2023-2024 Annual Report to Parliament: Privacy Act

Table of contents

Introduction

roman numeral 1. Introduction

The purpose of the Privacy Act (PA) is to protect the privacy of individuals with respect to their personal information. This Act governs the federal government's responsibilities for the collection, retention, use and disclosure of that information. The Act also to provides individuals with a right of access to that information.

This report reflects activities of Indigenous Services Canada (ISC), in respect to the stated legislation, for the period of April 1, 2023 to March 31, 2024.

This report, submitted to Parliament pursuant to section 72 of the PA, describes the activities of ISC in compliance with privacy legislation.

Creation and Growth of the Departments

Since the creation of the Department, the Access to Information and Privacy (ATIP) ATIP Office has provided a shared service support for ISC and Crown-Indigenous Relations and Northern Affairs (CIRNAC)  through a service level agreement (SLA).

Delegation on ministerial responsibilities for the PA remains institutionally specific.

Indigenous Services Canada's Mandate

The primary mandate of ISC is to work collaboratively with partners to improve access to high quality services for First Nations, Inuit and Métis. The Department aims to support and empower Indigenous Peoples to independently deliver services and address the socio-economic conditions in their communities.

ISC has been given the responsibility to identify the best models for delivering improved services to Indigenous Peoples and improve accountability to Indigenous Peoples for the quality of services delivered by the Department.

As Canada moves towards greater Indigenous self-government, ISC will oversee the provision of existing services to Indigenous Peoples, and particularly First Nations under the Indian Act, including the provision of community infrastructure, emergency management, water, education, moneys and trusts, and registration.

The Department works in collaboration with its partners to create systemic change in how the federal government delivers health services to Indigenous Peoples.

roman numeral 2. Organization

Administration of the Privacy Act at Indigenous Services Canada

Under the SLA, CIRNAC's ATIP Office processes requests made under the Access to Information Act (ATIA) and the PA. ISC's Corporate Secretary manages the SLA for ISC and is directly accountable to the Deputy Head. The Corporate Secretary is a member of the ISC Senior Management Committee. The ATIP Office also coordinates and implements policies, guidelines and procedures to ensure departmental compliance with the ATIA and PA.

Workshop presentations, training courses and awareness sessions designed to increase access to information and privacy capacity across the Department are provided by the ATIP Office.

Under a shared service model, ATIP analysts processed requests for both ISC and CIRNAC. Analysts processed requests varying in volume and complexity.

The ATIP Office provides advice and guidance to the Department on a number of topics:

  1. The application of the ATIA and PA;
  2. The release of sensitive or protected information to the public;
  3. Education and awareness of access to information and privacy issues throughout the Department;
  4. Proactive publications;
  5. Departmental Privacy Impact Assessments (PIAs);
  6. Permissible disclosures of personal information pursuant to subsection 8(2) of the PA;
  7. Appropriate PA Statements on Data Collection Instruments, i.e. forms, surveys, recorded events, etc.;
  8. Updates to Info Source and the preparation and registration of Personal Information Banks and their related Classes of Records;
  9. Protocols surrounding privacy breaches; and
  10. Privacy advice in Memoranda of Understanding, Information Sharing Agreements and more complicated Multi-Jurisdictional Information Sharing Agreements (MISAs).

The Intake Team triages and coordinates the receipt of requests for information under the control of the Department made pursuant to the ATIA and the PA.

The Operations Team ensures that a response is provided within the legislated timeframe. All requests are monitored using the AccessPro case management tracking system.

The Privacy/Policy Team provides expert advice, maintains and monitors privacy risks, and assists with the creation of privacy training material. The Privacy/Policy team also supports ISC in the development of departmental policies that reflect the Department's unique relationship with its clients and Indigenous partners, all while ensuring the Department meets its obligations under the PA.

The privacy specialists provided critical advice for new and evolving programs and information sharing initiatives, supporting privacy protection in the department.

Policies and procedures continue to be established, under an evolving multi-jurisdictional reality, to ensure that privacy is considered throughout the life cycle of ISC's programs and that informed policy decisions are made concerning the collection, sharing and/or use of personal information.

In addition to the ATIP Office, within each of the sectors and regional offices of ISC are ATIP Liaison Officers (ALOs) who receive callouts from the ATIP Office and subsequently task the requests as appropriate to areas within their sector. ALOs play a crucial role in ensuring the appropriate records, impact statements and approvals are obtained and communicated to the ATIP Office within the designated time allowances.

The ATIP Office will be transitioning away from an unsupported and sunsetting case management solution and as such ISC and CIRNAC procured a new case management solution: ATIPXpress. This solution was chosen in the hopes that it will increase efficiency, reduce processing times, and streamline the processing of requests. This in turn could reduce the number of complaints we receive, alleviating pressures from both the Office of the Information Commissioner, and the Privacy Commissioners of Canada and improve service to the public. This new case management system provides a supported, stable, and technologically contemporary tool that provides the ability to manage both department's workloads fluidly within one system, further reducing processing times. The solution is expected to be implemented in fiscal 2024-2025.

ATIP Operations has created and implemented a developmental program. The program is based on predetermined performance benchmarks that clearly state the expectations at each level from CR-04 to PM-06. An employee can choose to participate to develop their skills and build experience. With guidance from the team leaders, employees can advance within the organization.

This program was created to be open and transparent in order to develop and retain current staff and provide growth opportunities within the ATIP Office. The Developmental Program is highly successful and each year more and more analysts graduate to higher PM levels. During this reporting period, eleven analysts were promoted or provided acting opportunities based on their success in the program.

The Department is committed to transparency and accountability under the PA and continues to work to improve its performance to deliver the highest standards of service for access to information requests.

The Department continued to use the Microsoft Office 365 tools to communicate internally and engage with key stakeholders. The ATIP office also leveraged these tools for the transfer of information with sectors to allow for business continuity within the hybrid workplace structure.

To better serve our clients, the Department participates in the Access to Information and Privacy Online Request Service. Our clients can submit requests under the Act through this online channel administered by TBS.

In April 2023 the ATIP Office returned on-site in a hybrid model. Pandemic response conditions substantially reduced the use of paper. During this reporting period, the office mostly received electronic requests and records, and in most cases provided release packages electronically to applicants with the use of E-post Connect, which was implemented in February 2020.

The Department continues to use electronic tools to facilitate the collection, consultation and processing of information even with the return to the workplace.

roman numeral 3. Delegation Order

Under section 73 of the PA, the Minister's authority may be delegated to departmental officials in order to administer the PA within ISC. The delegation order signed by Minister Marc Miller on November 6, 2020, was in effect during this reporting period (Appendix A).

Under section 73 of the PA, the order delegates full authority and responsibility for the PA to the following positions:

  • Deputy Minister
  • Associate Deputy Minister
  • Corporate Secretary
  • Departmental ATIP Director (Coordinator)
  • ATIP Deputy Directors

Director's Office

The Director (EX-01), as institutional ATIP Coordinator, holds full delegated authority under the ATIA. The Director is supported in day-to-day administrative tasks by the Deputy Director Operations (PM-06), Deputy Director Privacy/Policy (PM-06), an Administrative Assistant (AS-01) and is also supported in reporting by the Systems Administrator (AS-04).

Privacy/Policy Team

The Privacy/Policy Team is led by two Team Leaders (PM-05), who are responsible for ensuring the department is adhering to the collection, use and disclosure of personal information holdings as per the PA. They also ensure all policies for Access and Privacy align with Treasury Board policies and directives. The Privacy/Policy Team consists of Analysts at the PM-04, PM-03 and PM-02 levels who respond to privacy policy matters (such as privacy breaches, court ordered disclosure requests, Privacy Assessments, etc.) and provide training and Privacy advice. They are supported by an Intake Clerk (CR-04).

Operations Team

The Operations Team is led by three Team Leaders (PM-05), who are responsible for the overview of request processing by their team, including the review of completed requests. The Operations Team consists of Analysts at the PM-04, PM-03, and PM-02 levels who process Access and Privacy requests of varying volume and complexity, as well as provide training.

Intake Team

The Intake Team is led by one Team Lead (PM-5) and is comprised of various Intake Officers (PM-01s and CR-04s), who enter all applications into the electronic case management system, acknowledge receipt of requests, perform imaging services, interact with and respond to inquiries from the public.

Statistics

roman numeral 4. Interpretation of the Statistical Report

ISC's Statistical Report and Supplemental Report were submitted to the Treasury Board Secretariat (TBS) on July 15th 2024, (Appendix B). The Report details various aspects of the requests ISC received and processed during the period of April 1, 2023 to March 31, 2024.

Requests under the Privacy Act

1.1 Number of requests received

In 2023-2024, ISC received 168 requests, representing an decrease of approximately 38% compared to the 272 received in 2022-2023 (Table 1.1.1). Another 25 requests were carried over from the previous year. This reflected a total of 193 requests to be processed in course of the reporting period. The ATIP Office completed 171 requests and carried 22 requests into the next reporting period. (Table 1.1.2)

Table 1.1.1 Number of Requests received and outstanding from 2020-2024
Number of Requests 2020-2021 2021-2022 2022-2023 2023-2024
Received during reporting period 180 202 272 168
Outstanding from previous reporting period 61 52 51 25
Total 241 254 323 193
Table 1.1.2 2020-2024 Number of requests closed and carried over to next reporting period
Number of Requests 2020-2021 2021-2022 2022-2023 2023-2024
Closed during reporting period 192 203 298 171
Carried over to next reporting period 49 51 25 22
1.2 Channels of requests

The channels of requests serve to identify the mechanism used by the Canadian public to request their personal information records: Government of Canada Online Portal, e-mail, mail, phone or fax. In the course this reporting period, the majority of the informal requests were received through the Government of Canada Online Portal.

Table 1.2 Channels of requests
Source Number of Requests
Online 105
E-mail 53
Mail 9
In person 0
Phone 0
Fax 1
Total 168

2. Informal requests

No Informal requests were received pursuant to the PA in 2023-2024.

3. Requests closed during the reporting period

3.1 Disposition and completion time

Of the 171 requests closed during the reporting period, ISC was able to fully or partially disclose records in 103 cases (60% of the requests) (Table 3.1.1). The most frequent outcome of requests processed during the reporting period was a partial disclosure, in 87 cases or 51% of the time. Records were disclosed in their entirety 10% of the time and no records existed in 37 cases or 22% of requests. (Table 3.1.1).

Table 3.1.1 Disposition of completed requests
Text alternative for Table 3.1.1 Disposition of completed requests
Dispositions Percentage of requests
All disclosed 9%
Disclosed in part 51%
No records exist 22%
Request abandoned 18%

During the course of the current reporting period, 52 requests were processed and completed within the initial 15 days of receipt and another 43 were closed between 16 and 30 days resulting in 55% of received requests completed within 30-days. An additional 36 files were completed between 31 and 60 days of receipt, with or without an extension recorded on the file. The remaining 40 files were finalized in 61 or more days.

Table 3.1.2 Disposition and completion time
Disposition of requests Completion Time (days)
1 to 15 16 to 30 31 to 60 61 to 120 121 to 180 181 to 365 > 365 Total
All disclosed 1 8 4 3 0 0 0 16
Disclosed in part 0 24 27 16 8 7 5 87
All exempted 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0
No records exist 22 10 5 0 0 0 0 37
Request abandoned 29 1 0 0 1 0 0 31
Neither confirmed nor denied 0 0 0 0 0 0 0 0
Total 52 43 36 19 9 7 5 171
3.2 Exemptions

As seen in previous years, section 26 (personal information of another individual) was the most common exemption invoked during the reporting period (85 times). The only other exemptions applied in 2023-2024 was pursuant to section 27 for the purpose of protecting personal information under 12(1) that is subject to solicitor-client privilege or the professional secrecy of advocates and notaries or to litigation privilege and section 25, where the disclosure of personal information could reasonably be expected to threaten the safety of individuals. (Table 3.2).

Table 3.2 Number of requests closed where exemption provisions were invoked
Section Number of requests
25 1
26 85
27 3
3.3 Exclusions

No mandatory exclusion provisions were applied to requests that were closed in fiscal year 2023-2024.

3.4 Format of information released

Over the course of this reporting period, all responses (103) were provided to the requesters electronically through E-post Connect or through e-mail. (Table 3.4).

Table 3.4 Format of information released
Paper Electronic Other
E-record Data set Video Audio
0 103 0 0 0 0
3.5 Complexity

The following sections detail several factors affecting the complexity of requests that were completed throughout 2023-2024.

3.5.1 Relevant pages processed and disclosed for paper and e-record formats by size of requests

Of the requests closed, 134 requests generated 39,067 pages of records. The total amount of pages disclosed was 11,460 during the reporting period (Table 3.5.1).

Table 3.5.1 Relevant pages processed and disclosed
Number of pages processed Number of pages disclosed Number of requests
39,067 11,460 134
3.5.2 Relevant pages processed per request disposition for paper and e-records formats by size of requests

Of the 134 requests, 98 requests (73%) required the processing of 100 pages or less. Also, a total of 10,080 pages required processing for 29 requests (21%), on files comprising between 101 and 1,000 pages to be reviewed. However, 7 (seven) requests (5%) had more than 1,001 pages to be reviewed, for a total count of 27,307 pages to process.

Table 3.5.2 Relevant pages processed per request disposition for paper and e-records formats by size of requests
Disposition < 100 pages 101-500 pages 501-1000 pages 1001-5000 pages > 5000 pages
Requests Pages Requests Pages Requests Pages Requests Pages Requests Pages
All disclosed 15 88 0 0 0 0 0 0 1 8,137
Disclosed in part 52 1,529 22 5,098 7 4,982 5 9,327 1 9,843
All exempted 0 0 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0 0 0
Abandoned 31 63 0 0 0 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0 0 0 0 0 0
Total 98 1,680 22 5,098 7 4,982 5 9,327 2 17,980
3.5.3 Relevant minutes processed and disclosed for audio formats

No audio files were provided to the ISC ATIP office in response to an ATIA request.

3.5.4 Relevant minutes processed per request disposition for audio formats by size of requests

No audio files were provided to the ISC ATIP office in response to an ATIA request.

3.5.5 Relevant minutes processed and disclosed for video formats

No video files were provided to the ISC ATIP office in response to an ATIA request.

3.5.6 Relevant minutes processed per request disposition for video formats by size of requests

No video files were provided to the ISC ATIP office in response to an ATIA request.

3.6 Closed requests

The following section details the number of privacy requests closed within the legislated timelines.

3.6.1 Number of requests closed within legislated timelines

During the reporting period, 134 requests or 78% were closed within legislated timelines. (Table 3.6.1) These are  consistent results from the previous reporting year which saw 78% compliance.

Table 3.6.1 Number of requests closed within legislated timelines
Number of requests closed within legislated timelines 134
Percentage of requests closed within legislated timelines (%) 78.36
3.7 Deemed refusals

The following sections detail the number of, and reasons for requests in deemed refusal (beyond legislative timelines) throughout 2023-2024.

3.7.1 Reason for not meeting legislated timelines

The majority of deemed refusals or late requests were a result of the Department's ability to retrieve records and our existing workload. In addition, large volume of records for a few files or large volume of files received in a short time frame created surges in workload that did not align with the resources available. The surges experienced throughout the last reporting period require the dedication of senior staff who are pulled from active files creating a large backlog of complex file review to be completed.  (Table 3.7.1).

Table 3.7.1 Number of requests closed within legislated timelines
Number of requests closed past the legislated timelines Principal Reasons
Interference with Operations / Workload External Consultation Internal Consultation Other
37 26 1 0 10
3.7.2 Request closed beyond legislated timelines (including any extension taken)

Requests closed beyond legislated timelines include any files where a request for extension was requested. During this reporting period 19 requests were closed beyond the legislated timelines with no extension taken, and 18 of those were closed beyond the legislated timeline with an extension taken.

Table 3.7.2 Number of days past deadline
Number of days past legislated timelines Number of requests past legislated timeline where no extension was taken Number of requests past legislated timeline where an extension was taken Total
1 to 15 days 1 0 1
16 to 30 days 5 1 6
31 to 60 days 5 2 7
61 to 120 days 4 6 10
121 to 180 days 2 2 4
181 to 365 days 2 2 4
> 365 days 0 5 5
Total 19 18 37
3.8 Requests for translation

During the reporting period, there were no instances where a requester asked for responsive records be translated to another official language.

4. Disclosure under subsections 8(2) and 8(5)

Permissible disclosure pursuant to subsection 8(2) of the PA describes the circumstances under which personal information under the control of government institutions may be disclosed without the consent of the individual to whom the information pertains. In 2023-2024, ISC made 50 permissible disclosures under 8(2)(e) and one (1) under 8(2)(m). The Treasury Board of Canada Secretariat requires these permissible disclosures to be captured in the statistical report.

The disclosures authorized under 8(2)(e) pursuant to requests made by investigative bodies were completed in accordance with the PA. The PA permits the disclosure of personal information to an investigative body specified in the regulations, on the written request of the body, for the purpose of enforcing any law of Canada or a province or carrying out a lawful investigation, if the request specifies the purpose and describes the information to be disclosed. The Department has the control of a substantial amount of personal information required to provide benefits and services to Indigenous Peoples.

There was one (1) disclosure authorized under 8(2)(m). The PA permits disclosure under 8(2)(m) pursuant to any purpose where, in the opinion of the head of the institution the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure, or disclosure would clearly benefit the individual to whom the information relates.

The Office of the Privacy Commissioner must be notified of disclosures pursuant to section 8(2)(m); as required under section 8(5) of the PA.  This was completed once as required in 2023-2024.

Other permissible disclosures not captured by the statistical report include:

There were twenty (20) disclosures authorized under 8(2)(d) pursuant to a request from the Department of Justice and disclosure complied existing criteria for disclosure. The PA permits the disclosure of personal information to the to the Attorney General of Canada for use in legal proceedings involving the Crown in right of Canada or the Government of Canada. 

There were eleven-hundred and fifty-nine (1,159) disclosures authorized under 8(2)(f) pursuant to an agreement or arrangement between the Government of Canada and another jurisdiction for the purpose of administering or enforcing any law or carrying out a lawful investigation. The department provides services across multiple-jurisdictions and agreements exist and continue to be drafted to respect the department's obligations under the PA.

There were six (6) disclosures authorized under 8(2)(j) pursuant to requests to undertake research or statistical activities. The PA permits the disclosure personal information to any person or body for research or statistical purposes with specific provisions.

There were seventy-three (73) disclosures authorized under 8(2)(k) pursuant to requests from the authorized researchers identified in the PA. The PA permits the disclosure of personal information for the purpose of researching or validating the claims, disputes or grievances of any of the Indigenous Peoples of Canada. 

The ATIP office authorized a combined total of 1,338 disclosures pursuant to section 8(2) of the PA during 2023-2024.

Table 4 Disclosures Under Subsections 8(2) and 8(5)
Subsections 8(2) Subsection (8)(5)
8(2)(a) 8(2)(c) 8(2)(d) 8(2)(e) 8(2)(f) 8(2)(j) 8(2)(k) 8(2)(m) 8(5)
22 7 20 50 1,159 6 73 1 1

5. Requests for Correction of Personal Information and Notations

During the reporting period, there were no requests for correction of personal information or notations.

6. Extensions

6.1 Reasons for extensions

In 2023-2024, 54 extensions were taken under subsection 15(a) of the PA. This includes 20 cases where delays were due to difficulties in obtaining records. Extensions were applied pursuant to section 15(a)(i), due to interference with operations, in all cases.

Table 6.1 Reasons for extensions
Number of requests where an extension was taken 15(a)(i) Interference with Operations 15(a)(ii) Consultation 15(b)
Further review required to determine exemptions Large volume of pages Large volume of requests Documents are difficult to obtain Cabinet Confidence Section (Section 70) External Internal Translation purposes or conversion
54 3 16 15 20 0 0 0 0

7. Consultations received from Other Institutions and Organizations

ISC received one (1) consultation from an organization during 2023-2024.

8. Completion Time of Consultations on Cabinet confidences

During the reporting period, no consultations on the application of section 70 of the PA were sent to Departmental Legal Services Unit for consultation on potential Cabinet confidences.

9. Complaints and Investigations Notices Received

During the 2023-2024 reporting period there were six (6) new complaints or investigation notices received related to the processing of requests under the PA. The Department closed five (5) complaints during this period, processing 1,613 pages under complaint.

Table 9 Complaints and Investigation Notices Received
Section 31 Section 33 Section 35 Court action Total
5 0 1 0 6

10. Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

10.1 Privacy Impact Assessments

A Privacy Impact Assessment (PIA) is a risk evaluation of the flow of personal information held within a program or service. This process enables the Department to determine whether new or substantially modified technologies, information systems, initiatives, and proposed programs or policies meet federal government privacy requirements. It identifies and mediates risks on programs collecting and using personal information.

The Department completed no new PIAs during the 2023-2024 reporting period.

10.2 Institution-specific and Central Personal Information Banks

The ATIP Office completed the transfer and realignment of ISC's Institutional Specific Personal Information Banks from the previous departmental designation. This is reflected in the annual publishing of the Departmental Info Source Chapter. However, the ATIP Office continues to work with sector to review and update PIBs to ensure their ongoing accuracy and necessity.

10.2. Institution-specific and Central Personal Information Banks
Personal Information Banks Active Created Terminated Modified
Institution-specific 37 0 0 0
Central 48 0 0 0
Total 85 0 0 0

11. Privacy Breaches

11.1 Material Privacy Breaches reported

The ATIP Office supports the Department in investigating potential privacy breaches. ISC reported no material breaches during this fiscal year. Material privacy breaches are at the highest risk and impact is defined as: involving sensitive personal information and could reasonably cause serious injury or harm to the individual and/or involves a large number of affected individuals.

On October 19, 2023, BGRS confirmed that there had been a breach involving Government of Canada information held by BGRS and SIRVA Canada systems. These companies provide relocation support to federal public service employees and members of the Canadian Armed Forces and RCMP. At least 550 individuals (not including family members) employed, or previously employed at ISC and CIRNAC (formerly INAC) were identified as potentially affected (BGRS could not specify the exact individuals whose information was compromised), and so, out of an abundance of caution, ISC notified individuals who had used BGRS relocation services in the past ten years. Credit monitoring services were offered to individuals whose information was potentially breached. Due to the large number of individuals potentially affected and the breadth of time associated with the personal information collection, the ATIP Office is continuing breach management efforts. Notification letters were sent out to identified individuals. While not identified as a material privacy breach for which ISC was directly responsible, the ATIP Office still notified the Office of the Privacy Commissioner of our breach management activities.

11.2 Non-Material Privacy Breaches

The ATIP Office completed the investigation and review of four non-material privacy breaches. These reported breaches were determined to have not met the threshold of a material privacy breach. Most privacy breaches were due to administrative errors and identified as low risk.

Table 11.2 Non-Material Privacy Breaches
Number of non-material privacy breaches 4

12. Resources related to the Privacy Act

12.1 Costs

In 2023-2024, ISC spent a total of $947,204 on staffing and goods and services which includes the purchase of a new case management system. These amounts reflect the level of effort in support of ISC's responsibilities pursuant to the Act (Table 12.1).

Table 12.1 Allocated Costs
Expenditures Amount
Salaries $474,963
Overtime $33,258
Goods and Services
Professional services contracts $248,610  
Other $190,373  
Total Goods and Services $438,983
Total $947,204
12.2 Human Resources

In 2023-2024, ISC allocated a total 6.396 full time employees (FTE), which includes the services of one consultant.

Highlights

roman numeral 5. 2023-2024 Points of Interest

Since November 30, 2017, the ATIP Office has administered the Privacy Act (PA) as a shared service for both Indigenous Services Canada (ISC) and Crown-Indigenous Relations and Northern Affairs Canada (CIRNAC). This past fiscal year (2023-2024) was the sixth full year of reporting for Indigenous Services Canada under the ATIA and PA.

ISC received 168 new privacy requests and closed 171, with a total of 39,067 pages processed under the PA. The Department maintained a compliance of 78% responding to 134 requests on time.

The most cited exemption under PA was section 26 for personal information of other individuals.

The department received six (6) complaints or investigations from the Office of the Privacy Commissioner of Canada and closed 5 complaints, with a total of 1,613 pages processed.

There were 50 permissible disclosure requests processed under paragraph 8(2)(e) and one under paragraph 8(2)(m) which are standard reporting requirements. There were an additional 1287 permissible disclosures requests processed by the ATIP Office.  The majority of the permissible disclosures relate to disclosures under provisions of existing agreements. They are primarily disclosures of information about specific Indigenous individuals, who are receiving services or benefits from the Department or associated multi-jurisdictional partners.

The relationship existing between Indigenous Peoples, Provinces, Territories and the Department leads to a large volume of requests for permissible disclosures under section 8(2) and necessitates the continuous development and renewal of Information Sharing Agreements and Memorandums of Understanding.  In 2023-2024, the ATIP Office completed work on three (3) information sharing arrangements put in place to facilitate the use and disclosure of personal information to support Indigenous rights holders (section 35 of the Constitution Act, 1982), in their exercise of treaty rights and in support of Canada's commitment to reconciliation.

The focus of the Privacy and Policy unit in 2023-2024 was providing advice, authorization and support for requests related to data sharing activities involving the disclosure of personal information associated to ongoing settlement activities and responsive program developments (Health, Education and Child and Family Services; and internal privacy policy support for Indian Status Registration activities, human resources, health, and child and family services related purposes).

The ATIP Office has worked with and continues to work with Central Agencies, partners, and stakeholders to develop and implement policies and procedures related to the disclosure of personal information to support treaty resolution activities such as shared flexible common language templates for Indigenous Organization's disclosure requests, the development of departmental specific guidance on Privacy Notices, and have continued a comprehensive review of Personal Information Banks to support the Departmental mandate for service transfer.

The ATIP Office trained a total of 160 ISC employees on the ATIA and PA in 2023-2024. The ATIP Office has also developed institution specific training related to the ATIA and PA that will be available internally for departmental employees in the new fiscal year.

The ATIP office continuously monitors progress on all Privacy request files. Reports are prepared monthly to ensure compliance with legislative timelines so that risks can be mitigated. Each quarter reports are produced on the Department's performance in meeting legislative time frames and these are shared with the senior management.

For the 2023-2024 fiscal year, ISC spent $947,204 to support the Administration of the PA. This includes the purchase of a new case management system. 

Annex A

Order of Delegation of the Privacy Act dated November 6, 2020

Delegation Order

Access to Information Act and Privacy Act

I, the Minister of Indigenous Services Canada, pursuant to section 95 of the Access to Information Act and section 73 of the Privacy Act, hereby delegate the persons holding the positions set out in the Delegation of Authority Schedule attached hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Minister as head of Indigenous Services Canada, under the provisions of the Act and related regulations set out in the schedule opposite each position. This delegation supersedes all previous delegation orders.

Original document signed on 6 November, 2020
The Honourable Patty Hajdu, P.C., M.P.
Minister of Indigenous Services

Designation Pursuant to Section 73 of the Access Information Act

6
Advise requesters that we need additional information to proceed with their request
7(a)
Give written notice to requestor that we can proceed with the request
8(1)
Transfer request to another institution or accept transfer from another institution
9
Extend time limits
10
Refuse to acknowledge or deny the existence of records
11
Charge additional fees
12
Provide access in alternate format
13
Exempt information obtained in confidence
14
Exempt information pertaining to federal-provincial affairs
15
Exempt information pertaining to international affairs and/or defence
16
Exempt information pertaining to law enforcement and investigations
17
Exempt information pertaining to the safety of individuals
18
Exempt information pertaining to the economic interests of Canada
19
Exempt personal information
20
Exempt or disclose third party information
21
Exempt information pertaining to advice, decision-making processes of government plans and positions etc.
22
Exempt information pertaining to testing procedures or audits
23
Exempt information pertaining to solicitor-client privilege
24
Exempt information subject to statutory prohibitions or other Acts of Parliament
25
Sever information
26
Exempt information to be published within 90 days
27(1)(4)
Notify third parties of their rights to provide comments/representations regarding the disclosure of their records
28
Receive third party representations; make a decision as to whether to disclose the record or part thereof; and, notify third party of right to appeal to Federal Court
29(1)
Disclose information on Information Commissioner's recommendation
33
Advise the Information Commissioner of any third-party involvement
35(2)
Make representations to the Information Commissioner during an investigation
37(4)
Release information to complainant
43(1)
Issue a notice to a third party of an application for Court review
44(2)
Issue a notice to an applicant that a third party has applied for Court review
52
Request special rules for hearings
69
Exclude Cabinet Confidences
71
Inspect and exempt information in manuals
72(1)
Prepare Annual Report to Parliament
77
Carry out responsibilities conferred to the Head of the institution by the regulations made under section 77 which are not included in the above

Delegation of Authority Schedule

Position Access to Information Act and Regulations Privacy Act and Regulations
Deputy Minister Full authority Full authority except:
sections 73.1(3), 73.1(5).
Associate Deputy Minister Full authority Full authority except:
sections 73.1(3), 73.1(5).
Corporate Secretary Full authority except:
sections 94, 96(3) or 96(5).		 Full authority
Sections 72, 73.1(3), 73.1(5).
Director, Access to Information and Privacy Full authority except:
sections 94, 96(3) or 96(5).		 Full authority, except:
Sections 72, 73.1(3), 73.1(5).
Deputy Director, Access to Information and Privacy Full authority, except:
sections 33, 37(1)(c), 37(4), 41(2),
43(2), 44(2) and 52(2)(b) and 52(3), 94, 96(3) or 96(5).		 Full authority except:
Sections 8(2)(j), 8(2)(m), 8(5), 9(1),
9(4), 10, 33(2), 35(1)b), 35(4), 36(3)(b), 51(2)(b), (3), 72, 73.1(3), 73.1(5).

Please see Access to Information Act for more information on the Access to Information Act.

Designation Pursuant to Section 73 of the Privacy Act

Sections and Powers, Duties or Functions

8(2)
Disclose personal information without the consent of the individual to whom it relates
8(4)
Keep copies of requests made under 8(2)(e), keep records of information disclosed pursuant to such requests and to make those records available to Privacy Commissioner
8(5)
Notify the Privacy Commissioner in writing of disclosure under paragraph 8(2)(m)
9(1)
Retain a record of use of personal information
9(4)
Notify the Privacy Commissioner of consistent use of personal information and update index accordingly
10
Include personal information in personal information banks
11(a)
Publish annually an index of all personal information banks and their respective contents
11(b)
Publish annually an index of all personal information held by the institution which is not part of a bank
14
Respond to request for access, within statutory deadline; give access or give notice
15
Extend time limit and notify applicant
16
Where access is refused
17(2)(b)
Language of access or alternative format of access
17(3)(b)
Access to personal information in alternative format
18(2)
May refuse to disclose information contained in an exempt bank
19(1)
Shall refuse to disclose information obtained in confidence from another government
19(2)
May disclose any information referred to in 19(1) if the other government consents to the disclosure or makes the information pubic
20
May refuse to disclose information injurious to federal-provincial affairs
21
May refuse to disclose information injurious to international affairs and/or defence
22
May refuse to disclose information injurious to law enforcement and investigation
23
May refuse to disclose information injurious to security clearances
24
May refuse to disclose information collected by the Canadian Penitentiary Service, the National Parole Service or the National Parole Board
25
May refuse to disclose information injurious to which could threaten the safety of individuals
26
May refuse to disclose information about other individuals, and shall refuse to disclose such information where disclosure is prohibited under section 8
27
May refuse to disclose information subject to solicitor-client privilege
28
May refuse to disclose information relating to an individual's physical or mental health where disclosure is contrary to the best interests of the individual
31
Receive notice of investigation by the Privacy Commissioner
33(2)
Make representations to the Privacy Commissioner during an investigation
35(1)
Receive the Privacy Commissioner's report of findings of the investigation and give notice of action taken
35(4)
Give complainant access to information after 35(1)(b) notice
36(3)
Receive Privacy Commissioner's report of findings of investigation of exempt
37(3)
Receive report of Privacy Commissioner's findings after compliance investigation where the institution has not complied with sections 4 to 8
51(2)(b)
Request that matter be heard and determined in National Capital Region
51(3)
Request and be given right to make representations in section 51 hearing
72(1)
Prepare Annual Report to Parliament
77
Carry out responsibilities conferred on the Head of the institution by the regulations made under section 77 which are not included above

Delegation of Authority Schedule

Position Access to Information Act and Regulations Privacy Act and Regulations
Deputy Minister Full authority Full authority except:
sections 73.1(3), 73.1(5).
Associate Deputy Minister Full authority Full authority except:
sections 73.1(3), 73.1(5).
Corporate Secretary Full authority except:
sections 94, 96(3) or 96(5).		 Full authority
Sections 72, 73.1(3), 73.1(5).
Director, Access to Information and Privacy Full authority except:
sections 94, 96(3) or 96(5).		 Full authority, except:
Sections 72, 73.1(3), 73.1(5).
Deputy Director, Access to Information and Privacy Full authority, except:
sections 33, 37(1)(c), 37(4), 41(2),
43(2), 44(2) and 52(2)(b) and 52(3), 94, 96(3) or 96(5).		 Full authority except:
Sections 8(2)(j), 8(2)(m), 8(5), 9(1),
9(4), 10, 33(2), 35(1)b), 35(4), 36(3)(b), 51(2)(b), (3), 72, 73.1(3), 73.1(5).

Please see Privacy Act for more information on the Privacy Act.

Annex B: Statistical Report on the Privacy Act

Name of institution: Indigenous Services Canada

Reporting period: 4/1/2023 to 3/31/2024

Section 1: Requests Under the Privacy Act

1.1.1 Number of requests received

Number of Requests
Received during reporting period 168
Outstanding from previous reporting periods
Outstanding from previous reporting period 18  
Outstanding from more than one reporting period 7  
Total Outstanding from previous reporting periods 25
Total 193

1.1.2 Number of requests received

Number of Requests
Closed during reporting period 171
Carried over to next reporting period
Carried over within legislated timeline 16  
Carried over beyond legislated timeline 6  
Total Carried over to next reporting period 22

1.2 Channels of requests

Source Number of Requests
Online 105
E-mail 53
Mail 9
In person 0
Phone 0
Fax 1
Total 168

Section 2: Informal requests

2.1.1 Number of informal requests

Number of Requests
Received during reporting period 0
Outstanding from previous reporting periods
Outstanding from previous reporting period 0  
Outstanding from more than one reporting period 0  
Total Outstanding from previous reporting periods 0
Total 0

2.1.2 Number of informal requests

Number of Requests
Closed during reporting period 0
Carried over to next reporting period 0

2.2 Channels of informal requests

Source Number of Requests
Online 0
E-mail 0
Mail 0
In person 0
Phone 0
Fax 0
Total 0

2.3 Completion time of informal requests

0 to 15 Days 16 to 30 Days 31 to 60 Days 61 to 120 Days 121 to 180 Days 181 to 365 Days More Than 365 Days Total
0 0 0 0 0 0 0 0

2.4 Pages released informally

Less Than 100
Pages Released		 100-500
Pages Released		 501-1000
Pages Released		 1001-5000
Pages Released		 More Than 5000
Pages Released
Number of Requests Pages Released Number of Requests Pages Released Number of Requests Pages Released Number of Requests Pages Released Number of Requests Pages Released
0 0 0 0 0 0 0 0 0 0

Section 3: Requests Closed During the Reporting Period

3.1 Disposition and completion time

Disposition of Requests Completion Time
0 to 15 Days 16 to 30 Days 31 to 60 Days 61 to 120 Days 121 to 180 Days 181 to 365 Days More Than 365 Days Total
All disclosed 1 8 4 3 0 0 0 16
Disclosed in part 0 24 27 16 8 7 5 87
All exempted 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0
No records exist 22 10 5 0 0 0 0 37
Request abandoned 29 1 0 0 1 0 0 31
Neither confirmed nor denied 0 0 0 0 0 0 0 0
Total 52 43 36 19 9 7 5 171

3.2 Exemptions

Section Number of Requests
18(2) 0
19(1)(a) 0
19(1)(b) 0
19(1)(c) 0
19(1)(d) 0
19(1)(e) 0
19(1)(f) 0
20 0
21 0
22(1)(a)(i) 0
22(1)(a)(ii) 0
22(1)(a)(iii) 0
22(1)(b) 0
22(1)(c) 0
22(2) 0
22.1 0
22.2 0
22.3 0
22.4 0
23(a) 0
23(b) 0
24(a) 0
24(b) 0
25 1
26 85
27 3
27.1 0
28 0

3.3 Exclusions

Section Number of Requests
69(1)(a) 0
69(1)(b) 0
69.1 0
70(1) 0
70(1)(a) 0
70(1)(b) 0
70(1)(c) 0
70(1)(d) 0
70(1)(e) 0
70(1)(f) 0
70.1 0

3.4 Format of information released

Paper Electronic Other
E-record Data set Video Audio
0 103 0 0 0 0

3.5 Complexity

3.5.1 Relevant pages processed and disclosed for paper, e-record and dataset formats
Number of Pages Processed Number of Pages Disclosed Number of Requests
39067 11460 134
3.5.2 Relevant pages processed per request disposition for paper, e-record and dataset formats by size of requests
Disposition Less Than 100
Pages Processed		 100-500
Pages Processed		 501-1000
Pages Processed		 1001-5000
Pages Processed		 More Than 5000
Pages Processed
Number of Requests Pages Processed Number of Requests Pages Processed Number of Requests Pages Processed Number of Requests Pages Processed Number of Requests Pages Processed
All disclosed 15 88 0 0 0 0 0 0 1 8137
Disclosed in part 52 1529 22 5098 7 4982 5 9327 1 9843
All exempted 0 0 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0 0 0
Request abandoned 31 63 0 0 0 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0 0 0 0 0 0
Total 98 1680 22 5098 7 4982 5 9327 2 17980
3.5.3 Relevant minutes processed and disclosed for audio formats
Number of Minutes Processed Number of Minutes Disclosed Number of Requests
0 0 0
3.5.4 Relevant minutes processed per request disposition for audio formats by size of requests
Disposition Less than 60 Minutes processed 60-120 Minutes processed More than 120 Minutes processed
Number of requests Minutes Processed Number of requests Minutes Processed Number of requests Minutes Processed
All disclosed 0 0 0 0 0 0
Disclosed in part 0 0 0 0 0 0
All exempted 0 0 0 0 0 0
All excluded 0 0 0 0 0 0
Request abandoned 0 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0 0
Total 0 0 0 0 0 0
3.5.5 Relevant minutes processed and disclosed for video formats
Number of Minutes Processed Number of Minutes Disclosed Number of Requests
0 0 0
3.5.6 Relevant minutes processed per request disposition for video formats by size of requests
Disposition Less than 60 Minutes processed 60-120 Minutes processed More than 120 Minutes processed
Number of requests Minutes Processed Number of requests Minutes Processed Number of requests Minutes Processed
All disclosed 0 0 0 0 0 0
Disclosed in part 0 0 0 0 0 0
All exempted 0 0 0 0 0 0
All excluded 0 0 0 0 0 0
Request abandoned  0 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0 0
Total 0 0 0 0 0 0
3.5.7 Other complexities
Disposition Consultation Required Legal Advice Sought Interwoven Information Other Total
All disclosed 0 0 0 0 0
Disclosed in part 1 0 7 2 10
All exempted 0 0 0 0 0
All excluded 0 0 0 0 0
Request abandoned 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0
Total 1 0 7 2 10

3.6 Closed requests

3.6.1 Number of requests closed within legislated timelines
Number of requests closed within legislated timelines 134
Percentage of requests closed within legislated timelines (%) 78.3625731

3.7 Deemed refusals

3.7.1 Reasons for not meeting legislated timelines
Number of requests closed past the legislated timelines Principal Reason
Interference with operations / Workload External Consultation Internal Consultation Other
37 26 1 0 10
3.7.2 Request closed beyond legislated timelines (including any extension taken)
Number of days past legislated timelines Number of requests past legislated timeline where no extension was taken Number of requests past legislated timeline where an extension was taken Total
1 to 15 days 1 0 1
16 to 30 days 5 1 6
31 to 60 days 5 2 7
61 to 120 days 4 6 10
121 to 180 days 2 2 4
181 to 365 days 2 2 4
More than 365 days 0 5 5
Total 19 18 37

3.8 Requests for translation

Translation Requests Accepted Refused Total
English to French 0 0 0
French to English 0 0 0
Total 0 0 0

Section 4: Disclosures Under Subsections 8(2) and 8(5)

4.1 Disclosures under subsections 8(2) and 8(5)

Paragraph 8(2)(e) Paragraph 8(2)(m) Subsection 8(5) Total
50 1 1 52

Section 5: Requests for Correction of Personal Information and Notations

5.1 Requests for correction of personal information and notations

Disposition for Correction Requests Received Number
Notations attached 0
Requests for correction accepted 0
Total 0

Section 6: Extensions

6.1  Reasons for extensions

Number of extensions taken 15(a)(i) Interference with operations 15 (a)(ii) Consultation 15(b) Translation purposes or conversion
Further review required to determine exemptions Large volume of pages Large volume of requests Documents are difficult to obtain Cabinet ConfidenceSection (Section 70) External Internal
54 3 16 15 20 0 0 0 0

6.2 Length of extensions

Length of Extensions 15(a)(i) Interference with operations 15 (a)(ii) Consultation 15(b) Translation purposes or conversion
Further review required to determine exemptions Large volume of pages Large volume of requests Documents are difficult to obtain Cabinet ConfidenceSection (Section 70) External Internal
1 to 15 days 0 0 0 0 0 0 0 0
16 to 30 days 3 16 15 20 0 0 0 0
31 days or greater   0
Total 3 16 15 20 0 0 0 0

Section 7: Consultations Received From Other Institutions and Organizations

7.1 Consultations received from other Government of Canada institutions and other organizations

Consultations Other Government of Canada Institutions Number of Pages to Review Other Organizations Number of Pages to Review
Received during the reporting period 0 0 0 0
Outstanding from the previous reporting period 0 0 0 0
Total 0 0 0 0

7.1.2  Consultations received from other Government of Canada institutions and other organizations

Consultations Other Government of Canada Institutions Number of Pages to Review Other Organizations Number of Pages to Review
Closed during the reporting period 0 0 0 0
Carried over within negotiated timelines 0 0 0 0
Carried over beyond negotiated timelines 0 0 0 0

7.2 Recommendations and completion time for consultations received from other Government of Canada institutions

Recommendation Number of Days Required to Complete Consultation Requests
0 to 15 Days 16 to 30 Days 31 to 60 Days 61 to 120 Days 121 to 180 Days 181 to 365 Days More Than 365 Days Total
Disclose entirely 0 0 0 0 0 0 0 0
Disclose in part 0 0 0 0 0 0 0 0
Exempt entirely 0 0 0 0 0 0 0 0
Exclude entirely 0 0 0 0 0 0 0 0
Consult other institution 0 0 0 0 0 0 0 0
Other 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0

7.3 Recommendations and completion time for consultations received from other organizations outside the Government of Canada

Recommendation Number of Days Required to Complete Consultation Requests
0 to 15 Days 16 to 30 Days 31 to 60 Days 61 to 120 Days 121 to 180 Days 181 to 365 Days More Than 365 Days Total
Disclose entirely 0 0 0 0 0 0 0 0
Disclose in part 0 0 0 0 0 0 0 0
Exempt entirely 0 0 0 0 0 0 0 0
Exclude entirely 0 0 0 0 0 0 0 0
Consult other institution 0 0 0 0 0 0 0 0
Other 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0

Section 8: Completion Time of Consultations on Cabinet Confidences

8.1 Requests with Legal Services

Number of Days Fewer Than 100 Pages Processed 100-500 Pages Processed 501-1000
Pages Processed		 1001-5000
Pages Processed		 More than 5000
Pages Processed
Number of
Requests		 Pages Disclosed Number of
Requests		 Pages Disclosed Number of
Requests		 Pages Disclosed Number of
Requests		 Pages Disclosed Number of
Requests		 Pages Disclosed
1 to 15 0 0 0 0 0 0 0 0 0 0
16 to 30 0 0 0 0 0 0 0 0 0 0
31 to 60 0 0 0 0 0 0 0 0 0 0
61 to 120 0 0 0 0 0 0 0 0 0 0
121 to 180 0 0 0 0 0 0 0 0 0 0
181 to 365 0 0 0 0 0 0 0 0 0 0
More than 365 0 0 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0 0 0

8.2 Requests with Privy Council Office

Number of Days Fewer Than 100 Pages Processed 100-500 Pages Processed 501-1000
Pages Processed		 1001-5000
Pages Processed		 More than 5000
Pages Processed
Number of
Requests		 Pages Disclosed Number of
Requests		 Pages Disclosed Number of
Requests		 Pages Disclosed Number of
Requests		 Pages Disclosed Number of
Requests		 Pages Disclosed
1 to 15 0 0 0 0 0 0 0 0 0 0
16 to 30 0 0 0 0 0 0 0 0 0 0
31 to 60 0 0 0 0 0 0 0 0 0 0
61 to 120 0 0 0 0 0 0 0 0 0 0
121 to 180 0 0 0 0 0 0 0 0 0 0
181 to 365 0 0 0 0 0 0 0 0 0 0
More than 365 0 0 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0 0 0

Section 9: Complaints and Investigations Notices Received

9.1 Complaints and investigations notices received

Section 31 Section 33 Section 35 Court action Total
5 0 1 0 6

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

10.1 Privacy Impact Assessments

Number of PIAs completed 0
Number of PIAs modified 0

10.2 Institution-specific and Central Personal Information Banks

Personal Information Banks Active Created Terminated Modified
Institution-specific 37 0 0 0
Central 48 0 0 0
Total 85 0 0 0

Section 11: Privacy Breaches

11.1 Material Privacy Breaches reported

Number of material privacy breaches reported to TBS 0
Number of material privacy breaches reported to OPC 0

11.2 Non-Material Privacy Breaches

Number of non-material privacy breaches 4

Section 12: Resources Related to the Privacy Act

12.1  Allocated Costs

Expenditures Amount
Salaries $474,963
Overtime $33,258
Goods and Services
Professional services contracts $248,610  
Other $190,373  
Total Goods and Services $438,983
Total $947,204

12.2  Human Resources

Resources Person Years Dedicated to Privacy Activities
Full-time employees 5.361
Part-time and casual employees 0.000
Regional staff 0.000
Consultants and agency personnel 1.035
Students 0.000
Total 6.396

Did you find what you were looking for?

What was wrong?

You will not receive a reply. Don't include personal information (telephone, email, SIN, financial, medical, or work details).
Maximum 300 characters

Thank you for your feedback

Date modified: