Annual Report to Parliament on the Administration of the Privacy Act 2016-2017

Table of content

• Introduction
• Organization of the implementation of privacy activities
• Report – Privacy Act
  1. Interpretation of the statistical report on access to personal information requests
  2. Public Interest Disclosures
  3. Material Privacy Breach
  4. Monitoring Compliance
  5. Complaints and Audits
  6. Privacy Impact Assessment
  7. Training and Awareness
  8. Policies, Guidelines, Procedures and Initiatives
  9. Planned Activities
• Statistical report on Privacy Act
• Delegation of authorities

Introduction

The Privacy Act became law on July 1, 1983.

The Act extends the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by government institutions and provides individuals with a right of access to that information.

Pursuant to section 72, the head of every federal institution shall prepare an annual report on the administration of this Act within its institution. This report is submitted to Parliament at the end of each fiscal year.

This report is intended to describe how the Canadian Space Agency (CSA) administered its responsibilities in relation to the Act during the 2016-2017 period.

Canadian Space Agency Mandate

To better understand the context in which the Privacy Act is implemented within the Canadian Space Agency (CSA), the following provides a general overview of the CSA's objectives and activities.

The CSA reports to the Minister of Innovation, Science and Economic Development. Its mandate, as defined in the Canadian Space Agency Act, is to "promote the peaceful use and development of space, to advance the knowledge of space through science and to ensure that space science and technology provide social and economic benefits for Canadians."

Mission

The CSA is committed to leading the development and application of space knowledge for the benefit of Canadians and humanity.

To achieve its mission, the CSA:

• pursues excellence collectively;
• advocates a client-oriented attitude;
• supports employee-oriented practices and open communication;
• commits itself to both empowerment and accountability; and
• pledges to cooperate and to work with partners to our mutual benefit.

The CSA has been a source of inspiration for Canadians for more than 25 years now. In addition to consolidating major federal space programs, it coordinates all the components of the Canadian Space Program and manages Canada's major space-related activities. The CSA has the expertise to lead knowledge in Canadian speciality fields, and to sponsor, support and encourage the best Canadian companies to make the next steps in space development.

More information on the CSA's activities can be found at: www.asc-csa.gc.ca.

Organization of the implementation of privacy activities

Delegation of Authority

The head of the institution under the terms of the Act is the Minister of Science, Innovation and Economic Development. In June 2016, some of the powers under the Act were delegated by him to the incumbent of the position of Vice President, CSA, to the incumbent of the position of Chief Information Officer, as well as to the incumbent of the position of Coordinator, Access to Information and Open Data. The appended delegation of authorities grid identifies these delegated powers.

Responsibility for the implementation of the Act on a daily basis is that of the Coordinator, Access to Information and Open Data who reports to the Vice President and the Chief Information Officer.

The Access to Information and Privacy Office (ATIP) is headed by the Coordinator. Since 2016-2017, an additional officer has been added, and both employees work closely with members of the Executive Committee to enforce and uphold the Act.

Change in the Role of the ATIP Office

In 2016-2017, the ATIP Office was mandated to not only process access to personal information requests and to report on the application of the acts, but also to implement the Open Government initiative.

The decision to combine the activities of granting access to personal information and those of open data was taken in order to unite two activities dedicated to the dissemination of information under the control of the CSA. This new unit has thus proven to be a one-stop shop both for CSA employees wishing to disseminate or protect information as well as for the public that wishes to obtain it.

This pairing has proven to be innovative and effective because of the centralization of activities, but especially because of the optimization of the application of knowledge. After a year of operation, the merging of these activities has proven to be unequivocally logical in the effectiveness and efficiency of the processing of information requested by the public.

In order to ensure compliance with service standards in terms of access to personal information, despite the addition of a second mandate, the CSA has assigned an additional full-time employee (FTE) to the ATIP Office, thus bringing to 2 FTEs the total number of resources allocated to the activities of protection of personal information and of open data.

The Request Processing Procedure

When it receives a request under the Act, the ATIP Office consults the Office of Primary Interest, and when necessary and depending on the case, Justice Canada, the communities of practices, the Treasury Board Secretariat, or other institutions.

A computerized system for processing access requests is used to list the administrative actions taken, to review the documents in question, and to apply the exceptions and exemptions, if necessary. As well, various consultations may occur in the course of processing requests.

Once the documents have been analyzed and consultations have taken place, the ATIP Office recommends the application of exemptions to the CSA's Vice President and the Chief Information Officer who are responsible for the approval of the communication of documents disseminated under the Act. The documents in response to requests are then transmitted.

Report – Privacy Act

1. Interpretation of the statistical report on access to personal information requests

The statistical report for the period from April 1, 2016 to March 31, 2017 is included at the end of this chapter.

Requests Received and Processed

The number of access requests received and processed during the current fiscal year reached the average (5) compared to the previous five years.

In 2016-2017, the CSA received a total of four new requests and processed a request deferred from the previous year. Thus, in total, the CSA processed five requests for access to personal information in 2016-2017.

The following table illustrates the trend in requests carried forward and received over the last five fiscal years:

Provisions and Processing Times

The Act stipulates that requests for access to personal information must normally be answered within 30 calendar days. In 2016-2017, one processed request was answered in less than 15 days, while three requests were answered between 16 and 30 days. Due to consultations held with respect to the last request, the processing time was between 31 and 60 days.

Of the five requests processed during the year, one request was abandoned in the course of processing, while no documentation existed for the second.

Exceptions and Exclusions Invoked

Exceptions were only invoked in the processing of two requests. These exceptions involved section 26 concerning the protection of information about another individual, as well as section 27 concerning attorney-client privacy.

Medium Used for the Documents Disclosed

Following the example of requests for access to information, the majority of documents were provided in an electronic version. Thus, two requests were answered electronically, while only one was answered in paper format.

Pages Examined and Disclosed

Due to the implementation by the Treasury Board Secretariat in 2011-2012 of a new detailed statistical report, it is now possible to count the total number of pages examined and compare it to the total number of pages released.

The number of pages can vary considerably from one year to another depending on the subject of the requests and the quantity of relevant documents held by the CSA.

The number of pages examined during the financial year proved to be greater with 394 pages. Of this batch, a total of 337 were communicated to requesters compared to the previous year when no document communication occurred.

Of the requests for which a communication occurred, three had fewer than 100 pages, while one had a total of 155 pages.

The following table illustrates the annual variations:

Consultations and Extensions

A single request necessitated consultation with another federal institution for a total of 38 days. The response to this request was then issued within the time promised.

Consultations Received from Other Institutions or Organizations

It is unusual for the CSA to receive requests for personal information consultations from other federal institutions or from organizations. Thus, in 2016-2017, the CSA did not receive any such request.

Costs

The costs of applying the Act were estimated at $5,850 for the period in question.

Due to the restructuring of the ATIP Office to ensure implementation of the Open Government initiative, the salary-related expenses ($5,633) represented 50% of the task of the two resources.

The costs of goods and services ($217) are mainly related to the cost of maintenance and of licences for the electronic system for access application processing, in addition to including charges related to the purchase of administrative supplies.

2. Public Interest Disclosures

The policy of the CSA concerning the use of personal information is that such information is used for the purpose for which it was obtained or for use consistent with that purpose.

No personal information was disclosed under paragraphs 8(2)(m) and subsection 8(5).

3. Material Privacy Breach

No material privacy breaches occurred in 2016-2017.

4. Monitoring Compliance

The time required to process access to personal information requests and requests for correction of personal information is monitored through the electronic requests management system. A weekly report is also prepared for management and for persons concerned by these requests.

As stated in the statistical report, no requests for correction of personal information were received during the period covered by this report. If any such requests had been received, the Coordinator would have informed the Chief Information Officer and the director responsible for this information.

5. Complaints and Audits

The CSA did not receive any complaints during the fiscal year. Furthermore, there were no unresolved complaints during the period covered by this report.

No audit on ATIP Office activities was also undertaken.

6. Privacy Impact Assessment

Due to the new astronauts recruitment exercise, a privacy impact assessment and the creation of a new personal information data bank occurred in 2016-2017.

The objective of this assessment was to analyze the collection of personal information by means of two new electronic systems. These systems, under two departments that were partnered in the recruitment campaign, had already been assessed in order to determine the invasion of privacy risks.

Since the CSA has, over the years, implemented and maintained sufficient procedures and controls in relation to the astronaut recruitment activity, the analysis revealed that the invasion of privacy risks were negligible.

To conclude the assessment of factors relating to privacy, a new personal information data bank, which specifies the information held in relation to campaign activities, was created. However, at the time of tabling this report, the activities surrounding the approval of the assessment and of the data bank were still ongoing.

7. Training and Awareness

In addition to managing access to information and personal information requests, the ATIP Office staff provide counselling and advice to the CSA's employees on observance of the Act. This counselling and advice is presented in a personalized way and is based on requests.

Information sessions covering the processing of requests for access and awareness sessions on the marking of documents at the CSA are also available on request. One session, to which five people attended, was held in 2016-2017. In order to properly target needs in this area, an analysis was carried out and new training will be recommended next year.

Finally, in order to increase the awareness of CSA employees faced with the application of the Act, informative messages were broadcast on the corporate screens on two occasions during the year. These screens are installed in the CSA's facilities and stream messages intended for employees.

8. Policies, Guidelines, Procedures and Initiatives

The CSA's policies, guidelines and procedures for administering the Access to Information Act, including subsection 67.1, are accessible on the CSA's intranet. No changes were made to them in 2016-2017.

The ATIP office did not undertake any new initiative during this period.

9. Planned Activities

Through its ATIP Office, the CSA will pursue its mandate to respond to all requests for access to personal information in accordance with the spirit and the letter of the Act.

This year, the ATIP Office broke new ground by combining access to information services with those of open data. In 2017-2018, it will consolidate the implementation of these combined activities through new initiatives which will be reported on in its next annual report.

Delegation of authorities

Canadian Space Agency

Access to Information Act and Privacy Act Delegation Order

The Minister of Industry Canada, pursuant to section 73 of the Access to Information Act and the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers and functions of the Minister as the head of a government institution, under the section of the Acts set out in the schedule opposite each position. This Delegation Order supersedes all previous Delegation Orders

Schedule