Annual Report on the Privacy Act 2020-2021

Table of Contents

• 1 Introduction
• 2 The Public Prosecution Service of Canada
• 3 The ATIP Office
  • 3.1 Organizational structure
• 4 Delegated authorities
• 5 Performance
  • 5.1 Requests received under the Privacy Act
    • 5.1.1 Number of requests
  • 5.2 Requests closed during the fiscal year
    • 5.2.1 Disposition of requests
    • 5.2.2 Number of pages processed
    • 5.2.3 Completion time
    • 5.2.4 Exemptions
    • 5.2.5 Exclusions
    • 5.2.6 Format of information released
    • 5.2.7 Complexity
    • 5.2.8 Deemed refusals
    • 5.2.9 Requests for translation
  • 5.3 Requests for correction of personal information and notations
  • 5.4 Extensions
  • 5.5 Consultations received from other institutions
    • 5.5.1 Number of consultations
    • 5.5.2 Sources of consultations
    • 5.5.3 Disposition and recommendations
    • 5.5.4 Completion time
  • 5.6 Consultations on Cabinet confidences
  • 5.7 Costs
• 6 Training and awareness activities
• 7 Policies, guidelines, procedures, and initiatives
  • 7.1 ATIP governance structure
  • 7.2 Information about Programs and Information Holdings
  • 7.3 Initiatives
  • 7.4 COVID-19 mitigation measures
• 8 Complaints and investigations
• 9 Monitoring compliance
• 10 Material privacy breaches
• 11 Privacy impact assessments
• 12 Public interest disclosures
• 13 Appendix A – Delegation order
• 14 Appendix B – Statistical report on the Privacy Act
• 15 Appendix C – Supplemental statistical report on the Access to Information Act and the Privacy Act

1 Introduction

The Privacy Act (the Act) came into force on July 1, 1983. The purpose of the Act is to protect the privacy of individuals with respect to personal information about themselves held by government institutions as well as to provide individuals with a right of access to that information.

The Public Prosecution Service of Canada (PPSC) became subject to the Act when it was established as an independent organization on December 12, 2006, with the coming into force of the Director of Public Prosecutions Act (Part 3 of the Federal Accountability Act).

Pursuant to section 72 of the Act, this 2020-2021 Annual Report on the Act has been prepared for tabling in the House of Commons and the Senate. This Report provides an analysis of the information contained in the PPSC's Statistical Report on the Act. In addition, it reports on emerging trends, training activities, internal policies, guidelines, and procedures with respect to the PPSC's administration of the Act.

2 The Public Prosecution Service of Canada

The PPSC's mandate is set out in the Director of Public Prosecutions Act (DPPA). The DPPA empowers the Director of Public Prosecutions (DPP), as Deputy Attorney General of Canada, to:

• Initiate and conduct federal prosecutions;
• Intervene in proceedings that raise a question of public interest that may affect the conduct of prosecutions or related investigations;
• Issue guidelines to federal prosecutors;
• Advise law enforcement agencies or investigative bodies on general matters relating to prosecutions and on particular investigations that may lead to prosecutions;
• Communicate with the media and the public on all matters that involve the initiation and conduct of prosecutions;
• Exercise the authority of the Attorney General of Canada in respect of private prosecutions; and
• Exercise any other power or carry out any other duty or function assigned by the Attorney General of Canada that is compatible with the office of the DPP.

The DPPA also empowers the DPP to:

• Initiate and conduct prosecutions under the Canada Elections Act; and
• Act, when requested by the Attorney General of Canada, in matters under the Extradition Act and the Mutual Legal Assistance in Criminal Matters Act.

The DPP has the rank and status of a deputy head of a department and, in this capacity, is responsible for the management of the PPSC as a distinct government institution.

3 The ATIP Office

The ATIP Office holds primary responsibility for the implementation and administration of the Privacy Act, along with the Access to Information Act (collectively known as ATIP). The Office deals directly with the public in relation to personal information requests, liaises with Offices of Primary Interest (the subject matter experts) to prepare responses, and serves as the centre of ATIP expertise within the PPSC.

The ATIP Office fulfills its responsibilities by:

• Processing requests for personal information in accordance with the Privacy Act, the Privacy Regulations (the Regulations), and the Treasury Board of Canada's policies, directives, and guidelines;
• Responding to consultations submitted by other federal government institutions or other levels of government on PPSC records being considered for release, including the review of solicitor-client privilege in records related to criminal proceedings;
• Providing advice to PPSC managers and employees regarding the application and interpretation of the Act, the Regulations, and Treasury Board policies and directives;
• Reviewing PPSC policies, procedures, and agreements as well as making recommendations to ensure that they comply with the requirements of the Act;
• Monitoring the PPSC's compliance with the Act, its Regulations, and Treasury Board policies and directives;
• Communicating with investigators of the Office of the Privacy Commissioner of Canada to resolve complaints filed against the PPSC;
• Reviewing documents relevant to proactive publication, such as briefing note titles and contracts over $10,000, prior to their publication on the PPSC's website, ensuring that they do not contain personal information;
• Delivering training sessions intended to familiarize the PPSC's managers and employees with the requirements of the Act, the Regulations, and Treasury Board policies and directives;
• Updating the PPSC's chapter of the federal government's Information About Programs and Information Holdings publication (formerly known as Info Source: Sources of Government and Employee Information);
• Submitting an annual statistical report on the administration of the Act to the Treasury Board of Canada Secretariat (TBS); and
• Preparing an annual report on the administration of the Act for tabling in both Houses of Parliament.

3.1 Organizational structure

As of February 2021, the Director General, Communications and Parliamentary Affairs (CPA), acts as the PPSC's ATIP Coordinator. This role was held previously by the Executive Director, Corporate Planning and External Relations Division.

During the period from April 1, 2020, to March 31, 2021, the ATIP Office comprised a Manager, two Senior Advisors, two Advisors, and an ATIP Officer.

The following chart outlines the organizational structure of the ATIP Office on March 31, 2021:

4 Delegated authorities

Pursuant to section 73 of the Act, the head of a government institution may designate one or more officers or employees of that institution, by order, to exercise or perform any of the powers, duties, or functions of the head of the institution under the Act.

The DPP, as the "head of institution," has designated this authority to the Director General, CPA, as well as the Senior Director General, Corporate Services, and the ATIP Manager (Delegation Order in Appendix A). The ATIP Manager exercises this authority in the absence of the Director General, CPA. The Senior Director General, Corporate Services, exercises this authority in the absence of both the Director General, CPA, and the ATIP Manager.

5 Performance

The following section provides an overview of key data on the PPSC's performance for the fiscal year, as reflected in the 2020-2021 Statistical Report on the Act in Appendix B of this report.

5.1 Requests received under the Privacy Act

5.1.1 Number of requests

The following chart illustrates this trend:

Note: As the PPSC was created on December 12, 2006, data for 2006-2007 only reflects a three-month period.

5.2 Requests closed during the fiscal year

5.2.1 Disposition of requests

Out of the 22 requests received in 2020-2021 or carried over from the previous period, the PPSC responded to 15 formal personal information requests, which is 38% fewer than the number of requests closed in 2019-2020 but similar to the closure rate in earlier reporting periods. This is described in the chart below, which sets out the closure rate from the past five (5) fiscal years:

Seven (7) requests remained outstanding as of March 31, 2020, and were carried forward to the next fiscal year. In comparison, three (3) requests were outstanding by the end of the previous period.

The disposition of requests closed in 2020-2021 is as follows:

Of the 15 requests closed in 2020-2021, records were fully or partially disclosed in 10 cases. On average, 62% of requests closed over the past five (5) reporting periods have resulted in a full or partial disclosure of records to applicants.

There were no requests closed in 2020-2021 where records were all exempted or excluded, as was the case in the previous fiscal year. Other requests were disposed of as follows:

No records exist

Three (3) requests could not be processed because relevant records did not exist under the control of the PPSC. Where possible, applicants were advised of other government institutions that may have records and were provided with contact information accordingly.

Request abandoned

Two (2) requests were abandoned by the applicants. In most abandoned cases, clarification is needed from the applicants in order to process their requests. When the applicants do not provide clarification, the requests are deemed as abandoned. In other cases, the applicants choose to abandon their requests.

5.2.2 Number of pages processed

For the 15 cases closed in 2020-2021, the PPSC processed 1,273 pages relevant to the requests, which is 65% fewer pages than in the previous period. This decrease could be due to the effects of COVID-19 pandemic restrictions on ATIP operations when local lockdowns on business and other activities were implemented during the year.

The PPSC ATIP Office also reviewed an additional 1,188 pages received from across the organization that were deemed to be not relevant to the requests and were therefore not included as part of the responses.

The following is a summary of the relevant pages processed by the PPSC over the last five (5) fiscal years:

5.2.3 Completion time

Of those closed in 2020-2021, 12 requests were processed within the initial 30-day statutory deadline, representing 80% of requests. This is a similar proportion to those closed within the same timeframe in 2019-2020.

The proportion of requests closed within 30 days of receipt has steadily increased over the last five (5) fiscal years, aside from a decrease in the rate for 2017-2018 due to a shortage of human resources in the ATIP Office. This trend is demonstrated in the chart that follows:

Over the three (3) most recent fiscal years, the PPSC has processed 75% of closed requests within the first 30 days, on average.

The following table is a breakdown of the number of days taken to respond to requests in 2020-2021:

5.2.4 Exemptions

An individual's right of access to his or her personal information is subject to limited and specific exceptions. Limitations to the right of access are set out in sections 18 through 28 of the Act.

The following is a breakdown of the exemptions applied by the PPSC in 2020-2021 for closed requests:

Over the last five (5) fiscal years, sections 26 (information about another individual) and 27 (solicitor-client privilege) of the Act have been most often invoked by the PPSC when exempting information from disclosure. This reflects the mandate of the PPSC to conduct federal prosecutions, which often involve personal information about individuals, and to provide legal advice to law enforcement agencies and investigative bodies on matters relating to prosecutions.

5.2.5 Exclusions

Records or parts thereof to which the Act does not apply are considered to be "excluded." Pursuant to section 69, the Act does not apply to library or museum material preserved solely for public record or material placed in Library and Archives Canada. Records containing confidences of the Queen's Privy Council for Canada, also known as Cabinet confidences, and which have been in existence for less than 20 years are also excluded from the Act pursuant to section 70.

The PPSC did not invoke any exclusions in 2020-2021.

5.2.6 Format of information released

Information was released electronically for all 10 requests where the PPSC fully or partially disclosed records in 2020-2021. This is an increase from the previous period, where information was released electronically 92% of the time.

Overall, in the last five (5) fiscal years, 78% of releases have been in electronic format, whether by email or compact disk, while 22% have been paper-based.

The proportion of electronic to paper-based releases of records from year to year is as follows:

5.2.7 Complexity

Due to the nature of the PPSC's work, processing requests can be challenging, and requests are regularly deemed "complex" based on a number of factors:

• The predominant complexity in five (5) requests was a need to retrieve records from across the country, including two (2) cases where the retrievals and review were further complicated by early pandemic-related restrictions on business activities. In 2020-2021, the Ontario Regional Office and the National Capital Regional Office were the regions most frequently involved in searches, which were tasked five (5) and (4) times, respectively, for requests closed in this period.
• The applicant's personal information is often intermixed with that of another individual. In these cases, section 26 of the Act could be applied to protect the personal information of other individuals. Intermixed personal information was the main complicating factor in five (5) cases closed in 2020-2021.

5.2.8 Deemed refusals

Requests that are not closed within the initial 30-day statutory deadline or within a timeframe covered by an extension provided by the Act are referred to as "deemed refusals." Further information on the circumstances in which an extension to the original deadline is permitted by the Act is available in section 5.4 (Extensions) of this report.

The vast majority of the 15 requests closed in the reporting period were responded to within the initial deadline or within an extended timeframe, representing 93% of cases.

One (1) request was closed as a deemed refusal in 2020-2021, three (3) fewer than in the previous period. This file related to a prosecution, where it was later determined that an extension should have been taken because of workload and interference with government operations. This was overlooked due to exceptional circumstances that coincided with the pandemic's onset. As a result, the request in question was closed 102 days past deadline.

5.2.9 Requests for translation

During the 2020-2021 fiscal year, the PPSC did not receive any requests from applicants to translate records from one official language to the other. This is consistent with the last five (5) fiscal years.

5.3 Requests for correction of personal information and notations

5.4 Extensions

Paragraph 15(a) of the Act allows for an extension of the initial statutory deadline for a maximum of 30 additional days in cases where meeting the original deadline would unreasonably interfere with the operations of the government institution processing the request, or when consultations with other government institutions are necessary and cannot be reasonably completed within the original deadline.

5.5 Consultations received from other institutions

5.5.1 Number of consultations

The PPSC received one (1) consultation from another government institution for processing under the Act in 2020-2021, one (1) fewer than in 2019-2020.

Additionally, another consultation was carried over from the previous period. Altogether, the PPSC had two (2) consultations to process in 2020-2021.

The PPSC has received 120 consultations in total since December 12, 2006. There was a sharp increase in the number of consultations in 2010-2011, but since then and especially in recent fiscal years, the number of consultations received by the PPSC has generally declined.

The following chart illustrates this trend:

Note: As the PPSC was created on December 12, 2006, data for 2006-2007 only reflects a three-month period.

5.5.2 Sources of consultations

The consultation received in 2020-2021 originated from Transport Canada, which is also subject to the Act. This is not typical of personal information consultations undertaken with the PPSC. Instead, the Royal Canadian Mounted Police, the Canada Border Services Agency, and the Ministry of Alberta Justice and the Solicitor General have been the most frequent sources of consultations over the last five (5) fiscal years.

5.5.3 Disposition and recommendations

The PPSC responded to two (2) consultations in 2020-2021. Therefore, there were no consultations outstanding as of March 31, 2021, and carried forward to the next fiscal year.

The PPSC processed 686 pages in closing these consultations, which is a significant increase from the single page processed in 2019-2020. The majority of these pages related to one (1) consultation that was carried over from the previous period.

The number of pages processed over the last five (5) fiscal periods have considerably fluctuated from year to year, which is demonstrated in the following chart:

For the consultations completed in 2020-2021, the PPSC recommended that the records be disclosed in full for one (1) case, and partially disclosed for the other. Over the last five (5) fiscal years, the PPSC has never recommended full exemption of the records sent in consultation.

5.5.4 Completion time

One (1) of the consultations closed in 2020-2021 was completed quickly, within 15 days of receipt. The other consultation, which had been carried over from the previous period, required more than a year to complete due to the volume and complexity of records involved.

Over the last five (5) fiscal years, approximately half of the consultations received were completed within 30 days or less.

5.6 Consultations on Cabinet confidences

No consultations regarding section 70 (Cabinet confidences) of the Act were carried out during fiscal year 2020-2021.

5.7 Costs

In the 2020-2021 fiscal year, the PPSC spent a total of $194,067 administering the Act, of which salaries accounted for nearly all expenditures at $193,567, while goods and services accounted for the remaining $500.

No overtime expenditures were incurred during this period.

6 Training and awareness activities

No formal ATIP awareness sessions were delivered in 2020-2021.

Presentations were delivered in the previous fiscal year to raise awareness of corporate responsibilities regarding ATIP. These materials continue to be made available to all PPSC employees through the internal website. Communiqués on ATIP topics were also distributed throughout the year as part of the PPSC's corporate newsletters, which included promoting Data Privacy Day 2021.

ATIP personnel provided informal learning to employees on an ad hoc basis regarding the processing of personal information requests and regularly provided advice to PPSC officials on the interpretation of the Act, including the appropriate collection, use, disclosure, and safeguarding of personal information.

7 Policies, guidelines, procedures, and initiatives

7.1 ATIP governance structure

The PPSC ATIP Governance Structure was approved by the PPSC's Executive Council in October 2011. It outlines the reporting relationships within the PPSC and establishes clear responsibilities for decision-making for the purposes of administering the Act.

7.2 Information about Programs and Information Holdings

Information about Programs and Information Holdings (formerly known as Info Source: Sources of Government and Employee Information) is published on the Government of Canada's canada.ca website. It provides information about the functions, programs, activities, and related information holdings of government institutions subject to the Access to Information Act and the Privacy Act.

It also serves as the Government's repository of personal information banks, which outline how personal information is collected, used, disclosed, retained, and disposed of in order to administer the Government's programs and services.

At least once a year, the PPSC ATIP Office reviews and updates information, if necessary, about the PPSC's activities and information holdings in the publication. No updates were required in 2020-2021.

7.3 Initiatives

7.4 COVID-19 mitigation measures

The ongoing COVID-19 pandemic presented a unique challenge for the ATIP Office. In response to emergency public health measures put in place at the end of the previous period, the Office had transferred operations to a remote working environment.

In these cases, the ATIP Office limited the disruption by implementing work plans to prioritize and process these records post-lockdown. Staff also consulted applicants and other government institutions on a case-by-case basis to find solutions for moving these requests and consultations forward.

When lockdowns were lifted, ATIP Office staff were authorized to return to work onsite based on operational requirements. In these circumstances, the Office retained partial capacity for processing non-electronic records. Minor processing delays sometimes occurred, depending on the volume of records involved and when staff could obtain prior approval to work onsite. Further information on capacity is available in the 2020-2021 Supplemental Statistical Report in Appendix C of this report.

While the ATIP Office experienced some limitations in managing operations remotely, every effort was made to ensure applicants received complete responses within established timelines.

8 Complaints and investigations

Decisions made under the Act are subject to a two-tiered system of review. This ensures government institutions' compliance with their privacy protection obligations as well as respect for applicants' right of access to their personal information and fair treatment. The first level of review is a formal complaint made to the Privacy Commissioner. The second level is an application for judicial review to the Federal Court.

The PPSC reviews the outcomes of all Office of the Privacy Commissioner (OPC) investigations and incorporates lessons learned into business processes, where appropriate.

During the 2020-2021 fiscal period, no new complaints were filed with the OPC against the PPSC. Additionally, the PPSC did not receive findings or recommendations from the Commissioner in connection with any other complaint. Similarly, no privacy audits were undertaken.

There were no applications for judicial review filed with the Federal Court in 2020-2021.

9 Monitoring compliance

The ATIP Office maintains a comprehensive statistical reporting and performance measurement system. The ATIP Manager meets with the ATIP Coordinator weekly on the status of active requests, complaints, and any issues that have arisen.

The ATIP Office also provides reports to the PPSC's senior management on an ad hoc basis about its activities, caseload, investigations, and trends related to privacy.

10 Material privacy breaches

A material privacy breach involves improper or unauthorized collection, use, disclosure, retention, or disposal of sensitive personal information, which could be reasonably expected to cause serious injury or harm to the individual to whom it relates. These cases are to be reported to the TBS and the OPC, as required by the Treasury Board's Directive on Privacy Practices.

The ATIP Office did not receive any reports of material privacy breaches having occurred at the PPSC in 2020-2021.

11 Privacy impact assessments

A privacy impact assessment (PIA) is a tool that assists a government institution in meeting its privacy responsibilities regarding the management of personal information. Institutions initiate PIAs when assessing the privacy implications of new or substantially modified programs and activities involving personal information.

The PPSC did not complete any PIAs in 2020-2021.

12 Public interest disclosures

Subsection 8(2) of the Act describes the circumstances under which personal information under the control of a government institution may be disclosed without the individual's consent.

In particular, disclosures without consent may be made when in the public interest, pursuant to paragraph 8(2)(m) of the Act. One (1) such disclosure was made in 2020-2021 and the OPC was notified, in accordance with subsection 8(5) of the Act. A commission of inquiry requested the names of individuals accused of economic crimes. The PPSC weighed the interests of the affected individuals with that of the public and decided in favour of disclosure, provided that the scope of the request was narrowed to what was relevant to the investigation and the information would also be used solely for that purpose and not be broadly disclosed.

13 Appendix A – Delegation order

The Director of Public Prosecutions, pursuant to section 73 of the Access to Information Act and section 73 of the Privacy Act, as they existed prior to June 21, 2019, and pursuant to the current subsection 95(1) of the Access to Information Act and subsection 73(1) of the Privacy Act, hereby designates to the persons holding the positions set out in the schedule hereto the powers, duties and functions of the Director of Public Prosecutions as the head of the Office of the Director of Public Prosecutions, under the under the provisions of the Acts and related regulations set out in the schedule opposite each position. This designation replaces all previous delegation orders.

Schedule

Dated, at the City of Ottawa, this 22 ^nd day of February, 2021.

(original signed by)

Kathleen Roussel
Director of Public Prosecutions

14 Appendix B – Statistical report on the Privacy Act

Name of institution: Public Prosecution Service of Canada

Reporting period: 2020-04-01 to 2021-03-31

Section 1: Requests Under the Privacy Act

Section 2: Requests Closed During the Reporting Period

2.5 Complexity

2.6 Closed requests

2.7 Deemed refusals

Section 3: Disclosures Under Subsections 8(2) and 8(5)

Section 4: Requests for Correction of Personal Information and Notations

Section 5: Extensions

Section 6: Consultations Received from Other Institutions and Organizations

Section 7 – Completion Time of Consultations on Cabinet Confidences

Section 8 – Complaints and Investigations Notices Received

Section 9 – Privacy Impact Assessments (PIAs)

Section 10 – Material Privacy Breaches

Section 11 – Resources related to the Privacy Act

Note: Enter values to three decimal places.

15 Appendix C – Supplemental statistical report on the Access to Information Act and the Privacy Act

Name of institution: Public Prosecution Service of Canada

Reporting period: 2020-04-01 to 2021-03-31

Section 1: Capacity to Receive Requests

Enter the number of weeks your institution was able to receive ATIP requests through the different channels.

Section 2: Capacity to Process Records

2.1 Enter the number of weeks your institution was able to process paper records in different classification levels.

2.2 Enter the number of weeks your institution was able to process electronic records in different classification levels.

Date modified:

2021-12-06