2014 to 2015 Annual report on the Privacy Act

The Privacy Act (Revised Statutes of Canada, 1985, Chapter P-21) was proclaimed on July 1, 1983. The Act was amended as a result of the royal assent of the Federal Accountability Act on December 12, 2006. Certain provisions came into force on December 12, 2006, and others took effect on April 1, 2007, and September 1, 2007.

The Privacy Act gives Canadian citizens, permanent residents and individuals present in Canada a right of access to information about themselves held by the government, subject to specific and limited exceptions. The Act also provides individuals the right to a reasonable expectation of privacy, including a basic right to exercise control over the collection, use and disclosure of their personal information.

Section 72 of the Privacy Act requires that the head of every federal government institution prepare for submission to Parliament an annual report on the administration of the Act within their institution during each fiscal year.

This annual report provides a summary of the management and administration of the Privacy Act within Public Works and Government Services Canada for the fiscal year 2014 to 2015.

Part I: Introduction

1. Background

The Department, founded in 1841 and originally known as The Board of Works, was instrumental in the building of our nation's canals, roads and bridges, the Houses of Parliament, post offices and federal buildings across the country.

In 1993, the Department became Public Works and Government Services Canada (PWGSC) through the amalgamation of the former Supply and Services Canada, Public Works Canada, Government Telecommunications Agency (Communications Canada), and the Translation Bureau (Secretary of State of Canada).

The Department of Public Works and Government Services Act, passed in 1996, established the Department and set out the legal authorities for PWGSC's services. The Act established PWGSC as a common service organization providing government departments, boards and agencies with support services for their programs.

Today, PWGSC has evolved into a sophisticated operational arm of government that employs approximately 12,000 people working across Canada and headquartered in the National Capital Area.

The Office of the Procurement Ombudsman, an independent office, and part of the portfolio of the Minister of PWGSC, was established on May 5, 2008, as one of the final steps in the implementation of the Federal Accountability Act.

2. Raison d'être and responsibilities

PWGSC plays an important role in the daily operations of the Government of Canada. It supports federal departments and agencies in the achievement of their mandated objectives as their central purchasing agent, real property manager, linguistic authority, treasurer, accountant, and pay and pension administrator. The Department's vision is to excel in government operations, and its strategic outcome and mission are to deliver high-quality, central programs and services that ensure sound stewardship on behalf of Canadians and meet the needs of federal institutions. The goal is to manage business in a way that demonstrates accountability, transparency, and adds value for its clients.

The Office of the Procurement Ombudsman, which reports to the Minister and operates independently, reviews complaints from suppliers. It also reviews procurement practices in departments and agencies, and makes recommendations for the improvement of those practices to ensure fairness, openness, and transparency in the procurement process.

3. Strategic outcome and program alignment architecture

PWGSC's program alignment architecture (PAA), as approved by the Treasury Board, supports the strategic outcome to deliver high-quality, central programs and services that ensure sound stewardship on behalf of Canadians and meet the program needs of federal institutions. The following lists the programs that comprise PWGSC's PAA:

• Acquisitions
• Accommodation management and real property services
• Receiver General for Canada
• Integrity programs and services
• Federal pay and pension administration
• Linguistic management and services
• Specialized programs and services
• Internal services
• Procurement Ombudsman^{Footnote 1}

Part II: The Public Works and Government Services Canada Access to Information and Privacy Program

1. Access to Information and Privacy Directorate structure and responsibilities

The Access to Information and Privacy (ATIP) Directorate administers the provisions of the Privacy Act for PWGSC, including one Special Operating Agency, the Translation Bureau, as well as the Office of the Procurement Ombudsman.

In 2014 to 2015, the ATIP Directorate operated with up to 17 ATIP officers, five students and six consultants who worked under five team leaders to manage the requests received within the Department, as well as four senior ATIP policy advisors.

The Director, ATIP, reports to the Director General, Ministerial Services and Access to Information (DG-MSAI), who, in turn, reports to the Assistant Deputy Minister, Policy, Planning and Communications Branch (ADM-PPCB). Reporting to the Director, ATIP, the teams are overseen by the three Managers, ATIP Operations, and the Manager, ATIP Policy and Governance. The operational units are responsible for processing ATIP requests, consultations, complaints, and court cases; the other unit is responsible for policy, governance, advice and training. The administrative functions are supported by an administrative assistant, an office manager and up to eight support staff members.

The ATIP Directorate is responsible for establishing and directing all activities within the Department relating to the management of the departmental ATIP program, in accordance with the related PWGSC delegation instruments and the provisions of the Acts, regulations, directives, policies and guidelines.

The administration of the Act by the ATIP Directorate is also facilitated at the branch and regional office levels of PWGSC. Each organizational branch has an ATIP liaison officer who coordinates the collection of information and provides guidance to branch managers on the application of the Act, as well as related departmental directives and procedures.

2. Delegation instruments

Under section 3 of the Privacy Act, the Minister of the Department is designated as the head of the government institution for purposes of the administration of the Act. Pursuant to section 73, the Minister may delegate any of her powers, duties or functions under the Act by signing an order authorizing one or more officers or employees of the institution, who are at the appropriate level, to exercise or perform the powers, duties or functions of the head, specified in the order.

Within PWGSC, this delegation instrument is based on a centralized process with the Director and managers of the ATIP Directorate having full delegated authority under the Act, with the exception of paragraph 8(2)(m). Certain administrative functions are also delegated to the ATIP team leaders to speed up the processing of requests. Full authority under the Act is also delegated to the ADM-PPCB and the DG-MSAI who are responsible for the PWGSC ATIP program.

An excerpt of the Delegation of authorities approved by the Minister of Public Works and Government Services is provided in Annex A: Delegation of authorities (excerpt).

3. Policies and procedures

3.1 Departmental Policy on Access to Information and Privacy

For the reference of all employees, departmental policies are posted on PWGSC's intranet.

The Policy on the Access to Information and Privacy Program (002) outlines the delegation of authority and sets out the definitions, and the roles and responsibilities of all stakeholders within PWGSC. The policy has been updated to provide a common understanding of what "under the control" means in relation to the retrieval of information from a contractor following a request for information, and to ensure consistent practices when responding to access to information requests for documents held by third parties acting on behalf of the Crown.

The Policy on Protection of Personal and Private Information in the Workplace (014) sets out definitions as well as the roles and responsibilities of employees with respect to the protection of personal information in the workplace.

The following policy instruments are under development:

• Privacy breach protocol
• Directive on privacy practices
• Protocol for non-administrative use of personal information

3.2 Access to Information and Privacy liaison officer handbook

The ATIP liaison officer handbook is produced by the ATIP Directorate and is posted on PWGSC's intranet as a guide to:

• introduce departmental ATIP liaison officers across the Department to the Privacy Act and regulations
• outline the roles and responsibilities of each PWGSC ATIP stakeholder
• provide national processing standards and guidelines for the centralized handling of requests

3.3 Access to Information and Privacy Directorate desk procedures

The ATIP Directorate has an ATIP officer desk procedures manual in place to standardize the work procedures used by staff, to facilitate the training of new hires and to complement the functionality of the electronic ATIP tracking system.

4. Training

4.1 Departmental employees

A brief overview of privacy is incorporated into the general ATIP information sessions. During the fiscal year, the ATIP Directorate delivered 27 training and awareness sessions to 379 managers and employees at all levels from all branches of the Department.

As well, a section on ATIP is included in the Department's Orientation Program for new employees. This section provides information on employee obligations under the Act, including an explanation of the duty to assist, a reminder that only those delegated under the Act can make disclosure decisions, a reference to procedures for reporting suspected contraventions, as well as a link to the departmental policy on ATIP.

4.2 Access to Information and Privacy Directorate staff

The ATIP officer development program created in 2006 was revised in 2014 to 2015 to address the Department's mid and long-term shortage of skilled ATIP professionals by recruiting new employees at the junior level, and preparing them to fill senior ATIP officer positions at the PM-4 group and level up to a five-year horizon. The program is also intended to reduce the costs associated with the competitive staffing process and the use of consultants.

ATIP staff has the opportunity to register and complete certification programs such as the International Association of Privacy Professionals (IAPP) certification program, take advantage of the ATIP training offered in house and by Treasury Board of Canada Secretariat (TBS). Staff can also attend conferences such as the Canadian Access and Privacy Association (CAPA) conference and the Canadian Bar Association annual ATIP law symposium.

5. Personal information banks

In accordance with section 10 of the Privacy Act, all personal information under the control of the institution that is used for an administrative purpose, or that is retrievable by name or personal identifier has to be described in personal information banks (PIBs).

Also, as required by the TBS directives on privacy practices and privacy impact assessment (PIA), any new or substantially modified PIB has to be approved by TBS before implementing the new or modified program or activity.

The following PIB was revised and registered with TBS in 2014 to 2015:

• PWGSC PCU 195—Certification program for the federal government procurement and material management communities

PWGSC does not have any exempt banks.

6. Collection of personal information

The PWGSC Forms management policy (061) requires that all new and revised forms that collect personal information be reviewed by the ATIP Directorate to ensure compliance with privacy legislative and policy requirements. As well, the ATIP Directorate reviews electronic forms on departmental intranet and Internet sites, including surveys and public opinion research. It also assists with the development of the related privacy notices and consent statements.

7. Material privacy breaches

A privacy breach involves improper or unauthorized collection, use, disclosure, retention or disposal of personal information. A privacy breach may occur within an institution or off-site and may be the result of inadvertent errors or malicious actions by employees, third parties, partners in information-sharing agreements or intruders.

A breach is deemed "material" if the breach involves sensitive personal information and could reasonably be expected to cause serious injury or harm to the individual and/or involves a large number of affected individuals.

There was only one material privacy breach reported to the ATIP Directorate and the Corporate Security Directorate during the fiscal year. In the evening of March 27, 2015, an individual gained access to PWGSC premises and stole a laptop computer and two USB keys among other items. The stolen devices contained sensitive personal information of approximately 260 employees, from 2011 to 2013, such as employee performance management agreements, grievances, and other human resources related documents. Although the devices were encrypted with strong passwords and the risk to the individuals was considered low, the ATIP Directorate reported the incident to the Office of the Privacy Commissioner (OPC) and TBS, in accordance with the TBS Guidelines for privacy breaches.

Part III: Interpretation and explanation of trends of the statistical report

Statistical reporting on the administration of the Act has been conducted since 1983. Since 2011 to 2012, government institutions have completed more in-depth statistical reporting forms on the administration of the Act as prescribed by the TBS. The 2014 to 2015 statistical report on the Privacy Act is provided in Annex B: Statistical report on the Privacy Act .

1. Departmental overview of requests received

The ATIP Directorate processed all requests received by the Department pursuant to the Privacy Act. Each request is first reviewed for clarity and then assigned to one or more organizational units of the Department that become responsible for locating and retrieving the records containing the information sought.

Organizational units review their relevant records and provide recommendations to the ATIP Directorate on sensitivities related to their disclosure. Where necessary, the ATIP Directorate also undertakes consultations with other organizations before a skilled analyst reviews each record to make a decision on disclosure. The ATIP Directorate then notifies the requester and provides access to all of the records that can be disclosed.

2. Requests under the Privacy Act

The Department received 166 requests under the Privacy Act in 2014 to 2015. Of these, 21% were for documents related to pension and pay, 17% related to labour relation matters, 17% were for other employment related records, seven percent pertained to staffing processes and five percent concerned security clearances. The remaining cases (33%) were for correspondence and other personal information pertaining to the requesters.

Compared with the previous fiscal year, PWGSC experienced a significant decrease in the total number of privacy requests received. Chart I provides an overview of the trends related to the volume of requests processed by PWGSC over the past three fiscal years.

Chart I: Processing trends for privacy requests

3. Requests closed during the reporting period

Of the 237 requests in progress, 224 requests (95%) were completed during the 2014 to 2015 reporting period. The remaining 13 requests (5%) were carried forward to the next fiscal year. Of the 224 cases where the Department completed the request, information was released either in whole or in part in 101 requests (45%). Chart II provides an overview of the disposition of requests closed by PWGSC during the fiscal year.

Chart II: Disposition of privacy requests closed

4. Exemptions and exclusions

An individual's right of access to his/her personal information under the Privacy Act is limited by a number of exemptions specified in sections 18 through 28 of the legislation.

Pursuant to section 69, the Act does not apply to material that is published or available for purchase, library or museum material preserved solely for public record, material deposited with the Library and Archives Canada, as well as records considered to be confidences of the Queen's Privy Council of Canada pursuant to section 70 of the Act.

Annex B: Statistical report on the Privacy Act shows the types of exemptions and exclusions invoked to refuse access. For clarity purposes, if five different exemptions and/or exclusions were used in one request, each relevant section would be reported for a total of five. If the same exemption or exclusion was used several times for the same request, it would be reported only once.

As noted in Annex B: Statistical report on the Privacy Act , information about another individual (section 26 of the Act) accounts for the vast majority of the exemptions applied by the Department. Sections 69 and 70 were not invoked by PWGSC for any of the privacy request processed in the 2014 to 2015 fiscal year.

5. Format of information released

Of the 101 requests in which information was released, the requesters received copies of the records in all cases. There were no cases where access was provided by a combination of copies and in-person examination. It should be noted that the data in this section reflect only requests for which information was all disclosed or disclosed in part.

Records were provided in the form of paper copies for 49 requests (49%), whereas 52 cases (51%) were in electronic format. With either method of access, as well as in-person examination, the ATIP Directorate offered the choice to the requester.

6. Complexity

PWGSC processed more than 62,700 pages during the reporting period. This represents a 35% increase compared with the previous fiscal year. While on average files contained 461 pages to be processed, 15 requests had over 1,000 pages, including four with more than 5,000 pages. Chart III provides the trends related to the relevant pages processed and disclosed by PWGSC over the past three fiscal years.

Chart III: Trends for relevant pages processed and disclosed

7. Processing time

Of the 224 requests completed during the fiscal year, 97 (43%) needed to be extended in accordance with section 15 of the Act. In 88 cases meeting the original time limit would have unreasonably interfered with the operations of the Department. For the remaining nine cases, there was a need to consult with other government institutions.

Despite the volume, 128 requests (57%) were completed within the initial 30-day period, while 67 requests (30%) were completed within 31 to 60 days. The average processing time for all requests completed was 41 days, same as in the previous fiscal year.

Due to the volume of records to be processed, 18 requests (8%) fell in a deemed refusal status and were closed after the statutory deadline. This represents a four percent improvement compared with last fiscal year. In 17 of those (94%), the maximum 30-day time extension allowed under the Act was not sufficient to complete the review. On average, PWGSC needed an additional 61 days to complete these late files.

The ATIP Directorate workload was the principal reason of delays in 81% of the 18 late cases. Other factors such as necessary consultations, complexity of requests and the reassignment of files within the ATIP Directorate also contributed to the delays.

The Department's timeliness and compliance for completing requests is closely monitored by the ATIP Directorate.

8. Translation

There were no requests for the translation of information from one official language to another.

9. Disclosures under subsection 8(2) of the Act

During 2014 to 2015, the Department made 20 disclosures of personal information to investigative bodies pursuant to paragraph 8(2)(e) of the Act. A copy of every request received under paragraph 8(2)(e), and a record of any information disclosed pursuant to the request, is kept in accordance with subsection 8(4) of the Act.

There were no disclosures made under paragraph 8(2)(m) of the Act.

10. Requests for correction of personal information and notations

There was no request for the correction of personal information or for notations to be placed on a file.

11. Consultations from other government institutions and organizations

The Department received seven privacy consultations in 2014 to 2015, for a total of 262 pages of records to review. PWGSC closed these seven consultations and took 13 days on average to respond. This is 13 days less than the previous fiscal year.

12. Complaints and requests for judicial review

Table I provides the breakdown of complaints made to the Office of the Privacy Commissioner of Canada and of requests for judicial review filed with the Federal Court of Canada, for which PWGSC has been informed of over the past three fiscal years.

12.1 Complaints to the Office of the Privacy Commissioner of Canada

In 2014 to 2015, the Privacy Commissioner notified the Department that it had received seven new complaints, one of which related to a request received in the previous fiscal year. This is a 46% decrease compared with the previous fiscal year.

Of the seven new complaints, two (29%) pertained to delays, one (14%) concerned missing records, and one (14%) was about information withheld under the Act. The remaining three complaints (43%) related to the collection and disclosure of personal information.

In 2014 to 2015, the Privacy Commissioner closed eight complaints. Of these, five were discontinued and the other three were not well-founded. Nine complaint investigations were still ongoing at the end of the fiscal year. PWGSC regularly reviews investigative findings to improve its administration of the Privacy Act.

12.2 Requests for judicial review

There was no request made to the Federal Court of Canada seeking a judicial review.

13. Privacy impact assessments

In accordance with the TBS Directive on PIA, a PIA must be initiated for a program or activity in the following circumstances:

• when personal information is used for or is intended to be used as part of a decision-making process that directly affects the individual
• upon substantial modifications to existing programs or activities where personal information is used or intended to be used for an administrative purpose
• when contracting out or transferring a program or activities to another level of government or the private sector results in substantial modifications to the program or activities

The ATIP Directorate provides advice and guidance to PWGSC managers throughout the PIA process, including the review of PIA reports and liaison with the Office of the Privacy Commissioner.

Summaries of the Privacy Impact Assessments completed by Public Works and Government Services Canada are published on the departmental Internet site. The site is intended to facilitate the public's understanding of the Access to Information Act, the Privacy Act and associated departmental procedures.

Table II provides the number of assessments conducted in the last three fiscal years.

During the 2014 to 2015 fiscal year, the following PIA was completed and sent to the Privacy Commissioner of Canada and the Treasury Board of Canada Secretariat.

• Certification program for the federal government procurement and material management communities—The program enables practitioners to obtain a professional designation by meeting the training, experience and knowledge requirements outlined in the Canadian General Standards Board standard CGSB-192.1-2005: Competencies of the federal government procurement, materiel management and real property communities. The PIA summary is available on the PWGSC Internet site
• Integrity databases services—PWGSC introduced its Integrity framework in July 2012. The initial PIA completed in May 2012 has been updated as significant enhancements have since been implemented. The proposed mitigating mechanisms for the identified privacy risks indicate a continued commitment by PWGSC in ensuring the confidentiality and privacy of the personal information collected from individuals. The PIA summary is available on the PWGSC Internet site

14. Resources related to the Privacy Act

The total salary costs associated with the Privacy program amounted to $647,513, and operations and maintenance costs to $229,836, for a combined total of $877,349. The number of employee and temporary help resources were estimated at 12 for the 2014 to 2015 fiscal year.

Annex A: Delegation of authorities (excerpt)

Please note that the November 4, 2011 version has been updated as follows:

Changes to Schedule 1

• Integration of "printing" under goods procurement within department-wide authorities. While printing is currently covered under standing offers which offer specific authorities, integrating printing within the goods procurement will provide additional clarity and flexibility
• Increased limits for the Software Licensing Supply Arrangements (SLSA) from $40,000 to $100,000 upon review of business volumes in collaboration with Acquisitions Branch
• Integration of new travel authorities and revision of hospitality, events and conferences authorities in order to be aligned and compliant with the revised TB Directive on travel, hospitality, conference and event expenditures, effective August 1, 2013
• Integration of a new authority for the Chief Financial Officer to act as the delegated travel and hospitality approval authority in situations where the Deputy Minister participates at the hospitality event or is the traveler
• Modification of the delegations pursuant to the Access to Information Act and the Privacy Act in order to reflect the transfer of the mandate for these authorities from the DG, Executive Secretariat to the DG responsible for the ATIP program, and the provision of additional authorities to team leaders
• Amendment to revenue agreement memoranda of understanding and specific services agreements authorities in order to allow incumbents of certain Real Property positions (level 3 and 4) to perform low risk transactions in order to avoid project delays
• Modification of the authority to make changes to the table of equivalent positions in order to allow the Deputy Minister to perform changes to the specific delegation of authorities in accordance with the TB Directive on delegation of financial authorities for disbursements
• Addition or change to the "table of equivalent positions" and "specific delegation of authorities" tables to reflect the current organizational structures

Minister's and Deputy Minister's delegation of authorities

We hereby delegate the powers vested in the offices of the Minister and Deputy Minister of Public Works and Government Services, in the manner defined in Schedules 1 to 4, the associated tables of equivalent positions and specific delegations in the notes to these schedules, including officers appointed on a temporary or acting basis to positions so defined, subject to the principles, guidelines, limitations and restrictions described in the department's delegation of authorities manual and all relevant legislation, regulations and policies.

Specifically, this instrument is intended to delegate authority, as defined by:

Schedule 1

"Department-wide authorities", the "table of equivalent positions" for Schedule 1 and the specific delegations contained in the "notes to Schedule 1"

Schedule 2

"Real Property authorities", the "table of equivalent positions" for Schedule 2 and the specific delegations contained in the "notes to Schedule 2"

Schedule 3

"Common service acquisition authorities", the "table of equivalent positions" for Schedule 3 and the specific delegations contained in the "notes to Schedule 3"

Schedule 4

"Receiver General for Canada authorities"

Further, these delegations are made on the explicit understanding that they are to be used only to:

• commensurate with the level of responsibility assigned to the position and when required to undertake the duties of that position as described in the operational plans of the Department
• attain departmental objectives, within the departmental mandate
• attain clients' objectives when providing common services to client departments

The department's delegation of authorities manual documents the delegated authorities of Public Works and Government Services Canada and includes important information on the conditions under which we have made these delegations. All officers of the Department who are acting on our behalf in any matter related to these delegations must make themselves familiar with the contents of the manual to ensure that they are fully cognizant of the conditions and implications of doing so.

Annex B: Statistical report on the Privacy Act

Name of institution: Public Works and Government Services Canada

Reporting period: April 1, 2014 to March 31, 2015

Part 1: Requests under the Privacy Act

Part 2: Requests closed during the reporting period

2.1 Disposition and completion time

2.2 Exemptions

2.3 Exclusions

2.4 Format of information released

2.5 Complexity

2.5.1 Relevant pages processed and disclosed

2.5.2 Relevant pages processed and disclosed by size of requests

2.5.3 Other complexities

2.6 Deemed refusals

2.6.1 Reasons for not meeting statutory deadline

2.6.2 Number of days past deadline

2.7 Requests for translation

Part 3: Disclosures under subsections 8(2) and 8(5)

Part 4: Requests for correction of personal information and notations

Part 5: Extensions

5.1 Reasons for extensions and disposition of requests

5.2 Length of extensions

Part 6: Consultations received from other institutions and organizations

6.1 Consultations received from other Government of Canada institutions and organizations

6.2 Recommendations and completion time for consultations received from other Government of Canada institutions

6.3 Recommendations and completion time for consultations received from other organizations

Part 7: Completion time of consultations on cabinet confidences

7.1 Requests with Legal Services

7.2 Requests with Privy Council Office

Part 8: Complaints and investigations notices received

Part 9: Privacy impact assessments

Number of PIA(s) completed: 2

Part 10: Resources related to the Privacy Act

10.1 Costs

10.2 Human resources

Note: Enter values to two decimal places.