2018 to 2019 Annual Report on the Access to Information Act and the Privacy Act

Access to Information Act

The purpose of the Access to Information Act (ATIA) is to provide a right of access to records under the control of a government institution. The act maintains that government information should be available to the public, that necessary exceptions to the right of access should be limited and specific, and that decisions on the disclosure of government information should be reviewed independently of government.

Privacy Act

The purpose of the Privacy Act (PA) is to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution and that provide individuals with a right of access to that information. The PA protects an individual's privacy by preventing others from having unlawful access to personal information. It also grants an individual specific rights regarding the collection, use and disclosure of this information.

Access to Information and Privacy reporting structure at Public Services and Procurement Canada

During the reporting period, the directorate's privacy policy and governance unit was divided into the privacy management and policy and governance units respectively. The new privacy management unit focusses its work on providing advice on the privacy related matters, the Privacy Act, and department-wide management of privacy risks. The ATIP policy and governance unit's mandate will concentrate on a strategic approach to promoting awareness of ATIP legislation within the department, and ensuring that necessary tools (including policies, procedures and training) are in place to support the ATIP Directorate, the ATIP liaison officers within each branch and the department as a whole.

Requests received

Pages reviewed

In 2018 to 2019, PSPC reviewed 224,771 pages for requests received under the Access to Information Act, which represents a 7% increase from the previous fiscal year. During the reporting period PSPC reviewed 271,332 pages for requests received under the Privacy Act, which represents a 6% increase from the previous reporting period. In total, the ATIP Directorate reviewed 469,103 pages in 2018 to 2019, an increase of over 29,000 pages from the previous fiscal year.

As of March 31, 2019, the department's backlog related to the ATIA consisted of 343 requests, representing over one million pages to be reviewed. The department is also managing a smaller backlog of 9 requests pursuant to the Privacy Act, which represents over 150,000 pages to be reviewed. The department has implemented a strategy to manage the backlog with resources dedicated to the closure of late files. It is expected that there will be further progress toward eliminating the backlog during the 2019 to 2020 reporting period. The department continues to work closely with the Offices of the Information Commissioner of Canada and the Privacy Commissioner of Canada in addressing this issue.

Sources of requests under the Access to Information Act

As with the previous fiscal year, during the 2018 to 2019 reporting period PSPC received the majority (76.45%) of its requests under the Access to Information Act from 3 sources: the media (31%), members of the public (26%) and private sector businesses (19%). 2018 to 2019 saw a decrease in the percentage of requesters who declined to identify themselves from the previous year.

Informal access requests under the Access to Information Act

PSPC publishes summaries of completed access to information requests, pertaining to records that do not contain personal or third party information, on the Open Government Portal. Members of the public can then submit informal requests for a copy of previously released information without having to pay the application fee.

In fiscal year 2018 to 2019, PSPC processed 311 informal access to information requests, which represents an increase of more than 150% from the 123 informal requests processed during the 2017 to 2018 reporting period.

Access to Information Act

The department invoked exemptions on 601 requests (51%), and all information was disclosed in 336 requests (29%). The remaining 229 (20%) were either abandoned, transferred or no records existed.

The majority of exemptions invoked by PSPC fell under 3 sections of the Access to Information Act:

• section 19(1), which protects personal information, was used in 333 files (28%)
• paragraph 20(1)(b), which protects confidential financial, commercial, scientific or technical information belonging to a third party, was used in 249 files (21%)
• paragraph 20(1)(c), which protects information the disclosure of which could result in material financial loss or prejudice the competitive position of a third party, in 172 files (15%)

Of note, more than 1 section (exemption) can be applied to a specific request.

Privacy Act

The department invoked exemptions on 207 requests (37%), and all information was disclosed in 259 requests (45%). The remaining 104 requests (18%) were either abandoned or no records existed.

The majority of exemptions invoked by PSPC fell under 3 sections of the Privacy Act:

• section 26, which protects personal information, was used in 198 files (35%)
• paragraph 22(1)(b), which addresses law enforcement and criminal investigations, was used in 11 files (2%)
• section 27, which protects solicitor-client privilege information, was used in 5 files (1%)

Of note, more than 1 section (exemption) can be applied to a specific request.

Exclusions

The Access to Information Act and Privacy Act do not apply to or exclude certain types of information, specifically records that are already available to the public (Section 68 of the ATIA) and confidence of the Queen's Privy Council (Section 69 of the ATIA and Section 70 of the PA).

Overall in the 2018 to 2019 reporting period, PSPC applied exclusions to records requested under the Access to Information Act on one occasion pursuant to Section 68, and cited Section 69 in 90 exclusions.

No exclusions were applied under the Privacy Act during the reporting period.

Disclosure of personal information under subsection 8(2)

In accordance with subsection 8(2) of the Privacy Act, under certain circumstances, a government institution may disclose personal information under its control without the consent of the individual to whom the information relates.

Four disclosures of personal information were made during the reporting period under the PA, 3 pursuant to paragraph 8(2)(e), releasing the information of 4 individuals, and 1 disclosure pursuant to paragraph 8(2)(m), releasing the information of one individual.

Consultations

PSPC responded to 397 consultations from other government institutions and organizations for records relating to the department's activities. These consultations totaled 33,797 pages, with 393 files (33,756 pages) relating to the Access to Information Act and 4 files (41 pages) relating to the Privacy Act.

A total of 88% of consultation files were responded to within 60 days against 61% for formal requests.

Of the 393 access to information consultations, 62 files (16%) were on the topic of defence with a higher level of sensitivity and complexity requiring more time and resources to review.

Extensions

Section 9 of the Access to Information Act permits the statutory time limits to be extended if consultations are necessary or if the request is for a larger volume of records, and processing it within the original time limit would unreasonably interfere with the operations of the department.

PSPC invoked a total of 531 extension during the 2018 to 2019 reporting period. Extensions were required in 338 instances in order to allow consultations with other government institutions. In 155 files, third party consultations were necessary and extensions taken accordingly. Extensions were required in 38 cases where the request necessitated a search through a large volume of records, which otherwise would have interfered with operations.

Section 15 of the Privacy Act permits the statutory time limits to be extended if consultations are necessary, if translation is required or if the request is for a large volume of records and processing it within the original time limits would unreasonably interfere with the operations of the department.

PSPC invoked a total of 71 extensions during the 2018 to 2019 reporting period. Of these, 60 were deemed necessary to allow the department to search for or through a large volume of records or to respond to the influx of records, or both, which interfered with operations. A further 11 files required extensions to allow for consultations with other institutions prior to responding. The department did not invoke any extensions for the purpose of translation.

Completion times

Fees

The Access to Information Act requires a $5 application fee to make a request. Based on requests completed during 2018 to 2019, PSPC collected $3,780 in application fees. In accordance with the Interim Directive on the Administration of the Access to Information Act, issued on May 5, 2016, PSPC waived all other fees prescribed by the act and regulations, other than the $5 application fee set out in paragraph 7(1)(a) of the regulations. PSPC also waived a total of $1,940 in application fees. The total operating cost of the ATIP program at PSPC for fiscal year 2018 to 2019 was $6,185,327.

Disposition

Approximately 84% of all requests made pursuant to the Access to Information Act completed during the 2018 to 2019 reporting period were either disclosed in part (53%) or fully disclosed (31%). Additionally, 12% of requests were abandoned.

Access to Information Act

During the 2018 to 2019 reporting period, PSPC was notified of 59 complaints received by the Office of the Information Commissioner of Canada (OIC). This represents 5% of all requests completed during this period. The majority of complaints were related to delays and allegations of missing records.

During the reporting period, the ATIP Directorate processed and closed 67 complaint investigations. Of these, 18 were deemed well founded, 14 were deemed not well founded and 8 were discontinued, while 27 were settled or resolved to the satisfaction of the requester.

During the 2018 to 2019 reporting period, no audits were undertaken under the Access to Information Act.

Privacy Act

During the 2018 to 2019 reporting period, the department was notified of 5 privacy complaints received by the Office of the Privacy Commissioner of Canada (OPC). This represents 0.9% of all requests completed during the fiscal year. The majority (4 of 5) of complaints were related to delays.

During the reporting period, the ATIP Directorate processed and closed 9 complaint investigations. Of these, 2 were deemed not well founded, while the remaining 7 were deemed well founded and resolved.

During the 2018 to 2019 reporting period, no audits were undertaken under the Privacy Act.

Initiatives

To improve internal processes and client service in its administration of the Access to Information Act and the Privacy Act, PSPC undertook the following initiatives during the 2018 to 2019 fiscal year:

• Initiated a Lean review to improve the administration of the ATIP process within the directorate for the benefit of both employees and applicants
• In support of the greening of government activities, established a new ePost delivery system to provide responses to applicants quickly, securely and at no extra cost to the applicant
• Updated the ATIP office's method of receiving records from offices of primary interest to a more intuitive and user friendly structure
• Commenced the transition of the ATIP Directorate to a paper light environment, including digitizing existing paper files and re-orienting towards electronic records, for example internal transmission of Protected B and lower records are no longer accepted via paper copy by the ATIP Directorate
• Initiated the realignment of the privacy impact assessment templates in the interest of streamlining and standardizing the work and increasing support to programs
• Drafted a Privacy Management Framework for the department

Bill C-58

During the 2018 to 2019 reporting period, the department conducted preparations for the implementation of Bill C-58, An Act to amend the Access to Information Act and the Privacy Act and to make consequential amendments to other Acts. The bill proposes to legislate proactive publication of certain records produced by government institutions.

PSPC undertook the following activities in preparation:

• Formed a working group in the summer of 2018 composed of representatives from the ATIP Directorate as well as various key enabling functions (Parliamentary Affairs, Strategic Governance and Ministerial Correspondence, Communications and Information Technologies)
• Focused on the significant culture shift required in preparing material for proactive publication, with an emphasis on plain language writing and being mindful of accessibility requirements in the development of products
• Considered leaning processes and streamlining approvals related to proactive publication
• Engaged senior management, through PSPC's governance committees to inform them of forthcoming changes and engage them in establishing priorities and mitigating potential risks

Directive on Privacy Practices

On October 17, 2018, the Deputy Minister approved the new PSPC Directive on Privacy Practices. The new directive replaces the Policy on the Protection of Personal and Private Information in the Workplace and addresses changes to the way personal information is being handled, given the increasing use of technology and digital tools.

Data Privacy Day

Data Privacy Day is an international effort held annually on January 28 to create awareness about the importance of respecting privacy, safeguarding personal data and enabling trust. It commemorates the signing of the first legally binding international treaty dealing with privacy and data protection in 1981.

The ATIP Directorate marked Data Privacy Day 2019 by holding a kiosk, in cooperation with departmental experts in information management, inviting employees to learn about how to protect their information and best practices to protect the personal information they handle every day.

Right to Know Week

International Right to Know Day originated at an international meeting of access to information advocates in 2002. Now celebrated annually by 40 countries and 60 non-governmental organizations, it has been expanded into a week-long event in Canada with the purpose of raising awareness about people's right to access government information while promoting freedom of information as essential to both democracy and good governance.

This year's Right to Know Week occurred from September 23, 2018 through to September 29, 2018. PSPC's ATIP Coordinator was invited to participate on a panel alongside the Information Commissioner of Canada for a discussion on the importance of the right of access in Canadian society and challenges faces within the federal ATIP industry.

Part 1: Requests under the Access to Information Act

Part 2: Requests closed during the reporting period

Part 3: Extensions

Part 4: Fees

Part 5: Consultations received from other institutions and organizations

Part 6: Completion time of consultations on cabinet confidences

Part 7: Complaints and investigations

Part 8: Court actions

Part 9: Resources related to the Access to Information Act

2.1 Disposition and completion time

2.2 Exemptions

2.3 Exclusions

2.4 Format of information released

2.5 Complexity

2.6 Deemed refusals

2.7 Requests for translation