2018-2019 Annual Report to Parliament on the Privacy Act
Table of contents
- 1. Introduction
- 2. Organizational Structure of CanNor to Fulfill its Privacy Act Responsibilities
- 3. Delegation Order
- 4. 2018-2019 Statistical Report on the Privacy Act
- 5. Training
- 6. Institution-specific Policies, Guidelines, and Procedures
- 7. Complaints, Audits, and Investigations
- 8. Monitoring
- 9. Material Privacy Breach Summary
- 10. Privacy Impact Assessment
- 11. Disclosure Pursuant to Paragraph 8(2) (m)
- Annex A – Privacy Act Delegation Order
- Schedule A – Delegation order - Designation pursuant to section 73 of the Privacy Act
- Schedule B – Delegation order - Designation pusuant to section 73 of the Privacy Act
- Annex B – Statistical Report on the Privacy Act
1. Introduction
The Privacy Act provides Canadian citizens and people present in Canada the right of access to, and correction of, information about them that is held by the federal government. It also protects against unauthorized disclosure of that personal information. In addition, it strictly controls how the government will collect, use, store, disclose, and dispose of any personal information.
This report summarizes the activities of CanNor in implementing the Act, and fulfils the requirement under Section 72, which stipulates that, "The head of every government institution shall prepare for submission to Parliament an annual report on the administration of this Act within the institution during each financial year."
Mandate
Contributing to jobs and growth in Canada, CanNor works to develop a diversified, sustainable and dynamic economy across Canada's three territories. It does this by delivering funding programs to Northerners and Indigenous people, guiding resource development and major projects across the North through the Northern Projects Management Office, undertaking research to support the development of evidence-based policies, advocating for northern economic prosperity and diversification, and collaborating with other federal departments, territorial governments, Indigenous organizations, and industry.
2. Organizational Structure of CanNor to Fulfill its Privacy Act Responsibilities
For the purposes of the Privacy Act, the President of CanNor has delegated powers, duties, and functions under the Act to the Director, Corporate Services and the Manager, IM/IT and Chief Information Officer. The Director, Corporate Services fulfills an oversight role and is responsible for representing Access to Information and Privacy (ATIP) issues at Senior Management Committee. The Manager, IM/IT and Chief Information Officer performs the role of ATIP Coordinator responsible for leading the ATIP Program. The ATIP Coordinator administers the Act with part-time assistance from an information management officer. Assistance is also obtained via the procurement of specialized professional services as-required.
The ATIP Coordinator is accountable for the development, coordination, and implementation of effective policies, guidelines, systems, and procedures to meet responsibilities under the Act, and to permit processing requests, and disclosure of information. Additionally, the ATIP Coordinator provides strategic support and advice to the executive management of the Agency regarding the administration of the ATIP program, and is responsible for all privacy activities and operations pursuant to the Act such as:
- processing and responding to all formal requests and interdepartmental consultations under the Privacy Act;
- providing strategic advice to the Agency about privacy-related issues;
- preparing guidance documents in support of privacy legislation;
- updating and registering personal information banks;
- preparing the Annual Report to Parliament on the Privacy Act;
- training employees on their roles and responsibilities under the Privacy Act; and
- replying to informal inquiries.
3. Delegation Order
The President’s Privacy Delegation Order (Annex A) was updated on June 17, 2019. It provides delegated authority to the Director, Corporate Services (and Chief Financial Officer) and the Manager, IM/IT and Chief Information Officer. The Manager, IM/IT and Chief Information Officer provides strategic support and advice to the executive management of the Agency concerning privacy issues and is responsible for all privacy activities and operations.
4. 2018-2019 Statistical Report on the Privacy Act
CanNor’s 2018-2019 Statistical Report on the Access Privacy Act is attached as Annex B. We have also included this table to show multi-year trends for the past three years.
| Privacy Requests | 2016-2017 | 2017-2018 | 2018-2019 |
|---|---|---|---|
| Received during reporting period | 0 | 0 | 1 |
| Outstanding from previous reporting period | 0 | 0 | 0 |
| Total | 0 | 0 | 0 |
| Closed during reporting period | 0 | 0 | 1 |
| Carried over to next reporting period | 0 | 0 | 0 |
As shown in the above table, CanNor received 0 privacy requests in 2016-2017, 0 requests in 2017-2018, and 1 request in 2018-2019.
5. Training
Informal briefings and awareness sessions were provided to employees to explain the administration of the Privacy Act, the processing of privacy requests, and guidance on the informal release of records and updating personal information banks and privacy notice statements.
6. Institution-specific Policies, Guidelines, and Procedures
CanNor developed a privacy breach reporting template for investigating and maintaining a record of privacy breaches. The template meets the criteria in the TBS Guidelines for Privacy Breaches, and helps to inform individuals that CanNor collects personal information regarding:
- the purpose and authority for the collection;
- any uses or disclosures that are consistent with the original purpose of the collection;
- the rights of access to, correction and protection of personal information under the Privacy Act;
- the right to file a complaint to the Office of the Privacy Commissioner (OPC) regarding CanNor’s handling of personal information;
- consequences for refusing to provide the personal information; and
- a reference to the personal information bank described in Info Source.
7. Complaints, Audits, and Investigations
One complaint notification under Section 31 of the legislation was received during the 2018-2019 fiscal year, and no audits or investigations were undertaken.
8. Monitoring
The ATIP coordinator uses a case management system to monitor, track and report on the processing of privacy requests from receipt through disposition. The Director of Corporate Services monitors the timelines of any privacy requests received by the ATIP Coordinator.
9. Material Privacy Breach Summary
No material privacy breaches occurred during the reporting period.
10. Privacy Impact Assessment
During the reporting period, CanNor did not complete any Privacy Impact Assessments and no assessments were forwarded to the Office of the Privacy Commissioner.
11. Disclosure Pursuant to Paragraph 8(2) (m)
There were no disclosures pursuant to paragraph 8(2) (m) for the April 1, 2018, to March 31, 2019 period.
Annex A – Privacy Act Delegation Order
Privacy Act – Delegation Order
Pursuant to the powers of designation conferred upon me by Section 73 of the Privacy Act, the persons exercising the functions or positions of Director, Corporate Services and CFO (position number 20000830), and Manager, IM/IT and Chief Information Officer (position number 000139900) and the departmental Access to Information and Privacy Coordinator (position number 20002643) and their respective successors, including in their absence, a person or officer designated in writing to act in the place of the holder of any such functions or positions are hereby designated to exercise those powers, duties or functions of the President as the Head of the government institution under the Act, and as set out in the attached Schedule A and B.
President - Canadian Northern Economic Development Agency
Dated at Ottawa, the 17th of June, 2019
Schedule A – Delegation order - Designation pursuant to section 73 of the Privacy Act
Sections and Powers, Duties or Functions
- 8(2)
- Disclose personal information without the consent of the individual to whom it relates
- 8(4)
- Keep copies of requests made under 8(2)(e), keep records of information disclosed pursuant to such requests and to make those records available to Privacy Commissioner
- 8(5)
- Notify the Privacy Commissioner in writing of disclosure under paragraph 8(2)(m)
- 9(1)
- Retain a record of use of personal information
- 9(4)
- Notify the Privacy Commissioner of consistent use of personal information and update index accordingly
- 10
- Include personal information in personal information banks
- 11(a)
- Publish annually an index of all personal information banks and their respective contents
- 11(b)
- Publish annually an index of all personal information held by the institution which is not part of a bank
- 14
- Respond to request for access, within statutory deadline; give access or give notice
- 15
- Extend time limit and notify applicant
- 16
- Where access is refused
- 17(2)(b)
- Language of access or alternative format of access
- 17(3)(b)
- Access to personal information in alternative format
- 18(2)
- May refuse to disclose information contained in an exempt bank
- 19(1)
- Shall refuse to disclose information obtained in confidence from another government
- 19(2)
- May disclose any information referred to in 19(1) if the other government consents to the disclosure or makes the information public
- 20
- May refuse to disclose information injurious to federal-provincial affairs
- 21
- May refuse to disclose information injurious to international affairs and/or defence
- 22
- May refuse to disclose information injurious to law enforcement and investigation
- 23
- May refuse to disclose information injurious to security clearances
- 24
- May refuse to disclose information collected by the Canadian Penitentiary Service, the National Parole Service or the National Parole Board
- 25
- May refuse to disclose information injurious to which could threaten the safety of individuals
- 26
- RMay refuse to disclose information about other individuals, and shall refuse to disclose such information where disclosure is prohibited under section 8
- 27
- May refuse to disclose information subject to solicitor-client privilege
- 28
- May refuse to disclose information relating to an individual’s physical or mental health where disclosure is contrary to the best interests of the individual
- 31
- Receive notice of investigation by the Privacy Commissioner
- 33(2)
- Make representations to the Privacy Commissioner during an investigation
- 35(1)
- Receive the Privacy Commissioner’s report of findings of the investigation and give notice of action taken
- 35(4)
- Give complainant access to information after 35(1)(b) notice
- 36(3)
- Receive Privacy Commissioner’s report of findings of investigation of exempt
- 37(3)
- Receive report of Privacy Commissioner’s findings after compliance investigation where the institution has not complied with sections 4 to 8
- 51(2)b)
- Request that matter be heard and determined in National Capital Region
- 51(3)
- Request and be given right to make representations in Section 51 hearing
- 72(1)
- Prepare Annual Report to Parliament
- 77
- Carry out responsibilities conferred on the head of the institution by the regulations made under section 77 which are not included above
Schedule B – Delegation order - Designation pusuant to section 73 of the Privacy Act
Sections and Powers, Duties or Functions
- 10
- Include personal information in personal information banks
- 11(a)
- Publish annually an index of all personal information banks and their respective contents
- 11(b)
- Publish annually an index of all personal information held by the institution which is not part of a bank
- 15
- Extend time limit and notify applicant
- 31
- Receive notice of investigation by the Privacy Commissioner
Annex B – Statistical Report on the Privacy Act
Name of institution: Canadian Northern Economic Development Agency
Reporting period: 2018-04-01 to 2019-03-31
Part 1: Requests Under the Privacy Act
| Number of Requests | |
|---|---|
| Received during reporting period | 1 |
| Outstanding from previous reporting period | 0 |
| Total | 1 |
| Closed during reporting period | 1 |
| Carried over to next reporting period | 0 |
Part 2: Requests Closed During the Reporting Period
2.1 Disposition and completion time
| Disposition of Requests | Completion Time | |||||||
|---|---|---|---|---|---|---|---|---|
| 1 to 15 Days | 16 to 30 Days | 31 to 60 Days | 61 to 120 Days | 121 to 180 Days | 181 to 365 Days | More Than 365 Days | Total | |
| All disclosed | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Disclosed in part | 0 | 0 | 1 | 0 | 0 | 0 | 0 | 1 |
| All exempted | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| All excluded | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 0 |
| No records exist | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Request transferred | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Request abandoned | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Neither confirmed nor denied | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Total | 0 | 0 | 1 | 0 | 0 | 0 | 0 | 1 |
2.2 Exemptions
| Section | Number of Requests |
|---|---|
| 18(2) | 0 |
| 19(1)(a) | 0 |
| 19(1)(b) | 0 |
| 19(1)(c) | 0 |
| 19(1)(d) | 0 |
| 19(1)(e) | 0 |
| 19(1)(f) | 0 |
| 20 | 0 |
| 22(1)(a)(i) | 0 |
| 22(1)(a)(ii) | 0 |
| 22(1)(a)(iii) | 0 |
| 22(1)(b) | 0 |
| 22(1)(c) | 0 |
| 22(2) | 0 |
| 22.1 | 0 |
| 22.2 | 0 |
| 22.3 | 0 |
| 23(a) | 0 |
| 23(b) | 0 |
| 24(a) | 0 |
| 24(b) | 0 |
| 25 | 0 |
| 26 | 1 |
| 27 | 0 |
| 28 | 0 |
2.3 Exclusions
| Section | Number of requests |
|---|---|
| 69(1)(a) | 0 |
| 69(1)(b) | 0 |
| 69.1 | 0 |
| 70(1) | 1 |
| 70(1)(a) | 0 |
| 70(1)(b) | 0 |
| 70(1)(c) | 1 |
| 70(1)(d) | 0 |
| 70(1)(e) | 0 |
| 70(1)(f) | 0 |
| 70.1 | 0 |
2.4 Format of information released
| Disposition | Paper | Electronic | Other formats |
|---|---|---|---|
| All disclosed | 0 | 0 | 0 |
| Disclosed in part | 0 | 1 | 0 |
| Total | 0 | 1 | 0 |
2.5 Complexity
2.5.1 Relevant pages processed and disclosed
| Disposition of Requests | Number of Pages Processed | Number of Pages Disclosed | Number of Requests |
|---|---|---|---|
| All disclosed | 0 | 0 | 0 |
| Disclosed in part | 176 | 153 | 1 |
| All exempted | 0 | 0 | 0 |
| All excluded | 0 | 0 | 0 |
| Request abandoned | 0 | 0 | 0 |
| Neither confirmed nor denied | 0 | 0 | 0 |
| Total | 176 | 153 | 1 |
2.5.2 Relevant pages processed and disclosed by size of requests
| Disposition | Less Than 100 Pages Processed |
101-500 Pages Processed |
501-1000 Pages Processed |
1001-5000 Pages Processed |
More Than 5000 Pages Processed | |||||
|---|---|---|---|---|---|---|---|---|---|---|
| Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | |
| All disclosed | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Disclosed in part | 0 | 0 | 1 | 153 | 0 | 0 | 0 | 0 | 0 | 0 |
| All exempted | 0 | 0 | 8 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| All excluded | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Request abandoned | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Neither confirmed nor denied | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Total | 0 | 0 | 9 | 153 | 0 | 0 | 0 | 0 | 0 | 0 |
2.5.3 Other complexities
| Disposition | Consultation Required | Assessment of Fees | Legal Advice Sought | Other | Total |
|---|---|---|---|---|---|
| All disclosed | 6 | 0 | 0 | 0 | 0 |
| Disclosed in part | 0 | 0 | 0 | 0 | 0 |
| All exempted | 0 | 0 | 0 | 0 | 0 |
| All excluded | 0 | 0 | 0 | 0 | 0 |
| Request abandoned | 0 | 0 | 0 | 0 | 0 |
| Neither confirmed nor denied | 0 | 0 | 0 | 0 | 0 |
| Total | 0 | 0 | 0 | 0 | 0 |
2.6 Deemed refusals
2.6.1 Reasons for not meeting statutory deadline
| Number of Requests Closed Past the Statutory Deadline | Principal Reason | |||
|---|---|---|---|---|
| Workload | External Consultation | Internal Consultation | Other | |
| 1 | 0 | 0 | 0 | 1 |
2.6.2 Number of days past deadline
| Number of Days Past Deadline | Number of Requests Past Deadline Where No Extension Was Taken | Number of Requests Past Deadline Where An Extension Was Taken | Total |
|---|---|---|---|
| 1 to 15 days | 0 | 0 | 0 |
| 16 to 30 days | 0 | 1 | 1 |
| 31 to 60 days | 0 | 0 | 0 |
| 61 to 120 days | 0 | 0 | 0 |
| 121 to 180 days | 0 | 0 | 0 |
| 181 to 365 days | 0 | 0 | 0 |
| More than 365 days | 0 | 0 | 0 |
| Total | 0 | 1 | 1 |
2.7 Requests for translation
| Translation Requests | Accepted | Refused | Total |
|---|---|---|---|
| English to French | 0 | 0 | 0 |
| French to English | 0 | 0 | 0 |
| Total | 0 | 0 | 0 |
Part 3: Disclosures Under Subsections 8(2) and 8(5)
| Paragraph 8(2)(e) | Paragraph 8(2)(m) | Subsection 8(5) | Total |
|---|---|---|---|
| 0 | 0 | 0 | 0 |
Part 4: Requests for Correction of Personal Information and Notations
| Disposition for Correction Requests Received | Number |
|---|---|
| Notations attached | 0 |
| Requests for correction accepted | 0 |
| Total | 0 |
Partie 5 - Extensions
5.1 Reasons for extensions and disposition of requests
| Disposition of Requests Where an Extension Was Taken | 15(a)(i) Interference With Operations | 15(a)(ii) Consultation | 15(b) Translation or Conversion | |
|---|---|---|---|---|
| Section 70 | Other | |||
| All disclosed | 0 | 0 | 0 | 0 |
| Disclosed in part | 1 | 0 | 0 | 0 |
| All exempted | 0 | 0 | 0 | 0 |
| All excluded | 0 | 0 | 0 | 0 |
| No records exist | 0 | 0 | 0 | 0 |
| Request abandoned | 0 | 0 | 0 | 0 |
| Total | 1 | 0 | 0 | 0 |
5.2 Length of extensions
| Length of Extension | 15(a)(i) Interference With Operations | 15(a)(ii) Consultation | 15(b) Translation purposes | |
|---|---|---|---|---|
| Section 70 | Other | |||
| 1 to 15 days | 0 | 0 | 0 | 0 |
| 16 to 30 days | 1 | 0 | 0 | 0 |
| Total | 1 | 0 | 0 | 0 |
Part 6: Consultations Received From Other Institutions and Organizations
6.1 Consultations received from other Government of Canada institutions and other organizations
| Consultations | Other Government of Canada Institutions | Number of Pages to Review | Other Organizations | Number of Pages to Review |
|---|---|---|---|---|
| Received during the reporting period | 0 | 0 | 0 | 0 |
| Outstanding from the previous reporting period | 0 | 0 | 0 | 0 |
| Total | 0 | 0 | 0 | 0 |
| Closed during the reporting period | 0 | 0 | 0 | 0 |
| Pending at the end of the reporting period | 0 | 0 | 0 | 0 |
6.2 Recommendations and completion time for consultations received from other Government of Canada institutions
| Recommendation | Number of Days Required to Complete Consultation Requests | |||||||
|---|---|---|---|---|---|---|---|---|
| 1 to 15 Days | 16 to 30 Days | 31 to 60 Days | 61 to 120 Days | 121 to 180 Days | 181 to 365 Days | More Than 365 Days | Total | |
| All disclosed | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Disclosed in part | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| All exempted | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| All excluded | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Consult other institution | 0 | 0 | 0 | 2 | 0 | 0 | 0 | 0 |
| Other | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Total | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
6.3 Recommendations and completion time for consultations received from other organizations
| Recommendation | Number of Days Required to Complete Consultation Requests | |||||||
|---|---|---|---|---|---|---|---|---|
| 1 to 15 Days | 16 to 30 Days | 31 to 60 Days | 61 to 120 Days | 121 to 180 Days | 181 to 365 Days | More Than 365 Days | Total | |
| All disclosed | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Disclose in part | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| All Exempted | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| All Excluded | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Consult other institution | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Other | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Total | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Part 7: Completion Time of Consultations on Cabinet Confidences
7.1 Requests with Legal Services
| Number of Days | Fewer Than 100 Pages Processed | 101-500 Pages Processed |
501-1000 Pages Processed |
1001-5000 Pages Processed |
More than 5000 Pages Processed | |||||
|---|---|---|---|---|---|---|---|---|---|---|
| Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | |
| 1 to 15 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 16 to 30 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 31 to 60 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 61 to 120 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 121 to 180 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 181 to 365 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| More than 365 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Total | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
7.2 Requests with Privy Council Office
| Number of Days | Fewer Than 100 Pages Processed | 101-500 Pages Processed |
501-1000 Pages Processed |
1001-5000 Pages Processed |
More than 5000 Pages Processed | |||||
|---|---|---|---|---|---|---|---|---|---|---|
| Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | |
| 1 to 15 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 16 to 30 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 31 to 60 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 61 to 120 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 121 to 180 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 181 to 365 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| More than 365 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Total | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Partie 8 - Complaints and Investigations
| Section 31 | Section 33 | Section 35 | Court action | Total |
|---|---|---|---|---|
| 0 | 0 | 0 | 0 | 1 |
Part 9 - Pivacy Impact Assessments (PIAs)
| Number of PIA(s) completed | 0 |
|---|
Partie 10 - Ressources Related to the Privacy Act
10.1 Costs
| Expenditures | Amount |
|---|---|
| Salaries | $413 |
| Overtime | $0 |
| Goods and Services | $0 |
| Professional services contracts | $0 |
| Other | $0 |
| Total | $413 |
10.2 Human Resources
| Resources | Person Years Dedicated to Privacy Activities |
|---|---|
| Full-time employees | 0.01 |
| Part-time and casual employees | 0.00 |
| Regional staff | 0.00 |
| Consultants and agency personnel | 0.00 |
| Students | 0.00 |
| Total | 0.01 |
| Note: Enter values to two decimal places. | |