Annual Report to Parliament 2015-2016 – Privacy Act

I. Introduction

The purpose of the Privacy Act is to extend the present laws of Canada that protect the privacy of individuals and that provide individuals with a right of access to personal information about themselves. The federal Privacy Act regulates the collection, use and disclosure of personal information held by federal institutions including the National Research Council Canada (NRC).

In accordance with Section 72 of the Privacy Act, this thirty-first Annual Report on the administration of the Privacy Act at NRC describes how NRC discharged its responsibilities in relation to the Act in the fiscal year 2015-2016. The Annual Report is to be tabled in Parliament in accordance with section 72 of the Privacy Act.

Mandate of the National Research Council of Canada

The National Research Council of Canada (NRC) is an agency of the Government of Canada established in 1916. As stated in the NRC Act, the agency is responsible for:

• Undertaking, assisting or promoting scientific and industrial research in different fields of importance to Canada;
• Establishing, operating and maintaining a national science library;
• Publishing and selling or otherwise distributing such scientific and technical information as the Council deems necessary;
• Investigating standards and methods of measurement;
• Working on the standardization and certification of scientific and technical apparatus and instruments and materials used or usable by Canadian industry;
• Operating and administering any astronomical observatories established or maintained by the Government of Canada;
• Administering NRC's research and development activities, including contributions used to support a number of international activities;
• Providing vital scientific and technological services to the research and industrial communities.

II. Organizational Structure

The President delegated full authority for the application and administration of the Privacy Act to the Director General, Knowledge Management and to the Director, Information Management Services Directorate. Partial authority was delegated to the Access to Information and Privacy (ATIP) Coordinator.

A detailed signed Delegation Order can be found at Annex A.

During the period covered by this report, the NRC Access to Information and Privacy (ATIP) office was part of NRC Knowledge Management Branch (NRC-KM).

In 2015-2016, the NRC ATIP office was comprised of one full-time Coordinator and one full-time ATIP officer.

The NRC ATIP office works closely with the NRC Records Management office, the NRC Industrial Research Assistance Program ATIP liaison officer, Executive Advisors, NRC Communications Branch and senior management across the organization.

Procedures are in place to process all formal Privacy requests in accordance with the Privacy Act.

The ATIP office is responsible for the coordination and implementation of policies, guidelines and procedures to ensure the organization's compliance with the Privacy Act. To that end, the office provides the following services to the organization:

• Promotes awareness of the Privacy Act within the organization
• Processes and manages Privacy requests and complaints
• Manages the ATIP electronic management system
• Responds to access-related matters in the Management Accountability Framework
• Processes consultations received from other institutions
• Provides advice and guidance to employees and senior officials on Privacy-related matters
• Prepares an Annual Report to Parliament
• Coordinates updates to the Info Source publications
• Reviews departmental documents (such as audit and evaluation reports prior to their proactive disclosure on the organization's website), Parliamentary Questions and Harassment Reports
• Develops internal procedures
• Participates in forums for the ATIP community, such as the Treasury Board Secretariat ATIP Community meetings and working groups.

The ATIP Office is also responsible for the implementation of any new Treasury Board Secretariat (TBS) directives.

III. Interpretation of Statistical Report

Annex B provides a summarized statistical report on the privacy requests received and processed by the National Research Council from 1 April 2015 to 31 March 2016. This section provides an interpretation of the statistical report.

During the fiscal year, NRC received eight (8) new privacy requests. Two (2) requests that were either not completed or had been received at the end of the fiscal year were carried over to the next reporting period. During this reporting period, NRC completed the processing of a total of ten (10) privacy requests.

The figures, as reflected in the chart on the next page, indicate the number of requests received and processed over the past three years. The figures do not reflect requests processed informally or other queries (requests transferred from the NRC call centre, from other branches, etc.) that have been received in the ATIP office.

Long description of the number of requests received and processed

	2013‑2014	2014‑2015	2015‑2016
received	11	11	8
completed	12	10	10
carried forward	1	2	0

The trends indicate a decrease in the number of privacy requests received, as well as a decrease in the number of pages reviewed (as per the grid below).

Long description for pages processed

	Pages processed
2013‑2014	15,715
2014‑2015	1,740
2015‑2016	947

Section 15 of the Privacy Act allows institutions to extend the legal deadline for processing a request. NRC invoked an extension in one (1) case where meeting the original time limit of thirty days would have unreasonably interfered with the operations of the organization due to the broad scope of the request and the level of effort required from NRC business units.

In summary, out of the ten (10) requests, eight (8) were completed within 30 days or less and two (2) took between 31 and 60 days to complete.

The exemptions section of the Statistical Report is intended to identify the number of requests in cases where specific types of exemptions were invoked. NRC invoked exemptions pursuant to section 26 of the Privacy Act. Section 26 (information about another individual) was applied in six (6) cases.

Within the context of its overall roles and responsibilities, NRC's ATIP office reviewed a total of one hundred (100) parliamentary questions received for the period of 1 April 2015 to 31 March 2016, compared to one hundred sixty-one (161) in 2014-2015 and seventy-six (76) in 2013-2014.

Long description for Parliamentary Questions

	Pages processed
2013‑2014	76
2014‑2015	161
2015‑2016	100

There is no request for correction of personal information to be reported for the 2015-2016 period.

The annual statistical report for the fiscal year 2015-2016 is included at the end of this chapter, as Annex B^{Footnote 1}.

IV. Privacy‑related Training and Education

The ATIP office is committed to providing ongoing development and training to NRC's employees.

ATIP tools and guidance are available on NRC external and internal websites.

ATIP employees continually work to sensitize and guide employees, third parties and requesters regarding the requirements of the Privacy Act through ongoing dialogue and bilateral discussions. During the reporting period, the ATIP Coordinator and officer responded to numerous inquiries from colleagues (Human resources branch, management, etc.), providing advice and guidance on various subjects pertaining to Privacy legislation.

The ATIP office promoted the Right to Know Day of 28 September and the Data Privacy Day of 28 January within NRC with postings on the NRC internal website.

Throughout the fiscal year, the ATIP Coordinator and the officer attended ATIP community meetings and various different training sessions offered by Treasury Board Secretariat.

V. Procedures, Guidelines and Directives

NRC ATIP office revised six (6) policies, guidelines and procedures during the reporting period:

• ATIP effective practices;
• Guidelines on privacy breaches;
• Policy governing the management of personal information;
• Privacy impact assessment handbook;
• Privacy protocol for non-administrative purposes;
• Procedures for suspected obstruction of the right of access to NRC records.

VI. Privacy Complaints

During this fiscal year, NRC did not receive any privacy complaints.

VII. Monitoring of Privacy Requests

In keeping with TBS policies and directives, the ATIP office has established internal ATIP procedures and business practices to ensure the efficient and timely processing of privacy requests, while making every effort to assist applicants in the most expeditious manner without regard to their identity.

The ATIP office has a tracking system that keeps track of both the active and closed requests. This system is designed to follow the legislative deadlines.

The ATIP office holds weekly meetings to discuss request-related activities, determine timelines and for ensuring that team members are informed of the status of files. Weekly meetings also take place with the Direction, Information Management Services Directorate.

A report of active ATIP files (while maintaining the privacy requestors' identity) is shared with the NRC Communications Branch on a weekly basis and a more detailed report is provided to delegated authorities.

VIII. Material Privacy Breaches

There is no material privacy breach to report for fiscal year 2015-2016.

IX. Privacy Impact Assessment Activities

During this fiscal year, NRC did not complete any privacy impact assessments.

X. Section 8(2)(m) Disclosures

Paragraph 8(2)(m) allows for the disclosure of personal information when the public interest clearly outweighs any invasion of privacy or when the disclosure would benefit the individual. There were no disclosures pursuant to paragraph 8(2)(m) for the 2015-2016 period.

Annex A: Delegation Order

Access to Information and Privacy Acts Delegation Order

The President of the National Research Council of Canada, pursuant to section 73 of the Access to Information Act and the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the person occupying on an acting basis the position, to exercise the powers and functions of the President as the head of a government institution, under the section of the Acts set out in the schedule opposite each position. This Designation Order supersedes all previous designation orders.

Schedule

Dated, at the City of Ottawa
20 August 2014

John R. McDougall, ing.,
President of the National Research Council of Canada

Annex B: Statistical Report on the Privacy Act

Name of institution: National Research Council Canada

Reporting period: 2015-04-01 to 2016-03-31