2018 to 2019 Annual report to Parliament on the Privacy Act

TABLE OF CONTENTS

1. Introduction
2. Organizational Structure
3. Delegation Order
4. Highlights of the Statistical Report, 2018-2019
5. Training and Awareness
6. Policies, Guidelines, Procedures and Initiatives
7. Summary of Key Issues and Actions Taken on Complaints or Audits
8. Monitoring Compliance
9. Material Privacy Breaches
10. Privacy Impact Assessments (PIAs)
11. Public Interest Disclosures
    Appendices
    • Appendix A: Delegation Order Privacy Act and Privacy Regulations
    • Appendix B: Statistical Report on the Privacy Act

1. Introduction

The Privacy Act (Act) was proclaimed into force on July 1, 1983. The Act provides individuals with the right of access to and correction of personal information about themselves that is under the control of a government institution. The Act also provides the legal framework for the collection, retention, use, disclosure, disposition and accuracy of personal information in the administration of programs and activities by government institutions subject to its legislation.

Section 72 of the Actrequires that the head of every government institution prepare for submission to Parliament an annual report on the administration of the Act within the institution during each reporting year.

This annual report is prepared in accordance with section 72 of the Act and describes how Natural Resources Canada (NRCan) administered its responsibilities under the Actduring fiscal year 2018-2019.

Mandate of Natural Resources Canada

NRCan works to improve the quality of life of Canadians by ensuring that our natural resources are developed sustainably, providing a source of jobs, prosperity and opportunity, while preserving our environment and respecting our communities and Indigenous peoples.

The Minister of Natural Resources Canada has responsibilities in relation to more than 30 acts of Parliament. The Minister’s core powers, duties and functions are set forth in the Department of Natural Resources Act, the Resources and Technical Surveys Act, the Forestry Act, the Energy Efficiency Act and the Extractive Sector Transparency Measures Act. The department also works in areas of shared responsibilities with provinces, which includes the environment, public safety, economic development, science and technology, and consultations with Indigenous peoples. To fulfil its responsibilities, the department relies on a number of instruments (e.g. policy, regulation, statutory transfers, grants and contributions) and key activities (e.g. science and technology, partnerships and communications).

NRCan has offices and laboratories across the country. About one-third of our employees are located in the National Capital Region, with the remainder working in regional offices: Atlantic Canada, Quebec, Ontario, the Western and Pacific Regions and Northern Canada.

2. Organizational Structure

NRCan’s Access to Information and Privacy (ATIP) Secretariat provides centralized privacy services for NRCan as wel as the Northern Pipeline Agency (NPA) as per a Service Letter of Agreement. 

The ATIP Coordinator has full authority delegated by the Minister for the administration of the Act. The Coordinator is accountable for ensuring compliance with the Privacy Act and its related policy instruments.  In addition, the Coordinator is responsible for the development, coordination, and implementation of effective practices and procedures within NRCan in order to enable efficient processing of requests under the Act. 

In 2018-2019, the ATIP Secretariat had one full-time employee (consultant) dedicated to the administration of the Privacy Act.

Core functions of the ATIP Secretariat include:

• Processing requests under the Act;
• Responding to consultations from other government departments regarding the application of the Act on records originating from NRCan;
• Representing the department in dealings with the Treasury Board Secretariat, Office of the Privacy Commissioner, and other government departments and agencies regarding the application of the Act;
• Developing procedures and practices to ensure the proper administration of the Act including privacy management;
• Providing advice related to the Act, as well as promoting awareness, to ensure that legislative obligations are respected;
• Providing guidance on the collection, protection, use, retention and disclosure of information in accordance with the Act;
• Monitoring departmental compliance with the Act, its regulations, and relevant procedures and policies;
• Coordinating, reviewing, approving and publishing new entries and modifications to Info Source, an annual Government of Canada publication that assists  members of the public in exercising their right of access under the Act;
• Reviewing Personal Information Banks (PIBs);
• Preparing the annual report to Parliament and other statutory reports, as well as other materials that may be required by central agencies; and
• Participating in and advising on the collection of personal information for new or modified programs.

Departmental officials gather the relevant records and provide them to the ATIP Secretariat within the requested timelines.

3. Delegation Order

Section 73 of the Act provides that the head of a government institution may, by Delegation Order, designate one or more officers or employees of that institution to exercise or perform any of the powers, duties or functions of the head regarding the administration of the Act.

Consistent with best practices, the ATIP Coordinator maintains full delegated authority and is the principal administrator of the Act for NRCan. Full delegation also rests with the ATIP Deputy Director, the Director General responsible for ATIP, the Associate Deputy Minister and the Deputy Minister. 

A copy of NRCan’s signed Delegation Order is included at Appendix A.   

4. Highlights of the Statistical Report, 2018-2019

Multi-year trends 2016-2017 to 2018-2019

• Decrease in requests received: In comparison to the previous reporting period, NRCan received 38% less requests in 2018-2019. It has received 28 requests and 4,593 pages were processed; whereas in 2017-2018, 45 requests were received but only 1,028 pages were processed. In 2016-2017, 22 requests were received and 49,663 pages were processed. Between 2017-2018 and 2018-2019, there has been a notable increase in the number of pages processed (i.e. 3,568 pages).
• Percentage of requests responded to within legislative timelines: From April 1, 2018 to March 31, 2019, 22 requests were completed.  Of these 22 requests, 21 were closed within their legislative timeframe, representing a compliance rate of 95%. During the 2017-2018 reporting period, 42 requests were completed. Of these 42 requests, 41 were closed within their legislative timeframe, resulting in a compliance rate of 97.6%.  In 2016-2017, 26 requests were completed. Of these 26 requests, 16 were completed within their legislative timeframe, resulting in a compliance rate of 61.5%. Over the last two reporting periods, NRCan’s compliance rate has been within the 90 to 99 percent range
• Application of exemptions and exclusions: In relation to the nature of exemptions and exclusions, the multi-year trend from 2016-2017 to 2018-2019 remains consistent in the application of the exemption related to personal information (section 26). In 2016-2017 and 2017-2018, section 26 was applied ten times. Similarly, section 26 was applied nine times in this reporting period.
• Application of extensions: During the current reporting period, NRCan requested extensions on 5% of all requests completed. The extensions were mainly applied due to the volume of records. The trend is consistent with the 2017-2018 and 2016-2017 reporting periods, where 100% of all extensions were requested due to volume of records. 
• Consultations completed from other institutions: During the current reporting period, NRCan did not receive any consultations from other institutions. In 2017-2018, NRCan received one privacy consultation from another government institution and none were received during the 2016-2017 reporting period.

For more information, the statistical report can be found at Appendix B of the current report.

5. Training and Awareness

The ATIP Secretariat regularly provides advice and training on the application of the Act to departmental employees who are responsible for handling personal information and processing records requested under the Act.

In 2018-2019, there were four training sessions held with various subject matter experts. A total of 44 employees received training during the current reporting period.

In light of the modernization of the Access to Information Act and Privacy Act, the ATIP Secretariat has established partnerships with various internal stakeholders to update the department and develop plans to support the proposed legislative changes.

This included the following:

• Briefing up and out to ensure that departmental officials are fully aware of the legislative changes;
• Creating centralized folders in GCDOCS for subject matter experts to store the relevant information;
• Developing high-level and instructional process maps outlining the roles and responsibilities for key program areas;
• Collaborating with TBS to ensure that processes line up with intent of Bill C-58; and
• Meeting with the Tiger Team representatives on an ad-hoc basis to discuss performance and assess impacts and costs to program areas.

6. Policies, Guidelines, Procedures and Initiatives

NRCan continues to improve its privacy practices and performance in accordance with the department’s Privacy Management Framework and to support the highest standards of service. 

In 2018-2019, the ATIP Secretariat implemented the following initiatives to support both the revitalization of the Access to Information Act and the modernization of the Privacy Act:

• Professional Development Program (PDP): In order to address the shortage of skills and expertise in the ATIP community and strengthen recruitment and retention of ATIP professionals, the ATIP Secretariat developed a PDP. The PDP is a 3 to 5 year program designed to support the renewal, development and retention of ATIP Analysts to meet current and future operational needs. Participants are appointed at the entry ATIP Analyst level (PM-01) and promoted by means of a structured competency-based learning and development framework to a Senior ATIP Analyst level (PM-04).
  
  The PDP will support the renewal and retention of ATIP Analysts within NRCan while:
  • Building internal capacity and maintaining corporate knowledge;
  • Supporting continuous intake of ATIP Analysts within the community;
  • Training and developing specialists according to current and future operational needs;
  • Addressing chronic shortages of ATIP professionals across the public service;
  • Offering a structured development program to develop competencies for working level specialists; and
  •  Positioning NRCan as an employer of choice for ATIP professionals.
• Dedicated privacy mailbox: In order to ensure that all privacy-related questions are addressed promptly and appropriately, the ATIP Secretariat continued to use the new privacy mailbox. The requests typically received via the privacy mailbox include: general privacy advice, reporting a breach / incident, filing an internal complaint related to privacy management, and requesting privacy training.  
• Formalizing the internal process for policy files: As part of a continued effort to improve efficiency in the policy and governance operations, the ATIP Secretariat refined the review process for privacy-related files and activities. This included implementing a revised formal sign-off mechanism for the processing of policy-related files that allowed for both consistency and accountability.
• Engagement and promotion of privacy management within NRCan: In addition to the privacy training sessions offered to departmental employees, the ATIP Secretariat continued to participate in a number of committees and working groups such as the Information Management Working Group, as a way of ensuring that privacy and data protection are considered and incorporated in new projects and initiatives. By engaging with departmental officials at the onset, the department was in a better position to anticipate and prevent privacy breaches before they occur.
• Open Government: The ATIP Secretariat collaborated and assisted the sectors in meeting their obligations with respect to the Open Government Initiative. The Secretariat continued to work with program areas to ensure that “privacy by design” is incorporated in open government activities so that the department is proactive and not reactive in considering privacy, security and confidentiality of information.
• Privacy Act Reform: The ATIP Secretariat participated in the ATIP community working groups for the Privacy Act reform.  
• Format of information released: In order to ensure that Canadians’ right of access to their personal information is respected, the ATIP Secretariat continued to provide records in the format requested by the applicant, including machine-readable and reusable formats.
• Duty to Assist: To ensure transparency in the ATIP process and in relation to the Duty to Assistrequirements, the ATIP Secretariat proactively communicated with requesters to provide timely and complete responses.

7. Summary of Key Issues and Actions Taken on Complaints or Audits

There were no complaints made under the Privacy Act during 2018-2019 as well as no audits or investigations.

8. Monitoring Compliance

To ensure that the internal ATIP process remains as efficient as possible, the ATIP Secretariat routinely monitored the processing time for privacy requests. This routine monitoring was done using various statistical reports (weekly, monthly, quarterly and yearly). The department’s performance statistics, reporting on trends and changes to the ATIP process were communicated through weekly meetings with departmental and senior officials.  

9. Material Privacy Breaches

There were no material privacy breaches reported in 2018-2019.

10. Privacy Impact Assessments (PIAs)

NRCan did not complete any PIAs during the reporting period.

11. Public Interest Disclosures

NRCan did not make any public interest disclosures during the reporting period.

Appendix A: Delegation Order - Privacy Act and Privacy Regulations

The Minister of Natural Resources Canada, pursuant to section 73 of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Minister as the head of Natural Resources Canada, under the provisions of the Privacy Act and related regulations set out in the schedule below. This designation replaces all previous delegation orders.

Deputy Minister / Associate Deputy Minister	Full Delegation
Director General, Portfolio Management and Corporate Secretariat (responsible for the ATIP function)	Full Delegation
Access to Information and Privacy Coordinator	Full Delegation
Access to Information and Privacy Deputy Director	Full Delegation
Access to Information and Privacy Team Leaders	10, 15, 17(2)(b), 17(3)(b) of the Privacy Act and 11(2), 11(4) of the Privacy Regulations

Original signed by: The Honourable Jim Carr, P.C., M.P. Minister of Natural Resources Canada
Date: December 15, 2015

Appendix B: Statistical report on the Privacy Act

Name of institution: Natural Resources Canada
Reporting period: 2018-04-01 to 2019-03-31

Part 1: Requests Under the Privacy Act

	Number of Requests
Received during reporting period	28
Outstanding from previous reporting period	5
Total	33
Closed during reporting period	22
Carried over to next reporting period	11

Part 2: Requests Closed During the Reporting Period

2.1 Disposition and completion time

Disposition of Requests	Completion Time
	1 to 15 Days	16 to 30 Days	31 to 60 Days	61 to 120 Days	121 to 180 Days	181 to 365 Days	More Than 365 Days	Total
All disclosed	2	1	1	0	0	0	0	4
Disclosed in part	0	6	2	0	0	1	0	9
All exempted	0	0	0	0	0	0	0	0
All excluded	0	0	0	0	0	0	0	0
No records exist	3	1	0	0	0	0	0	4
Request abandoned	5	0	0	0	0	0	0	5
Neither confirmed nor denied	0	0	0	0	0	0	0	0
Total	10	8	3	0	0	1	0	22

2.2 Exemptions

Section	Number of Requests	Section	Number of Requests	Section	Number of Requests
18(2)	0	22(1)(a)(i)	0	23(a)	0
19(1)(a)	0	22(1)(a)(ii)	0	23(b)	0
19(1)(b)	0	22(1)(a)(iii)	0	24(a)	0
19(1)(c)	0	22(1)(b)	0	24(b)	0
19(1)(d)	0	22(1)(c)	0	25	0
19(1)(e)	0	22(2)	0	26	9
19(1)(f)	0	22.1	0	27	0
20	0	22.2	0	27.1	0
21	0	22.3	0	28	0
-	-	-	22.4	0	-

2.3 Exclusions

Section	Number of Requests	Section	Number of Requests	Section	Number of Requests
69(1)(a)	0	70(1)	0	70(1)(d)	0
69(1)(b)	0	70(1)(a)	0	70(1)(e)	0
69.1	0	70(1)(b)	0	70(1)(f)	0
-	-	70(1)(c)	0	70.1	0

2.4 Format of information released

Disposition	Paper	Electronic	Other formats
All disclosed	3	1	0
Disclosed in part	7	2	0
Total	10	3	0

2.5 Complexity

2.5.1 Relevant pages processed and disclosed

Disposition of Requests	Number of Pages Processed	Number of Pages Disclosed	Number of Requests
All disclosed	447	447	4
Disclosed in part	4146	2098	9
All exempted	0	0	0
All excluded	0	0	0
Request abandoned	0	0	5
Neither confirmed nor denied	0	0	0
Total	4593	2545	18

2.5.2 Relevant pages processed and disclosed by size of requests

Disposition	Less Than 100 Pages Processed		101-500 Pages Processed		501-1000 Pages Processed		1001-5000 Pages Processed		More Than 5000 Pages Processed
	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests
All disclosed	3	91	1	356	0	0	0	0	0
Disclosed in part	4	180	4	792	0	0	1	1126	0
All exempted	0	0	0	0	0	0	0	0	0
All excluded	0	0	0	0	0	0	0	0	0
Request abandoned	5	0	0	0	0	0	0	0	0
Neither confirmed nor denied	0	0	0	0	0	0	0	0	0
Total	12	271	5	1148	0	0	1	1126	0

2.5.3 Other complexities

Disposition	Consultation Required	Legal Advice Sought	Interwoven Information	Other	Total
All disclosed	0	0	0	0	0
Disclosed in part	0	0	0	0	0
All exempted	0	0	0	0	0
All excluded	0	0	0	0	0
Request abandoned	0	0	0	0	0
Neither confirmed nor denied	0	0	0	0	0
Total	0	0	0	0	0

2.6 Deemed refusals

2.6.1 Reasons for not meeting statutory deadline

Number of Requests Closed Past the Statutory Deadline	Principal Reason
	Workload	External Consultation	Internal Consultation	Other
1	1	0	0	0

2.6.2 Number of days past deadline

Number of Days Past Deadline	Number of Requests Past Deadline Where No Extension Was Taken	Number of Requests Past Deadline Where An Extension Was Taken	Total
1 to 15 days	0	0	0
16 to 30 days	0	0	0
31 to 60 days	0	0	0
61 to 120 days	0	0	0
121  to 180 days	0	0	0
181 to 365 days	0	1	1
More than 365 days	0	0	0
Total	0	1	1

2.7  Requests for translation

Translation Requests	Accepted	Refused	Total
English to French	0	0	0
French to English	0	0	0
Total	0	0	0

Part 3: Disclosures Under Subsections 8(2) and 8(5)

Paragraph 8(2)(e)	Paragraph 8(2)(m)	Subsection 8(5)	Total
0	0	0	0

Part 4: Requests for Correction of Personal Information and Notations

Disposition for Correction Requests Received	Number
Notations attached	0
Requests for correction accepted	0
Total	0

Part 5: Extensions

5.1 Reasons for extensions and disposition of requests

Disposition of Requests Where an Extension Was Taken	15(a)(i) Interference With Operations	15(a)(ii) Consultation		15(b) Translation or Conversion
		Section 70	Other
All disclosed	0	0	0	0
Disclosed in part	1	0	0	0
All exempted	0	0	0	0
All excluded	0	0	0	0
No records exist	0	0	0	0
Request abandoned	0	0	0	0
Total	1	0	0	0

5.2 Length of extensions

Length of Extensions	15(a)(i) Interference with operations	15(a)(ii) Consultation		15(b) Translation purposes
		Section 70	Other
1 to 15 days	0	0	0	0
16 to 30 days	1	0	0	0
Total	1	0	0	0

Part 6: Consultations Received From Other Institutions and Organizations

6.1 Consultations received from other Government of Canada institutions and other organizations

Consultations	Other Government of Canada Institutions	Number of Pages to Review	Other Organizations	Number of Pages to Review
Received during the reporting period	0	0	0	0
Outstanding from the previous reporting period	0	0	0	0
Total	0	0	0	0
Closed during the reporting period	0	0	0	0
Pending at the end of the reporting period	0	0	0	0

6.2 Recommendations and completion time for consultations received from other Government of Canada institutions

Recommendation	Number of Days Required to Complete Consultation Requests
	1 to 15 Days	16 to 30 Days	31 to 60 Days	61 to 120 Days	121  to 180 Days	181 to 365 Days	More Than 365 Days
All disclosed	0	0	0	0	0	0	0
Disclosed in part	0	0	0	0	0	0	0
All exempted	0	0	0	0	0	0	0
All excluded	0	0	0	0	0	0	0
Consult other institution	0	0	0	0	0	0	0
Other	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0

6.3 Recommendations and completion time for consultations received from other organizations

Recommendation	Number of days required to complete consultation requests
	1 to 15 Days	16 to 30 Days	31 to 60 Days	61 to 120 Days	121  to 180 Days	181 to 365 Days	More Than 365 Days
All disclosed	0	0	0	0	0	0	0
Disclosed in part	0	0	0	0	0	0	0
All exempted	0	0	0	0	0	0	0
All excluded	0	0	0	0	0	0	0
Consult other institution	0	0	0	0	0	0	0
Other	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0

Part 7: Completion Time of Consultations on Cabinet Confidences

7.1 Requests with Legal Services

Number of Days	Fewer Than 100 Pages Processed		101-500 Pages Processed		501-1000 Pages Processed		1001-5000 Pages Processed		More than 5000 Pages Processed
	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests
1 to 15	0	0	0	0	0	0	0	0	0
16 to 30	0	0	0	0	0	0	0	0	0
31 to 60	0	0	0	0	0	0	0	0	0
61 to 120	0	0	0	0	0	0	0	0	0
121 to 180	0	0	0	0	0	0	0	0	0
181 to 365	0	0	0	0	0	0	0	0	0
More than 365	0	0	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0	0	0

7.2 Requests with Privy Council Office

Number of Days	Fewer Than 100 Pages Processed		101‒500 Pages Processed		501-1000 Pages Processed		1001-5000 Pages Processed		More than 5000 Pages Processed
	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests
1 to 15	0	0	0	0	0	0	0	0	0
16 to 30	0	0	0	0	0	0	0	0	0
31 to 60	0	0	0	0	0	0	0	0	0
61 to 120	0	0	0	0	0	0	0	0	0
121 to 180	0	0	0	0	0	0	0	0	0
181 to 365	0	0	0	0	0	0	0	0	0
More than 365	0	0	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0	0	0

Part 8: Complaints and Investigations Notices Received

Section 31	Section 33	Section 35	Court action	Total
0	0	0	0	0

Part 9: Privacy Impact Assessments (PIAs)

Number of PIA(s) completed	0

Part 10: Resources Related to the Privacy Act

10.1 Costs

Expenditures	Amount
Salaries	$57,804
Overtime	$0
Goods and Services Professional services contracts:$24,459 Other: $0	$24,459
Total	$82,263

10.2 Human Resources

Resources	Person Years Dedicated to Privacy Activities
Full-time employees	0.64
Part-time and casual employees	0.13
Regional staff	0.00
Consultants and agency personnel	0.10
Students	0.00
Total	0.87