Annual Report 2008-2009 Access to Information Act from the Public Health Agency of Canada on the Privacy Act for the period of April 1, 2008 to March 31, 2009

Table of Contents

• I. Introduction
  • Background on the Agency
  • Privacy Activities
• II. Report on the administration of the Privacy Act
  • Requests made under the Privacy Act
  • Disposition of requests completed
  • Exemptions invoked
  • Exclusions cited
  • Completion time
  • Method of access
  • Costs
  • Complaints and investigations
  • Court applications and appeals
  • Disclosure of personal information pursuant to subsection 8(2)(e)
  • Disclosure of personal information pursuant to subsection 8(2)(f)
  • Disclosure of personal information pursuant to subsection 8(2)(g)
  • Disclosure of personal information pursuant to subsection 8(2)(m)
  • Description of Privacy Impact Assessments (PIA)
  • New data sharing activities
• III. Report on Informal Privacy Requests
  • Informal Privacy Consultations
• APPENDIX A: Delegation Order – Privacy Act
• APPENDIX B: Privacy Act – Statistical Report
• APPENDIX C: Supplemental Reporting Requirements – Privacy Act

I. Introduction

The Privacy Act took effect on July 1, 1983.

This Act imposes obligations on some 150 federal government departments and agencies to respect privacy rights by limiting the collection, use and disclosure of personal information. The Privacy Act gives individuals the right to access and request correction of personal information about themselves held by these federal government organizations.

The Privacy Act extends to individuals the right of access to information held by the government, about themselves, subject to specific and limited exceptions. The Privacy Act also protects individuals' privacy by preventing others from having access to their personal information and provides control over its collection, use and disclosure.

Section 72 of the Privacy Act requires that the head of every government institution prepare for submission to Parliament an annual report on the administration of the Act within the institution for each financial year.

This is the second Annual Report on the administration of the Privacy Act for the Public Health Agency of Canada. It is intended to describe how the Agency administered its responsibilities under the Privacy Act during fiscal year 2008-2009.

---

For further information or to make a request under the Privacy Act, please direct your inquiries to:

Access to Information and Privacy Office
Public Health Agency of Canada
130 Colonnade Road
A.L. 6503F
Ottawa, Ontario
K1A 0K9

Tel: (613) 948-8187
Fax: (613) 957-9093

Background on the Agency

The Public Health Agency of Canada (PHAC), as part of the federal health portfolio, has a mission to promote and protect the health of Canadians through leadership, partnership, innovation and action in public health. To assist Canadians in moving towards its vision of healthy Canadians and communities in a healthier world, the Agency is mandated to work in collaboration with its partners, to mobilize pan-Canadian action in preventing disease and injury, and to promote and protect national and international public health.

PHAC’s main areas of focus are : prevention of disease and injury and the promotion of health; federal leadership and accountability in managing public health emergencies; sharing Canada’s expertise with the rest of the world, and applying international research and knowledge to Canada’s public health programs; strengthening intergovernmental collaboration on public health and facilitating national approaches to public health policy and planning; and advancing Aboriginal public health issues along with Health Canada.

The Agency achieves its objectives through leadership and partnership. It consults with provincial and territorial governments in the area of public health, fosters cooperation in that field with foreign governments and international organizations and collaborates with provincial and territorial governments to coordinate federal policies and programs. The Agency contributes to federal efforts to identify and reduce public health risk factors and to support national readiness for public health threats.

The Public Health Agency of Canada (PHAC) is made up of two branches including two laboratories, and has more than 2,400 staff contributing to the achievements of the Agency’s mission. In addition to the National Capital Region, PHAC has a presence in the Atlantic, Quebec, Ontario and Nunavut, Manitoba and Saskatchewan, Alberta and Northwest Territories, and British Columbia and Yukon Regions.

The regional offices develop, maintain and strengthen relationships with local/regional, provincial/territorial and federal governments as well as non-governmental organizations and academia, and support the public health responses to emergencies. Agency Regional Offices also connect and support stakeholders, including those outside the health sector, to take action on national priorities, gather public health information and build on resources at the regional, provincial and district levels.

The most senior departmental official at PHAC is the Chief Public Health Officer (CPHO), who is supported by one (1) Senior Assistant Deputy Minister (SADM) and one (1) Assistant Deputy Minister (ADM). The Chief Public Health Officer (CPHO) reports to the Minister of Health.

The Minister of Health is the designated head of the Agency for the purposes of Section 73 of the Act. The Minister has delegated full authority for the administration of the Act to the ATIP Director/Coordinator.

The following list outlines the roles and responsibilities of the two (2) branches of the Public Health Agency of Canada (PHAC): Planning and Public Health Integration Branch and; Infectious Disease and Emergency Preparedness Branch.

Planning and Public Health Integration Branch (PPHIB)

Senior ADM - Planning and Public Health Integration Branch is responsible for providing an integrated and coordinated strategic direction, overarching policy and program strategies as well as communication and human resources advice to identify and realize the Agency’s priorities and commitments. The Senior ADM is also the focal point within the Agency to support and improve the public health infrastructure that underlies and enables effective public health practice. In addition, the branch is responsible for implementing PHAC programs in the regions, as well as: providing national and international leadership in health promotion, chronic disease prevention and control; coordinate the surveillance of chronic diseases and their risk factors and early disease detection.

Infectious Disease and Emergency Preparedness Branch (IDEP)

ADM - Infectious Disease and Emergency Preparedness Branch is responsible for the prevention and control of infectious diseases and improvement in the health of those infected. IDEP leads the PHAC’s work around planning and coordinating pandemic influenza preparedness, and is responsible for the Canadian Pandemic Influenza Plan for the Health Sector. The Plan maps out how the Canadian health sector will prepare for, and respond to, an influenza pandemic, and has been developed through a collaborative process between federal, provincial, territorial, local and regional governments and nongovernments stakeholders. PHAC staff is ready to respond to public health emergencies, 365 days a year. Examples of specific challenges are HIV/AIDS, pandemic influenza preparedness, health care acquired infections such as C-difficile, food and water-borne diseases, sexually transmitted infections and those resulting from injection drug use, illnesses resulting from the interface between humans, animals and the environment including West Nile Virus Infection and Creutzfeldt-Jakob Disease (CJD).

Privacy Activities

The Director/Coordinator of Access to Information and Privacy (ATIP) is accountable for the development, coordination and implementation of effective policies, guidelines, systems and procedures to ensure the Agency’s responsibilities under the Privacy Act are met and to enable appropriate processing and proper disclosure of information. The Director/ Coordinator is also responsible for related policies, systems and procedures emanating from the Act.

The continuous growth of the Agency along with ongoing world wide health issues has brought to the forefront privacy related surveillance matters and the need to better educate the community on their responsibilities concerning privacy. The MAF requirements along with the need to update our Personal Information Banks (PIB) and to act upon the Privacy Impact Assessments that are needed will all be aided by the development of our Agency Privacy Framework.

The main Privacy related activities of the ATIP Office include:

• processing requests under the Privacy Act;
• developing and maintaining policies, procedures and guidelines to ensure that the Privacy Act is respected by the Agency;
• reviewing and approving Privacy Impact Assessments (PIA)
• promoting privacy awareness to ensure departmental responsiveness to the obligations imposed on the Government;
• monitoring departmental compliance with the Privacy Act, regulations and relevant procedures and policies;
• preparing annual reports to Parliament and other statutory reports, as well as other material that may be required by central agencies;
• responding to consultations submitted by other federal institutions on PHAC documents under consideration for release; and
• representing the Agency in dealings with the Treasury Board Secretariat, the Information and Privacy Commissioners and other government departments and agencies regarding the application of the Privacy Act as it relates to PHAC.

Training, education and accomplishments for 2008-2009:

• Nine (9) general presentations on Privacy were delivered to over 200 employees of PHAC;
• Nine (9) presentations on processing Privacy requests were delivered to approximately 30 branch liaisons; and
• Three (3) presentations on Privacy Impact Assessment were delivered to 50 employees of PHAC;

Upcoming initiatives for the PHAC ATIP Office:

• develop an agency-wide Privacy Management Framework in order to standardize privacy policies and processes;
• create an ATIP Office procedures manual in order to standardize our processes;
• organize a National Training Program for all staff;
• conduct a review of best management practices for program delivery at regional and headquarters level;
• develop a Communications' Strategy to increase awareness of all employees' responsibilities under the Privacy Act;
• introduce a Recruitment and Retention Program for employees which includes succession planning and classification review;
• initiate the acquisition of an electronic tracking and processing software that will improve the efficiency of the overall operation of the ATIPO; and
• review the results of the Corporate Secretariat Capacity Assessment to analyze the current staffing compliment and levels.

II. Report on the administration of the Privacy Act

Appendix B provides a statistical summary of the privacy requests received and/or finalized in 2008-2009.

Disposition of requests completed

Of the twelve (12) requests dealt with, nine (9) were completed during the 2008-2009 reporting period. The breakdown is as follows:

• In five (5) cases, the information was disclosed in part. Section 26 was the only section invoked.
• In three (3) cases, no relevant records existed under the control of the Department.
• In one (1) case, the request was abandoned.

Pages Examined: 1,006
Pages Released: 968

Exemptions invoked

As noted in Appendix B, only exemptions under section 26 of the Act were invoked by the Agency. The Appendix is intended to show the types of exemptions invoked to deny access. It is important to note that if the same exemption is claimed several times for the same request, it is reported only once in the Appendix.

Exclusions cited

None.

Completion time

Of the nine (9) requests that were completed during the reporting period, six (6) (66.7%) were completed in 30 days or less; one (1) (11.1%) were completed in the 31 to 60 days period; two (2) (22.2%) were completed in the 61 to 120 days period; and no requests required more than 120 days to complete.

Method of access

Copies of the records or part thereof were provided to the applicants in response to five (5) requests.

Costs

Total salary costs associated with Privacy Act activities are estimated at $86,283.50. Other administrative costs were estimated at $23,248.70, for a total of $109,532.20. The associated full-time employee resources for 2008-2009 are estimated at 1.15 FTEs for administering the Privacy Act.

Complaints and investigations

There were no complaints filed with the Office of the Privacy Commissioner of Canada concerning the Agency's administration of the Privacy Act during the reporting year.

Court applications and appeals

There were no court applications / appeals submitted to the Federal Court or Federal Court of Appeal.

Disclosure of personal information pursuant to subsection 8(2) (e)

No disclosures were done pursuant to this subsection.

Disclosure of personal information pursuant to subsection 8(2) (f)

No disclosures were done pursuant to this subsection.

Disclosure of personal information pursuant to subsection 8(2) (g)

No disclosures were done pursuant to this subsection.

Disclosure of personal information pursuant to subsection 8(2) (m)

No disclosures were done pursuant to this subsection.

Description of Privacy Impact Assessments (PIA)

PHAC is still undergoing a review of privacy issues and the establishment of an internal Privacy Framework and therefore no PIAs were completed during fiscal year 2008-2009. Four (4) PIAs were initiated in fiscal year 2008-2009 but were not complete.

New data sharing activities

No new data sharing activities have been undertaken during the reporting period.

III. Report on Informal Privacy Requests

Fiscal year 2008-2009.

Informal Privacy Consultations

There were eight (8) informal consultations which were processed by PHAC during this fiscal year.

Pages Examined: 192

APPENDIX A: Delegation Order – Privacy Act

Pursuant to the powers of delegation conferred upon me by Section 73 of the Privacy Act, the person exercising the functions and positions of Access to Information and Privacy Coordinator for the Public Health Agency of Canada and the respective successor, including in the Coordinator's absence, a person of officer designated in writing to act in the place of the holder of such functions and position is hereby authorized to exercise these powers, duties or functions of the Minister as the head of the government institution under the Act, set out in the attached schedule.

The person exercising the functions and position of Access to Information and Privacy Coordinator for the Public Health Agency of Canada and the respective successor, including in the Coordinator's absence, a person or officer designated in writing to act in the place of the holder of such functions and position, is hereby authorized to exercise these powers, duties or functions of the Minister as the head of the government institution under the Act, set out in sections 13 and 15 of the Act.

Public Heath Agency Of Canada Schedule of Delegation Order

Delegation of Powers, Duties & Functions Pursuant to Section 73 of the Privacy Act

Sections of Act	Powers, Duties or Functions	Responsible Position
8(2)	Disclose personal information without the consent of the individual to whom it relates	ATIP Co-ordinator
8(4)	Retain a copy of 8(2)(e) requests and disclosed records	ATIP Co-ordinator
8(5)	Notify the Privacy Commissioner of 8(2)(m) disclosures	ATIP Co-ordinator
9(1)	Retain a record of the use of personal information	ATIP Co-ordinator
9(4)	Notify the Privacy Commissioner of a consistent use of personal information and update the index accordingly	ATIP Co-ordinator
10	Include personal information in personal information banks	ATIP Co-ordinator
14	Respond to a request for access within statutory deadlines; give access or give notice	ATIP Co-ordinator
15	Extend the time limit and notify the applicant	ATIP Co-ordinator
17(2)(b)	Determine the necessity for a translation or interpretation for requested personal information	ATIP Co-ordinator
18(2)	Refuse to disclose information contained in an exempt bank	ATIP Co-ordinator
19(1)	Refuse to disclose information obtained in confidence from another government	ATIP Co-ordinator
19(2)	Disclose any information referred in 19(1) if the other government consents to the disclosure or makes the information public	ATIP Co-ordinator
20	Refuse to disclose information injurious to federal-provincial affairs	ATIP Co-ordinator
21	Refuse to disclose information injurious to international affairs and/or defence	ATIP Co-ordinator
22	Refuse to disclose information injurious to law enforcement and investigation	ATIP Co-ordinator
23	Refuse to disclose information injurious to security clearance	ATIP Co-ordinator
24	Refuse to disclose information collected by the Canadian Penitentiary Service, Tthe National Parole Service, or The National Parole Board	ATIP Co-ordinator
25	Refuse to disclose information which could threaten the safety of the individual	ATIP Co-ordinator
26	Refuse to disclose information about other individuals, and shall refuse to disclose such information where disclosure is prohibited under Section 8	ATIP Co-ordinator
27	Refuse to disclose information subject to solicitor-client privilege	ATIP Co-ordinator
28	Refuse to disclose information relating to an individual's physical or mental health where disclosure is contrary to the best interests of the individual	ATIP Co-ordinator
31	Receive notice of an investigation by the Privacy Commissioner	ATIP Co-ordinator
33(2)	Make representations of the Privacy Commissioner during an investigation	ATIP Co-ordinator
35(1)	Receive the Privacy Commissioner's report of findings of the investigation and give notice of action taken	ATIP Co-ordinator
35(4)	Give the complainant access to information after a 35(1)(b) notice	ATIP Co-ordinator
36(3)	Receive the Privacy Commissioner's report of findings of investigation of exempt banks	ATIP Co-ordinator
37(3)	Receive the report of the Privacy Commissioner's findings after a compliance investigation	ATIP Co-ordinator
51(2)(b)	Request that a matter be heard and determined in the National Capital Region	ATIP Co-ordinator
51(3)	Request and make representations in Section 51 hearings	ATIP Co-ordinator
72(1)	Prepare an Annual Report to Parliament	ATIP Co-ordinator
77	Carry out responsibilities conferred on the head of the institution by regulations made under section 77 which are not included above	ATIP Co-ordinator

 

APPENDIX B: Privacy Act – Statistical Report

REPORT ON THE PRIVACY ACT

PUBLIC HEALTH AGENCY OF CANADA

Reporting period 4/1/2008 to 3/31/2009

I. Requests under the Privacy Act
Received during reporting period	11
Outstanding from previous period	1
Total	12
Completed during reporting period	9
Carried forward	3

II. Disposition of requests completed
1.	All disclosed	0
2.	Disclosed in part	5
3.	Nothing disclosed (excluded)	0
4.	Nothing disclosed (exempt)	0
5.	Unable to process	3
6.	Abandoned by applicant	1
7.	Transferred	0
TOTAL		9

III. Exemptions invoked
S. Art 18(2)	0
S. Art 19(1)(a)	0
(b)	0
(c)	0
(d)	0
S. Art 20	0
S. Art 21	0
S. Art 22(1)(a)	0
(b)	0
(c)	0
S. Art 22(2)	0
S. Art 23 (a)	0
(b)	0
S. Art 24	0
S. Art 25	0
S. Art 26	5
S. Art 27	0
S. Art 28	0

IV. Exclusions cited
S. Art 69(1)(a)	0
(b)	0
S. Art 70(1)(a)	0
(b)	0
(c)	0
(d)	0
(e)	0
(f)	0

V. Completion time
30 days or under	6
31 to 60 days	1
61 to 120 days	2
121 days or over	0

VI. Extensions
	30 days or under	31 days or over
Interference with operations	1	0
Consultation	1	0
Translation	0	0
Total	2	0

VII. Translations
Translations requested		0
Translations prepared	English to French	0
	French to English	0

VIII. Method of access
Copies given	5
Examination	0
Copies and examination	0

IX. Corrections and notation
Corrections requested	0
Corrections made	0
Notation attached	0

X. Costs
Financial (all reasons)                    ($000)
Salary	86,283.5
Administration (O and M)	23,248.7
Total	109,532.2
Person year utilization (all reasons)
Person year (decimal format)	1.15

 

APPENDIX C: Supplemental Reporting Requirements - Privacy Act