Annual report to Parliament on the administration of the Privacy Act – 2019-2020

From: Transport Canada

On this page

Introduction

The Purpose of the Privacy Act

The Privacy Act (the Act) provides Canadian citizens and permanent residents of Canada a right of access to information about themselves held by the federal government subject to certain specific and limited exceptions. The Act protects an individual's privacy by setting out provisions related to the collection, use, disclosure, retention and disposal of personal information.

Section 72 of the Act requires the Minister of Transport to submit an annual report to Parliament on the administration of the Act following the close of each fiscal year. This report describes how Transport Canada (TC) fulfilled its responsibilities and obligations during the 2019-2020 fiscal year.

About Transport Canada

TC is responsible for developing and overseeing the Government of Canada's transportation policies and programs so that Canadians can have access to a safe, secure, innovative and integrated transportation system that promotes trade, economic growth and a cleaner environment.

For more information about Transport Canada, visit the website.

Organizational structure

The Access to Information and Privacy (ATIP) Office is part of the Corporate Services Group. The Director of the ATIP Office is the ATIP Coordinator for TC. Consistent with best practices identified by the Treasury Board Secretariat (TBS), TC's ATIP Coordinator is positioned within three levels of the Minister. The Coordinator reports to the Chief Financial Officer (CFO) and Assistant Deputy Minister (ADM), Corporate Services, who in turn reports to the Deputy Minister. 

The ATIP Coordinator has full delegated authority, with the exception of privacy disclosures in the public interest pursuant to section 8(2)(m) of the Privacy Act. This delegation is given to the Deputy Minister, the Associate Deputy Minister and the CFO and ADM, Corporate Services. 

The ATIP Office works closely with departmental liaison officers who are the main point of contact between the ATIP Office and subject matter experts. Liaison officers are responsible for ensuring that requests tasked to their Group or region are handled promptly and that relevant records are forwarded to the ATIP Office within provided timelines.

The ATIP Office is comprised of three units: two units dedicated to access to information activities, including proactive publication responsibilities, while the third unit is responsible for policy and privacy activities, internal services and access to information operations. Each unit is headed by a Chief. Overall, 4 person-years were dedicated to privacy activities in the 2019-2020 fiscal year.

There were no service agreements under section 73 of the Privacy Act to which TC was party during the reporting period.

Delegation Order

Responsibilities associated with the administration of the Privacy Act are delegated to departmental officials through a delegation order signed by the Minister of Transport (see Annex A for the signed Delegation Order).

Highlights of the 2019-2020 Statistical Report

This section highlights key information on the department's performance for fiscal year 2019-2020. See Annex B for the complete Statistical Report.

Requests under the Privacy Act

In the 2019-2020 fiscal year, TC received 139 privacy requests. In addition, 14 requests were carried over from the previous year for a total of 153 requests on hand during 2019-2020.

Of the 153 requests on hand, 136 were completed during the reporting period, which resulted in 17 requests being carried over to the 2020-2021 fiscal year.

Requests completed during the reporting period

The number of requests completed within 30 days was 73% in 2019-2020. An increase in volume of relevant pages processed and a decrease in resources compared to the previous year are factors that contributed to a decrease from the previous year.

Requests completed within 30 days

2014-2015 2015-2016 2016-2017 2017-2018 2018-2019 2019-2020
73% 79% 77% 77% 80% 73%

Average days required to process a request

2014-2015 2015-2016 2016-2017 2017-2018 2018-2019 2019-2020
33 23 28 32 66 66

COVID-19 Operational Impact

On March 16, 2020, TC's ATIP Office shifted to working remotely in response to the COVID-19 pandemic. Some of the challenges encountered during the period from March 16, 2020 to March 31, 2020 included:

  • Setting up several digital initiatives and processes in a short period of time to accommodate remote working;
  • The inability to review large volumes of records due to limited system performance at the time; similarly, secret records were unavailable remotely;
  • Delays in receiving consultation responses from other federal organizations whose operations were similarly restricted due to the COVID-19 pandemic;
  • Limited capacity to conduct third party consultations due to their limited business capacity or closures resulting from the COVID-19 pandemic;
  • Limited access to regular incoming mail from internal or external sources; and
  • In some cases, program areas being tasked to retrieve records were already fully engaged in leading Canada's response to the COVID-19 pandemic, and therefore faced challenges responding to requests while providing critical services to Canadians and the transportation industry.

TC's ATIP Office developed strategies to address these operational limitations as part of its business resumption plan, and many operations resumed within days. By March 31, the ATIP Office had implemented digital signatures to approve, among other things, the release of records, ensuring Canadians continued to receive information. TC pivoted from a paper-based process to a digital process for the submission of records internally, for review and release by the ATIP Office. Regular mail was also replaced with E-post, a service from Canada Post for the electronic submission of records to requesters when email was not possible.

Exemptions

Sections 18 through 28 of the Act set out the exemptions that can be applied in order to protect information pertaining to a particular public or private interest. The majority of exemptions invoked by TC fell under Section 26 of the Act, which protects personal information about another individual (60 files).

Exclusions

The Act does not apply to certain publicly available information described in section 69, or to confidences of the Queen's Privy Council for Canada pursuant to section 70. During this reporting period, zero exclusions were cited pursuant to sections 69 and 70.

Deemed refusals

During the 2019-2020 fiscal year, 121 requests (89%) were completed within the statutory deadline. This result reflects TC's commitment to ensuring that every reasonable effort is made to complete requests in a timely manner, and to meet its obligations to requesters. For the reporting period, the number of requests completed past the statutory deadline represent 11% of the total number of requests received, which is a decrease from 13% the previous year. Workload and staff turnover were the primary reasons for completing requests past the statutory deadline.

Disclosures under subsections 8(2)

In the 2019-2020 reporting period, 103 disclosures were made under paragraph 8(2)(e), where personal information may be disclosed to an investigative body specified in the regulationsFootnote 1.

One disclosure was made under 8(2)(m), where personal information may be disclosed for public interest or for the benefit of the individual to whom the information relates. The Office of the Privacy Commissioner was notified of this public interest disclosure.

Requests for correction of personal information and notation

There were no requests for correction of personal information or notation in the reporting period.

Extensions

The Privacy Act allows departments to extend the legislated deadline by 30 days if the request cannot be completed within the legislated 30-day time limit due to specific circumstances.

In total, 30 extensions were taken during the reporting year. This is a decrease from the

43 extensions taken during the previous reporting period. Of the 30 extensions, 20 were taken because of large volumes of records, nine for consultations and one for translation or conversion purposes. 

Consultations received from other government institutions and organizations

TC did not receive consultations from another federal institution during the reporting period.

Complaints and investigations

Requesters can submit a complaint to the Office of the Privacy Commissioner (OPC) on the processing of their request. Canadians may also submit a complaint to the OPC regarding the handling of their personal information by a federal institution. During the 2019-2020 reporting year, TC received one privacy complaint. This is a significant decrease compared to the previous five years and ranks as TC's best result for the past six years.

Complaints

Complaints 2014 to 2015 2015 to 2016 2016 to 2017 2017 to 2018 2018 to 2019 2019 to 2020
Received 7 4 11 16 7 1
Closed 5 2 1 27 13 1

Other services provided by the ATIP Office

In addition to request processing and other disclosures, the ATIP Office received many requests from internal clients. The ATIP Office processed 32 internal administrative reports for review under the spirit of the Privacy Act, many of which were complex (e.g. harassment reports). This contributed to a marked increase in the workload of the Office.

Training and awareness

Throughout 2019-2020, great efforts were deployed to strengthen the ATIP training program in order to reach a broad audience, both in the National Capital Region and in regional offices. Training material was revamped and updated based on feedback from employees participating in various training sessions. A new training schedule was established to meet the demand from TC employees, providing at least two scheduled training sessions per month.

A total of 40 training sessions were delivered in person or by video conference, half of those in Ottawa and half in regional offices (Prairies and Northern Region, Pacific Region and Quebec Region). These sessions provided TC employees with information on ATIP principles and procedures, responsibilities and expectations regarding the retrieval and reviewing of records, and the completion of the OPI recommendations form. Additionally, ATIP training was delivered in venues such as all staff meetings and small groups, upon request. Other training activities included increased in-house training for ATIP analysts, mentoring and case studies to expand knowledge and improve results.

Training and awareness were key elements of the ATIP Transformation Plan that was developed and implemented over the course of 2019-20. An Engagement Strategy involved meetings with each ADM in the department, led by the CFO and ADM, Corporate Services, to discuss the importance of timely records retrieval, new proactive publication requirements and other requirements.

The ATIP Transformation Plan included a structural reorganization and the addition of new resources. The Plan also fostered the use of new technologies, which began with pilot projects, such as telework and digital signatures, which were then fully implemented at the end of March when work pivoted to digital solutions enabling remote work.

The ATIP Director became a member of the Directors General Horizontal Committee where new or substantially modified programs are presented, from the planning to the closing stage. Senior executives were informed regularly through this committee of their responsibilities to ensure compliance with the Privacy Act when TC programs involve the collection of personal information.

Policies, guidelines, procedures and initiatives

As part of the ATIP Transformation Plan and in an effort to ensure consistent and efficient practices by all ATIP employees, departmental ATIP procedures manuals were updated. The manuals are “evergreen” electronic documents which are updated whenever new policies or procedures are implemented or existing ones are revised. The form used by OPIs to provide recommendations to the ATIP Office regarding sensitive information was revised and a new accompanying guidance document was created. That document assisted TC employees in providing rationales to better describe sensitivities in responsive records for consideration by the ATIP Office, and potentially for the OPC should a complaint be made on the application of exemptions.

Summary of key issues and actions taken on complaints

During the reporting period, the Department received one complaint related to an alleged privacy breach, and zero complaint related to privacy requests. The ATIP Office also resolved one previous complaint in collaboration with the OPC.

Monitoring compliance

The ATIP Office engaged departmental officials at various levels in order to ensure the timely and accurate processing of ATIP requests. The ATIP Director met regularly with Chiefs and team leaders to review on-time performance.

Analysts were trained to review the specialized software used to track and process requests on a daily basis in order to track timeframes for requests under their responsibility. This was supplemented with regular bilateral meetings between managers and analysts to provide guidance and ensure compliance.

Various reports were prepared to assist in tracking the status of requests. The ATIP Three Weeks Look Ahead Reports were provided to ATIP staff reminding them of requests coming due within three weeks to assure legislated timelines were met.

Since July 2019, members of the ATIP management team have been paired with OPI liaison officers and they maintain regular communications to address questions and concerns proactively. This new approach has contributed to a greater understanding between the ATIP Office and OPIs, with regular opportunities to share concerns and challenges and find solutions together. An electronic ATIP bulletin featuring news, updates, latest developments and information regarding the ATIP Office was launched in December 2019 and has been shared monthly with key partners across the department.

With the multiple new measures described in this report, the department reached 89% compliance with legislated timelines to provide timely access to personal information.

Material privacy breaches

During the reporting period, TC experienced no material privacy breaches.

Privacy Impact Assessments

During the reporting period, several Privacy Impact Assessments (PIAs) were drafted but none were completed. ATIP plays a vital role in providing guidance and advice to program areas in the drafting of PIAs to ensure compliance with the Privacy Act and the safe handling of personal information. ATIP officials met with programs, discussed the activities they are planning and reviewed draft versions of their PIAs to ensure they consider all privacy implications and mitigation measures throughout the development of their processes. Much progress has been made in advancing several PIAs, which will be completed in the next reporting period.

Public interest disclosures

Paragraph 8(2)(m) of the Privacy Act allows for the head of the institution to disclose personal information without the consent of the affected individual in cases where, in the opinion of the head, the public interest outweighs any invasion of privacy that could result from the disclosure or when it is clearly in the best interest of the individual. During the reporting period, TC made one disclosure of personal information under this provision and informed the OPC accordingly.

Annex A: Delegation Order

Access to Information Act and Privacy Act designation

The Minister of Transport, pursuant to section 73 of the Access to Information Act ("ATIA") and section 73 of the Privacy Act ("PA"), hereby designates the persons holding the positions set out in the attached schedule, or the persons occupying those positions on an acting basis, to exercise the powers, duties and functions of the Minister of Transport as the head of the Department of Transport, under the provisions of these Acts and related RegulationsFootnote 2, set out in the attached schedule opposite each position.

This designation replaces all previous designations.

Dated at the City of Ottawa, in the Province of Ontario, this 10 day of March, 2016.

Marc Garneau
Minister of Transport/ Ministre des Transports

Schedule
Position Access to Information Act and Regulations Privacy Act and Regulations
Deputy Minister Full authority Full authority
Associate Deputy
Minister		 Full authority Full authority
Assistant Deputy Minister, Corporate Services, and Chief Financial Officer Full authority Full authority
Director, ATIP Full authority Full authority except :
PA: 8(2)(m)
Chiefs, ATIP Full authority Full authority except:
PA: 8(2)(j) and 8(2)(m)
Senior ATIP Analysts (Team Leaders) ATIA: 7(a), 8(1), 11(2), 11(3),
11(4), 11(5), 27(1), 33, and 43(1)		 PA: 14(a)
ATIP Analysts ATIA: 7(a) PA: 14(a)

Annex B: Transport Canada's Statistical Report on the Privacy Act

Name of institution: Transport Canada

Reporting period: 2019-04-01 to 2020-03-31

Part 1: Requests under the Privacy Act

  Number of requests
Received during reporting period 139
Outstanding from previous reporting period 14
Total 153
Closed during reporting period 136
Carried over to next reporting period 17

Part 2: Requests closed during the reporting period

2.1 Disposition and completion time

Disposition of requests Completion time
1 to 15 days 16 to 30 days 31 to 60 days 61 to 120 days 121 to 180 days 181 to 365 days More than 365 days Total
All disclosed 3 12 3 0 0 0 0 18
Disclosed in part 1 29 13 9 1 1 2 56
All exempted 0 1 1 0 0 0 0 2
All excluded 0 0 0 0 0 0 0 0
No records exist 9 13 2 0 0 0 1 25
Request abandoned 26 5 2 0 0 0 2 35
Neither confirmed nor
denied		 0 0 0 0 0 0 0 0
Total 39 60 21 9 1 1 5 136

2.2 Exemptions

Section Number of requests
18(2) 0
19(1)(a) 1
19(1)(b) 0
19(1)(c) 0
19(1)(d) 0
19(1)(e) 0
19(1)(f) 0
20 1
21 1
22(1)(a)(i) 0
22(1)(a)(ii) 0
22(1)(a)(iii) 0
22(1)(b) 2
22(1)(c) 0
22(2) 0
22.1 0
22.2 0
22.3 0
22.4 0
23(a) 0
23(b) 0
24(a) 0
24(b) 0
25 0
26 60
27 3
28 0

2.3 Exclusions

Section Number of requests
69(1)(a) 0
69(1)(b) 0
69.1 0
70(1) 0
70(1)(a) 0
70(1)(b) 0
70(1)(c) 0
70(1)(d) 1
70(1)(e) 1
70(1)(f) 0
70.1 0

2.4 Format of information released

Paper Electronic Other formats
25 49 0

2.5 Complexity

2.5.1 Relevant pages processed and disclosed
Number of pages processed Number of pages disclosed Number of requests
44823 43802 111
2.5.2 Relevant pages processed and disclosed by size of requests
Disposition Less Than 100 pages processed 101-500 pages processed 501-1000 pages processed 1001-5000 pages processed More than 5000 pages processed
Number of requests Pages Disclosed Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed
All disclosed 17 378 1 125 0 0 0 0 0 0
Disclosed in
part		 31 1346 15 3134 8 5366 1 1326 1 27154
All exempted 2 0 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0 0 0
Request
abandoned		 31 0 1 185 1 625 2 4163 0 0
Neither
confirmed nor denied		 0 0 0 0 0 0 0 0 0 0
Total 81 1724 17 3444 9 5991 3 5489 1 27154
2.5.3 Other complexities
Disposition Consultation required Legal advice sought Interwoven information Other Total
All disclosed 0 0 0 0 0
Disclosed in
part		 10 2 0 0 12
All exempted 0 2 0 0 2
All excluded 0 0 0 0 0
Request
abandoned		 2 0 0 0 2
Neither
confirmed nor denied		 0 0 0 0 0
Total 0 0 0 0 0

2.6 Closed Requests

2.6.1 Number of requests closed within legislated timelines
  Requests closed within legislated timelines
Number of requests closed within legislated timelines 121
Percentage of requests closed within legislated timelines (%) 89%

2.7 Deemed Refusals

2.7.1 Reasons for not meeting statutory deadline
Number of requests closed past the statutory deadline Principal reason
Workload External consultation Internal consultation Other
15 1 0 0 14
2.7.2 Number of days past deadline
Number of days past deadline Number of requests past deadline where no extension was taken Number of requests past deadline where an extension was taken Total
1 to 15 days 2 3 5
16 to 30 days 1 2 3
31 to 60 days 0 0 0
61 to 120 days 0 2 2
121 to 180 days 0 0 0
181 to 365 days 0 1 1
More than 365 days 1 3 4
Total 4 11 15

2.8 Requests for translation

Translation requests Accepted Refused Total
English to French 0 0 0
French to English 0 0 0
Total 0 0 0

Part 3: Disclosures under subsections 8(2) and 8(5)

Paragraph 8(2)(e) Paragraph 8(2)(m) Subsection 8(5) Total
103 1 1 105

Part 4: Requests for correction of personal information and notations

Disposition for correction requests received Number
Notations attached 0
Requests for correction accepted 0
Total 0

Part 5: Extensions

5.1 Reasons for extensions and disposition of requests

Number of requests where an extension was taken 15(a)(i) Interference with operations 15 (a)(ii) Consultation
Further review required to determine exemptions Large volume of pages Large volume of requests Documents are difficult to obtain Cabinet ConfidenceSection (Section 70) External Internal 15(b)
Translation purposes or conversion
Total 0 20 0 0 0 8 1 1

5.2 Length of extensions

Length of Extensions 15(a)(i) Interference with operations 15 (a)(ii) Consultation
Further review required to determine exemptions Large volume of pages Large volume of requests Documents are difficult to obtain Cabinet ConfidenceSection (Section 70) External Internal 15(b) Translation purposes or conversion
1 to 15 days 0 0 0 0 0
16 to 30 days 0 20 0 9 0
31 days or greater   1
Total 0 20 0 9 1

Part 6: Consultations received from other institutions and organizations

6.1 Consultations received from other Government of Canada institutions and other organizations

Consultations Other Government of Canada institutions Number of pages to review Other organizations Number of pages to review
Received during the reporting
period		 0 0 0 0
Outstanding from the previous
reporting period		 0 0 0 0
Total 0 0 0 0
Closed during the reporting
period		 0 0 0 0
Pending at the end of the
reporting period		 0 0 0 0

6.2 Recommendations and completion time for consultations received from other Government of Canada institutions

Recommendation Number of days required to complete consultation requests
1 to 15 days 16 to 30 days 31 to 60 days 61 to 120 days 121 to 180 days 181 to 365 days More than 365 days Total
All disclosed 0 0 0 0 0 0 0 0
Disclosed in part 0 0 0 0 0 0 0 0
All exempted 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0
Consult other institution 0 0 0 0 0 0 0 0
Other 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0

6.3 Recommendations and completion time for consultations received from other organizations

Recommendation Number of days required to complete consultation requests
1 to 15 days 16 to 30 days 31 to 60 days 61 to 120 days 121 to 180 days 181 to 365 days More than 365 days Total
All disclosed 0 0 0 0 0 0 0 0
Disclosed in part 0 0 0 0 0 0 0 0
All exempted 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0
Consult other institution 0 0 0 0 0 0 0 0
Other 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0

Part 7: Completion Time of Consultations on Cabinet Confidences

7.1 Requests with Legal Services

Number of Days Fewer Than 100 pages processed 101-500 pages processed 501-1000 pages processed 1001-5000 pages processed More than 5000 pages processed
Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed
1 to 15 0 0 0 0 0 0 0 0 0 0
16 to 30 0 0 0 0 0 0 0 0 0 0
31 to 60 0 0 0 0 0 0 0 0 0 0
61 to 120 0 0   0 0 0 0 0 0 0 0
121 to 180 0 0 0 0 0 0 0 0 0 0
181 to 365 0 0 0 0 0 0 0 0 0 0
More than 365 0 0 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0 0 0

7.2 Requests with Privy Council Office

Number of days Fewer Than 100 pages processed 101‒500 pages processed 501-1000 pages processed 1001-5000 pages processed More than 5000 pages processed
Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed Number of requests Pages disclosed
1 to 15 0 0 0 0 0 0 0 0 0 0
16 to 30 0 0 0 0 0 0 0 0 0 0
31 to 60 0 0 0 0 0 0 0 0 0 0
61 to 120 0 0 0 0 0 0 0 0 0 0
121 to 180 0 0 0 0 0 0 0 0 0 0
181 to 365 0 0 0 0 0 0 0 0 0 0
More than 365 0 0 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0 0 0

Part 8: Complaints and investigations notices received

Section 31 Section 33 Section 35 Court action Total
1 0 0 0 1

Part 9: Privacy Impact Assessments (PIAs)

Number of PIA(s) completed 0

9.2 Personal Information Banks

Personal Information Banks Active Created Terminated Modified
10 0 0 0

Part 10: Resources related to the Privacy Act

10.1 Costs

Expenditures Amount
Salaries $341,520
Overtime $0

Goods and Services

  • Professional services contracts: $47,938
  • Other: $36,721

$84,659
Total $426,179

10.2 Human resources

Resources Person years dedicated to privacy activities
Full-time employees 3.50
Part-time and casual employees 0.00
Regional staff 0.00
Consultants and agency personnel 0.50
Students 0.00
Total 4.00

Report a problem with this page

Date modified: