Annual Report to Parliament 2018-2019 - Privacy Act

 

Alternate format

Annual Report to Parliament 2018-2019 - Privacy Act (PDF, 1.24 MB)

I . Introduction

The National Research Council of Canada (NRC) is pleased to present to Parliament its annual report on the administration of the Privacy Act for fiscal year April 1, 2018 to March 31, 2019. Section 72 of the Act requires that the head of every federal government institution submit an annual report to Parliament on the administration of the Act during the fiscal year.

The purpose of the Privacy Act is to extend the present laws of Canada that protect the privacy of individuals and that provide individuals with a right of access to personal information about themselves. The federal Privacy Act regulates the collection, use and disclosure of personal information held by federal institutions including the National Research Council Canada (NRC).

This thirty-fifth Annual Report on the administration of the Privacy Act at the NRC provides an overview of the activities of the Council in implementing the Act.

Mandate of the National Research Council of Canada

The National Research Council of Canada (NRC) supports industrial innovation, the advancement of knowledge, technology development and public policy mandates. The NRC plays a unique role in Canada, undertaking large-scale mission-oriented research and development programs. With a presence in every province, NRC combines its strong national foundation with international linkages to help Canada grow in productivity and remain globally competitive. NRC works in collaboration with industry, governments and academia to maximize Canada's overall RandD investment.

II . Organizational structure and delegation of authority

From April 1, 2018 to March 31, 2019, the NRC President delegated full authority for the application and administration of the Privacy Act to the Vice-President, Business and Professional Services, to the Chief Information Officer and Director General of Knowledge, Information and Technology Services, and to the Director, Information and Data Management Services Directorate. Partial authority was delegated to the Access to Information and Privacy (ATIP) Coordinator.

A copy of the current signed Delegation Order can be found at Annex A.

During the period covered by this report, the NRC Access to Information and Privacy (ATIP) office was part of the Information and Data Management Services Directorate (formerly Information Management Services Directorate), within the Knowledge, Information and Technology Services Branch.

As noted by other federal ATIP departments as well as by the Information Commissioner, there is a shortage of staff in the ATIP field which can result in difficulty attracting experienced officers. In 2018-2019, the NRC ATIP office was partially understaffed due to standard staff turn-over and consisted of a coordinator and a full-time officer, with another part-time officer joining the team at the end of the year.

The NRC ATIP office works closely with the NRC information management team, Executive Advisors, NRC Communications Branch and senior management across the organization.

Procedures are in place to process all formal privacy requests in accordance with the Privacy Act.

The ATIP office is responsible for the coordination and implementation of policies, guidelines and procedures to ensure the organization's compliance with the Privacy Act. To that end, the office provides the following services to the organization:

  • Promotes awareness of the Privacy Act within the organization;
  • Processes and manages privacy requests and complaints;
  • Manages the ATIP electronic case management system;
  • Processes consultations received from other institutions;
  • Provides professional advice and guidance to senior management and all departmental staff on the Act;
  • Prepares the annual report to Parliament and the annual statistical report;
  • Maintains NRC's Info Source chapter;
  • Assists in the privacy impact assessment process and in creating or modifying personal information banks;
  • Reviews departmental documents (such as audit and evaluation reports prior to their proactive disclosure on the organization's website), Parliamentary Questions and Harassment Reports for privacy-related considerations;
  • Develops internal procedures;
  • Participates in forums for the ATIP community, such as the Treasury Board Secretariat ATIP Community meetings and working groups.

The ATIP Office is also responsible for the implementation of any new Treasury Board Secretariat (TBS) directives.

III . Interpretation of statistical report

Annex B provides a detailed statistical report on the privacy requests received and processed by the National Research Council from April 1 2018 to March 31 2019. This section provides an interpretation of the statistical report.

During the fiscal year, NRC received sixteen (16) new privacy requests. One (1) request was outstanding from the previous fiscal year, for a total of seventeen (17) requests. During this reporting period, NRC completed the processing of a total of seventeen (17) privacy requests.

The figures, as reflected in the chart below, indicate the number of requests received and processed over the past three years. The figures do not reflect informal privacy-related queries that have been received in the ATIP office.

Chart 1: Volume of privacy requests

atip-pa-2018-2019-fig1-e.jpg
Long description for Chart 1: Volume of privacy requests
  2016‑2017 2017‑2018 2018‑2019
received 8 10 16
completed 7 10 17
carried forward 1 1 0
 

Out of the seventeen (17) closed requests, ten (10) were completed within 30 days, five (5) took between 31 and 60 days, and two (2) took between 61 and 120 days to complete. NRC had two late requests closed past the statutory deadline due to external and internal consultations.

Chart 2: Number of days taken to complete requests

atip-pa-2018-2019-fig2-e.jpg
Long description for Chart 2: Number of days taken to complete requests
between 1 and 30 days 59%
between 31 and 60 days 29%
between 61 and 120 days 12%
 

The exemptions section of the statistical report is intended to identify the number of requests in cases where specific types of exemptions were invoked. NRC invoked exemptions pursuant to sections 25, 26 and 27 of the Privacy Act. Section 25 (Safety of individuals) was applied in one (1) case, section 26 (Information about another individual) was applied in ten (10) cases and section 27 (Solicitor-client privilege) was applied in five (5) cases.

As per the following grid, the number of pages processed in response to privacy requests increased over the previous fiscal years.

Chart 3: Trends for pages disclosed

atip-pa-2018-2019-fig3-e.jpg
Long description for Chart 3: Trends for pages disclosed
  pages processed
2016‑2017 1471
2017‑2018 3596
2018‑2019 6542
 

Section 15 of the Privacy Act allows institutions to extend the legal deadline for processing a request. NRC invoked an extension in seven (7) cases where meeting the original time limit of thirty (30) days would have unreasonably interfered with the operations of the organization due to the broad scope of the request and the level of effort required from NRC business units.

Within the context of its overall roles and responsibilities, NRC's ATIP office reviewed a total of one hundred and forty-eight (148) Parliamentary Questions received for the period of 1 April 2018 to 31 March 2019, compared to ninety-eight (98) in 2017-2018 and one hundred forty-eight (148) in 2016-2017.

Chart 4: Parliamentary questions

atip-pa-2018-2019-fig4-e.jpg
Long description for Chart 4: Parliamentary questions
  pages processed
2016‑2017 148
2017‑2018 98
2018‑2019 148
 

The annual statistical report for the fiscal year 2018-2019 is included at the end of this chapter, as Annex B.

IV . Privacy-related training and education

To increase the knowledge and understanding of the Privacy Act across NRC, training and awareness sessions are delivered on an ongoing basis to NRC employees. These sessions provided basic information on the purposes and provisions of the Act, roles and responsibilities, and general best practices (such as email management). All training sessions include information on the identification and management of personal information and the Privacy Act. During the reporting period, the ATIP office delivered a total of five (5) training sessions to seventy-four (74) employees in the National Capital Region and in regional offices.

ATIP tools and guidance are updated on a regular basis and are made available on NRC external and internal websites.

The ATIP team continually works to sensitize and guide employees, third parties and requesters regarding the requirements of the Privacy Act, through ongoing dialogue and bilateral discussions. During the reporting period, the ATIP Coordinator and officers responded to numerous inquiries from colleagues (Human Resources Branch, management, etc.), providing advice and guidance on various privacy-related subjects.

The ATIP office promoted Right to Know Day (September 28th) and Data Privacy Day (January 28th) within NRC, through postings on the NRC internal website.

Throughout the fiscal year, the ATIP Coordinator and the officers attended ATIP community meetings and various training sessions offered by Treasury Board Secretariat.

V . Procedures, guidelines and directives

NRC did not implement new and/or revised privacy policies, guidelines or procedures during the reporting period. NRC actively participated in the Treasury Board Secretariat (TBS) pilot project for online ATIP requests. Consequently, since October 2018, NRC has been receiving requests through the TBS ATIP online requests tool.

VI . Privacy complaints

During this fiscal year, NRC did not receive any privacy complaints.

VII . Monitoring of privacy requests

In keeping with TBS policies and directives, the ATIP office has established internal ATIP procedures and business practices to ensure the efficient and timely processing of privacy requests, while making every effort to assist applicants in the most expeditious manner without regard to their identity.

The ATIP office has a tracking system that keeps track of both the active and closed requests. This system is designed to follow the legislative deadlines.

The ATIP office holds weekly meetings to discuss request-related activities, determine timelines and ensure that team members are informed of the status of files. Weekly meetings also take place with the Director, Information and Data Management Services Directorate.

A report of active ATIP files (which maintains the privacy of the requestors' identities) is shared with the NRC senior management team on a weekly basis and a more detailed report is provided to delegated authorities.

VIII . Material privacy breaches

There are no material privacy breaches to report for fiscal year 2018-2019.

IX . Privacy impact assessment activities

During this fiscal year, NRC did not complete any privacy impact assessments.

X . Section 8(2)(m) disclosures

Paragraph 8(2)(m) allows for the disclosure of personal information when the public interest clearly outweighs any invasion of privacy or when the disclosure would benefit the individual. There were no disclosures pursuant to paragraph 8(2)(m) for the 2018-2019 period.

Annex A: Delegation order

Access to Information and Privacy Acts delegation order

The President of the National Research Council of Canada, pursuant to section 73 of the Access to Information Act and the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the person occupying on an acting basis the position, to exercise the powers and functions of the President as the head of a government institution, under the section of the Acts set out in the schedule opposite each position. This Designation Order supersedes all previous designation orders.

Schedule
Position Access to Information Act and regulations Privacy Act and Regulations
Vice-President, Business and Professional Services Full authority Full authority
Chief Information Officer and Director General, Knowledge and Information Technology Services Full authority Full authority
Director, Information and Data Management Full authority Full authority
Access to Information and Privacy Coordinator Sections 7(a), 8(1), 9, 11(2) to (6), 12(2)(3), 26, 27(1) and (4), 28(1), (2) and (4), 29(1), 33, 37(4), 43(1), 44(2) Sections 8(2)(j), 8(4), 8(5), 9(1), 9(4), 10, 14, 15, 17(2)(b), 18(2), 31, 35(1), 35(4), 36(3), 37(3), 51(2)(b)
 

Dated, at the City of Ottawa
10 October 2017

Iain Stewart
President of the National Research Council of Canada

Annex B: Statistical report

Name of institution: National Research Council Canada

Reporting period: 2018-04-01 to 2019-03-31

Part 1 - Requests under the Privacy Act

Requests under the Privacy Act
  Number of requests
Received during reporting period 16
Outstanding from previous reporting period 1
Total 17
Closed during reporting period 17
Carried over to next reporting period 0
   
 

Part 2 – Requests closed during the reporting period

2.1 Disposition and completion time
  Completion time
Disposition of requests 1 to 15
days
16 to 30
days
31 to 60
days
61 to 120
days
121 to 180
days
181 to 365
days
More than 365
days
Total
All disclosed 3 2 0 0 0 0 0 5
Disclosed in part 0 3 5 2 0 0 0 10
All exempted 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0
No records exist 2 0 0 0 0 0 0 2
Request abandoned 0 0 0 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0 0 0 0
Total 5 5 5 2 0 0 0 17
 
2.2 Exemptions
Section Number
of requests
18(2) 0
19(1)(a) 0
19(1)(b) 0
19(1)(c) 0
19(1)(d) 0
19(1)(e) 0
19(1)(f) 0
20 0
21 0
22(1)(a)(i) 0
22(1)(a)(ii) 0
22(1)(a)(iii) 0
22(1)(b) 0
22(1)(c) 0
22(2) 0
22.1 0
22.2 0
22.3 0
23(a) 0
23(b) 0
24(a) 0
24(b) 0
25 1
26 10
27 5
28 0
 
2.3 Exclusions
Section Number
of requests
69(1)(a) 0
69(1)(b) 0
69.1 0
70(1) 0
70(1)(a) 0
70(1)(b) 0
70(1)(c) 0
70(1)(d) 0
70(1)(e) 0
70(1)(f) 0
70.1 0
 
2.4 Format of information released
Disposition Paper Electronic Other formats
All disclosed 3 2 0
Disclosed in part 1 9 0
Total 4 11 0
 

2.5 Complexity

2.5.1 Relevant pages processed and disclosed
Disposition of requests Number of
pages processed
Number of
pages disclosed
Number of
requests
All disclosed 320 320 5
Disclosed in part 6222 6222 10
All exempted 0 0 0
All excluded 0 0 0
Request abandoned 0 0 0
Neither confirmed or denied 0 0 0
Total 6542 6542 15
 
2.5.2 Relevant pages processed and disclosed by size of requests
Disposition Less Than 100 pages processed 101‑500 pages processed 501‑1000 pages processed 1001‑5000 pages processed More Than 5000 pages processed
Number of
requests
Pages disclosed Number of
requests
Pages disclosed Number of
requests
Pages disclosed Number of
requests
Pages disclosed Number of
requests
Pages disclosed
All disclosed 4 109 1 211 0 0 0 0 0 0
Disclosed in part 1 14 4 1201 3 2038 2 2969 0 0
All exempted 0 0 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0 0 0
Request abandoned 0 0 0 0 0 0 0 0 0 0
Neither confirmed or denied 0 0 0 0 0 0 0 0 0 0
Total 5 123 5 1412 3 2038 2 2969 0 0
 
2.5.3 Other complexities
Disposition Consultation required Legal advice sought Interwoven information Other Total
All disclosed 0 0 0 0 0
Disclosed in part 0 1 0 0 1
All exempted 0 0 0 0 0
All excluded 0 0 0 0 0
Request abandoned 0 0 0 0 0
Neither confirmed or denied 0 0 0 0 0
Total 0 1 0 0 1
 

2.6 Deemed refusals

2.6.1 Reasons for not meeting statutory deadline
Number of requests
closed past the
statutory deadline
Principal reason
Workload External consultation Internal consultation Other
2 0 1 1 0
 
2.6.2 Number of days past deadline
Number of days past deadline Number of requests past deadline where no extension was taken Number of requests past deadline where an extension was taken Total
1 to 15 days 0 1 1
16 to 30 days 0 0 0
31 to 60 days 0 1 1
61 to 120 days 0 0 0
121 to 180 days 0 0 0
181 to 365 days 0 0 0
More than 365 days 0 0 0
Total 0 2 2
 
2.7 Requests for translation
Translation requests Accepted Refused Total
English to French 0 0 0
French to English 0 0 0
Total 0 0 0
 

Part 3 – Disclosures under subsection 8(2) and 8(5)

Disclosures under subsection 8(2)
Paragraph 8(2)(e) Paragraph 8(2)(m) Subsection 8(5) Total
0 0 0 0
 

Part 4 – Requests for correction of personal information and notations

Requests for correction of personal information and notations
Disposition for correction requests received Number
Notations attached 0
Requests for correction accepted 0
Total 0
 

Part 5 – Extensions

5.1 Reasons for extensions and disposition of requests
Disposition of requests where an extension was taken 15(a)(i)
interference with operations
15(a)(ii) Consultation 15(b)
Translation or Conversion
Section 70 Other
All disclosed 0 0 0 0
Disclosed in part 7 0 0 0
All exempted 0 0 0 0
All excluded 0 0 0 0
No records exist 0 0 0 0
Request abandoned 0 0 0 0
Total 7 0 0 0
 
5.2 Length of extensions
Length of extensions 15(a)(i)
interference with operations
15(a)(ii)
Consultation
15(b)
Translation purposes
Section 70 Other
1 to 15 days 0 0 0 0
16 to 30 days 7 0 0 0
Total 7 0 0 0
 

Part 6 – Consultations received from other institutions and organizations

6.1 Consultations received from other Government of Canada institutions and organizations
Consultations Other Government of Canada institutions Number of pages to review Other organizations Number of pages to review
Received during the reporting period 0 0 0 0
Outstanding from the previous reporting period 0 0 0 0
Total 0 0 0 0
Closed during the reporting period 0 0 0 0
Pending at the end of the reporting period 0 0 0 0
 
6.2 Recommendations and completion time for consultations received from other Government of Canada institutions
Recommendation Number of days required to complete consultation requests
1 to 15 days 16 to 30 days 31 to 60 days 61 to 120 days 121 to 180 days 181 to 365 days than 365 days Total
All disclosed 0 0 0 0 0 0 0 0
Disclose in part 0 0 0 0 0 0 0 0
All exempted 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0
Consult other institution 0 0 0 0 0 0 0 0
Other 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0
 
6.3 Recommendations and completion time for consultations received from other organizations
Recommendation Number of days required to complete consultation requests
1 to 15 days 16 to 30 days 31 to 60 days 61 to 120 days 121 to 180 days 181 to 365 days than 365 days Total
All disclosed 0 0 0 0 0 0 0 0
Disclose in part 0 0 0 0 0 0 0 0
All exempted 0 0 0 0 0 0 0 0
all excluded 0 0 0 0 0 0 0 0
Consult other institution 0 0 0 0 0 0 0 0
Other 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0
 

Part 7 – Completion time of consultations on cabinet confidences

7.1 Requests with legal services
Number of days Fewer than 100 pages processed 101‑500 pages processed 501‑1000 pages processed 1001‑5000 pages processed More than 5000 pages processed
Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed
1 to 15 0 0 0 0 0 0 0 0 0 0
16 to 30 0 0 0 0 0 0 0 0 0 0
31 to 60 0 0 0 0 0 0 0 0 0 0
61 to 120 0 0 0 0 0 0 0 0 0 0
121 to 180 0 0 0 0 0 0 0 0 0 0
181 to 365 0 0 0 0 0 0 0 0 0 0
More than 365 0 0 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0 0 0
 
7.2 Requests with Privy Council Office
Number of days Fewer Than 100 pages
processed
101‑500 pages
processed
501‑1000 pages
processed
1001‑5000 pages
processed
More than 5000 pages
processed
Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed
1 to 15 0 0 0 0 0 0 0 0 0 0
16 to 30 0 0 0 0 0 0 0 0 0 0
31 to 60 0 0 0 0 0 0 0 0 0 0
61 to 120 0 0 0 0 0 0 0 0 0 0
121 to 180 0 0 0 0 0 0 0 0 0 0
181 to 365 0 0 0 0 0 0 0 0 0 0
More than 365 0 0 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0 0 0
 

Part 8 – Complaints and investigations notices received

Complaints and investigations notices received
Section 31 Section 33 Section 35 Court action Amount
0 0 0 0 0
 

Part 9 – Privacy impact assessments (PIAs)

Privacy impact assessments (PIAs)
Number of PIA(s) completed 0
 

Part 10: Resources related to the Privacy Act

10.1 Costs
Expenditures Amount
Salaries $72,781
Overtime $0
Good and services
  • Professional services contracts ($0)
  • Other ($11,378)
$11,378
Total $84,159
 
10.2 Human Resources
Resources Person years dedicated
to privacy activities
Full-time employees 0.86
Part-time and casual employees 0.00
Regional staff 0.00
Consultants and agency personnel 0.00
Students 0.00
Total 0.86
 

Note: Enter values to two decimal places.