Annual Report to Parliament 2024-2025 – Privacy Act

Introduction

The National Research Council of Canada (NRC)'s annual report to Parliament on the administration of the Privacy Act (PA) is submitted in accordance with section 72 of the PA. This 41st annual report on the administration of the PA at the NRC provides an overview of the activities undertaken by the Council during the reporting period of April 1, 2024, to March 31, 2025. During this time, the NRC did not have any non-operation subsidiaries.

The purpose of the PA is to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution and that provide individuals with a right of access to that information. The PA also regulates the collection, use and disclosure of personal information held by federal institutions including the NRC.

Mandate of the National Research Council of Canada

The NRC supports industrial innovation, the advancement of knowledge, technology development, and public policy mandates. The NRC plays a unique role in Canada, undertaking large-scale mission-oriented research and development programs. With a presence in every province, the NRC combines its strong national foundation with international linkages to help Canada grow in productivity and remain globally competitive. The NRC works in collaboration with industry, governments, and academia to maximize Canada's overall research and development investment.

I. Organizational structure and delegation of authority

From April 1, 2024 to June 17, 2024, the NRC President delegated full authority for the application and administration of the PA to the Vice-President, Corporate Services and Chief Financial Officer, to the Chief Information Officer & Director General of Knowledge, Information and Technology Services, and to the Director, Library and Information Management Services. Partial authority was delegated to the Access to Information and Privacy (ATIP) Coordinator.

From June 18, 2024 to March 31, 2025, the NRC President delegated full authority for the application and administration of the PA to the Vice-President, Business and Professional Services, to the Chief Information Officer & Director General of Knowledge, Information and Technology Services, and to the Director, Library and Information Management Services. Partial authority was delegated to the ATIP Coordinator

Copies of the signed Delegation Orders are included as Annex A.

During this reporting period, the NRC's ATIP Office was part of the Library and Information Management Services Directorate within the Knowledge, Information and Technology Services Branch. The ATIP Office had 6 full-time positions: 1 ATIP coordinator, 3 senior ATIP officers, 1 junior ATIP officer and 1 ATIP clerk.

The ATIP Office works closely with the NRC's Human Resources Branch, the Information Management team, executive advisors, the Communications Branch, and senior management across the organization.

The ATIP Office is responsible for the coordination and implementation of policies, guidelines, and procedures to ensure the organization's compliance with the PA. To this end, the Office provides the following services:

• Promotes awareness of the PA within the organization
• Processes and manages personal information requests and complaints
• Administers the ATIP electronic case management system
• Processes consultations received from other institutions
• Provides professional advice and guidance to senior management and all departmental staff on the Act
• Prepares the annual report to Parliament and the annual statistical report
• Maintains the NRC's Info Source chapter
• Assists in the privacy impact assessment process and in creating or modifying personal information banks
• Reviews departmental documents (such as audit and evaluation reports prior to their proactive disclosure on the organization's website), parliamentary questions and harassment reports for privacy-related considerations
• Develops internal procedures

During the period covered by this report, the NRC was not party to any service agreements under section 73.1 of the PA.

II. Interpretation of statistical report

The complete statistical report on the administration of the PA by the NRC from April 1, 2024, to March 31, 2025, is included as Annex B. This section provides an interpretation of the statistics presented in that report.

During the 2024-2025 reporting period, the NRC received 19 new requests for personal information. Of these, 16 were closed within the reporting period, while 3 were carried over to the next reporting period.

The statistical figures, as reflected in the chart below, indicate the number of requests received and processed over the past 3 years. These figures do not include informal privacy-related queries received in the ATIP Office.

Chart 1: Volume of requests for personal information

Long description for Chart 1

Chart 1: Volume of request for personal information

Status	2022-2023	2023-2024	2024-2025
Received	24	25	19
Completed	17	33	16
Carried over	8	0	3

Of the 16 requests completed within the reporting period, 38% of the records were all disclosed, 31% of the records were disclosed in part, 25% had no existing records, and 6% were closed as abandoned.

With regard to completion times, out of the 16 requests completed during this reporting period, 11 requests (69%) were completed within 30 days and 5 requests (31%) were completed within 31 to 60 days, resulting in a 100% compliance with legislated timelines.

Chart 2: Number of days taken to complete requests

Long description for Chart 2

Chart 2: Number of days taken to complete requests

Number of days	Number of requests
1 to 30 days	11
31 to 60 days	5

Section 15 of the PA allows institutions to extend the time limit for processing requests for a maximum of 30 days if: (i) meeting the original time limit would unreasonably interfere with the operations of the government institution; or, (ii) consultations are necessary to comply with the request that cannot reasonably be completed within the original time limit. Should the records require translation or conversion to an alternative format, a reasonable period of time may also be taken to extend the time limit.

The NRC invoked an extension in 5 cases where meeting the original time limit of 30 days would have unreasonably interfered with the operations of the organization due to the large volume of pages.

Sections 3.2 and 3.3 of the Statistical Report focus on the application of exemptions and exclusions under the PA. During this reporting period, the NRC invoked section 26 to protect information about other individuals.

As per the following chart, the NRC disclosed significantly more pages in response to personal information requests than in previous years, despite receiving fewer overall requests.

Chart 3: Trends in number of pages disclosed

Long description for Chart 3

Chart 3: Trends in number of pages disclosed

Years	Pages disclosed
2022-2023	1072
2023-2024	2073
2024-2025	3716

During this reporting period, the ATIP Office processed 1 consultation under the PA. The NRC provided input to another government institution regarding the disclosure of 19 pages.

With regard for the provisions of the PA and in the context of its general responsibilities, the NRC's ATIP Office reviewed a total of 142 parliamentary questions received during this reporting period, compared to 121 reviewed in 2023-2024 and 114 reviewed in 2022-2023.

Chart 4: Parliamentary Questions

Long description for Chart 4

Chart 4: Parliamentary Questions

Years	Parliamentary questions
2022-2023	114
2023-2024	121
2024-2025	142

This year, the NRC was required to report on additional criteria, the 2024-2025 Supplemental Statistical Report is included as Annex C.

III. Privacy-related training and education

To increase the knowledge and understanding of the PA across the NRC, training and awareness sessions are delivered to NRC employees. These sessions provide basic information on the purposes and provisions of the PA, roles and responsibilities, as well as general best practices (such as email management). All training sessions include information on the identification and management of personal information in accordance with the provisions of the Privacy Act as well as the Access to Information Act. During this reporting period, the ATIP Office delivered a total of 6 training sessions to 212 employees located in the National Capital Region and in regional offices. These training and awareness sessions contributed to the NRC achieving a 100% compliance rate.

In support of ATIP activity across the Council, tools and guidance are updated regularly and are made available on the NRC's external and internal websites.

The ATIP Office continually works to sensitize and educate employees, third parties and requesters regarding the requirements of the PA, through ongoing dialogue and bilateral discussions. During the reporting period, the ATIP coordinator and officers responded to numerous inquiries from colleagues (Human Resources Branch, management, etc.), providing advice and guidance on various privacy-related matters.

Throughout this reporting period, the ATIP coordinator and officers attended ATIP community meetings and a variety of training sessions offered by the Treasury Board of Canada Secretariat (TBS).

IV. Procedures, guidelines and directives

The NRC regularly reviews its practices and procedures to identify information that can be more readily made available to the public. In addition, this year the ATIP Office worked with NRC's Workplace Harassment and Violence Prevention and Resolution team to identify information that can proactively be provided to individuals to decrease the need for them to seek recourse under the Privacy Act.

V. Complaints, investigations and audits

During this reporting period, 1 complaint against the NRC was closed with the Office of the Privacy Commissioner (OPC) after being abandoned by the requester. The complaint was lodged during the previous fiscal year (2023-2024) with respect to the time taken to respond despite it being within the initial time limit.

There are no ongoing investigations or audits of the NRC under the provisions of the PA.

VI. Monitoring of requests for personal information

In keeping with TBS policies and directives, the ATIP Office has established internal ATIP procedures and business practices to ensure the efficient and timely processing of personal information requests, while making every effort to assist applicants in the most expeditious manner without regard for their identity.

The ATIP Office uses a case management system that tracks both active and closed requests. This system is designed to follow the legislative deadlines.

The ATIP Office holds weekly meetings to discuss request-related activities, determine timelines and ensure that all team members are informed of the status of files. Weekly meetings also take place with the Director, Library and Information Management Services.

A report of active ATIP files (which maintains the privacy of the requesters' identities) is shared with the NRC senior management team every week and a more detailed report is provided to delegated authorities. A weekly report is also shared with the Minister of Innovation, Science and Economic Development Canada.

No requests for the corrections to personal information were received by the ATIP Office during this reporting period.

VII. Material privacy breaches

There were no confirmed material privacy breaches during the 2024-2025 reporting period at the NRC. The ATIP Office addressed 9 non-material privacy breaches, ensuring that associated risks were mitigated and communicated internally.

VIII. Privacy impact assessment activities

The NRC did not complete any privacy impact assessments during the 2024-2025 reporting period.

IX. Section 8(2)(m) disclosures

Paragraph 8(2)(m) allows for the disclosure of personal information when the public interest clearly outweighs any invasion of privacy or when the disclosure would benefit the individual. There were no disclosures pursuant to paragraph 8(2)(m) for the 2024-2025 period.

Annex A: Delegation order

Access to Information and Privacy Act Delegation Order

The President of the National Research Council of Canada (NRC), pursuant to section 95 of the Access to Information Act and section 73 of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the President as the head of the NRC, under the sections of the Acts and related regulations set out in the schedule opposite each position. This designation replaces all previous designation orders.

Dated at the City of Ottawa
24 July 2023

Iain Stewart
President of the National Research Council of Canada

Access to Information Act and Privacy Act Delegation Order

The President of the National Research Council of Canada (NRC), pursuant to section 95 of the Access to Information Act and section 73 of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the President as the head of the NRC, under the sections of the Acts and related regulations set out in the schedule opposite each position. This designation replaces all previous designation orders.

Dated, at the City of Ottawa
18 June 2024

Mitch Davies
President of the National Research Council of Canada

Annex B: Statistical report

Statistical report on the Privacy Act

Name of institution: National Research Council Canada
Reporting period: April 1, 2024 to March 31, 2025

Section 2 – Informal requests

Section 3 – Requests closed during the reporting period

3.5 Complexity

Section 11 – Privacy breaches

Section 12 – Resources related to the Privacy Act

Annex C: 2024-2025 Supplemental statistical report

Supplemental statistical report on the Access to Information Act and the Privacy Act

Name of institution: National Research Council of Canada

Reporting period: April 1, 2024 to March 31, 2025

Section 1 – Requests carried over and active complaints under the Access to Information Act

Section 2 – Requests carried over and active complaints under the Privacy Act

Section 3 – Social insurance number (SIN)

Has your institution begun a new collection or a new consistent use of the SIN in 2024-2025? No

Section 4 – Universal Access under the Privacy Act

How many requests were received from confirmed foreign nationals outside of Canada in 2024-2025? 0