Annual Report on the Privacy Act 2014-2015

Table of Contents

• Introduction
• Mandate of the Public Prosecution Service of Canada
• Commissioner of Canada Elections
• Access to Information and Privacy (ATIP) Office
• Delegated Authorities
• Interpretation of the Statistical Report
  • Part 1 – Requests Under the Privacy Act
  • Part 2 – Requests Closed During the Reporting Period
    • Disposition of requests
    • Completion time
    • Exemptions
    • Exclusions
    • Format of information released
    • Complexity
    • Deemed refusals
    • Requests for translation
  • Part 3 – Disclosures Under Subsection 8(2) and 8(5)
  • Part 4 – Requests for Correction of Personal Information and Notations
  • Part 5 – Extensions
    • Reason for extensions
    • Length of extensions
  • Part 6 – Consultations Received from Other Institutions and Organizations
    • Number of consultations
    • Sources of consultations
    • Recommendations
    • Completion time
  • Part 7 – Completion Time of Consultations on Cabinet Confidences
  • Part 8 – Complaints and Investigations Notices Received
    • Complaints
    • Federal Court review
  • Part 9 – Privacy Impact Assessments (PIAs)
  • Part 10 – Resources Related to the Privacy Act
• Training Activities
• New or Revised Policies, Guidelines and Procedures
• Monitoring of Processing Time
• Privacy Breaches
• Appendix A – Delegation Order
• Appendix B – Statistical Report on the Privacy Act

Introduction

The Privacy Act (the Act) came into force on July 1, 1983. The purpose of the Act is to protect the privacy of individuals with respect to personal information about themselves held by government institutions and to provide individuals with a right of access to that information.

The Public Prosecution Services of Canada (PPSC) became subject to the Act when it was established as an independent organization on December 12, 2006, with the coming into force of the Director of Public Prosecutions Act (Part 3 of the Federal Accountability Act).

Pursuant to section 72 of the Act, the PPSC has prepared this 2014–2015 Annual Report on the Privacy Act for tabling in the House of Commons and the Senate. This Report provides an analysis of the information contained in the PPSC’s Statistical Report on the Privacy Act. In addition, it reports on emerging trends, training activities and newly implemented or revised internal policies, guidelines and procedures with respect to the PPSC’s administration of the Act.

Mandate of the Public Prosecution Service of Canada

The PPSC’s mandate is set out in the Director of Public Prosecutions Act (DPPA). The DPPA empowers the Director of Public Prosecutions (DPP) as Deputy Attorney General of Canada to:

• initiate and conduct federal prosecutions;
• intervene in proceedings that raise a question of public interest that may affect the conduct of prosecutions or related investigations;
• issue guidelines to federal prosecutors;
• advise law enforcement agencies or investigative bodies on general matters relating to prosecutions and on particular investigations that may lead to prosecutions;
• communicate with the media and the public on all matters that involve the initiation and conduct of prosecutions;
• exercise the authority of the Attorney General of Canada in respect of private prosecutions; and
• exercise any other power or carry out any other duty or function assigned by the Attorney General of Canada that is compatible with the office of the DPP.

The DPPA also empowers the DPP to:

• initiate and conduct prosecutions under the Canada Elections Act; and
• act, when requested by the Attorney General of Canada, in matters under the Extradition Act and the Mutual Legal Assistance in Criminal Matters Act.

The DPP has the rank and status of a deputy head of a department, and in this capacity is responsible for the management of the PPSC as a distinct governmental organization.

Commissioner of Canada Elections

The Commissioner of Canada Elections (CCE) is responsible for ensuring that the Canada Elections Act and the Referendum Act are complied with and enforced. On October 1, 2014, following passage of Bill C-23, An Act to amend the Canada Elections Act and other Acts and to make consequential amendments to certain Acts, the Office of the CCE was transferred from Elections Canada to the PPSC. As a result, the CCE reports to the DPP, but remains operationally independent.

As of October 1, 2014, all privacy requests and consultations regarding the Office of the CCE are processed by the PPSC’s Access to Information and Privacy Office. Any requests prior to this date would have been processed by Elections Canada.

Access to Information and Privacy (ATIP) Office

The ATIP Office holds primary responsibility for the implementation and administration of the Act. The Office deals directly with the public in relation to privacy requests, liaises with its points of contact to prepare responses, and serves as the centre of expertise for ATIP within the PPSC.

The ATIP Office carries out its responsibilities by:

• processing requests for personal information in accordance with the Act, its Regulations and the Treasury Board Secretariat of Canada (TBS)’s policies, directives and guidelines;
• responding to consultations submitted by other federal institutions or other levels of government on PPSC records being considered for release;
• providing advice to PPSC managers and employees regarding the application and interpretation of the Act, its Regulations and relevant case law;
• responding to requests received from other federal institutions for the review of solicitor-client privilege in records related to criminal proceedings in which the PPSC is involved;
• reviewing PPSC policies, procedures and agreements to ensure that they comply with the requirements of the Act and making recommendations for amendments;
• monitoring the PPSC’s compliance with the Act, its Regulations and the TBS’s policies, directives and guidelines;
• communicating with investigators of the Office of the Privacy Commissioner of Canada to resolve complaints filed against the PPSC;
• reviewing documents relevant to proactive disclosure, such as audits and evaluations and contracts over $25,000 prior to their publication on the PPSC’s website, in order to ensure that they do not contain personal information;
• delivering training sessions intended to familiarize PPSC managers and employees with the requirements of the Act, its Regulations and the TBS’s policies, directives and guidelines;
• updating the PPSC’s chapter of the federal government’s Info Source publication;
• submitting an annual statistical report on the administration of the Act to the TBS; and
• preparing an annual report on the administration of the Act for tabling in both Houses of Parliament.

Organization Structure

[Text version]

As of March 31, 2014, the ATIP Office is comprised of a Manager, a Senior Analyst, two Advisors and one Junior Analyst. The Executive Director and Senior Counsel, Ministerial and External Relations Secretariat, serves as the organization’s ATIP Coordinator. Counsel for the Ministerial and External Relations Secretariat serves as ATIP Counsel and provides legal advice to the ATIP Coordinator, the ATIP Office and PPSC managers on the application and interpretation of the Act and relevant case law.

Delegated Authorities

Pursuant to section 73 of the Act, the head of a government institution may, by order, designate one or more officers or employees of that institution to exercise or perform any of the powers, duties of function of the head of the institution under the Act.

The DPP, as the “head of institution”, has designated the authority to exercise the powers and to perform the duties and functions conferred to him under the Act to the Executive Director and Senior Counsel, Ministerial and External Relations Secretariat, and the ATIP Manager (see Delegation Order in Appendix A). The ATIP Manager exercises this authority in the absence of the Executive Director and Senior Counsel.

Interpretation of the Statistical Report

The following section provides a summary and analysis of the information contained in the Statistical Report on the Privacy Act located in Appendix B of this report. It also compares statistical data from 2014–2015 with data from previous reporting periods in order to identify possible trends.

Part 1 – Requests Under the Privacy Act

The PPSC received 11 requests for personal information in 2014–2015, which represents a 48% decrease in the number of requests received from the previous reporting period. In addition, three (3) requests were carried forward from fiscal year 2013–2014.

This is the first time since the 2010–2011 reporting period that there has been a decrease in the number of privacy requests received. Although the number of requests fluctuated in the early years since the creation of the PPSC, it had been steadily increasing since 2010–2011, reaching an all-time high of 21 during the last fiscal year.

Part 2 – Requests Closed During the Reporting Period

Disposition of requests

The PPSC responded to 12 requests for personal information during the 2014–2015 reporting period. A total of 2,634 pages were reviewed, which represents a 24% decrease in volume from the previous reporting period. Two (2) outstanding requests for personal information were carried over to the next reporting period.

The 12 completed requests can be categorized as follows:

No Records Exist

• A total of 17% of requests could not be processed as no relevant records existed under the control of the PPSC. Where possible, applicants were advised of other government institutions that may have records and provided with the contact information of those institutions for the purpose of submitting a request.

The PPSC’s disclosure rates in 2014–2015 were significantly higher than the average over the previous five (5) years. The PPSC responded to a total of 78 requests for personal information between fiscal years 2010–2011 to 2014–2015. In 63% of cases, the PPSC responded by releasing information in whole or in part. During 2014–2015, full or partial disclosure of the information requested was provided in 83% of cases.

Completion time

The chart below provides a breakdown of the length of time (in days) required to process requests for personal information during the 2014–2015 reporting period.

Of the 12 requests that were completed during fiscal year 2014–2015, nine (9) were processed within the 30-day statutory response period. Two (2) requests were responded to within 31 to 120 days, and one (1) request required more than 365 days to complete.

Over the last five (5) reporting periods, 57% of the PPSC’s requests for personal information were responded to within the 30-day statutory deadline.

Exemptions

An individual’s right of access to his or her personal information is subject to limited and specific exceptions. Limitations to the right of access are set out in sections 18 through 28 of the Act.

The following is a breakdown of the exemptions that were invoked by the PPSC during the 2014–2015 reporting period.

Exclusions

Records or parts thereof to which the Act does not apply are considered to be “excluded”. Pursuant to section 69, the Act does not apply to library or museum material preserved solely for public record, and material placed in Library and Archives Canada. Records containing Confidences of the Queen's Privy Council for Canada that have been in existence for less than 20 years are also excluded from the Act pursuant to section 70.

During the 2014–2015 reporting period, no exclusions pursuant to sections 69 and 70 of the Act were applied by the PPSC.

Format of information released

For responses in which information was disclosed, the information was provided to the applicant electronically by e-mail or on a compact disk in 30% of cases. Paper copies of records were provided in 70% of cases.

Complexity

The mandate of the PPSC is to prosecute offences under federal jurisdiction and to provide advice on prosecution-related matters to investigative agencies. Due to the nature of the organization’s work, processing privacy requests is challenging. Records held by the PPSC often contain information relating to criminal or regulatory investigations or prosecutions that also frequently involve other organizations and government departments at the federal, provincial or territorial level.

During the 2014–2015 reporting period, the PPSC consulted with other government institutions on two (2) particularly complex requests. Legal advice was sought in order to respond to one (1) request. Five (5) requests were also considered complex due to the personal information of another individual being intermixed with the information of the applicant.

Deemed refusals

The PPSC was in deemed refusal on two (2) occasions during the 2014–2015 reporting period due to the large volume of records that required processing. On one (1) such occasion, the PPSC took a 30-day extension; however, the organization was unable to complete the processing of the request within the 60-day time period.

Requests for translation

One (1) request for translation was received by the PPSC. The organization granted the applicant’s request to have the records translated from French to English.

Part 3 – Disclosures under Subsection 8(2) and 8(5)

Subsection 8(2) of the Act describes the circumstances under which personal information under the control of a government institution may be disclosed without the consent of the individual to whom the information pertains.

There were no disclosures made to federal investigative bodies for the purpose of enforcing any law of Canada or a province, or for carrying out a lawful investigation [paragraph 8(2)(e)] in fiscal year 2014–2015, nor were any disclosures made in the public interest [paragraph 8(2)(m)].

Part 4 – Requests for Correction of Personal Information and Notations

Paragraph 12(2)(a) of the Act provides that every individual who is given access to personal information about themselves that has been used, is being used, or is available for use for an administrative purpose (i.e. in a decision making process that directly affects the individual) is entitled to request correction of the information where the individual believes there is an error or omission.

There were no requests for correction of personal information nor were notations required during this reporting period.

Part 5 – Extensions

Paragraph 15(a) of the Act allows for an extension of the 30-day statutory time limit for a maximum of 30 days in cases where meeting the original time limit would unreasonably interfere with the operations of the institution processing the request, or when consultations with other government institutions are necessary and cannot reasonably be completed within the original time limit.

Reason for extensions

A total of three (3) extensions were taken during the 2014–2015 reporting period. In one (1) instance, the extension was sought on the basis that meeting the original time limit would unreasonably interfere with the operations of the PPSC. On two (2) other occasions, consultations were necessary to comply with the request and could not be completed within the 30-day statutory time limit.

Length of extensions

Of the three (3) extensions taken during the reporting period, one (1) was for a duration of 16 to 30 days. The remaining two (2) instances, required extensions of 15 or less days.

Part 6 – Consultations Received from Other Institutions and Organizations

Number of consultations

The PPSC received seven (7) privacy consultations in 2014–2015, which represents a 46% decrease in the number of consultations received during the previous reporting period. This decrease in consultations can be attributed in part to the Treasury Board Secretariat’s decision to remove the mandatory requirement of government institutions to consult the PPSC prior to exempting information on the basis of solicitor-client privilege pursuant to section 27 of the Act.

Sources of consultations

The Royal Canadian Mounted Police (RCMP) sent four (4) consultations, while the Canada Border Services Agency (CBSA), the Canadian Food Inspection Agency (CFIA) and the Nova Scotia Justice Canada each sent one (1).

Recommendations

The PPSC responded to seven (7) consultations during the 2014–2015 reporting period. A total of 316 pages were reviewed, representing a 2% decrease in volume from the previous fiscal year.

Recommendations made by the PPSC in respect of completed consultations during the reporting period can be broken down as follows:

The PPSC’s disclosure rates in 2014–2015 are consistent with the average rate over the five (5) previous years. The PPSC processed 68 consultations from fiscal years 2010–2011 to 2014–2015. In 85% of cases, the PPSC recommended that information be released in whole or in part. During 2014–2015, full or partial disclosure of information was recommended in 86% of cases.

Completion time

Of the seven (7) consultations that were completed, three (3) were responded to within 15 days or less. The four (4) remaining consultations required between 16 to 30 days to complete.

Over the last five (5) reporting periods, more than three quarters of privacy consultations received by the PPSC were responded to within 30 days. From 2010–2011 to 2014–2015, 57% of consultations completed were processed in 15 days or less while an additional 22% were completed within 16 to 30 days.

Part 7 – Completion Time of Consultations on Cabinet Confidences

No consultations on the application of section 70 [Cabinet confidences] of the Act were carried out during the 2014–2015 reporting period.

Part 8 – Complaints and Investigations Notices Received

Complaints

Decisions made under the Act are subject to a two-tiered system of review. The first level of review is a formal complaint to the Office of the Privacy Commissioner of Canada (OPC); the second level is an application for judicial review to the Federal Court.

No complaints were filed with the OPC against the PPSC during the 2014–2015 reporting period; however, two (2) exemption complaints were carried forward from previous reporting periods. The OPC has yet to issue its finding in either case.

Federal Court review

During this reporting period, no application for judicial review was filed with the Federal Court pursuant to section 41 of the Act with respect to privacy requests submitted to the PPSC.

Part 9 – Privacy Impact Assessments (PIAs)

A Privacy Impact Assessment (PIA) is a tool used to assist an organization to meet its privacy responsibilities with regard to the management of personal information. PIAs are initiated when assessing the privacy implications of new or substantially modified programs and activities involving personal information.

During this reporting period, a PIA with respect to the PPSC’s proposal to outsource to a private collection agency a portion of the collection work being handled by the National Fine Recovery Program (NFRP) was completed by the PPSC and provided to the OPC.

An executive summary of the PIA is available on the PPSC website at: https://www.ppsc-sppc.gc.ca/eng/tra/pia-efp/nfrp-pnra.html.

Part 10 – Resources Related to the Privacy Act

During this reporting period, the PPSC spent a total of $191,222 administering the Act of which salaries accounted for $178,383 and Goods and Services accounted for $12,839. There were no overtime expenditures.

Training Activities

During this reporting period, the ATIP Office provided a training and awareness session regarding the PPSC’s processes and employee obligations under the Act to approximately ten (10) employees of the PPSC’s Alberta Regional Office. An information session regarding the PPSC’s privacy policies was also provided to the organization’s business coordinators.

In addition, ATIP personnel provided informal training to employees on various privacy-related matters on an ad hoc basis.

New or Revised Policies, Guidelines and Procedures

In 2014–2015, the PPSC developed a Privacy Management Framework which will serve as a primary resource for employees and agents of the PPSC seeking information regarding the organization’s privacy management practices. The Framework sets out the PPSC’s organizational practices to ensure compliance with the Act, including the distribution of responsibilities, coordination of privacy work and management of privacy risks.

Monitoring of Processing Time

The ATIP Office maintains a comprehensive statistical reporting and performance measurement system. Monthly reports are provided to the ATIP Coordinator identifying the number of active privacy requests, the sources and due dates of the requests, as well as the length of any extensions taken.

Information relating to the processing time of requests for correction of personal information is included in the monthly reports.

Privacy Breaches

A material privacy breach involves improper or unauthorized collection, use, disclosure, retention or disposal of sensitive personal information which could reasonably be expected to cause serious injury or harm to the individual to whom it relates.

The Office of the Privacy Commissioner and the Treasury Board Secretariat were notified that two (2) material breaches had occurred during the 2014–2015 reporting period.

One (1) breach resulted from the mail-out of Statement 1 income tax forms in connection with the Barreau du Québec fees paid by the PPSC for applicable employees. Due to the type of envelope used and the formatting of the Statement 1 forms, the social insurance number of the intended recipients were inadvertently displayed in the address window of the shipping envelope. The PPSC made available to affected employees the use of a protection service to monitor credit activity. Employees were also advised to remain vigilant about suspicious activity and to check their credit reports and any other financial account statements periodically.

The other breach resulted from an unvetted Information to Obtain (ITO) a search warrant being inadvertently located in a defense counsel’s file. The ITO contained information that could potentially lead to the identification of a confidential informant. Upon being notified of the incident, the PPSC recovered the the document and advised the law enforcement agency involved.

Appendix A – Delegation Order

The Director of Public Prosecutions, pursuant to section 73 of the Access to Information Act and the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on acting basis those positions, to exercise the powers and functions of the Director as the head of a government institution.

Schedule

Dated, at the City of Ottawa, this 11 day of January, 2010.

Brian Saunders
Director of Public Prosecutions

Appendix B – Statistical Report on the Privacy Act

Name of institution: Public Prosecution Service of Canada

Reporting period: 2014-04-01 to 2015-03-31

Part 1: Requests Under the Privacy Act

Part 2: Requests Closed During the Reporting Period

2.1 Disposition and completion time

2.2 Exemptions

2.3 Exclusions

2.4 Format of information released

2.5 Complexity

2.5.1 Relevant pages processed and disclosed

2.5.2 Relevant pages processed and disclosed by size of requests

2.5.3 Other Complexities

2.6 Deemed refusals

2.6.1 Reasons for not meeting statutory deadline

2.6.2 Number of days past deadline

2.7 Requests for translation

Part 3: Disclosures Under Subsection 8(2) and 8(5)

Part 4: Requests for Correction of Personal Information and Notations

Part 5: Extensions

5.1 Reasons for extensions and disposition of requests

5.2 Length of extensions

Part 6: Consultations Received From Other Institutions and Organizations

6.1 Consultations received from other Government of Canada institutions and other organizations

6.2 Recommendations and completion time for consultations received from other Government of Canada institutions

6.3 Recommendations and completion time for consultations received from other organizations

Part 7: Completion Time of Consultations on Cabinet Confidences

7.1 Requests with Legal Services

7.2 Requests with Privy Council Office

Part 8: Complaints and Investigation Notices Received

Part 9: Privacy Impact Assessments (PIAs)

Part 10: Resources Related to the Privacy Act

10.1 Costs

10.2 Human Resources

Note: Enter values to two decimal places.