¶¶ÒùÊÓƵ

Annual Report to Parliament on the Administration of the Privacy Act 2020-2021

Table of Contents

• Introduction
  • Purpose of the Privacy Act
  • Mandate of the Institution
• Organizational Structure
• Delegated Authorities
• Performance and Statistics
  • Impact of COVID-19
  • Number of Requests
  • Deemed Refusal Rate
  • Completion Time
  • Staffing
  • Disposition of Completed Requests
  • Extensions
  • Consultations from Other Institutions
• Training and Awareness
• Policies, Guidelines, Procedures and Initiatives
• Complaints, Audits, and Investigations
• Monitoring Compliance
• Administration of Personal Information
  • Privacy Breaches
  • Privacy Impact Assessments
  • Public Interest Disclosures
• Annex A: Designation Order
• Annex B: ¶¶ÒùÊÓƵ 2020-2021 Statistical Report

Introduction

We are pleased to table the Annual Report to Parliament on the administration of the Privacy Act for fiscal year 2020-2021, as required under section 72 of the Act.

NOTE: The Department is referred to in this report as ¶¶ÒùÊÓƵ. Its legal name, however, remains the Department of Foreign Affairs, Trade and Development, as set out in the Department of Foreign Affairs, Trade and Development Act.

Purpose of the Privacy Act

The Privacy Act provides Canadian citizens and individuals present in Canada with the right to seek access to their personal information that is held by the federal government. It also governs the collection, use, disclosure, retention, and disposal of personal information.

Mandate of the Institution

¶¶ÒùÊÓƵ is Canada’s face to the world, working to advance Canada’s political and economic interests in the international community as well as to apply Canadian experience to help address global issues.

The Department's legal mandate, as set out in the Department of Foreign Affairs, Trade and Development Act, SC 2013, c. 33, s. 174, is to:

• conduct all diplomatic and consular relations on behalf of Canada;
• conduct all official communication between the Government of Canada and the government of any other country and between the Government of Canada and any international organization;
• conduct and manage international negotiations as they relate to Canada;
• coordinate Canada’s international economic relations;
• foster the expansion of Canada’s international trade and commerce;
• foster sustainable international development and poverty reduction in developing countries and provide humanitarian assistance during crises;
• coordinate the direction given by the Government of Canada to the heads of Canada’s diplomatic and consular missions;
• manage Canada’s diplomatic and consular missions;
• administer the foreign service of Canada;
• foster the development of international law and its application in Canada’s external relations.

The Minister of Foreign Affairs is also responsible for the Export and Import Permits Act, RSC 1985, c. E-19, which authorizes the government to control and monitor the trans- border flow of specified goods, the Special Economic Measures Act, SC 1992, c. 17, which authorizes the government to apply economic sanctions in response to a serious threat to international peace and security, and the Justice for Victims of Corrupt Foreign Officials Act , S.C. 2017, c. 21, for the taking of restrictive measures in respect of foreign nationals responsible for gross violations of internationally recognized human rights.

The Department also provides administrative support to other federal government institutions with personnel abroad.

Organizational Structure

The Access to Information and Privacy Protection (ATIP) Division is responsible for the administration of the Act, including the processing of requests and consultations. The Director of the ATIP Division reports to the Corporate Secretary, who in turn reports to the Deputy Minister of Foreign Affairs.

In 2020-2021, the ATIP Division had 57 Full-Time Equivalent (FTEs) positions to fulfill the Department’s obligations under both the Access to Information Act and the Privacy Act. During most of the fiscal year, the Division’s staff included up to three consultants and one student.

The Division’s staffing structure consists of a director, five deputy directors, nine team leaders, one manager, one administrative assistant, thirty-two analysts, three system administrators, one systems analyst and four clerks.

The Division is organized into five units in order to fulfill its Access to Information and Privacy responsibilities. During the reporting period each unit was headed by one or more deputy directors.

• The Operational Unit consists of ATIP processing teams, each under the supervision of a team leader. These teams are comprised of analysts who process and review access, privacy, and consultation requests.
• The Privacy Policy Team deals directly with privacy matters such as privacy breaches, departmental complaints, Privacy Impact Assessments (PIAs), and requests for privacy advice.
• The Policy and Governance Team coordinates process modernization, procedural updates, and training.
• The Business Practices and Systems Unit processes incoming and outgoing ATIP correspondence, performs imaging services, provides technical support, and is responsible for other administrative tasks.
• Finally, the Division has a dedicated Complaints Team which processes legacy complaints and works closely with the Office of the Privacy Commissioner.

Under section 73.1 of the Privacy Act institutions reporting to the same minister can partner to share request-processing services. As of the 2020-2021 fiscal year, ¶¶ÒùÊÓƵ has not entered into any such service sharing agreements.

Delegated Authorities

Consistent with Section 73 of the Privacy Act, the Minister’s authority is delegated to the deputy ministers, to the Corporate Secretary, to the Director of the ATIP Division, and to the deputy directors of the ATIP Division. It is also delegated to heads of mission for the purpose of public interest disclosures under section 8(2)(m) of the Act.

A copy of ¶¶ÒùÊÓƵ’s signed Delegation Order is provided in Annex A.

Performance and Statistics

Impact of COVID-19

The Lockdown

This year’s performance should be understood within the context of the substantial impact COVID-19 had on ATIP operations.

Beginning on March 16, 2020, in an effort to curb the spread of COVID-19, ¶¶ÒùÊÓƵ’s employees who were not delivering critical government operations and services to Canadians were required to work from home. Because ¶¶ÒùÊÓƵ houses its ATIP processing software and records on a classified network accessible exclusively from the office, and ATIP was not a designated critical service, the lockdown resulted in a prolonged interruption of services that impacted the Department’s ability to meet legislative deadlines. During the March to June 2020 period, a small policy and governance team and management team remained operational from home, performing administrative tasks, such as notifying stakeholders and requesters of anticipated delays in meeting legislative due dates. Additionally, during that time, the privacy policy team was able to deliver its regular services while working from home.

In June 2020, a limited number of ATIP employees was granted access to the building on an exceptional basis, triggering the resumption of some ATIP services. In September 2020, the remaining staff of the ATIP Division were reintegrated into the office, bringing the Division back to near pre-COVID capacity some six months after the lockdown had begun. At the same time, access to the building remained constrained for employees in the offices of primary interest (OPIs) with ongoing impacts on service delivery.

The Division was incorporated into the Business Continuity Plan on November 6, 2020, thus ensuring the continued delivery of ATIP services in the future.

Opportunity in Change

While the pandemic substantially impacted the Department’s ability to meet legislative timelines, it also pointed toward new investment opportunities and the redesign of our processes and policies. In a matter of weeks, paper was virtually eliminated; the decades-old system of OPIs delivering their documents in hard copy form was replaced with an electronic system. In addition, investments were made in IT infrastructure to

enable unclassified ATIP requests to be processed on an unclassified system, accessible from home. This unclassified system became operational in October 2021. Future lockdowns, no matter how severe or sudden, will not result in substantial operational delays in the processing of unclassified ATIPs.

For more comprehensive information of the measures taken to re-establish processing capability in the wake of COVID-19, refer to the “Policies, Guidelines and Procedures” section of this report.

Number of Requests

In 2020-2021, the Department received 82 new requests under the Privacy Act, a decrease of 22% compared to the 2019-2020 fiscal year and of 26% compared to the average of the previous three reporting periods. In addition, 63 requests were carried over from the previous fiscal year, for a total of 145 active requests.

During the same reporting period, 74 requests were completed, a decrease of 33% compared to the 2019-2020 fiscal year and of 23% compared to the average of the previous three reporting periods. This decrease is mainly due to the impact of COVID- 19 in fiscal year 2020-2021.

The carry-over of active files at the end of fiscal year 2020-2021 was 71.

Deemed Refusal Rate

The Department’s deemed refusal rate in 2020-2021 (i.e., the percentage of requests under the Privacy Act that received a response beyond the deadline required under the Act) was 89%. This means that 11% of the Department’s responses to Privacy requests were provided to requesters on time. The deemed refusal percentage for the reporting period increased by 44 percentage points compared to the previous reporting period.

Completion Time

During the reporting period, the Department was able to close a total of 3 requests in 15 days or less (4%), 5 requests within 16-30 days (7%), 1 request within 31-60 days (1%),

7 requests within 61-120 days (10%), 11 requests within 121-180 days (15%), 126 requests within 181-365 days (35%), and 121 requests took over 365 days to complete (28%).

Staffing

In 2020-21, the Division had approximately 12 FTEs working on Privacy Protection requests and Privacy Policies. This represented a 20% increase over the previous reporting period.

Disposition of Completed Requests

Of the 74 Privacy requests closed in the 2020-2021 fiscal year, 11 were all disclosed (15%), 29 were disclosed in part (39%), 2 were all exempted (3%), 7 had no records in existence (9%), and 25 were abandoned (34%).

Extensions

During the reporting period, the Department took extensions on 18 requests. The reasons for extension include 11 extensions taken under section 15(a)(i) for interference with operations, and 7 extensions taken under section 15(a)(ii) for required consultations.

Consultations from Other Institutions

Given its mandate and various responsibilities at the international level, the Department played a key role under the Privacy Act on behalf of other institutions of the Government of Canada. Specifically, the Department consulted foreign governments and organizations on behalf of other federal government institutions when the latter needed to determine whether they could release records that originated abroad. During the reporting period, the Department received five new consultations from other government institutions, comprising 543 pages, as well as one request from another organization comprising 34 pages.

During the reporting period, the Department closed one consultation request comprising 883 pages. This consultation took over 365 days to complete.

Training and Awareness

The ATIP Division worked to provide analysts the required tools and training to perform their jobs effectively. The ATIP Division continues to develop tools and guidance to assist analysts in their application of the Access to Information Act and ensure consistency of approach. Internal training initiatives offered to staff this year included a three-day course on the Access to Information Act as well as a three-day course on the Privacy Act offered by an ATIP specialist. In total, there were 32 training registrations for these courses amongst ATIP staff.

The ATIP Division benefited from its Professional Development Program, which allows the Department to train and promote its analysts from junior to senior levels. This program has been very successful in addressing recruitment, retention and succession planning issues. During the fiscal year, approximately 16 employees were participating in the program and further recruitment was underway. Near the end of this fiscal year, a review of the current Professional Development Program was launched.

The ATIP Division continued to work closely with internal clients as they too adapted to changes in the ATIP processing procedures. In order to facilitate the transition to the new electronic processes, the ATIP Division scaled up the training it offered to the wider Department. Initial stages of the training initiative were focused on training staff within the ATIP Division in the new processes. This training was then expanded to include ATIP liaison officers. Finally, the ATIP Division provided a series of training offerings available to the entire Department, targeted toward subject-matter experts.

Throughout this wider initiative, the ATIP Division has continued to offer training at the divisional level in order to address the specific business and operational needs of the individual groups within the Department. Further, the ATIP Division frequently engaged in informal individual training as immediate needs manifested themselves.

In addition, during this reporting period, 106 employees successfully completed an online interactive ATIP awareness tutorial, developed in collaboration with the Canadian Foreign Service Institute.

Policies, Guidelines, Procedures and Initiatives

Despite the operational challenges brought on by the COVID-19 pandemic, the ATIP Division has maintained its commitment to continuous improvement and innovation. In the previous fiscal period, the Department had engaged a change- management consultant to advise on process modernization. In order to take advantage of future IT infrastructure and new electronic processes, the modernization project undertook to evaluate the existing processes, identified inefficiencies, and conceptualized new workflows that would improve the overall operational performance of the Division.

In order to adapt to the majority of OPIs teleworking, the ATIP Division converted previous paper-based tasking procedures to electronic processes. Network-based document exchange mechanisms were implemented, best practices consultations were carried out with other Departments, and new documentation was created and communicated to OPIs. This was a major step in the resumption of the tasking and consulting process between the ATIP Division and the OPIs resulting from operational interruptions during the initial months of the pandemic.

Incoming and outgoing correspondence also transitioned to an electronic process, diminishing the use of paper and enabling email responses to a majority of ATIP requests.

At the end of the 2019-2020 fiscal year, the ATIP Division began a telework pilot project within the Privacy Policy Team and the Policy and Governance Unit. Unlike the processing teams, this pilot project allowed these groups to maintain full functionality during the early days of the pandemic.

The Division also launched an ambitious IT project to allow for the processing of unclassified ATIP records remotely. This project involved numerous regulatory and administrative steps and included the procurement and installation of new computer servers. Although this project was only in its infancy when the COVID-19 lockdown first occurred, the pandemic provided the impetus to prioritize and operationalise the project by October 2021.

The intake process was restructured. Initially the Unit was comprised of a team leader, two senior analysts and four to five intake officers. It was determined that the process would be more efficient by integrating an intake officer into each processing team. This approach further removed the need to dedicate a team leader and experienced ATIP analysts solely to the Intake unit.

Throughout this fiscal year, the Division piloted new software in order to provide clients with a more efficient way to obtain privacy advice. Starting August 1, 2021, employees can submit their requests through Service Desk Online, a tool that allows clients to obtain status updates of their requests in real-time, and interact directly with the Privacy Policy and Governance Team.

As effective management of personal information continues to increase in relevance throughout the world, the Division was the focus of an internal privacy audit starting in the fall of 2020 as identified in ¶¶ÒùÊÓƵ’s 2020-2021 Risk Based Audit Plan. After several productive meetings and a review of our office’s tools, procedures, and guidelines, a management action plan was developed in order to respond to three recommendations:

1. Expand the current Privacy Management Framework;
2. Develop a Privacy Impact Assessment Policy;
3. Launch a strategic plan to align privacy management with key departmental initiatives.

All three items are to be completed by the summer of 2022.

The Division’s Privacy Management Framework (PMF) is adapted to ¶¶ÒùÊÓƵ’s own needs and mandate and will enable and promote best practices for privacy and the handling of personal information at ¶¶ÒùÊÓƵ. The PMF is intended to ensure accountability for privacy compliance and promote awareness of privacy issues and obligations across the Department regarding the protection of personal information.

The Privacy Policy and Governance team actively participated in the Department of Justice led modernization of the Privacy Act. ¶¶ÒùÊÓƵ provided a number of recommendations reflecting the important work the Department does in Canada as well as through our Missions abroad.

Complaints, Audits, and Investigations

The Department received four new complaints and closed one complaint.

Of the four complaints received in the reporting period, three alleged deemed refusals and one alleged the Department withheld information.

During the reporting period, the Department provided representations for one investigation related the GCKey incident.

Monitoring Compliance

The Department has established internal procedures and tools to help ensure timely processing of ATIP requests.

The Division prepares, and distributes to ATIP management, a weekly statistics report which tracks the number of requests received and closed, as well as any emerging trends and performance statistics. The report also allows for comparison of workload and completion rates in relation to the previous year in order to identify changes in ATIP processing.

Additionally, an active tasking report is posted weekly to identify all current active taskings within the Department. This report is available for all offices of primary interest to view and lists all open taskings by bureau, highlighting late files.

Finally, every week a report shared within the Department that includes summaries of upcoming access to information requests soon to be disclosed and the proposed packages available for review.

Administration of Personal Information

Privacy Breaches

During fiscal year 2020-2021, 23 material privacy breaches were reported to the Department. This number has increased compared to previous reporting periods and can be largely attributed to the many initiatives, processes, and tools adopted in order to allow for telework across the Department. At the end of the fiscal year, 10 material privacy breach notifications were sent to the Treasury Board Secretariat and the Office of the Privacy Commissioner and 13 were still outstanding.

Privacy Impact Assessments

During the fiscal year, ¶¶ÒùÊÓƵ finalized two Privacy Impact Assessments. However, they were not signed before March 31, 2021, and therefore they will be addressed in next year’s report.

Public Interest Disclosures

Subsection 8(2) of the Privacy Act provides that “personal information under the control of a government institution may be disclosed” without consent under certain specific circumstances.

During fiscal year 2020-2021, the Department made a total of 76 disclosures pursuant to subsection 8(2)(m) of the Privacy Act. In 58 cases, the Department determined that the public interest in disclosing personal information clearly outweighed any invasion of privacy that could result. All other disclosures were determined to clearly benefit the individual to whom the information related.

Disclosures pursuant to subparagraph 8(2)(m)(i):

• 58 disclosures were made in the interest of public safety.

Disclosures pursuant to subparagraph 8(2)(m)(ii):

• 2 disclosures were made to notify the relevant authorities of an individual’s detainment and arrest abroad;
• 1 disclosure was made to a family member on compassionate grounds
• 2 disclosures were related to advising local authorities or agencies regarding child welfare cases;
• 11 disclosures were made to either the family, friend, doctor, or legal counsel of an individual requiring medical assistance; and
• 2 disclosures were made to advise relevant authorities in the interest of the individual’s safety.

Because of the constraints brought on by the COVID-19 pandemic, no notifications were sent out to the Privacy Commissioner of Canada for the 76 disclosures pursuant to paragraph 8(2)(m) that were made during fiscal year 2020-2021. However, the Division is currently in the process of sending out those 76 notifications to the Privacy Commissioner of Canada.

Annex A: Designation Order

Annex B: ¶¶ÒùÊÓƵ 2020-2021 Statistical Report

Statistical Report on the Privacy Act

Name of institution: ¶¶ÒùÊÓƵ

Reporting period: 2020-04-01 to 2020-03-31

Section 1: Requests Under the Privacy Act

1.1 Number of requests

Section 2: Requests Closed During the Reporting Period

2.1 Disposition and completion time

TBS/SCT 350-63

2.2  Exemptions

2.3  Exclusions

2.4 Format of information released

2.5 Complexity

2.5.1 Relevant pages processed and disclosed

2.5.2 Relevant pages processed and disclosed by size of requests

2.5.3  Other complexities

2.6 Closed requests

2.6.1 Number of requests closed within legislated timelines

2.7  Deemed refusals

2.7.1  Reasons for not meeting legislated timelines

2.7.2 Requests closed beyond legislated timelines (including any extension taken)

2.8  Requests for translation

Section 3: Disclosures Under Subsections 8(2) and 8(5)

Section 4: Requests for Correction of Personal Information and Notations

Section 5: Extensions

5.1  Reasons for extensions and disposition of requests

5.2  Length of extensions

Section 6: Consultations Received From Other Institutions and Organizations

6.1 Consultations received from other Government of Canada institutions and organizations

6.2 Recommendations and completion time for consultations received from other Government of Canada institutions

6.3 Recommendations and completion time for consultations received from other organizations

Section 7: Completion Time of Consultations on Cabinet Confidences

7.1 Requests with Legal Services

7.2 Requests with Privy Council Office

Section 8: Complaints and Investigations Notices Received

Section 9: Privacy Impact Assessments (PIA) and Personal Information Banks (PIB)

9.1  Privacy Impact Assessments

9.2  Personal Information Banks

Section 10: Material Privacy Breaches

Section 11: Resources Related to the Privacy Act

11.1 Costs

11.2 Human Resources

Note: Enter values to three decimal places.