Annual Report on the Privacy Act 2017-2018

Table of Contents

• Introduction
• The Public Prosecution Service of Canada
• Commissioner of Canada Elections
• Access to Information and Privacy Office
  • Organizational structure
• Delegated authorities
• Interpretation of the statistical report
  • Requests received under the Privacy Act
    • Number of requests
  • Requests closed during the fiscal year
    • Disposition of requests
    • Number of pages processed
    • Completion time
    • Exemptions
    • Exclusions
    • Format of information released
    • Complexity
    • Deemed refusals
    • Requests for translation
  • Requests for correction of personal information and notations
  • Extensions
  • Consultations received from other government institutions and organizations
    • Number of consultations
    • Sources of consultations
    • Disposition and recommendations
    • Completion time
  • Completion time of consultations on Cabinet confidences
  • Resources related to the Privacy Act
• Training activities
• Policies, guidelines, procedures, and initiatives
  • ATIP governance structure
  • Information about Programs and Information Holdings
  • Initiatives
• Complaints, audits, and investigations
• Court action
• Monitoring compliance
• Material privacy breaches
• Privacy impact assessments
• Public interest disclosures
• Appendix A – Delegation Order
• Appendix B – Statistical Report on the Privacy Act

Introduction

The Privacy Act (the Act) came into force on July 1, 1983. The purpose of the Act is to protect the privacy of individuals with respect to personal information about themselves held by government institutions as well as to provide individuals with a right of access to that information.

The Public Prosecution Service of Canada (PPSC) became subject to the Act when it was established as an independent organization on December 12, 2006, with the coming into force of the Director of Public Prosecutions Act (Part 3 of the Federal Accountability Act).

Pursuant to section 72 of the Act, this 2017-2018 Annual Report on the Privacy Act has been prepared for tabling in the House of Commons and the Senate. This Report provides an analysis of the information contained in the PPSC’s Statistical Report on the Privacy Act. In addition, it reports on emerging trends, training activities, internal policies, guidelines and procedures with respect to the PPSC’s administration of the Act.

The Public Prosecution Service of Canada

The PPSC’s mandate is set out in the Director of Public Prosecutions Act (DPPA). The DPPA empowers the Director of Public Prosecutions (DPP) as Deputy Attorney General of Canada to:

• initiate and conduct federal prosecutions;
• intervene in proceedings that raise a question of public interest that may affect the conduct of prosecutions or related investigations;
• issue guidelines to federal prosecutors;
• advise law enforcement agencies or investigative bodies on general matters relating to prosecutions and on particular investigations that may lead to prosecutions;
• communicate with the media and the public on all matters that involve the initiation and conduct of prosecutions;
• exercise the authority of the Attorney General of Canada in respect of private prosecutions; and
• exercise any other power or carry out any other duty or function assigned by the Attorney General of Canada that is compatible with the office of the DPP.

The DPPA also empowers the DPP to:

• initiate and conduct prosecutions under the Canada Elections Act; and
• act, when requested by the Attorney General of Canada, in matters under the Extradition Act and the Mutual Legal Assistance in Criminal Matters Act.

The DPP has the rank and status of a deputy head of a department, and in this capacity is responsible for the management of the PPSC as a distinct governmental organization.

Commissioner of Canada Elections

The Commissioner of Canada Elections (CCE) is responsible for ensuring that the Canada Elections Act and the Referendum Act are complied with and enforced. While the CCE is part of the PPSC, it remains operationally independent.

All privacy requests and consultations regarding CCE are processed by the PPSC’s ATIP Office.

Access to Information and Privacy Office

The ATIP Office holds primary responsibility for the implementation and administration of the Act. The Office deals directly with the public in relation to privacy requests, liaises with Offices of Primary Interest to prepare responses, and serves as the centre of expertise for access to information and privacy (ATIP) within the PPSC.

The ATIP Office fulfills its responsibilities by:

• processing requests for personal information in accordance with the Act, the Privacy Regulations and the Treasury Board Secretariat of Canada’s (TBS) policies, directives and guidelines;
• responding to consultations submitted by other federal institutions or other levels of government on PPSC records being considered for release;
• providing advice to PPSC managers and employees regarding the application and interpretation of the Act, its Regulations and relevant case law;
• responding to requests received from other government institutions for the review of solicitor-client privilege in records related to criminal proceedings in which the PPSC is involved;
• reviewing PPSC policies, procedures and agreements to ensure that they comply with the requirements of the Act and making recommendations for amendments;
• monitoring the PPSC’s compliance with the Act, its Regulations and TBS policies, directives and guidelines;
• communicating with investigators of the Office of the Privacy Commissioner of Canada (OPC) to resolve complaints filed against the PPSC;
• reviewing documents relevant to proactive disclosure, such as audits and evaluations and contracts over $25,000, prior to their publication on the PPSC’s website, in order to ensure that they do not contain personal information;
• delivering training sessions intended to familiarize PPSC managers and employees with the requirements of the Act, its Regulations and the TBS’s policies, directives and guidelines;
• updating the PPSC’s chapter of the federal government’s Information About Programs and Information Holdings publication (formerly known as Info Source: Sources of Government and Employee Information);
• submitting an annual statistical report on the administration of the Act to TBS; and
• preparing an annual report on the administration of the Act for tabling in both Houses of Parliament.

Organizational structure

The Director, Corporate Planning and External Relations Division (CPERD), acts as the PPSC’s ATIP Coordinator. Counsel for the CPERD provides legal advice to the ATIP Coordinator, the ATIP Office and PPSC managers on the application and interpretation of the Act and relevant case law.

During the period from April 1, 2017, to March 31, 2018, the ATIP Office comprised a Manager, a Senior Advisor, two Advisors and one ATIP Officer, who was previously classified as Junior ATIP Analyst.

During this fiscal year, the ATIP Office had the additional support of a part-time casual employee and one student.

Delegated Authorities

Pursuant to section 73 of the Act, the head of a government institution may, by order, designate one or more officers or employees of that institution to exercise or perform any of the powers, duties of function of the head of the institution under the Act.

The DPP, as the “head of institution,” has designated the authority to exercise the powers and to perform the duties and functions conferred to her under the Act to the Director, Corporate Planning and External Relations Division (CPERD), as well as the Acting Director General, Corporate Services, and the ATIP Manager (Delegation Order in Appendix A). The ATIP Manager exercises this authority in the absence of the Director, CPERD. The Acting Director General, Corporate Services, exercises this authority in the absence of both the Director, CPERD, and the ATIP Manager.

Interpretation of the Statistical Report

The following section provides a summary and analysis of the information contained in the 2017-2018 Statistical Report on the Privacy Act in Appendix B of this report.

Requests received under the Privacy Act

Number of requests

During the 2017-2018 fiscal period, the PPSC received 16 formal requests for personal information, which reflects a 30% decrease from the number of requests received in the previous fiscal year. Additionally, nine (9) requests were carried forward from 2016-2017.

The PPSC has received a total of 156 personal information requests since December 12, 2006. Since 2006, the organization has experienced periodic, sharp increases in the number of received requests. Such an increase occurred in the previous fiscal year, where the PPSC received 23 requests in 2016-2017, an all-time high for the organization. Despite the fluctuations, the overall trend of the past twelve fiscal years suggests that the number of requests received by the PPSC is increasing.

Note: As the PPSC was created on December 12, 2006, data for 2006-2007 only reflects a three-month period.

Requests closed during the fiscal year

Disposition of requests

During the 2017-2018 fiscal period, the PPSC responded to 18 formal requests for personal information. Seven (7) requests were not completed by March 31, 2018, and were carried over to the next fiscal year.

The disposition of closed requests is as follows:

Records were fully or partially disclosed in response to 14 requests closed in 2017-2018, which was 78% of all closed requests. This is an 18% proportional increase from the previous fiscal year. Over the last five fiscal years, an average of 63% of closed requests have resulted in a full or partial disclosure of records to the applicants.

There were no requests closed in 2017-2018 where all records were exempted or excluded. Other requests were disposed as follows:

No records exist

• One (1) request could not be processed because no relevant records existed under the control of the PPSC. When possible, applicants were advised of other government institutions that may have records, and were provided with contact information for the purpose of submitting their request.

Request abandoned

• Two (2) requests were abandoned by the applicants. In most abandoned cases, clarification is needed from the applicant and the applicant is contacted accordingly. When the applicant does not provide clarification, the applicant’s request is deemed abandoned.

Neither confirmed nor denied

• Paragraph 16(1)(b) of the Act was invoked in one (1) request, where the PPSC could not confirm nor deny that records existed. In this case, the PPSC advised the applicant that if the records did exist, they would have qualified for exemption under paragraph 22(1)(a) of the Act, which protects information relating to law enforcement and investigations.

Number of pages processed

A total of 15,723 pages were processed for requests closed in 2017-2018, a substantial increase from the previous fiscal year, in which 1,475 pages were processed. Additionally, the number of pages processed in 2017-2018 is almost double the number of pages processed during the last four fiscal years combined. This increase was largely attributable to four (4) requests closed by the PPSC, each of which involved greater than 1,000 pages. These four (4) requests represented 22% of all requests closed by the PPSC in 2017-2018.

Completion time

Of the 18 requests closed in the 2017-2018 fiscal period, seven (7) requests were closed within the initial 30-day statutory deadline. This is a 53% decrease from the 15 requests that were closed within the same timeframe the previous fiscal year. This decrease could be attributable to the substantially greater number of pages that were processed in 2017-2018, as compared with the previous fiscal year.

Overall, out of the 81 requests closed over the last five fiscal years, the PPSC has closed 62% within 30 days of receipt.

Exemptions

An individual’s right of access to his or her personal information is subject to limited and specific exceptions. Limitations to the right of access are set out in sections 18 through 28 of the Act.

The following is a breakdown of the exemptions that were applied for requests closed by the PPSC in 2017-2018:

Over the last five fiscal years, sections 26 [Information about another individual] and 27 [Solicitor-client privilege] of the Act have been most often invoked by the PPSC when exempting information from disclosure. This reflects the mandate of the PPSC to conduct federal prosecutions, which often involve individuals, as well as to provide legal advice to law enforcement agencies and investigative bodies on matters relating to prosecutions.

Exclusions

Records or parts thereof to which the Act does not apply are considered to be “excluded.” Pursuant to section 69, the Act does not apply to library or museum material preserved solely for public record or material placed in Library and Archives Canada. Records containing Confidences of the Queen's Privy Council for Canada that have been in existence for less than 20 years are also excluded from the Act pursuant to section 70.

No exclusions were applied by the PPSC in 2017-2018.

Format of information released

Where records were fully or partially disclosed, information was provided to the applicant electronically, on compact disk, in 79% of requests that were closed in fiscal year 2017-2018.

Paper copies of records were provided in response to the remaining requests that were closed, whether at the request of the applicant or when the records totaled 50 pages or fewer. Since there was a significant increase in the number of pages processed this fiscal year, the majority of records were provided electronically.

Over the last five fiscal years, 53% of all responses have been in electronic format, while 47% have been paper-based.

Complexity

Due to the nature of the PPSC’s work, processing requests can be challenging and are regularly deemed “complex” based on a number of factors:

• Records held by the PPSC often contain information relating to criminal or regulatory investigations or prosecutions that also frequently involve other organizations at the federal, provincial or territorial level. For this reason, consultations can be required.
• Requests to the PPSC often pertain to high-profile or sensitive topics, and legal advice is often sought in such matters.
• For a majority of requests, the PPSC must retrieve records from across the country.
• The applicant’s personal information is often intermixed with that of another individual. This was the case for 12 of the 18 requests closed in 2017-2018 where section 26 of the Act was applied, which protects the personal information of other individuals.

Deemed refusals

Requests that are not closed within the initial 30-day statutory deadline or within a timeframe covered by an extension provided by the Act are referred to as “deemed refusals.” Further information on the circumstances in which an extension to the original deadline is permitted by the Act is available in the section about extensions.

Seven (7) requests were closed as deemed refusals in 2017-2018 as a result of workload. These requests involved 14,449 pages in total, which represents 92% of all pages processed for requests closed this fiscal year.

Requests for translation

During the 2017-2018 fiscal period, the PPSC did not receive any requests from applicants to translate records from one official language to the other.

Over the last five fiscal years, the PPSC received only one (1) request for translation. In this case, the organization granted an applicant’s request in 2014-2015 to translate records from French to English.

Requests for correction of personal information and notations

Paragraph 12(2)(a) of the Act provides every individual that is given access to their personal information the right to request correction if:

• The individual believes there is an error or omission regarding their information; and
• The information has been, is being used, or is available for use for an administrative purpose (i.e., a decision-making process that directly affects the individual).

Where correction is not possible, the individual has the right to request a notation about the error or omission to be placed on the file.

There were no requests for correction of personal information or notations in fiscal year 2017-2018. This has been typical of the last five fiscal years.

Extensions

Paragraph 15(a) of the Act allows for an extension of the 30-day statutory deadline for a maximum of 30 additional days in cases where meeting the original deadline would unreasonably interfere with the operations of the government institution processing the request, or when consultations with other government institutions are necessary and cannot reasonably be completed within the original deadline.

Eight (8) extensions in total were taken to process requests closed in fiscal year 2017-2018, which is an increase from recent fiscal years. Over the last five fiscal years, the PPSC has taken an average of five (5) extensions each fiscal year.

The substantial amount of pages to be processed this fiscal year was a significant factor in the increase. The majority of the extensions taken in 2017-2018 were for the maximum length of 30 additional days permitted by the Act and were taken because processing the requests within the original deadline would have interfered with the PPSC’s operations.

The following table sets out the length and reasons for all extensions:

Consultations received from other institutions and organizations

Number of consultations

During the 2017-2018 fiscal period, the PPSC received five (5) consultations from other government institutions and organizations for processing under the Act. This is an increase of three (3) from the previous fiscal year.

The PPSC has received a total of 112 consultations since December 12, 2006. There was a sharp increase in the number of consultations in 2010-2011, but since then and especially in recent fiscal years, the number of consultations received by the PPSC has generally declined.

Note: As the PPSC was created on December 12, 2006, data for 2006-2007 only reflects a three-month period.

Sources of consultations

All five (5) of the consultations received in 2017-2018 originated from different sources, four (4) of which were other government institutions subject to the Act: the Department of Justice Canada, the Canada Border Services Agency, the Canada Revenue Agency, and the Royal Canadian Mounted Police. These institutions have been frequent sources of consultations for the PPSC over the last five fiscal years. One (1) other consultation was sent by a provincial government institution, the ministry of Alberta Justice and the Solicitor General.

Disposition and recommendations

The PPSC responded to three (3) of the five (5) consultations received in fiscal year 2017-2018. The other two (2) consultations were not completed by March 31, 2018, and were carried over to the next fiscal year.

A total of 17 pages were processed in 2017-2018 in order to respond to these three (3) consultations. This is a significant decrease from 2016-2017, where 1,776 pages were processed. However, the number of pages processed in 2016-2017 is not typical of the past five fiscal years; overall, there have been fewer pages to process.

Of the consultations completed in 2017-2018, the PPSC recommended that the other government institutions and organizations disclose the records fully or partially in all cases.

Over the last five fiscal years, the PPSC has never recommended full exemption of the records that were sent to the organization in consultation.

Completion time

Of the three (3) consultations completed in 2017-2018, one (1) was completed within 15 days of receipt, which is a decrease from the previous fiscal year, in which two (2) were completed within the same timeframe. The other two (2) consultations were completed within 31 to 60 days in 2017-2018.

Of the 34 consultations completed over the last five fiscal years, 85% of them were completed within 30 days of receipt.

Completion time of consultations on Cabinet confidences

No consultations on the application of section 70 [Cabinet confidence] of the Act were carried out during fiscal year 2017-2018.

Resources related to the Privacy Act

During the 2017-2018 fiscal period, the PPSC spent a total of $199,508 administering the Act, of which salaries accounted for 95% ($190,151) of expenditures, while goods and services accounted for the remaining 5% ($9,357).

No overtime expenditures were incurred in 2017-2018.

Training activities

ATIP personnel provided informal learning to employees on an ad hoc basis regarding the processing of personal information requests.

The ATIP Office also regularly provided advice to PPSC officials regarding the interpretation of the Act to ensure that personal information is appropriately collected, used, disclosed and protected.

No formal training or awareness activities were provided to PPSC employees in fiscal year 2017-2018.

Policies, guidelines, procedures, and initiatives

ATIP governance structure

The PPSC ATIP Governance Structure was approved by the PPSC’s Executive Council in October 2011. It outlines the reporting relationships within the PPSC and establishes clear responsibilities for decision-making for the purposes of administering the Act.

Information about Programs and Information Holdings

Information about Programs and Information Holdings (formerly known as Info Source: Sources of Government and Employee Information) is published on the Government of Canada’s canada.ca website. It provides information about the functions, programs, activities and related information holdings of government institutions subject to the Access to Information Act and the Privacy Act.

It also serves as the Government’s repository of personal information banks, which outline how personal information is collected, used, disclosed, retained and disposed of in order to administer the Government’s programs and services.

Each year, the PPSC ATIP Office updates information about the PPSC’s activities and information holdings in the publication. The PPSC updated information about its personal information banks in fiscal year 2017-2018.

Initiatives

The PPSC did not implement any new policies or initiatives related to privacy during fiscal year 2017-2018. However, the PPSC expects to develop new and revised privacy procedures throughout the next fiscal year in preparation for government-wide modernization of ATIP digital services.

Privacy tools were updated so that the organization may continue to efficiently process requests under the Act. Notably, a new Statement of Completeness form was developed and implemented in 2017-2018. The Statement of Completeness much be completed by PPSC officials each time they are tasked with responding to a request. The form assists in compliance by requiring officials to attest that they have conducting a thorough search for records and provides a useful means for officials to communicate relevant details about the records for the ATIP Office’s consideration when reviewing the records.

Complaints, audits, and investigations

Decisions made under the Act are subject to a two-tiered system of review. The first level of review is a formal complaint to the Office of the Privacy Commissioner of Canada (OPC); the second level is an application for judicial review to the Federal Court. The PPSC reviews the outcomes of all OPC investigations and incorporates lessons learned into business processes, where appropriate.

During the 2017-2018 fiscal period, four (4) complaints were filed with the OPC against the PPSC, three (3) of which were still under investigation as of March 31, 2018.

The other complaint was resolved before the end of the fiscal year. Due to the complexity of the records at issue, the PPSC was unable to process the request within the statutory deadline under the Act. Once the PPSC provided the applicant with a copy of the relevant records in response to their request, the OPC concluded its investigation.

No audits were received in 2017-2018.

The following table is a breakdown of the reasons for the complaints as well as the findings of the OPC’s investigations:

Court action

There were no applications for judicial review filed with the Federal Court pursuant to section 41 Act in fiscal year 2017-2018.

Monitoring compliance

The ATIP Office maintains a comprehensive statistical reporting and performance measurement system. The ATIP Manager meets with the ATIP Coordinator weekly on the status of active requests, complaints and any issues that have arisen.

The ATIP Office also provides reports to PPSC senior management on its activities, investigations and trends related to privacy on an ad hoc basis.

Material privacy breaches

A material privacy breach involves improper or unauthorized collection, use, disclosure, retention or disposal of sensitive personal information which could reasonably be expected to cause serious injury or harm to the individual to whom it relates.

The ATIP Office received reports of three (3) material privacy breaches in fiscal year 2017-2018. In all cases, records containing sensitive personal information were either improperly redacted or inadvertently disclosed to defence counsel in legal proceedings. The PPSC took immediate steps to mitigate these breaches and reviewed internal processes for improvements.

Privacy impact assessments

A Privacy Impact Assessment (PIA) is a tool used to assist a government institution in meeting its privacy responsibilities with regard to the management of personal information. PIAs are initiated when assessing the privacy implications of new or substantially modified programs and activities involving personal information.

No PIAs were completed by the PPSC in fiscal year 2017-2018.

Public interest disclosures

Subsection 8(2) of the Act describes the circumstances under which an individual’s personal information under the control of a government institution may be disclosed without their consent.

During the 2017-2018 fiscal period, no disclosures were made to federal investigative bodies for the purpose of enforcing any law in Canada, or for carrying out a lawful investigation, pursuant to paragraph 8(2)(e) of the Act, nor were there any disclosures made in the public interest, pursuant to paragraph 8(2)(m) of the Act.

Appendix A – Delegation order

The Director of Public Prosecutions, pursuant to section 73 of the Access to Information Act and section 73 of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or with respect to the position of Director General, Corporate Services, any person occupying the position on an acting basis, to exercise the powers, duties and functions of the Director as the head of the Office of the Director of Public Prosecution, under the provisions of the Act and related regulations set out in the schedule opposite each position. This designation replaces ail previous delegation orders.

Schedule

Dated, at the City of Ottawa, this 6^th day of November, 2017.

Kathleen Roussel
Director of Public Prosecutions

Appendix B – Statistical Report on the Privacy Act

Name of institution: Public Prosecution Service of Canada

Reporting period: 2017-04-01 to 2018-03-31

Part 1: Requests Under the Privacy Act

Part 2: Requests Closed During the Reporting Period

2.1 Disposition and completion time

2.2 Exemptions

2.3 Exclusions

2.4 Format of information released

2.5 Complexity

2.5.1 Relevant pages processed and disclosed

2.5.2 Relevant pages processed and disclosed by size of requests

2.5.3 Other complexities

2.6 Deemed refusals

2.6.1 Reasons for not meeting statutory deadline

2.6.2 Number of days past deadline

2.7 Requests for translation

Part 3: Disclosures Under Subsection 8(2) and 8(5)

Part 4: Requests for Correction of Personal Information and Notations

Part 5: Extensions

5.1 Reasons for extensions and disposition of requests

5.2 Length of extensions

Part 6: Consultations Received From Other Institutions and Organizations

6.1 Consultations received from other Government of Canada institutions and other organizations

6.2 Recommendations and completion time for consultations received from other Government of Canada institutions

6.3 Recommendations and completion time for consultations received from other organizations

Part 7: Completion Time of Consultations on Cabinet Confidences

7.1 Requests with Legal Services

7.2 Requests with Privy Council Office

Part 8: Complaints and Investigation Notices Received

Part 9: Privacy Impact Assessments (PIAs)

Part 10: Resources Related to the Privacy Act

10.1 Costs

10.2 Human Resources

Note: Enter values to two decimal places.