2022-2023 Annual Report to Parliament: Privacy Act

Creation and Growth of the New Departments

In June 2019, the Department of Crown-Indigenous Relations and Northern Affairs Act and the Department of Indigenous Services Act received Royal Assent. The Access to Information and Privacy (ATIP) Directorate provides shared services to support ISC and Crown-Indigenous Relations and Northern Affairs Canada (CIRNAC) through a Service Level Agreement (SLA) between the Departments.

Delegation on ministerial responsibilities for the PA remains institutionally specific.

Indigenous Services Canada's Mandate

The primary mandate of ISC is improving the quality of services delivered to First Nations, Inuit, and Métis Peoples. The Department will work to close socio-economic gaps and ultimately ensure that Indigenous Peoples have control and responsibility over their services and programs. The Department of ISC will focus, in partnership with Indigenous Peoples, on the following five interconnected priority areas: health, education, children and families, infrastructure, and a new fiscal relationship.

ISC works collaboratively with partners to improve access to high quality services for First Nations, Inuit and Métis Peoples.

Our vision is to support and empower Indigenous Peoples to independently deliver services and address the socio-economic conditions in their communities.

ISC has been given the responsibility to identify the best models for delivering improved services to Indigenous Peoples and improve accountability to Indigenous Peoples for the quality of services delivered by the Department.

As Canada moves towards greater Indigenous self-government, ISC will oversee the provision of existing services to Indigenous Peoples, and particularly First Nations under the Indian Act, including the provision of community infrastructure, emergency management, water, education, moneys and trusts, and registration.

The Department works in collaboration with its partners to create systemic change in how the federal government delivers health services to Indigenous Peoples.

Privacy requests at Indigenous Services Canada

Through the SLA, CIRNAC's ATIP Directorate handles requests made under the Access to Information Act (ATIA) and the PA. ISC's Corporate Secretary, who is directly accountable to the Deputy Head and is a member of the ISC Senior Management Committee manages the SLA for ISC. The Directorate also coordinates and implements policies, guidelines and procedures to ensure departmental compliance with the ATIA and PA.

Workshop presentations, training courses and awareness sessions designed to increase access to information and privacy capacity across the Department are provided by the ATIP Directorate.

Under a shared service agreement, ATIP analysts processed requests for both ISC and CIRNAC. Analysts processed requests varying in volume and complexity based on their classification level.

The privacy specialists provided critical advice for new initiatives and information sharing activities, resulting in privacy protection in departmental programs.

Policies and procedures continue to be established, under an evolving multi-jurisdictional reality, to ensure that privacy is considered throughout the life cycle of ISC's programs and that informed policy decisions are made concerning the collection, sharing and/or use of personal information.

The ATIP Directorate provides advice and guidance to the Department on a number of topics:

1. The application of the ATIA and PA;
2. The release of sensitive or protected information to the public;
3. Education and awareness of access to information and privacy issues throughout the Department;
4. Proactive publications;
5. Departmental Privacy Impact Assessments (PIAs);
6. Permissible disclosures of personal information pursuant to subsection 8(2) of the PA;
7. Appropriate PA Statements on Data Collection Instruments, i.e. forms, surveys, recorded events, etc.;
8. Updates to Info Source and the preparation and registration of Personal Information Banks and their related Classes of Records;
9. Protocols surrounding privacy breaches; and
10. Privacy advice in Memoranda of Understanding, Information Sharing Agreements and more complicated Multi-Jurisdictional Information Sharing Agreements (MISAs).

The Intake Team triages and coordinates the receipt of requests for information under the control of the Department made pursuant to the ATIA and the PA.

The Operations Team ensures that a response is provided within the legislated timeframe (30 days). All requests are monitored using the tracking system Access Pro Case Management.

ATIP analysts work closely with the relevant program areas to ensure that all responsive documents are provided and the information contained within those documents is treated in accordance with the Acts to allow for government records to be safely disclosed to the Canadian public.

The Privacy/Policy team is available to provide expert advice, maintain and monitor privacy risks and with the creation of privacy policy training. The Privacy/Policy team also supports ISC in the development of Departmental policies that reflect the Department's unique relationship with its clients and Indigenous partners all while ensuring the Department meets its obligations under the PA.

In addition to the ATIP Directorate, each of the sectors and regional offices of ISC are ATIP Liaison Officers (ALOs) who receive callouts from the ATIP Directorate and subsequently task the requests as appropriate to areas within their sector. ALOs play a crucial role in ensuring the appropriate records, impact statements and approvals are obtained and communicated to ATIP Directorate officials within the designated time allowances.

Director's Office

The Director (EX-01), as institutional ATIP Coordinator, holds full delegated authority under the ATIA. The Director is supported in day-to-day administrative tasks by the Deputy Director Operations (PM-06), Deputy Director Privacy/Policy (PM-06), an Administrative Assistant (AS-01) and in reporting by the Systems Administrator (AS-04).

1. Requests under the Privacy Act

2. Informal requests

No Informal requests were received pursuant to the PA in 2022-2023.

3. Requests closed during the reporting period

3.1 Disposition and completion time

Of the 298 requests closed during the reporting period, ISC was able to fully or partially disclose records in 217 cases (73% of the requests) (Table 3.1.1). The most frequent outcome of requests processed during the reporting period was a partial disclosure, in 143 cases or 47% of the time. Records were disclosed in their entirety 34% of the time and no records existed in 38 cases or 13% of requests. (Table 3.1.1).

Text alternative for: Table 3.1.1 Percentage of completed files relevant to each disclosures

Table 3.1.1 Number of completed files relevant to each disclosures

Dispositions	Percentage of requests
All disclosed	25%
Disclosed in part	48%
All exempted	0%
All excluded	0%
No records exist	14%
Request abandoned	13%
Neither confirmed nor denied	0%

In course of the current reporting period, 53 requests were processed and completed within the initial 15 days of receipt and another 111 were closed between 16 and 30 days resulting in 55% of received requests completed within 30-days. An additional 79 files were completed between 31 and 60 days of receipt, with or without an extension recorded on the file. The remaining 55 files were finalized in 61 or more days.

Table 3.1.2 Disposition and completion time

Disposition of requests	Completion Time (days)
	1 to 15	16 to 30	31 to 60	61 to 120	121 to 180	181 to 365	> 365	Total
All disclosed	9	48	15	1	1	0	0	74
Disclosed in part	4	41	51	29	6	6	6	143
All exempted	0	0	0	0	0	0	0	0
All excluded	0	0	0	0	0	0	0	0
No records exist	8	18	11	5	1	0	0	43
Request abandoned	32	4	2	0	0	0	0	38
Neither confirmed nor denied	0	0	0	0	0	0	0	0
Total	53	111	79	35	8	6	6	298

4. Disclosure under subsections 8(2) and 8(5)

Permissible disclosure pursuant to subsection 8(2) of the PA describes the circumstances under which personal information under the control of government institutions may be disclosed without the consent of the individual to whom the information pertains. In 2022-2023, ISC made 46 permissible disclosures under 8(2)(e) and none under 8(2)(m). The Treasury Board of Canada Secretariat requires these permissible disclosures to be captured in the statistical report.

The disclosures authorized under 8(2)(e) pursuant to requests made by investigative bodies were completed in accordance with the PA. The PA permits the disclosure of personal information to an investigative body specified in the regulations, on the written request of the body, for the purpose of enforcing any law of Canada or a province or carrying out a lawful investigation, if the request specifies the purpose and describes the information to be disclosed. The Department has the control of a substantial amount of personal information required to provide benefits and services to Indigenous Peoples.

There were no disclosures authorized under 8(2)(m). The PA permits disclosure under 8(2)(m) pursuant to any purpose where, in the opinion of the head of the institution the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure, or disclosure would clearly benefit the individual to whom the information relates.

The Office of the Privacy Commissioner must be notified of disclosures pursuant to section 8(2)(m); as required under section 8(5) of the PA. This was not required in 2022-2023.

5. Requests for Correction of Personal Information and Notations

During the reporting period, there were no requests for correction of personal information or notations.

6. Extensions

7. Consultations received from Other Institutions and Organizations

ISC received one (1) consultation from an organization during 2022-2023.

8. Completion Time of Consultations on Cabinet confidences

During the reporting period, no consultations on the application of section 70 of the PA were sent to Departmental Legal Services Unit for consultation on potential Cabinet confidences.

9. Complaints and Investigations Notices Received

During the 2022-2023 reporting period there were no new complaints or investigation notices received related to the processing of requests under the Act. However, there were two complaints received related to breach investigations that were unrelated to the processing of formal requests.

10. Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

11. Privacy Breaches

12. Resources related to the Privacy Act

12.2 Human Resources

In 2022-2023, ISC allocated a total 5.009 full time employees (FTE), which includes the services of one consultant (Table 12.2).

Text alternative for: Table 12.2 Human resources

Description of Table 12.2 Human resources

Expenditures	Amount
Full-time employees	4.734
Consultants and agency personnel	0.275

Delegation Order

Sections and Powers, Duties or Functions

8(2)

Disclose personal information without the consent of the individual to whom it relates

8(4)

Keep copies of requests made under 8(2)(e), keep records of information disclosed pursuant to such requests and to make those records available to Privacy Commissioner

8(5)

Notify the Privacy Commissioner in writing of disclosure under paragraph 8(2)(m)

9(1)

Retain a record of use of personal information

9(4)

Notify the Privacy Commissioner of consistent use of personal information and update index accordingly

10

Include personal information in personal information banks

11(a)

Publish annually an index of all personal information banks and their respective contents

11(b)

Publish annually an index of all personal information held by the institution which is not part of a bank

14

Respond to request for access, within statutory deadline; give access or give notice

15

Extend time limit and notify applicant

16

Where access is refused

17(2)(b)

Language of access or alternative format of access

17(3)(b)

Access to personal information in alternative format

18(2)

May refuse to disclose information contained in an exempt bank

19(1)

Shall refuse to disclose information obtained in confidence from another government

19(2)

May disclose any information referred to in 19(1) if the other government consents to the disclosure or makes the information pubic

20

May refuse to disclose information injurious to federal-provincial affairs

21

May refuse to disclose information injurious to international affairs and/or defence

22

May refuse to disclose information injurious to law enforcement and investigation

23

May refuse to disclose information injurious to security clearances

24

May refuse to disclose information collected by the Canadian Penitentiary Service, the National Parole Service or the National Parole Board

25

May refuse to disclose information injurious to which could threaten the safety of individuals

26

May refuse to disclose information about other individuals, and shall refuse to disclose such information where disclosure is prohibited under section 8

27

May refuse to disclose information subject to solicitor-client privilege

28

May refuse to disclose information relating to an individual's physical or mental health where disclosure is contrary to the best interests of the individual

31

Receive notice of investigation by the Privacy Commissioner

33(2)

Make representations to the Privacy Commissioner during an investigation

35(1)

Receive the Privacy Commissioner's report of findings of the investigation and give notice of action taken

35(4)

Give complainant access to information after 35(1)(b) notice

36(3)

Receive Privacy Commissioner's report of findings of investigation of exempt

37(3)

Receive report of Privacy Commissioner's findings after compliance investigation where the institution has not complied with sections 4 to 8

51(2)(b)

Request that matter be heard and determined in National Capital Region

51(3)

Request and be given right to make representations in section 51 hearing

72(1)

Prepare Annual Report to Parliament

77

Carry out responsibilities conferred on the Head of the institution by the regulations made under section 77 which are not included above

Section 1: Requests Under the Privacy Act

Section 2: Informal requests

Section 3: Requests Closed During the Reporting Period

Section 4: Disclosures Under Subsections 8(2) and 8(5)

Section 5: Requests for Correction of Personal Information and Notations

Section 6: Extensions

Section 7: Consultations Received From Other Institutions and Organizations

Section 8: Completion Time of Consultations on Cabinet Confidences

Section 9: Complaints and Investigations Notices Received

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

Section 11: Privacy Breaches

Section 12: Resources Related to the Privacy Act