy Impact Assessment which came into effect on April 1, 2010, requires that the Treasury Board Secretariat monitor compliance with the Directive. Given this responsibility, institutions are asked to include pertinent statistics in their annual reports on the administration of the PA.
In 2011-2012 the OPC did not initiate any PIAs.
The OPC disclosed no personal information under sections 8(2)(e), (f), (g) or (m) of the PA during this fiscal year
During this reporting year the OPC did not create any new policy or directive with regards to the protection of personal information.
Appendix A – Privacy Act
Assistant Privacy Commissioner 8(2)(m)
Director, ATIP Act: 8(2)(j), 8(4) and (5), 9(1) and (4), 10, 14, 15, 17(2)(b) and (3)(b),18 to 28, 31, 33(2), 35(1) and (4), 36(3), 37(3), 51(2)(b) and (3), 72(1)
In force April 1, 2007 - Privacy Commissioner shall refuse to disclose information obtained or created in the course of an investigation conducted by the Commissioner
In force April 1, 2007 - Privacy Commissioner shall not refuse under 22.1(1) to disclose any information created by the Commissioner in the course of an investigation conducted by the Commissioner once the investigation and related proceedings are concluded
May refuse to disclose information prepared by an investigative body for security clearances
May refuse to disclose information collected by the Correctional Service of Canada or the National Parole Board while individual was under sentence if conditions in section are met
May refuse to disclose information about another individual, and shall refuse to disclose such information where disclosure is prohibited under section 8
May refuse to disclose information subject to solicitor-client privilege
May refuse to disclose information relating to the individual’s physical or mental health where disclosure is contrary to best interests of the individual
Receive notice of investigation by Privacy Commissioner
Right to make representations to the Privacy Commissioner during an investigation
Receive Privacy Commissioner’s report of findings of the investigation and give notice of action taken
Request that section 51 hearing be held in the National Capital Region
Preliminary PIAs initiated: 0
Preliminary PIAs completed: 0
PIAs initiated: 0
PIAs completed: 0
PIAs forwarded to the Office of the Privacy Commissioner (OPC): 0
**No PIAs were completed during the reporting period
This exemption was invoked in 3 files
Note: If your institution did not invoke any exemptions or cite any exclusion noted above during the reporting period, this must be stated explicitly.
Institution: Office of the Privacy Commissioner of Canada
Reporting period: 04/01/2011 to 03/31/2012
I Requests under the Privacy Act
1. All Disclosed 2
2. Disclosed in part 3
4. Nothing disclosed (exempt) 1
5. Unable to process 2
6. Abandonned by applicant 2
S.18(2) 0
S. / Art. 22(1)(a) 0
S. / Art. 22(2) 0
S. / Art. 23(a) 0
S. / Art. 24 0
S. / Art. 25 0
S. / Art. 26 3
S. / Art. 27 2
S. / Art. 28 0
30 days or under 9
31 to 60 days 1
61 to 120 days 0
121 days or over 0
IX Corrections and notation
$127,940.69
$134,472.58