2018 to 2019 Annual Report to Parliament: Privacy Act

Creation of Two New Departments

In August 2017, the Prime Minister announced the dissolution of Indigenous and Northern Affairs Canada and the establishment of two new departments to better meet the needs and aspirations of First Nations, Inuit and Métis Peoples. At that time, he named two Ministers to lead these new departments: a Minister of Crown-Indigenous Relations and Northern Affairs Canada (CIRNAC) and a Minister of Indigenous Services Canada.

The ATIP office provided shared services support for ISC and CIRNAC through a Memorandum of Understanding (MOU) between the departments.

Indigenous Services Canada's Mandate

The primary mandate of Indigenous Services Canada is improving the quality of services delivered to First Nations, Inuit, and Métis Peoples. The Department will work to close socio-economic gaps and ultimately ensure that Indigenous Peoples have control over their services and programs. The Department of Indigenous Services Canada will focus, in partnership with Indigenous peoples, on the following five interconnected priority areas: health, education, children and families, infrastructure, and a new fiscal relationship.

Indigenous Services Canada works collaboratively with partners to improve access to high quality services for First Nations, Inuit and Métis Peoples.

Our vision is to support and empower Indigenous peoples to independently deliver services and address the socio-economic conditions in their communities.

Indigenous Services Canada has been given the responsibility to identify the best models for delivering improved services to Indigenous Peoples and improve accountability to Indigenous Peoples for the quality of services delivered by the Department.

As Canada moves towards greater Indigenous self-government, ISC will oversee the provision of existing services to Indigenous Peoples, and particularly First Nations under the Indian Act, including the provision of community infrastructure, emergency management, water, education, moneys and trusts, and registration.

The Department works in collaboration with its partners to create systemic change in how the federal government delivers health services to Indigenous Peoples.

ATIP Directorate at ISC

On November 30, 2017, by means of Order in Council # 2017-1464 the Department of Indigenous Services Canada was created. Effective this date, via Order in Council # 2017-1465, INAC transferred responsibility of two sectors to the new department: the Education and Social Development Programs and Partnership Sector (ESDPP) and Regional Operations Sector (RO). Under the same authority (OIC #2017-1465) the Department of Health transferred to ISC the First Nations and Inuit Health Branch (FNIHB).

Last fiscal year and by written agreement, the former INAC continued to process ATIP requests for ESDPP and RO related records in order to support continuity of service to the public.

Effective April 1, 2018, ISC assumed full responsibility for processing all requests for records relating to its programs, including requests relating to FNIHB received after November 30, 2017.

The ATIP Directorate is responsible for the administration of requests made under the Access to Information Act (ATIA)and the PA. It was established within the Corporate Secretariat and reports to the Corporate Secretary, who is directly accountable to the Deputy Head and is a member of the ISC Senior Management Committee. The Directorate also coordinates and implements policies, guidelines and procedures to ensure departmental compliance with the ATIA and PA. Workshop presentations, training courses and awareness sessions designed to increase access to information and privacy capacity across the Department are also provided by the ATIP Directorate.

Under a shared service MOU, all ATIP analysts processed requests for both ISC and CIRNAC. This is the first annual report to cover a full fiscal year since the creation of ISC.

The ATIP Directorate processed requests of varying volume and complexity based on their classification level. They also provide critical privacy advice for new initiatives, resulting in privacy protection in departmental programs. Policies and procedures continue to be established to ensure that privacy is considered throughout the life cycle of ISC's programs and that informed policy decisions are made concerning the collection, sharing and/or use of personal information.

They provide advice and guidance to the Department on a number of topics:

• The application of the ATIA and PA;
• The release of sensitive or protected information to the public;
• Departmental Privacy Impact Assessments (PIAs);
• Permissible disclosures of personal information pursuant to subsection 8(2) of the PA;
• Appropriate PA Statements on Data Collection Instruments (DCIs), i.e. forms, surveys, etc.;
• Updates to Info Source and the preparation and registration of Personal Information Banks and their related Classes of Records ;
• Protocols surrounding privacy breaches;
• Education and awareness of access to information and privacy issues throughout the Department; and
• Provide privacy advice in MOU.

Within each of the sectors and regional offices of ISC are ATIP Liaison Officers (ALOs) who receive callouts from the ATIP Directorate and subsequently task the requests as appropriate to areas within their sector. ALOs play a crucial role in ensuring requests are clear to the record retrievers and that the appropriate records, impact statements and approvals are obtained and communicated to ATIP Directorate officials within the designated time allowances.

The Intake Team triages and coordinates the receipt of requests for information under the control of the Department made pursuant to the Access to Information Act and the Privacy Act. The Operations Team ensures that a response is provided within the legislated timeframe (30 days). All requests are monitored using the tracking system Access Pro Case Management. To do so, ATIP analysts work closely with the relevant program areas in order to ensure that all responsive documents are provided and to ensure that the information contained within those documents is treated in accordance with the Acts to allow for government records to be safely disclosed to the Canadian public. The Privacy/Policy team is available to provide expert advice, maintain and monitor privacy risks as well as support ISC with the creation of privacy policy training.

Description of the Organizational Chart

Director's Office

The Director (EX-01), as institutional ATIP Coordinator, holds full delegated authority under the Act. The Director is supported in day-to-day administrative tasks by the Deputy Director Operations (PM-06), Deputy Director Privacy/Policy (PM-06) and an Administrative Assistant (AS-01) and in reporting and policy initiatives by the Reporting Analyst (PM-03).

Intake Team

The Intake Team is comprised of two Intake Officers (PM-01) and one Clerk (CR-04), who enter all applications into the electronic case management system, acknowledge receipt of requests, perform imaging services, interact with and respond to inquiries from the public, and are responsible for other administrative tasks.

Operations Team

The Operations Team is led by four Team Leaders (PM-05), who are responsible for the oversight of request processing by their team, including the review of completed requests. The Ops Team consists of Analysts PM-04, PM-03, and PM-02 level, who process Access and Privacy requests of varying volume and complexity, provide training and provide Access and Privacy advice.

Privacy/Policy Team

The Privacy/Policy Team is led by two Team Leaders (PM-05), who are responsible for the oversight of request processing by their team, including the review of privacy/policy requests. The Privacy/Policy Team consists of Analysts PM-04, and PM-02 level, who respond to Privacy matters (such as breaches), provide training and provide Privacy advice.

Part 1. Requests under the Privacy Act

In 2018-2019, ISC received 72 new requests under the Privacy Act. The ATIP Directorate completed 61 requests during the reporting period. There were only 11 requests carried over for next reporting period. (Table 1.1)

Part 2. Requests closed during the reporting period

2.1 Disposition and completion time

Of the 61 requests closed during the reporting period, ISC was able to fully or partially disclose records in 35 cases; that is 57.4% of the time a request was submitted to ISC, the result was a disclosure of relevant information. The majority of requests (36 or 59.0%) took 30 days or less to complete. In 2018-2019, one (1) request took longer than 121 days to be completed.

The most frequent outcome of the requests processed during the reporting period was ‘Disclosed in Part', which was the result for 26 requests (42.65). In 4 instances, the request was abandoned by the requester, likely because the original request was not complete or sufficient authorization for disclosure was not obtained. (Table 2.1)

2.2 Exemptions

Out of the 61 requests closed during this reporting period, 26 were disclosed in part with the only exemption applied being s. 26 (Table 2.2).

2.3 Exclusions

No exclusion provisions were applied to requests that were closed in 2018-2019.

2.4 Format of information released

Over the course of this reporting period, requesters received more of their responsive packages via paper format. ISC conveyed response packages in electronic format (CD or email) for 16 requests (35.5%), and paper format for 29 requests (64.5%). (Table 2.4)

2.5 Complexity

The following sections detail several factors affecting the complexity of requests that were completed throughout 2018-2019.

2.5.1 Relevant pages processed and disclosed

During the reporting period, the ATIP Directorate closed 61 requests. This resulted in the review of 4,441 pages of records under the control of the Department. A total of 3,715 pages were disclosed during the period of 2018-2019. (Table 2.5.1)

2.5.2 Relevant pages processed and disclosed by size of requests

Over the reporting period, the majority of requests (41or 67.2%) were included in the small category for the number of pages processed (less than 100 pages processed) (Table 2.5.2). ISC did not treat very large (1001 to more than 5000 pages) requests in 2018-2019.

2.5.3 Other complexities

The ATIP Directorate did not require external consultations with other organizations.

2.6 Deemed refusals

The following sections detail number and reason of requests that were in deemed refusal throughout 2018-2019.

2.6.1 Reason for not meeting statutory deadline

During the course of the reporting period, 11 requests were completed past the statutory deadline with excessive workload being the reason on six (6) of those requests. Five (5) requests were completed past the statutory deadline due to a delay in responses from ISC's internal program areas. (Table 2.6.1)

2.6.2 Number of days past deadline

Of the 11 requests that were completed past the statutory deadline, five (5) were completed within 1 to 15 days. (Table 2.6.2).

2.7 Requests for translation

During the reporting period, there were no instances where requesters asked that responsive records be translated to another official language.

Part 3. Disclosure under subsections 8(2) and 8(5) of the Privacy Act

Permissible disclosure pursuant to subsection 8(2) of the PA describes the circumstances under which personal information under the control of government institutions may be disclosed without the consent of the individual to whom the information pertains. In 2018-2019, ISC made six permissible disclosures under 8(2)(e), 8(2)(m) and 8(5). The Treasury Board of Canada requires these three permissible disclosures to be captured in the statistical report. ISC ATIP, like other institutions, has processed another ten requests under section 8(2) for a total of 16 permissible disclosures in 2018-2019.

8(2)(e) disclosures – Two (2) disclosures were made under paragraph 8(2)(e) pursuant to request made by investigative bodies as found in the schedule II and III of the Privacy Act.

8(2)(m) disclosures - For the purpose of public interest. ISC made two (2) disclosures under paragraph 8(2)(m) .

8(5) disclosures - Requires institutions to report 8(2)(m) to the Office of the Privacy Commissioner. The two (2) 8(2)(m) disclosure noted above was reported to the Privacy Commissioner.

Other permissible disclosures not captured by the statistical report include:

8(2)(a) disclosures – ISC has made two (2) disclosures that were obtained by the Department and disclosed for a consistent use.

8(2)(b) disclosures – ISC has made two (2) disclosures in accordance with an Act of Parliament or regulation that authorizes the disclosure of personal information.

8(2)(d) disclosures – ISC has made two (2) disclosures to the Attorney General of Canada pursuant to legal proceedings.

8(2)(f) disclosures – Under an agreement or arrangement between the Government of Canada and Provincial Governments for the purpose of administering or enforcing any law or carrying out lawful investigations. ISC made four (4) disclosures of personal information.

8(2)(k) disclosures - Permits the disclosure of personal information to researchers involved in the process of settling native claims. ISC made two (2) disclosures to researchers for native claims research.

Part 4. Requests for correction of personal information and notations

During the reporting period, there was no request for correction of personal information or notations.

Part 5. Extensions

5.1 Reasons for extensions and disposition of requests

During 2018-2019, 11 extensions were taken under subsection 15(1) of the Privacy Act. All 11 extensions were taken under subsection 15(1)(i) (interference with operation). During the reporting period, two (2) requests were disclosed in their entirety whereas nine (9) requests were disclosed in part. (Table 5.1).

5.2 Length of extensions

ISC applied 11 extensions during the reporting period and of those, eight (8) were for 16 to 30 days. (Table 5.2).

Part 6. Consultations received from other Institutions and Organizations

ISC did not receive any consultations from another institution or organization during the reporting period.

Part 7. Completion time of consultations on Cabinet confidences

During the reporting period, no consultations on the application of section 70 of the PA were sent to Departmental Legal Services Unit for consultation on potential Cabinet confidences.

Part 8. Complaints and Investigations Notices Received

During the reporting period, ISC received two (2) any complaints from the Office of the Privacy Commissioner (OPC). These sections are not cumulative.

Part 9. Privacy Impact Assessments

Privacy Impact Assessments (Appendix A of the TBS Statistical Report)

A PIA is a risk evaluation of the flow of personal information held within a program or service. This process enables the Department to determine whether new or substantially modified technologies, information systems, initiatives, and proposed programs or policies meet federal government privacy requirements.

There was one (1) PIA completed during the 2018-2019 reporting period.

Saskatchewan Panorama Immunization Management: A PIA was launched on the impact of the eHealth Saskatchewan Panorama Immunization Management System deployment to 23 First Nation communities in Central and South regions of Saskatchewan, where FNIHB healthcare providers provide public health services including immunization to clients.

Privacy Act Statements

The ATIP Directorate assists and reviews all ISC programs in the development of appropriate Privacy Notice Statements to be included in any form(s) and/or shared during a consultation engagement process which collects personal information. Privacy Statements inform individuals what is done with their personal information. In 2018-2019, the ATIP Directorate responded to numerous requests for Privacy Statements.

The ATIP Directorate continues to work with all ISC program areas in the upcoming years to update Privacy Notice Statements for all hard copy and online DCIs, forms and/or consultation processes.

Privacy Policy Questions

The ATIP Directorate also fields questions regarding privacy protocols, policies/directives, issues and other inquiries related to the collection, use, retention and disposal, and/or sharing of personal information.  During the 2018-2019 reporting period, the ATIP Directorate responded to numerous questions from departmental clients for all ISC-related privacy matters. In addition, the ATIP Directorate put in place a Record of Decision in regards to consistent use disclosures under section 8(2)(a) of the Privacy Act to health care providers and professionals directly involved in the care and treatment of a patient. This practice, initiated at Health Canada, is now a recognized approach at ISC that would allow for personal information about ISC clients to be disclosed to health care providers within the circle of care of a client in order to provide timely and/or critical health services.

Privacy Breaches

ISC identified five (5) privacy breaches from April 1, 2018 to March 31, 2019. All privacy breaches were of low sensitivity and were not identified as material privacy breaches. Therefore, the Office of the Privacy Commissioner was not advised as per Treasury Board Secretariat policies.

Part 10. Resources related to the Privacy Act

10.1 Costs

The ATIP Directorate functioned under a shared services model to support ISC and CIRNAC. It spent a total of $1,603,740 on staffing, goods and services and was supported by 23 human resources.

Calculations for the annual reports reflect the level of effort in support ISC's responsibilities pursuant to the Acts.

In 2018-2019, ISC spent $159,786 on the administration of the PA and was supported by 2.30 Human Resources.

10.2 Human Resources

The Privacy Operations unit within the ATIP Directorate consisted of 2.3 full-time equivalents (FTEs) (Table 10.2). Over the course of the reporting period, ISC hired 0.10 students or consultants and 0.01 part-time or casual employees.

Schedule A