Annual Report to Parliament 2019‑2020 – Privacy Act

 
Information
Status: Active
Effective date: August 4, 2020
Approval: Iain Stewart
Alternate format: Annual Report to Parliament 2019‑2020 – Privacy Act  (PDF 2.33 MB)

I. Introduction

The National Research Council of Canada (NRC) is pleased to present to Parliament its annual report on the administration of the Privacy Act (PA) for the 2019‑2020 reporting period. This is done in accordance with section 72 of the PA, which requires the head of every government institution to submit an annual report to Parliament on the administration of the Act during the period beginning on April 1 of the preceding year and ending on March 31 of the current year.

The purpose of the PA is to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution and that provide individuals with a right of access to that information. The PA also regulates the collection, use and disclosure of personal information held by federal institutions including the NRC.

This thirty‑sixth annual report on the administration of the PA at the NRC provides an overview of the activities by the Council undertaken during the 2019‑2020 reporting period.

Mandate of the National Research Council of Canada

The NRC supports industrial innovation, the advancement of knowledge, technology development, and public policy mandates. The NRC plays a unique role in Canada, undertaking large‑scale mission‑oriented research and development programs. With a presence in every province, the NRC combines its strong national foundation with international linkages to help Canada grow in productivity and remain globally competitive. The NRC works in collaboration with industry, governments, and academia to maximize Canada’s overall R&D investment.

II. Organizational structure and delegation of authority

From April 1, 2019, to March 31, 2020, the NRC’s President delegated full authority for the application and administration of the PA to the Vice‑President, Business and Professional Services, to the Chief Information Officer & Director General of Knowledge, Information and Technology Services, and to the Director, Library and Information Management Services.  Partial authority was delegated to the Access to Information and Privacy (ATIP) Coordinator. 

A copy of the current signed Delegation Order is included as Annex A.

During the 2019‑2020 reporting period, the NRC’s ATIP Office was part of the Library and Information Management Services Directorate within the Knowledge, Information and Technology Services Branch.

The ATIP Office has three full-time positions: one ATIP Coordinator, one Senior ATIP Officer, and one Junior ATIP Officer.  During this reporting period, NRC experienced challenges in staffing a full complement of ATIP Officers.  As noted by other institutions subject to the Act, as well as by the Information Commissioner of Canada, a shortage of experienced ATIP personnel presents a challenge for staffing in both short and long term capacities.

The ATIP Office works closely with NRC’s Human Resources Branch, the Information Management team, Executive Advisors, the Communications Branch, and senior management across the organization.

The ATIP Office is responsible for the coordination and implementation of policies, guidelines, and procedures to ensure the organization’s compliance with the PA.  To this end, the Office provides the following services:

  • Promotes awareness of the PA within the organization;
  • Processes and manages personal information and complaints;
  • Manages the ATIP electronic case management system;
  • Processes consultations received from other institutions;
  • Provides professional advice and guidance to senior management and all departmental staff on the Act;
  • Prepares the annual report to Parliament and the annual statistical report;
  • Maintains NRC’s Info Source chapter;
  • Assists in the privacy impact assessment process and in creating or modifying personal information banks;
  • Reviews departmental documents (such as audit and evaluation reports prior to their proactive disclosure on the organization’s website), Parliamentary Questions and Harassment Reports for privacy‑related considerations;
  • Develops internal procedures; and,
  • Participates in forums for the ATIP community, such as the Treasury Board of Canada Secretariat (TBS) ATIP Community meetings and working groups.

During the period covered by this report, the NRC was not party to any service agreements under section 73.1 of the PA.

III. Interpretation of statistical report

The complete statistical report on the administration of the PA by the NRC from April 1, 2019, to March 31, 2020, is included as Annex B.  This section provides an interpretation of the statistics presented in that report. 

During the 2019‑2020 reporting period, the NRC received 13 new requests for personal information and no requests were outstanding from the previous period.

The figures, as reflected in the chart below, indicate the number of requests received and processed over the past 3 years. These figures do not include informal privacy‑related queries received in the ATIP Office.

Chart 1: Volume of requests for personal information

Chart 1: Volume of requests for personal information
Long description for Chart 1: Volume of requests for personal information
Chart 1: Volume of requests for personal information
Status 2017‑2018 2018‑2019 2019‑2020
Received 10 16 13
Completed 10 17 13
Carried forward 1 0 0
 

With regard to completion times, out of the 13 requests completed during this reporting period, 10 were completed in 30 days or less, and 3 were completed between 31 and 60 days. No requests were closed past their statutory deadline, for 100% compliance with legislated timelines.

Chart 2: Number of days taken to complete requests

Chart 2: Number of days taken to complete requests
Long description for Chart 2: Number of days taken to complete requests
Chart 2: Number of days taken to complete requests
Number of days Number of requests
1 to 30 days 10
31 to 60 days 3
Over 61 days 0
 

Section 15 of the PA allows institutions to extend the time limit for processing requests for a maximum of 30 days if: (i) meeting the original time limit would unreasonably interfere with the operations of the government institution; or, (ii) consultations are necessary to comply with the request that cannot reasonably be completed within the original time limit. Should the records require translation or conversion to an alternative format, a reasonable period of time may also be taken to extend the time limit.

The NRC invoked an extension in 3 cases where meeting the original time limit of 30 days would have unreasonably interfered with the operations of the organization due to the large volume of pages and where external consultations had to be carried out.

Sections 2.2 and 2.3 of the Statistical Report focus on the application of exemptions and exclusions under the PA. During this reporting period, the most commonly invoked exemptions by the NRC were as follows:

  • Section 21 (International affairs and defence)
  • Section 26 (Information about another individual)
  • Section 27 (Protected information — solicitors, advocates and notaries)
As per the following chart, the number of pages processed in response to requests for personal information decreased from the two previous reporting periods.

Chart 3: Trends in number of pages disclosed

Chart 3: Trends in number of pages disclosed
Long description for Chart 3: Trends in number of pages disclosed
Chart 3: Trends in number of pages disclosed
Years Pages processed
2017‑2018 3,596
2018‑2019 6,542
2019‑2020 1,939
 

During this reporting period, the ATIP Office processed one consultation under the PA.

With regard for the provisions of the PA and in the context of its general responsibilities, the NRC’s ATIP Office reviewed a total of 105 Parliamentary Questions received during this reporting period, compared to 148 reviewed in 2018‑2019 and 98 reviewed in 2017‑2018.

Chart 4: Parliamentary questions

Chart 4: Parliamentary questions
Long description for Chart 4: Parliamentary questions
Chart 4: Parliamentary questions
Years Parliamentary questions
2017‑2018 98
2018‑2019 148
2019‑2020 105
 

At the end of the 2019‑2020 reporting period, ATIP Offices across most Government of Canada institutions were functioning at reduced operational capacities due to exceptional measures put in place to curb the spread of the novel coronavirus (COVID‑19).  As a result, the processing of requests and consultations, as well as other activities that support ATIP program administration, were either delayed or temporarily suspended.

Beginning on March 13, 2020, the large majority of NRC activity moved offsite to teleworking as part of anti‑COVID‑19 measures.  This impacted ATIP operations as ATIP staff adjusted to the new work environment and determined the best way to deliver on obligations in the new circumstances.  Nevertheless, for the period since March, the ATIP Office made every reasonable effort to maintain service delivery in accordance with its operational realities.

For the 2019-2020 reporting period, the NRC was asked to complete a supplemental report on the impact of measures to curb the spread of the novel coronavirus on its performance.  This supplemental statistical report is included as Annex C.

IV. Privacy‑related training and education

To increase the knowledge and understanding of the PA across the NRC, training and awareness sessions are delivered on an ongoing basis to NRC employees.  These sessions provided basic information on the purposes and provisions of the Act, roles and responsibilities, and general best practices (such as email management).  All training sessions include information on the identification and management of personal information in accordance with the provisions of the PA as well as the Access to Information Act.  During this reporting period, the ATIP Office delivered a total of 3 training sessions to 48 employees located in the National Capital Region and in regional offices.  The ATIP Office also delivered training to small groups on requests throughout the reporting period.

In support of ATIP activity across the Council, tools and guidance are updated regularly and are made available on NRC’s external and internal websites.

The ATIP Office continually works to sensitize and guide employees, third parties and requesters regarding the requirements of the PA, throughongoing dialogue and bilateral discussions.  During the reporting period, the ATIP Coordinator and Officers responded to numerous inquiries from colleagues (Human Resources Branch, management, etc.), providing advice and guidance on various privacy‑related matters.

The ATIP Office promoted Data Privacy Day within NRC through postings on the NRC internal website. Throughout this reporting period, the ATIP Coordinator and Officers attended ATIP community meetings and various training sessions offered by the TBS.

V. Procedures, guidelines and directives

NRC did not implement new and/or revised privacy policies, guidelines or procedures during the reporting period.

VI. Complaints, investigations and audits

During this reporting period no complaints against the NRC were registered with the Office of the Privacy Commissioner.

There are no ongoing investigations or audits of the NRC under the provisions of the PA.

VII. Monitoring of requests for personal information

In keeping with TBS policies and directives, the ATIP Office has established internal ATIP procedures and business practices to ensure the efficient and timely processing of personal information requests, while making every effort to assist applicants in the most expeditious manner without regard for their identity.

The ATIP Office uses a case management system that tracks both active and closed requests. This system is designed to follow the legislative deadlines.

The ATIP Office holds weekly meetings to discuss request‑related activities, determine timelines and ensure that all team members are informed of the status of files. Weekly meetings also take place with the Director, Library and Information Management Services.

A report of active ATIP files (which maintains the privacy of the requesters’ identities) is shared with the NRC senior management team every week and a more detailed report is provided to delegated authorities. A weekly report is also shared with the Minister of Innovation, Science and Economic Development Canada.

No requests for the corrections to personal information were received by the ATIP Office during this reporting period.

VIII. Material privacy breaches

No material privacy breaches occurred during 2019‑2020 reporting period.

IX. Privacy impact assessment activities

The NRC did not complete any privacy impact assessments during this reporting period.

X. Section 8(2)(m) disclosures

Paragraph 8(2)(m) allows for the disclosure of personal information when the public interest clearly outweighs any invasion of privacy or when the disclosure would benefit the individual. There were no disclosures pursuant to paragraph 8(2)(m) for the 2019‑2020 period.

Annex A: Delegation order

Access to Information and Privacy Acts delegation order

The President of the National Research Council of Canada, pursuant to section 73 of the Access to Information Act and the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the person occupying on an acting basis the position, to exercise the powers and functions of the President as the head of a government institution, under the section of the Acts set out in the schedule opposite each position. This Designation Order supersedes all previous designation orders.

Schedule
Position Access to Information Act and regulations Privacy Act and Regulations
Vice‑President, Business and Professional Services Full authority Full authority
Chief Information Officer & Director General, Knowledge, Information and Technology Services Full authority Full authority
Director, Library and Information Management Services Full authority Full authority
Access to Information and Privacy Coordinator Sections 7(a), 8(1), 9, 11(2) to (6), 12(2)(3), 26, 27(1) and (4), 28(1), (2) and (4), 29(1), 33, 37(4), 43(1), 44(2) Sections 8(2)(j), 8(4), 8(5), 9(1), 9(4), 10, 14, 15, 17(2)(b), 18(2), 31, 35(1), 35(4), 36(3), 37(3), 51(2)(b)
 

Dated, at the City of Ottawa
10 October 2017

Iain Stewart
President of the National Research Council of Canada

Access to Information and Privacy Act delegation order

The President of the National Research Council of Canada (NRC), pursuant to section 95 of the Access to Information Act and section 73 of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the President as the head of the NRC, under the sections of the Acts and related regulations set out in the schedule opposite each position. This designation replaces all previous delegation orders.

Schedule
Position Access to Information Act and regulations Privacy Act and Regulations
Vice‑President, Business and Professional Services Full authority Full authority
Chief Information Officer and Director General, Knowledge and Information Technology Services Full authority Full authority
Director, Library and Information Management Services Full authority Full authority
Access to Information and Privacy Coordinator Sections 7(a), 8(1), 9, 11(2) to (6), 12(2)(3), 26, 27(1) and (4), 28(1), (2) and (4), 29(1), 33, 37(4), 43(1), 44(2) Sections 8(2)(j), 8(4), 8(5), 9(1), 9(4), 10, 14, 15, 17(2)(b), 18(2), 31, 35(1), 35(4), 36(3), 37(3), 51(2)(b)
 

Dated, at the City of Ottawa
August 4th, 2020

Iain Stewart
President of the National Research Council of Canada

Annex B: Statistical report

Name of institution: National Research Council Canada

Reporting period: 2019‑04‑01 to 2020‑03‑31

Section 1: Requests under the Privacy Act

Requests under the Privacy Act
  Number of requests
Received during reporting period 13
Outstanding from previous reporting period 0
Total 13
Closed during reporting period 13
Carried over to next reporting period 0
 

Section 2: Requests closed during the reporting period

2.1 Disposition and completion time
  Completion time
Disposition of requests 1 to 15
days
16 to 30
days
31 to 60
days
61 to 120
days
121 to 180
days
181 to 365
days
More than 365
days
Total
All disclosed 0 5 0 0 0 0 0 5
Disclosed in part 0 3 3 0 0 0 0 6
All exempted 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0
No records exist 1 0 0 0 0 0 0 1
Request abandoned 0 1 0 0 0 0 0 1
Neither confirmed nor denied 0 0 0 0 0 0 0 0
Total 1 9 3 0 0 0 0 13
 
2.2 Exemptions
Section Number
of requests
18(2) 0
19(1)(a) 0
19(1)(b) 0
19(1)(c) 0
19(1)(d) 0
19(1)(e) 0
19(1)(f) 0
20 0
21 0
22(1)(a)(i) 0
22(1)(a)(ii) 0
22(1)(a)(iii) 0
22(1)(b) 0
22(1)(c) 0
22(2) 0
22.1 0
22.2 0
22.3 0
22.4 0
23(a) 0
23(b) 0
24(a) 0
24(b) 0
25 0
26 6
27 2
27.1 0
28 0
 
2.3 Exclusions
Section Number
of requests
69(1)(a) 0
69(1)(b) 0
69.1 0
70(1) 0
70(1)(a) 0
70(1)(b) 0
70(1)(c) 0
70(1)(d) 0
70(1)(e) 0
70(1)(f) 0
70.1 0
 
2.4 Format of information released
Paper Electronic Other formats
8 3 0
 

2.5 Complexity

2.5.1 Relevant pages processed and disclosed
Number of pages processed Number of pages disclosed Number of requests
3153 1939 12
 
2.5.2 Relevant pages processed and disclosed by size of requests
Disposition Less Than 100 pages processed 101‑500 pages processed 501‑1000 pages processed 1001‑5000 pages processed More Than 5000 pages processed
Number of
requests
Pages disclosed Number of
requests
Pages disclosed Number of
requests
Pages disclosed Number of
requests
Pages disclosed Number of
requests
Pages disclosed
All disclosed 4 171 1 278 0 0 0 0 0 0
Disclosed in part 1 65 4 726 1 699 0 0 0 0
All exempted 0 0 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0 0 0
Request abandoned 1 0 0 0 0 0 0 0 0 0
Neither confirmed or denied 0 0 0 0 0 0 0 0 0 0
Total 6 236 5 1004 1 699 0 0 0 0
 
2.5.3 Other complexities
Disposition Consultation required Legal advice sought Interwoven information Other Total
All disclosed 0 0 0 0 0
Disclosed in part 0 0 0 0 0
All exempted 0 0 0 0 0
All excluded 0 0 0 0 0
Request abandoned 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0
Total 0 0 0 0 0
 

2.6 Closed requests

2.6.1 Number of requests closed within legislated timelines
  Requests closed within legislated timelines
Number of requests closed within legislated timelines 13
Percentage of requests closed within legislated timelines (%) 100
 

2.7 Deemed refusals

2.7.1 Reasons for not meeting statutory deadline
Number of Requests Closed Past the Legislated Timelines Principal reason
Workload External consultation Internal consultation Other
0 0 0 0 0
 
2.7.2 Requests closed beyond legislated timelines (including any extension taken)
Number of days past deadline Number of Requests Past Legislated Timeline Where No Extension Was Taken Number of Requests Past Legislated Timelines Where an Extension Was Taken Total
1 to 15 days 0 0 0
16 to 30 days 0 0 0
31 to 60 days 0 0 0
61 to 120 days 0 0 0
121 to 180 days 0 0 0
181 to 365 days 0 0 0
More than 365 days 0 0 0
Total 0 0 0
 
2.8 Requests for translation
Translation requests Accepted Refused Total
English to French 0 0 0
French to English 0 0 0
Total 0 0 0
 

Section 3: Disclosures under subsection 8(2) and 8(5)

Disclosures under subsection 8(2) and 8(5)
Paragraph 8(2)(e) Paragraph 8(2)(m) Subsection 8(5) Total
0 0 0 0
 

Section 4: Requests for correction of personal information and notations

Requests for correction of personal information and notations
Disposition for correction requests received Number
Notations attached 0
Requests for correction accepted 0
Total 0
 

Section 5: Extensions

5.1 Reasons for extensions and disposition of requests
Number of requests where an extension was taken 15(a)(i)
interference with operations
15(a)(ii) Consultation 15(b)
Translation purposes or conversion
Further review required to determine exemptions Large volume of pages Large volume of requests Documents are difficult to obtain Cabinet Confidence Section (Section 70) External Internal
3 0 1 0 0 0 2 0 0
 
5.2 Length of extensions
Length of Extensions 15(a)(i)
interference with operations
15(a)(ii) Consultation 15(b)
Translation purposes or conversion
Further review required to determine exemptions Large volume of pages Large volume of requests Documents are difficult to obtain Cabinet Confidence Section (Section 70) External Internal
1 to 15 days 0 0 0 0 0 0 0 0
16 to 30 days 0 1 0 0 0 2 0 0
31 days or greater               0
Total 0 1 0 0 0 2 0 0
 

Section 6: Consultations received from other institutions and organizations

6.1 Consultations received from other Government of Canada institutions and other organizations
Consultations Other Government of Canada institutions Number of pages to review Other organizations Number of pages to review
Received during the reporting period 1 0 0 0
Outstanding from the previous reporting period 0 0 0 0
Total 1 0 0 0
Closed during the reporting period 1 0 0 0
Carried over to the next reporting period 0 0 0 0
 
6.2 Recommendations and completion time for consultations received from other Government of Canada institutions
Recommendation Number of days required to complete consultation requests
1 to 15 days 16 to 30 days 31 to 60 days 61 to 120 days 121 to 180 days 181 to 365 days than 365 days Total
All disclosed 0 0 0 0 0 0 0 0
Disclose in part 1 0 0 0 0 0 0 1
All exempted 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0
Consult other institution 0 0 0 0 0 0 0 0
Other 0 0 0 0 0 0 0 0
Total 1 0 0 0 0 0 0 1
 
6.3 Recommendations and completion time for consultations received from other organizations
Recommendation Number of days required to complete consultation requests
1 to 15 days 16 to 30 days 31 to 60 days 61 to 120 days 121 to 180 days 181 to 365 days than 365 days Total
All disclosed 0 0 0 0 0 0 0 0
Disclose in part 0 0 0 0 0 0 0 0
All exempted 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0
Consult other institution 0 0 0 0 0 0 0 0
Other 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0
 

Section 7: Completion time of consultations on cabinet confidences

7.1 Requests with legal services
Number of days Fewer than 100 pages processed 101‑500 pages processed 501‑1000 pages processed 1001‑5000 pages processed More than 5000 pages processed
Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed
1 to 15 0 0 0 0 0 0 0 0 0 0
16 to 30 0 0 0 0 0 0 0 0 0 0
31 to 60 0 0 0 0 0 0 0 0 0 0
61 to 120 0 0 0 0 0 0 0 0 0 0
121 to 180 0 0 0 0 0 0 0 0 0 0
181 to 365 0 0 0 0 0 0 0 0 0 0
More than 365 0 0 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0 0 0
 
7.2 Requests with Privy Council Office
Number of days Fewer Than 100 pages
processed
101‑500 pages
processed
501‑1000 pages
processed
1001‑5000 pages
processed
More than 5000 pages
processed
Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed
1 to 15 0 0 0 0 0 0 0 0 0 0
16 to 30 0 0 0 0 0 0 0 0 0 0
31 to 60 0 0 0 0 0 0 0 0 0 0
61 to 120 0 0 0 0 0 0 0 0 0 0
121 to 180 0 0 0 0 0 0 0 0 0 0
181 to 365 0 0 0 0 0 0 0 0 0 0
More than 365 0 0 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0 0 0
 

Section 8: Complaints and investigations notices received

Complaints and investigations notices received
Section 31 Section 33 Section 35 Court action Total
0 0 0 0 0
 

Section 9: Privacy impact assessments (PIAs)

9.1 Privacy impact assessments (PIAs)
Number of PIA(s) completed 0
 
9.2 Personal Information Banks(PIAs)
  Active Created Terminated Modified
Personal Information Banks 76 0 0 0
 

Section 10: Material privacy breaches

Material privacy breaches
Number of material privacy breaches reported to TBS 0
Number of material privacy breaches reported to OPC 0
 

Section 11: Resources related to the Privacy Act

11.1  Costs
Expenditures Amount
Salaries $77,780
Overtime $0
Goods and Services $0
Professional services contracts $0  
Other $0  
Total $77,780
 
11.2  Human Resources
Resources Person Years Dedicated to Privacy Activities
Full‑time employees 1.00
Part‑time and casual employees 0.00
Regional staff 0.00
Consultants and agency personnel 0.00
Students 0.00
Total 1.00

Note: Enter values to two decimal places.

Annex C: 2019‑2020 Supplemental statistical report ‑ requests affected by COVID‑19 measures

Supplemental Statistical Report on the Privacy Act

The following table reports the total number of formal requests received during two periods; 2019‑04‑01 to 2020‑03‑13 and 2020‑03‑14 to 2020‑03‑31.

Table 1 – Requests Received
  Number of requests
Received from 2019‑04‑01 to 2020‑03‑13 13
Received from 2020‑03‑14 to 2020‑03‑31 0
Total 13

The following table reports the total number of requests closed within the legislated timelines and the number of closed requests that were deemed refusals during two periods 2019‑04‑01 to 2020‑03‑13 and 2020‑03‑14 to 2020‑03‑31.

Table 2 – Requests Closed
  Number of requests closed within the legislated timelines Number of requests closed past the legislated timelines
Received from 2019‑04‑01 to 2020‑03‑13 and outstanding from previous reporting periods 13 0
Received from 2020‑03‑14 to 2020‑03‑31 0 0
Total 13 0

The following table reports the total number of requests carried over during two periods; 2019‑04‑01 to 2020‑03‑13 and 2020‑03‑14 to 2020‑03‑31.

Table 3 – Requests Carried Over
  Number of requests
Requests from 2019‑04‑01 to 2020‑03‑13 and outstanding from previous reporting period that were carried over to the 2020‑2021 reporting period 0
Requests from 2020‑03‑14 to 2020‑03‑31 that were carried over to the 2020‑2021 reporting period 0
Total 0