Annual Report Privacy Act 2022-2023

TABLE OF CONTENTS

• Introduction
  • About the Commission
  • Our Mandate
• Organizational Structure
• Delegation Order
• Performance 2022-2023
• Training and Awareness
• Policies, Guidelines and Procedures
• Initiatives and Projects to Improve Privacy
• Summary of Key Issues and Actions Taken on Complaints
• Material Privacy Breaches 
• Privacy Impact Assessments 
• Public Interest Disclosures 
• Monitoring Compliance 

1. Introduction

This is the 39th Annual Report to Parliament submitted by the Canadian Human Rights Commission (the Commission) pursuant to section 72 of the Privacy Act.

The purpose of the Privacy Act is to protect the privacy of individuals with respect to personal information about themselves held by a government institution and to provide individuals with a right of access to that information.

Section 72 of the Privacy Act requires that the head of every government institution shall prepare, for submission to Parliament, an annual report on the administration of the Act within the institution during each fiscal year.

This report describes the work of the Commission’s Access to Information and Privacy Office for the fiscal year 2022-2023.

About Us

The Canadian Human Rights Commission is Canada's human rights watchdog. We work for the people of Canada and operate independently from the Government. The Commission helps ensure that everyone in Canada is treated fairly, no matter who they are. We are responsible for representing the public interest and holding the Government of Canada to account on matters related to human rights.

The Accessible Canada Act, the Employment Equity Act, and the Pay Equity Act give the Commission the authority to work with federally regulated employers to ensure they are preventing discrimination and promoting inclusion through proactive compliance with these laws. This contributes to the elimination of employment barriers and wage discrimination in federally regulated work places for women, Indigenous peoples, people with disabilities and racialized groups.^*

Our Mandate

The Commission protects the core principle of equal opportunity and promotes a vision of an inclusive society free from discrimination by:

• promoting human rights through research and policy development;
• protecting human rights through a fair and effective complaints process;
• representing the public interest to advance human rights for all Canadians; and
• auditing employers under federal jurisdiction for compliance with employment equity.
• help federally regulated employers and services create a barrier-free Canada through the
• proactive identification, removal, and prevention of barriers to accessibility;
• promote women’s equality by ensuring that federal public and private sector organizations
• value the work done by women in the same as they value work done by men; and
• drive change on key systemic housing issues and advance the right for housing for all in
• Canada. 

2. Organizational Structure

The ATIP Office is organizationally housed within the IM/IT Division, which is part of the Corporate Management Branch.

In fiscal year 2022-2023, the ATIP Unit was composed of an ATIP Coordinator, a Senior ATIP Adviser, a Senior ATIP Analyst, an ATIP Analyst, and an ATIP Officer.

The ATIP Unit processes formal and informal requests, consultations and complaints the Commission receives pursuant to the Access to Information Act and the Privacy Act, and produces Annual Reports and the Info Source in accordance with these Acts. In addition, the ATIP Unit investigates and reports on privacy incidents.

Furthermore, the ATIP Unit provides subject matter expert advice and training to all staff, compiles statistics as required, and prepares weekly reports to provide updates with respect to the active Privacy Act requests, consultations, and complaints submitted to the Office of the Privacy Commissioner for senior management. It is also responsible for investigating privacy breaches and reporting any material breach to the Office of the Privacy Commissioner and the Treasury Board Secretariat.

3. Delegation Order

The Delegation Order sets out the powers, duties and functions for the administration of the Privacy Act that has been delegated by the head of the institution, the Chief Commissioner.

The Chief Commissioner has delegated her decision-making authority under the Privacy Act to the Director General of the Corporate Management Branch. The power to process requests is delegated to the ATIP Office. As the functional delegate, the Director General oversees the processing of requests, the internal investigations on privacy breaches, and the handling of complaints.

Please refer to Appendix A for a copy of the Signed Delegation Order.  

4. Performance 2022-2023

During the period under review, April 1, 2022 to March 31, 2023, the Commission’s total number of Privacy Act requests were as follows:

• 26 new requests were received,
• 6 were requests outstanding from the previous reporting period, and
• 2 were requests outstanding from more than one reporting period.

Of these, 29 requests were closed during this reporting period and 5 were carried over to the next reporting period. During this 2022-2023 reporting period, the Commission received 7 privacy requests less than last reporting year representing a 21% decrease.

We note that most requests were submitted from individuals who have filed human rights complaints at the Commission alleging discrimination on the basis of one or more of the prohibited grounds under the Canadian Human Rights Act:

• race;
• national or ethnic origin;
• colour;
• religion;
• age;
• sex;
• sexual orientation;
• gender identity or expression;
• marital status;
• family status;
• disability;
• genetic characteristics; and
• a conviction for which a pardon has been granted or a record suspended.

Of the 8 requests carried over from the previous fiscal years, 3 were completed within legislated timelines during the reporting year, and 5 were completed beyond legislated timelines during the reporting year. Extensions of 30 days were taken for 6 of the 8 requests. No extension was taken for 2 of the requests that were completed within legislated timelines.

Out of the 26 new requests received during this period, 17 were made online, 5 were made by e-mail, 3 were mailed, and 1 request was made by telephone. Although the Privacy Act requires that requests for personal information be made in writing, the Commission accepts requests made by telephone when it is necessary to accommodate requesters.

Of the 29 requests closed during this period, 17,567 relevant pages were processed, 7,892 pages were released. The disposition of each request was as follows:

• 4, or 13.8%, and totalizing 44 pages, were All disclosed;
• 14, or 48.3%, and totalizing 17,523 pages, were Disclosed in part;
• 5, or 17.2%, were No records exist; and 
• 6, or 20.7%, were Request abandoned.

The completion times of the 29 Privacy requests closed during this reporting period were as follows:

• 11 requests took between 1 to 15 days;
• 6 requests took between 16 to 30 days;
• 7 requests took between 31 to 60 days;
• 2 requests took between 61 to 120 days;
• 0 requests took between 121 to 180 days;
• 1 requests took between 181 to 365 days; and,
• 2 requests took more than 365 days 

Consultations:

A consultation is when the record(s) responding to a particular request are transmitted from another organization (federal, provincial, territorial, municipal) to the Commission for review, and to advise recommendations if any exemptions are needed.

During this reporting period, the Commission received 4 consultation requests from other Government of Canada institutions and reviewed 260 pages. All consultations were closed during the reporting period and there were none carried over from the last reporting period. The completion times were as follows:

• 1 consultation request took 1 to 15 days;
• 2 consultation requests took 16 to 30 days; and
• 1 consultation request took 31-60 days.

The recommendation was to disclose all records on each consultation request.

Informal requests:

An informal request is a request for information that is not processed under the Act. There are no deadlines for responding. Also, the requester has no statutory right to complain to the Office of the Privacy Commissioner of Canada.

The Commission did not receive any informal requests during this reporting period.

Multi-year trends

Figure 1 reveals the number of requests received, processed, and completed during each fiscal year over the past five years. We observe that the number of requests received, processed, and completed increased significantly in the fiscal year 2021-2022, but decreased at a rate of 21% in fiscal year 2022-2023.

Figure 2 shows the number of consultations processed during each reporting period. Although there is no consistent pattern in these numbers to set a specific trend, it is clear that the number of consultations processed decreased during the reporting period. 

With respect to Figure 3, the graph shows the number of complaints processed during each reporting period, which includes those received during the fiscal year and carried over from previous fiscal years. The Commission received 2 new complaints during the reporting period and there were 4 carried over from the previous fiscal years. We observe that the ATIP Unit has consistently worked on 2 complaint files in each fiscal year from 2018 to 2021. However, this number has increased to 6 in the fiscal years 2021-2022 and 2022-23. More information about the 6 complaints the ATIP Unit worked on for the reporting period is explained on page 9 and 10. 

Requests closed past the legislated timelines

The Commission is committed to completing requests in a timely fashion. During this reporting period, 24 requests, or 83%, were responded to within the legislated timelines, while 5 requests, or 17%, were closed past the legislated timeline. The details are explained in the following table and further expanded below. 

Out of the 5 requests that were closed past the statutory deadline, the Commission took an extension on all 5 requests due to volume pursuant to s. 15(a)(i) because meeting the original time limit would unreasonably interfere with operations.

Extensions taken on requests closed within legislated timelines

The Commission took extensions on 7 requests due to volume pursuant to s. 15(a)(i) because meeting the original time limit would unreasonably interfere with the operations. In addition, we completed internal consultations for 2 out of the 7 requests, and we completed external consultations for 2 out of the 7 requests.

Impacts experienced in relation to the processing of ATIP requests due to COVID-19

The COVID-19 pandemic brought changes to the Commission’s records management practices: since March 16, 2020, all the new records of business value at the Commission are created in electronic format only. External records received in paper format are digitized.

During the reporting period, the Commission staff had full access to the offices and could consult paper documents created prior to the pandemic. Therefore, the Commission did not experience any impacts in relation to the processing of ATIP requests due to COVID-19 during the reporting period.

Application of Exemptions

Partial exemptions claimed under the PA were invoked in 25 requests. For some requests, more than one exemption was invoked.

Legal Advice Sought

During the reporting period, legal advice was requested 8 times for issues regarding Privacy Act. Please refer to Appendix B for the statistical report on the Privacy Act.

5. Training and Awareness

The ATIP Office provides policy and processing advice to the Commission staff on the Privacy Act as needed.

The ATIP Unit has two types of training that can be provided to the Commission’s staff. One includes a general overview of ATIP, discussing the 8 steps involved in the processing of ATIP requests, drawing on the information available in the Canada School of Public Service online ATIP module. The training also touches on the various responsibilities of the Commission staff members that need to be completed in response to an ATIP request. This training also discusses privacy breaches, best practices to avoid privacy breaches and what to do when they happen. The second training focuses on the role and the responsibilities of the Offices of Primary Interest when responding to ATIP requests. It is a summary of the first one, but focuses on explaining how to read a request; how and where to search for records; how to retrieve them; how to determine which records are responsive; and how to send the responsive records to the ATIP Unit. This training also touches on information management best practices (a member of the Information Management Services team is assisting the ATIP trainer when answering questions).

During the fiscal year 2022-23, the ATIP Unit provided one-on-one training to new staff members and refresher training to two teams. The ATIP Unit, in collaboration with the Information Management Services, continued to educate staff on information management best practices through training and email communications sent to all staff.

Employees wanting more training for their personal and professional development are also referred to the Treasury Board Secretariat training calendar and the Canada School of Public Service. 

6. Policies, Guidelines and Procedures

The functioning of the ATIP Office is governed by the Treasury Board Secretariat’s policies and the Commission’s internal policies. Ongoing review and business re-engineering of the Commission’s practices concerning the processing of requests is always a top consideration. This review serves to improve our policies and practices. For example, as mentioned earlier, the COVID -19 pandemic brought changes in the Commission’s records management practices (since the beginning of the pandemic, all the new records of business value are in electronic format). The documents that are received in paper format are systematically digitized. This has facilitated the search for records process for the Offices of the Primary Interest as well as the processing of the records for the ATIP Unit as it has resulted in the handling of primarily electronic records.

The ATIP Unit began work on updating the Commission’s Privacy Breach Management process and its Privacy Breach checklist during this reporting period in line with the Treasury Board Secretariat’s updated Policy on Privacy Protection. The Privacy Breach checklist now provides additional scenarios of privacy breaches offering guidance to the Office of the Primary Interest about when to report a privacy breach and when to provide supporting documents to the ATIP Unit. Privacy breaches are now monitored in a faster and more efficient way.

To make the ATIP functions operate more smoothly, the Commission continues to develop its procedures to take into account the complexity of the requests to achieve our goal of fulfilling our mandate under the Privacy Act within the prescribed deadlines.

In line with our commitment to finding efficiencies, the ATIP Unit continues to refine its tools for Offices of the Primary Interest and the Commission as a whole providing information on best practices, including on how to respond to an ATIP request, the retrieval of responsive records, and the reporting of privacy breaches.

7. Initiatives and Projects to Improve Privacy

The Commission began to gather information and prepare for the implementation project of ATIPXpress, a new Request Processing Software Solution (RPSS), to replace the Commission’s existing Access Pro Case Management software. ATIPXpress is one of the two next generation RPSS available for procurement to federal Government of Canada institutions. The project is in support of the Government of Canada which seeks to modernize its various request management software solutions used throughout the federal government, with more current and more advanced technology that would allow the ATIP offices to benefit from significant gains in efficiency and administrative cost savings to process ATIP requests.

In addition, the ATIP Unit began to provide to requesters voluminous electronic responsive records, wen requested, through a secured Microsoft 365 OneDrive link. This allowed the requesters to simply click on the link to access the records automatically.

8. Summary of Key Issues and Actions Taken on Complaints

The Commission received 2 new complaints during this reporting period. Furthermore, the Commission worked on 4 complaints that were carried over from previous fiscal years.

9. Material Privacy Breaches

There were no material privacy breaches during the reporting period.

10. Privacy Impact Assessments

During the reporting period, the ATIP Unit initiated the drafting of a Privacy Impact Assessment for the implementation of ATIPXpress to replace Access Pro, the current ATIP case management system of the Commission.

11. Public Interest Disclosures

There was no disclosure under subsection 8(2)(m) during the reporting period.

12. Monitoring Compliance

Requests are monitored daily. Information about the different processing stages is entered into the Commission’s case management system. Weekly reports of the open requests and complaints are generated and shared with the team, the ATIP Coordinator, and the ATIP Delegate.

Delays in processing requests primarily occur when consultations are needed or when handling voluminous records. When it appears that a delay in processing a request is inevitable, the ATIP staff contacts the requester. If the requester cannot be reached, the ATIP Coordinator is notified of any concerns. If necessary, the ATIP Delegate is notified to ensure that the request is being processed in a reasonable period. In addition, the Commission makes every effort to limit conducting inter- institutional consultations, but they could be carried out if requested by the ATIP Coordinator and, or, the ATIP Delegate when there is an intention to disclose information. The ATIP Delegate will bring any issues to the Executive Director’s attention and the Executive Director will discuss them with the Chief Commissioner, as required.

Although there are internal practices put in place to ensure that the Commission is maintaining privacy and confidentiality for contracts, agreements and arrangements, there is currently no specific monitoring being conducted during the reporting period, therefore no level of officials are being advised for this type of requirement at this time.

The Commission’s procurement team has put in place internal practices to maintain privacy and confidentiality for contracts, agreements, and arrangements. For example, contracts do not include personal information and clients are encouraged to send this information if/when required separately. Although there are internal practices put in place to maintain privacy and confidentiality for contracts, agreements, and arrangements, as indicated earlier, there was no specific monitoring being conducted during the reporting period, therefore no level of officials were advised during this time.

APPENDIX A

APPENDIX B 

Statistical Report on the Privacy Act

Name of institution: Canadian Human Rights Commission    

Reporting period: 2022-04-01 to 2023-03-31    

Section 1: Requests Under the Privacy Act

1.1  Number of requests received

1.2 Channels of requests

Section 2: Informal requests 

2.1 Number of informal requests 

2.2  Channels of informal requests 

2.3 Completion time of informal requests 

2.4 Pages released informally

Section 3: Requests Closed During the Reporting Period 

3.1 Disposition and completion time

3.2 Exemptions

3.3 Exclusions

3.4 Format of information released 

3.5 Complexity

3.5.1 Relevant pages processed and disclosed for paper and e-record formats

3.5.2 Relevant pages processed by request disposition for paper and e-record formats by size of requests

3.5.3 Relevant minutes processed and disclosed for audio formats

3.5.4 Relevant minutes processed per request disposition for audio formats by size of requests

3.5.5 Relevant minutes processed and disclosed for video formats

3.5.6 Relevant minutes processed per request disposition for video formats by size of requests

3.5.7 Other complexities

3.8 Requests for translation

Section 4: Disclosures Under Subsections 8(2) and 8(5) 

Section 5: Requests for Correction of Personal Information and Notations 

Section 6: Extensions 

6.1 Reasons for extensions

7.2 Recommendations and completion time for consultations received from other Government of Canada institutions

7.3 Recommendations and completion time for consultations received from other organizations outside the Government of Canada

Section 8: Completion Time of Consultations on Cabinet Confidences 

8.1 Requests with Legal Services

8.2 Requests with Privy Council Office

Section 9: Complaints and Investigations Notices Received

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs) 

10.1 Privacy Impact Assessments

10.2 Institution-specific and Central Personal Information Banks

Section 11: Privacy Breaches  

11.1 Material Privacy Breaches reported

11.2 Non-Material Privacy Breaches

Section 12: Resources Related to the Privacy Act

12.1 Allocated Costs

12.2 Human Resources

Note: Enter values to three decimal places.

Supplemental Statistical Report on the Access to Information Act and the Privacy Act

Name of institution: Canadian Human Rights Commission    

Reporting period: 2022-04-01 to 2023-03-31

Section 1: Capacity to Receive Requests under the Access to Information Act and the Privacy Act

Enter the number of weeks your institution was able to receive ATIP requests through the different channels.

Section 2: Capacity to Process Records under the Access to Information Act and the Privacy Act

2.1 Enter the number of weeks your institution was able to process paper records in different classification levels.

2.2 Enter the number of weeks your institution was able to process electronic records in different classification levels.

Section 3: Open Requests and Complaints Under the Access to Information Act

3.1 Enter the number of open requests that are outstanding from previous reporting periods.

3.2 Enter the number of open complaints with the Information Commissioner of Canada that are outstanding from previous reporting periods.

Section 4: Open Requests and Complaints Under the Privacy Act

4.1 Enter the number of open requests that are outstanding from previous reporting periods.

4.2 Enter the number of open complaints with the Privacy Commissioner of Canada that are outstanding from previous reporting periods.

Section 5: Social Insurance Number

Section 6: Universal Access under the Privacy Act