Annual report to Parliament on the Administration of the Privacy Act

Introduction

The Purpose of the Privacy Act

The Privacy Act protects an individual's privacy by setting out provisions related to the collection, use, disclosure, retention and disposal of personal information. The Privacy Act also provides Canadian citizens, permanent residents as defined under subsection 2(1) of the Immigration and Refugee Protection Act, and individuals who are present in Canada, a right of access to information about themselves held by a federal government institution, subject to certain specific and limited exceptions.

Section 72 of the Privacy Act requires the Minister of Transport to submit an annual report to Parliament on the administration of the legislation following the close of each fiscal year. This report describes how Transport Canada (TC) fulfilled its responsibilities and obligations for the reporting period April 1, 2020 to March 31, 2021.

About Transport Canada

TC is responsible for developing and overseeing the Government of Canada's transportation policies and programs so that Canadians can have access to a safe, secure, innovative and integrated transportation system that promotes trade, economic growth and a cleaner environment.

For more information about TC, visit our website.

Organizational structure

The Access to Information and Privacy (ATIP) Office is part of the Corporate Services Group. The Director of the ATIP Office is the ATIP Coordinator for TC. Consistent with best practices identified by the Treasury Board Secretariat (TBS), TC's ATIP Coordinator is positioned within three levels of the Minister. The Coordinator reports to the Chief Financial Officer (CFO) and Assistant Deputy Minister (ADM), Corporate Services, who, in turn, reports to the Deputy Minister.

The ATIP Office is comprised of specialists for the processing of access to information requests pursuant to the Access to Information Act, as well as privacy experts that ensured compliance with the Privacy Act and processed related requests. Overall, there were five person-years dedicated to privacy activities during the reporting period ending March 31, 2021.

The ATIP Office works closely with 13 departmental ATIP liaison officers, who are the main points of contact between the ATIP Office and subject matter experts. They are responsible for ensuring that requests tasked to their Group or regional office are handled promptly and that relevant records are forwarded to the ATIP Office in accordance with established procedures.

There were no service agreements under section 73.1 of the Privacy Act to which TC was party during the reporting period.

Delegation Order

Responsibilities associated with the administration of the Privacy Act are delegated to departmental officials through a delegation order signed by the Minister of Transport (see Annex A for the signed Delegation Order).

At Transport Canada, the ATIP Coordinator has full delegated authority, with the exception of privacy disclosures in the public interest pursuant to section 8(2)(m) of the Privacy Act, which are delegated to the Deputy Minister, the Associate Deputy Minister and the CFO and ADM, Corporate Services.

Performance 2020-2021

This section highlights key information on the department's performance for fiscal year 2020-2021. See Annex B for the complete Statistical Report.

Requests under the Privacy Act

During this reporting period, TC received 141 privacy requests. In addition, 18 requests were carried over from the previous year for a total of 159 requests on hand during 2020-2021.

Of the 159 requests on hand, 135 were completed during the reporting period, which resulted in 24 requests being carried over to the 2021-2022 fiscal year.

**Year-over-year trends**
	2017-2018	2018-2019	2019-2020	2020-2021
Requests received	462	322	139	141
Requests closed	438	372	136	135
Responded within legislated deadline	92 %	87 %	89 %	81%

Completion time of requests

Our commitment to ensuring that every reasonable effort is made to complete requests in a timely manner and to meet obligations to requesters remained paramount during the past year. During the reporting period, 109 requests (81%) were completed within the statutory deadline. This represents an 8% decline from the previous fiscal year, which was the result of challenges presented by the COVID-19 pandemic in processing these requests. However, these 109 requests represent roughly the same number of files completed during the previous reporting period.

**Completion time of requests**
1 to 15 Days	16 to 30 Days	31 to 60 Days	61 to 120 Days	121 to 180 Days	181 to 365 Days	More than 365 Days
51	44	16	15	4	4	1

For the reporting period, 95 requests were completed within 30 days. The amount of time it takes to close requests can be an indication of the volume of records and complexity of requests. Other reasons for delays continue to include high staff turnover and difficulty recruiting experts with a specialization in privacy.

Extensions

The Privacy Act allows departments to extend the legislated deadline by 30 days if the request cannot be completed within the legislated 30-day time limit due to specific circumstances.

In total, 24 extensions were taken during the reporting period. This represents a decrease from the 30 extensions taken during the previous reporting period. Of the 24 extensions, 15 were taken due to large volumes of responsive records and 9 for consultations. No extensions were taken for translation or conversion purposes.

Dispositions

Sections 18 through 28 of the Privacy Act set out the exemptions that can be applied in order to protect information pertaining to particular public or private interests. Of the five exemptions applied to privacy requests processed during the reporting period, the majority of exemptions invoked by TC (85.5%) fell under Section 26 of the Privacy Act, which protects the personal information of another individual.

Consultations received from other government institutions and organizations

TC did not receive consultations from other federal institutions during the reporting period.

Requests for correction of personal information and notation

There were no requests for the correction of personal information or notation in the reporting period.

Other services provided by the ATIP Office

In addition to request processing and other disclosures, the ATIP Office received many requests from internal clients. The ATIP Office processed 22 internal administrative reports for review under the spirit of the Privacy Act, many of which were complex (e.g., harassment reports).

COVID-19 operational impact

Since March 16, 2020, and for the entire duration of the reporting period, TC's ATIP employees have been working predominantly from home in response to the COVID-19 pandemic. Some of the challenges encountered during the period from April 1, 2020 to March 31, 2021 that affected privacy activities included:

adjusting to, and perfecting, digital initiatives, meeting formats, and operational processes to accommodate remote working for the entire office
overcoming system and network performance issues with innovative solutions developed with IT partners
in some cases, program areas tasked with the retrieval of records were already fully engaged in leading Canada's response to the COVID-19 pandemic, and therefore faced similar challenges responding to requests while providing critical services to Canadians and the transportation industry

TC's ATIP Office took a balanced approach to conditions during COVID-19, and developed strategies to address operational limitations as part of its business resumption plan. By April 1, 2020, the ATIP Office had implemented digital signatures to approve the release of records, ensuring requesters continued to receive information. TC pivoted from paper-based processes to a digital process for the submission of records internally, for review and for release by the ATIP Office. Regular mail was also replaced with E-post, a service from Canada Post for the electronic submission of records to requesters and other institutions when the use of email was not possible. These changes have modernized the operations of the ATIP Office, and have demonstrated efficiency and effectiveness that will continue to be valuable in a post-pandemic environment.

Training and awareness

Throughout the reporting period, great efforts were deployed to maintain the ATIP training program in spite of the pandemic. The goal of training is to familiarize or further educate TC employees on the principles and procedures of ATIP, responsibilities and expectations regarding the retrieval and reviewing of records, the provision of recommendation regarding sensitive information, and the overall importance of ATIP as it pertains to TC's daily operations. Training resumed as early as April 2020 in a fully digital format, for a total of 10 sessions delivered during the reporting period to hundreds of employees. Training material was updated based on feedback from employees participating in various sessions. One of the greatest advantages of the digital training approach was that the ATIP Office was able to reach a higher number of participants, from any location in Canada.

As part of its Engagement Strategy, the ATIP Office engendered a high level of visibility and transparency within the 2020-2021 reporting period. Transport Canada's Chief Financial Officer and Assistant Deputy Minister of Corporate Services regularly discussed ATIP matters with his colleagues, and ATIP was presented and discussed at the Transport Canada Executive Management Committee (TMX). Additionally, the ATIP Director shared information and provided updates and advice at the Director General Horizontal Committee (DGH), including information concerning the importance of timely record retrievals and DGs' responsibilities to ensure compliance with the Privacy Act when TC programs involve the collection of personal information.

Policies, guidelines, procedures and initiatives

As part of the 2019 ATIP Transformation Plan, and in an effort to ensure consistent and efficient practices by all ATIP employees, departmental ATIP procedure manuals continued to be updated whenever new policies or procedures were implemented or existing ones were revised.

Building on pilot projects launched in 2019, digital operations were fully implemented during the entire reporting period: information was disclosed to Canadians electronically; processing of records, tasking of OPIs, consultations with other government departments or other parties for documents (classified up to and including Protected B) were all accomplished electronically, either by E-post or email; approvals were provided digitally; and remote network performance was enhanced.

Summary of key issues and actions taken on complaints

During the reporting period, the department received one notification of investigation from the Office of the Privacy Commissioner (OPC), which they initiated. TC collaborated and provided representations. Additionally, two complaints received in previous years were deemed unfounded by the OPC during this reporting period.

Monitoring compliance

The ATIP Office engaged departmental officials at various levels in order to ensure that privacy requests are processed in a timely and efficient manner.

The ATIP Director met regularly with managers and supervisors to review on-time performance. Analysts were trained to leverage the specialized ATIP processing software to track timeframes for requests under their responsibility. This was supplemented with regular bilateral meetings between analysts and their supervisor to receive guidance and ensure compliance.

Various reports were prepared to assist in tracking the status of requests. Staff were reminded of upcoming deadlines, with oversight conducted by the management team and by the CFO and ADM, Corporate Services.

Throughout the year, members of the ATIP management team were paired with OPI liaison officers in each group and regional office to maintain regular communications and address questions and concerns proactively. This approach continues to contribute to a greater understanding between the ATIP Office and OPIs, as well as enhanced collaboration. An electronic ATIP bulletin featuring news, updates, latest developments and information regarding the ATIP Office continued to be shared monthly with key partners across the department. This tool was crucial throughout the pandemic to communicate changes and adjustments in a timely manner to all departmental partners, as well as important messages on access to information and privacy, such as letters from the President of the Treasury Board or updates on the Privacy Act Modernization project.

Material privacy breaches

During the reporting period, TC experienced no material privacy breaches.

Privacy Impact Assessments

During the reporting period, several Privacy Impact Assessments (PIAs) were drafted and three were completed. ATIP plays a vital role in providing guidance and advice to program areas in the drafting of PIAs to ensure compliance with the Privacy Act and the safe handling of personal information. ATIP officials met with the programs, discussed the activities and/or initiatives they were planning and reviewed draft versions of their PIAs to ensure they considered all privacy implications and mitigation measures throughout the development and implementation of their processes. Much progress has been made in advancing several PIAs, which will be completed in the next reporting period. Below are brief descriptions of two completed PIAs during the reporting period, which will be published once registered by the Treasury Board Secretariat:

Incentives for Zero-Emission Vehicles Program (iZEV Program): The program is aimed at contributing to a clean transportation system by increasing the adoption of zero-emission vehicles (ZEVs) in Canada. The program contributes to the adoption of ZEVs by providing incentives to Canadians and Canadian businesses for the purchase or lease (12 months or more) of an eligible ZEV between May 1, 2019, and March 31, 2022. A PIA was completed on these activities to ensure compliance with the Privacy Act and TBS policies, as well as to recommend mitigation actions to address any risks to privacy in connection with the collection of personal information in this context.
Transportation Security Clearance Program: In order to support a safe and secure transportation system, TC conducts relevant background checks on all individuals who require unescorted access to restricted areas of Canadian airports. A PIA was completed on these activities to ensure compliance with the Privacy Act and TBS policies, as well as to recommend mitigation actions to address any risks to privacy in connection with the collection of personal information in this context.

In addition, a multi-institutional PIA was completed with respect to the implementation and delivery of the centralized screening component of the Passenger Protect Program, with Public Safety as the lead institution and with TC and the Canada Border Service Agency as partner institutions.

Public interest disclosures

Paragraph 8(2)(m) of the Privacy Act allows for the head of the institution to disclose personal information without the consent of the affected individual in cases where, in the opinion of the head, the public interest outweighs any invasion of privacy that could result from the disclosure, or when it is clearly in the best interest of the individual. During the reporting period, no disclosures were made under paragraph 8(2)(m).

Annex A: Delegation Order

Access to Information Act and Privacy Act designation

The Minister of Transport, pursuant to subsection 95(1) of the Access to Information Act and subsection 73(1) of the Privacy Act,delegates the persons holding the positions set out in the attached schedule, including persons designated to act in their absence, to exercise the powers, duties and functions of the Minister of Transport as the head of theDepartment of Transport, under the provisionsof these Acts and related Regulations^{Footnote 1}, set out in the attached schedule opposite eachposition.

This delegation replaces all previous designations.

Dated at the City of Ottawa, in the Province of Ontario, this 30th day of March, 2021.

Omar Alghabra
Minister of Transport

**Schedule**
Position	Access to Information Act and regulations	Privacy Act and regulations
Deputy Minister	Full authority	Full authority
Associate Deputy Minister	Full authority	Full authority
Assistant Deputy Minister, Corporate Services, and Chief Financial Officer	Full authority	Full authority
Director, ATIP	Full authority	Full authority except: PA: 8(2)(m)
Managers, ATIP	Full authority except: ATIA: 6.1(1)	Full authority except: PA: 8(2)(j) and 8(2)(m)
Senior ATIP Advisors (Team Leaders)	ATIA: 7(a), 8(1), 9, 19, 27(1), 33, and 43(1)	PA: 14(a), 15, and 26

Annex B: Transport Canada's statistical report on the Privacy Act

Statistical report on the Privacy Act

Name of institution: Transport Canada
Reporting period: April 1, 2020 to March 31, 2021

Section 1: Requests under the Privacy Act

1.1 Number of requests

	Number of requests
Received during reporting period	141
Outstanding from previous reporting period	18*
Total	159
Closed during reporting period	135
Carried over to next reporting period	24

*Note: The 2019-20 Annual Report indicated that 17 requests would be carried over to the next reporting period. However, due to a change in status to one request following the completion of the 2019-20 report, this number has been updated accordingly.

Section 2: Requests closed during the reporting period

2.1 Disposition and completion time

Disposition of requests	Completion time
Disposition of requests	1 to 15 days	16 to 30 days	31 to 60 days	61 to 120 days	121 to 180 days	181 to 365 days	More than 365 days	Total
All disclosed	2	11	3	0	0	0	0	16
Disclosed in part	2	21	11	13	4	4	1	56
All exempted	0	0	0	0	0	0	0	0
All excluded	0	0	0	0	0	0	0	0
No records exist	11	9	1	2	0	0	0	23
Request abandoned	36	3	1	0	0	0	0	40
Neither confirmed nor denied	0	0	0	0	0	0	0	0
Total	51	44	16	15	4	4	1	135

2.2 Exemptions

Section	Number of requests
18(2)	0
19(1)(a)	0
19(1)(b)	0
19(1)(c)	0
19(1)(d)	1
19(1)(e)	0
19(1)(f)	0
20	0
21	1
22(1)(a)(i)	0
22(1)(a)(ii)	0
22(1)(a)(iii)	0
22(1)(b)	9
22(1)(c)	0
22(2)	0
22.1	0
22.2	0
22.3	0
22.4	0
23(a)	0
23(b)	0
24(a)	0
24(b)	0
25	0
26	56
27	1
27.1	0
28	0

2.3 Exclusions

Section	Number of requests
69(1)(a)	0
69(1)(b)	0
69.1	0
70(1)	0
70(1)(a)	0
70(1)(b)	0
70(1)(c)	0
70(1)(d)	0
70(1)(e)	0
70(1)(f)	0
70.1	0

2.4 Format of information released

Paper	Electronic	Other
0	72	0

2.5 Complexity

2.5.1 Relevant pages processed and disclosed

Number of pages processed	Number of pages disclosed	Number of requests
12 418	9707	112

2.5.2 Relevant pages processed and disclosed by size of requests

Disposition	Less than 100 pages processed		101-500 pages processed		501-1000 pages processed		1001-5000 pages processed		More than 5000 pages processed
Disposition	Number of requests	Pages disclosed	Number of requests	Pages disclosed	Number of Requests	Pages disclosed	Number of requests	Pages disclosed	Number of requests	Pages disclosed
All disclosed	14	296	2	296	0	0	0	0	0	0
Disclosed in part	32	905	17	3464	4	1981	3	2719	0	0
All exempted	0	0	0	0	0	0	0	0	0	0
All excluded	0	0	0	0	0	0	0	0	0	0
Request abandoned	40	46	0	0	0	0	0	0	0	0
Neither confirmed nor denied	0	0	0	0	0	0	0	0	0	0
Total	86	1247	19	3760	4	1981	3	2719	0	0

2.5.3 Other complexities

Disposition	Consultation required	Total
All disclosed	0	0
Disclosed in part	15	15
All exempted	0	0
All excluded	0	0
Request abandoned	0	0
Neither confirmed nor denied	0	0
Total	15	15

2.6 Closed requests

2.6.1 Number of requests closed within legislated timelines

	Requests closed within legislated timelines
Number of requests closed within legislated timelines	109
Percentage of requests closed within legislated timelines (%)	80.7

2.7 Deemed refusals

2.7.1 Reasons for not meeting statutory deadline

Number of requests closed past the statutory deadline	Principal reason
Number of requests closed past the statutory deadline	Interference with operations / workload	External consultation	Internal consultation	Other
26	4	0	0	22

2.7.2 Requests closed beyond legislated timelines (including any extension taken)

Number of days past legislated timelines	Number of requests past legislated timeline where no extension was taken	Number of requests past legislated timelines where an extension was taken	Total
1 to 15 days	4	2	6
16 to 30 days	1	1	2
31 to 60 days	4	2	6
61 to 120 days	3	4	7
121 to 180 days	0	2	2
181 to 365 days	0	3	3
More than 365 days	0	0	0
Total	12	14	26

2.8 Requests for translation

Translation requests	Accepted	Refused	Total
English to French	0	0	0
French to English	0	0	0
Total	0	0	0

Section 3: Disclosures under subsections 8(2) and 8(5)

Paragraph 8(2)(e)	Paragraph 8(2)(m)	Subsection 8(5)	Total
0	0	0	0

Section 4: Requests for correction of personal information and notations

Disposition for correction requests received	Number
Notations attached	0
Requests for correction accepted	0
Total	0

Section 5: Extensions

5.1 Reasons for extensions and disposition of requests

Number of requests where an extension was taken	15(a)(i) Interference with operations				15 (a)(ii) Consultation			15(b) Translation purposes or conversion
	Further review required to determine exemptions	Large volume of pages	Large volume of requests	Documents are difficult to obtain	Cabinet Confidence Section (Section 70)	External	Internal


24	0	15	0	0	0	9	0	0

5.2 Length of extensions

Length of Extensions	15(a)(i) Interference with operations				15 (a)(ii) Consultation			15(b) Translation purposes or conversion
	Further review required to determine exemptions	Large volume of pages	Large volume of requests	Documents are difficult to obtain	Cabinet Confidence Section (Section 70)	External	Internal


1 to 15 days	0	1	0	0	0	0	0	0
16 to 30 days	0	14	0	0	0	9	0	0
31 days or greater								0
Total	0	15	0	0	0	9	0	0

Section 6: Consultations received from other institutions and organizations

6.1 Consultations received from other Government of Canada institutions and other organizations

Consultations	Other Government of Canada institutions	Number of pages to review	Other organizations	Number of pages to review
Received during the reporting period	0	0	0	0
Outstanding from the previous reporting period	0	0	0	0
Total	0	0	0	0
Closed during the reporting period	0	0	0	0
Carried over to the next reporting period	0	0	0	0

6.2 Recommendations and completion time for consultations received from other Government of Canada institutions

Recommendation	Number of days required to complete consultation requests
Recommendation	1 to 15 days	16 to 30 days	31 to 60 days	61 to 120 days	121 to 180 days	181 to 365 days	More than 365 days	Total
All disclosed	0	0	0	0	0	0	0	0
Disclosed in part	0	0	0	0	0	0	0	0
All exempted	0	0	0	0	0	0	0	0
All excluded	0	0	0	0	0	0	0	0
Consult other institution	0	0	0	0	0	0	0	0
Other	0	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0	0

6.3 Recommendations and completion time for consultations received from other organizations

Recommendation	Number of days required to complete consultation requests

Recommendation	1 to 15 days	16 to 30 days	31 to 60 days	61 to 120 days	121 to 180 days	181 to 365 days	More than 365 days	Total
All disclosed	0	0	0	0	0	0	0	0
Disclosed in part	0	0	0	0	0	0	0	0
All exempted	0	0	0	0	0	0	0	0
All excluded	0	0	0	0	0	0	0	0
Consult other institution	0	0	0	0	0	0	0	0
Other	0	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0	0

Section 7: Completion time of consultations on cabinet confidences

7.1 Requests with Legal Services

Number of days	Fewer Than 100 pages processed		101-500 pages processed		501-1000 pages processed		1001-5000 pages processed		More than 5000 pages processed
Number of days	Number of requests	Pages disclosed	Number of requests	Pages disclosed	Number of requests	Pages disclosed	Number of requests	Pages disclosed	Number of requests	Pages disclosed
1 to 15	0	0	0	0	0	0	0	0	0	0
16 to 30	0	0	0	0	0	0	0	0	0	0
31 to 60	0	0	0	0	0	0	0	0	0	0
61 to 120	0	0	0	0	0	0	0	0	0	0
121 to 180	0	0	0	0	0	0	0	0	0	0
181 to 365	0	0	0	0	0	0	0	0	0	0
More than 365	0	0	0	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0	0	0	0

7.2 Requests with Privy Council Office

Number of days	Fewer Than 100 pages processed		101‒500 pages processed		501-1000 pages processed		1001-5000 pages processed		More than 5000 pages processed
Number of days	Number of requests	Pages disclosed	Number of requests	Pages disclosed	Number of requests	Pages disclosed	Number of requests	Pages disclosed	Number of equests	Pages disclosed
1 to 15	0	0	0	0	0	0	0	0	0	0
16 to 30	0	0	0	0	0	0	0	0	0	0
31 to 60	0	0	0	0	0	0	0	0	0	0
61 to 120	0	0	0	0	0	0	0	0	0	0
121 to 180	0	0	0	0	0	0	0	0	0	0
181 to 365	0	0	0	0	0	0	0	0	0	0
More than 365	0	0	0	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0	0	0	0

Section 8: Complaints and investigations notices received

Section 31	Section 33	Section 35	Court action	Total
1	1	2	0	4

Section 9: Privacy Impact Assessments (PIA) and Personal Information Banks (PIB)

9.1 Privacy Impact Assessments

Number of PIA(s) completed	3

9.2 Personal Information Banks

Personal Information Banks

Active	Created	Terminated	Modified
24	0	0	2

Of note that this information is aligned with publications on InfoSource as well as any pending updates to Personal Information Banks submitted for registration and publication during the reporting period, accounting for ommissions in the previous statistical period.

Section 10: Material privacy breaches

Number of material privacy breaches reported to TBS	0
Number of material privacy breaches reported to OPC	0

Section 11: Resources related to the Privacy Act

11.1 Costs

Expenditures		Amount
Salaries		$378,530
Overtime		$0
Goods and Services		$103,112
Professional services contracts	$81,767
Other	$21,345
Total		$481,642

11.2 Human Resources

Resources	Person years dedicated to privacy activities
Full-time employees	4.5
Part-time and casual employees	0
Regional staff	0
Consultants and agency personnel	0.5
Students	0
Total	5