Annual Report on the Administration of the Privacy Act 2023–2024

Introduction

The Privacy Act (R.S.C. 1985, c. P-21, the Act) was proclaimed into force on July 1, 1983. It extends the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution and provides individuals with a right of access to that information.

Section 72 of the Act requires each head of a federal government institution to submit a report to Parliament on the administration of the Act within their institution during the fiscal year. We are pleased to provide the following Annual Report to Parliament on the Administration of the Privacy Act in accordance with section 72. It provides an overview on the activities of the Canadian Space Agency (CSA) during the reporting period of April 1, 2023 to March 31, 2024.

The CSA is not reporting on behalf of wholly owned subsidiaries or non-operational institutions.

Organizational Structure

The Access to Information and Privacy (ATIP) office is a member of the Information Management and Information Technologies Directorate (IM-IT). The IM-IT Directorate is led by the Director General and Chief Information Officer who reports to the Vice-President Corporate Strategy, Innovation and Chief Financial Officer. The Access to Information and Open Government Coordinator is overseen by the Cybersecurity & Information Management Director.

The ATIP Office is the central coordinating office for all requests received by the CSA under the Access to Information Act and the Privacy Act. It provides advice to senior management on the implementation of statutes and prepares reports to Parliament, the Treasury Board Secretariat and senior management. The ATIP Office also represents the CSA in complaints and investigations conducted by the Information Commissioner and Privacy Commissioner of Canada, and in any Federal Court application arising from ATIP matters.

The main functions of the CSA ATIP Office are ATIP Operations and Privacy. Analysts assigned to ATIP Operations coordinate and process the CSA's ATIP requests. These analysts are responsible for coordinating with sectors, performing a "line-by-line" review of records. Conversely, the analyst assigned to Privacy provides privacy recommendations and expertise within the CSA. The analyst leads the horizontal implementation of departmental privacy policies, conducts risk analyses including privacy impact assessments and privacy protocols for non-administrative purposes; as well as the prevention and management of privacy breaches.

To help meet the increase in volume and complexity of requests, the ATIP Office added 1 additional position of senior officer during the fiscal year, as well as 1 consultant during the reporting period. As of March 31, 2024, the ATIP Office was comprised of 4 full-time employees which include: 1 ATIP coordinator, 2 senior officers and 1 junior officer.

Delegation Order

Under the Act, the head of the CSA is the Minister of Innovation, Science and Economic Development. Decision-making responsibility for the application of the various provisions of the Access to Information Act and the Privacy Act have been formally established and are outlined in the departmental Delegation of Authority Instrument found in Appendix A of this report.

The Delegation Order in effect during the 2023-2024 reporting report was approved by the Minister is Innovation, Science and Economic Development Canada on May 2021. The instrument identified that powers are delegated to the Chief Information Officer and the Access to Information and Open Government Coordinator.

Interpretation of the Statistical Report

The CSA's statistical report on the Privacy Act is included in Appendix B of this report.

Between April 1, 2023 and March 31, 2024, the CSA received 11 requests under the Privacy Act. There were no requests carried forward from previous reporting periods.

In the 2023-2024 fiscal year, a total of 9 requests were completed and 2 requests were carried forward to the next reporting period. The 2 requests carried forward to the following year were both within legislative timelines.

All 11 requests received this fiscal year were submitted through the ATIP Online Request Service.

There were no informal requests received during the 2023-2024 fiscal year.

The following table illustrates the trend in number of requests received under the Privacy Act from 2019-2020 to 2023-2024:

Training and Awareness

In addition to managing requests, the ATIP Office provides all CSA employees with guidance and advice on complying with the Act. This guidance is presented to all CSA employees but also to targeted professional groups such as: Human Resources, Information Technology, Contracting/Procurement, etc. This ensures knowledge of common privacy principles but also tailored to the mandate of different CSA sectors.

This year the CSA beneficiated from the services of a consultant to deliver privacy awareness training throughout the Agency. More than 170 employees participated in 10 awareness sessions which covered the following topics:

• Privacy through an Indigenous perspective
• Privacy 101
• Privacy Impact Assessment 101
• ATI 101 with a focus on commercial information, trade secrets and international relations
• Privacy Notices and Personal Information Banks
• Privacy considerations during the purchase of software

The purpose of these training sessions was to raise awareness concerning the role of employees and their responsibilities as they relate to the handing of personal information and the processing of privacy and access requests.

In addition to the courses offered above, employees were also invited to take the ATIP Fundamentals course (I015) given by the Canada School of Public Service.

Information sessions are also available on the processing of privacy requests at the CSA. This training session covers an overview of procedures and responsibilities during the processing of a request. In 2023-2024, 1 session was delivered to approximatively 28 individuals.

Policies, Guidelines and Procedures

In the reporting period of 2022-2023, the ATIP Office created a three-year Privacy Awareness Plan. The purpose of this framework is to guide the advancement of Privacy awareness at the CSA.

Within this framework, 5 principles were identified in the Privacy Awareness Plan and are as follows:

1. Program Design and Delivery
2. Employee Outreach
3. Internal and External Controls
4. Risk Management and Compliance
5. Management of Privacy Breaches.

In each of the 5 principles mentioned above, the CSA ATIP Office identified multiple short, medium, and long-term goals for each principle. In 2023-2024, the CSA ATIP office worked towards the implementation of medium-term goals identified in the Privacy Awareness Plan. These actions included the following: promoting oversight and accountability, creating PIA checklists for administrative information, promoting best practices when sharing information internally, ongoing general privacy awareness, developing oversight to ensure privacy requirements are being used effectively, creating a policy on privacy impact assessments, creating an internal directive on monitoring compliance and automating privacy breach notices.

In 2023-2024, no changes were made to CSA policies, guidelines, and procedures for the administration of the Privacy Act. However, the CSA ATIP Office completed a new internal webpage and will continue to draft privacy policies. The ATIP Office also continues to offer targeted awareness training to groups of interest (ie. Human Resources, Information Technology, etc.).

Initiatives and Projects to Improve Privacy

The CSA continues to use the Treasury Board Secretariat's online ATIP Request Service to receive requests under the Act.

The ATIP Office currently uses an access to information request management tool which was implemented in 2019-2020. After obtaining this tool, the ATIP Office was able to benefit from its functions which facilitated the production of reports and follow-up of access to information requests. Through TBS procurement, the ATIP Office is preparing for a new system to be implemented in 2024-2025.

Summary of Key Issues and Actions Taken on Complaints

No complaints were received by the CSA in 2023-2024. Additionally, no applications or appeals were filed with the Federal Court or Federal Court of Appeal during the reporting period.

Material Privacy Breaches

A privacy breach involves improper or unauthorized collection, use, disclosure, retention, or disposal of personal information. In 2023-2024, there were no material privacy breaches.

Privacy Impact Assessments

All government institutions that are subject to the Act and that create, sponsor or fund programs, projects or initiatives involving the collection, use or sharing of personal information, are responsible for conducting a Privacy Impact Assessment. TBS Directive on Privacy Impact Assessment supports institutions such as the CSA in this activity. During the reporting period, there were no privacy impact assessments that were initiated or completed.

Public Interest Disclosures

Section 8(2)(m) of the Privacy Act allows the head of a government institution to disclose personal information without the consent of the individual concerned where, in his opinion, there are grounds for public interest would clearly justify a possible invasion of privacy, or where it is clearly in the best interests of the individual to do so. During the reporting period, the CSA did not disclose any personal information in accordance with this provision.

Monitoring Compliance

The CSA ATIP Office engaged regularly with departmental official at various levels to ensure privacy requests were processed in a timely and efficient manner. Meetings were held regularly with CSA sectors and analysts to ensure that timelines were respected in all requests. For all requests, legislative deadlines are tracked through an electronic ATIP request processing system and deadlines are followed-up on a regular basis. The ATIP Office also continues to seek to streamline the need for consultations 'only as required' both within the CSA and with other government institutions.

In delivering its mandate, the CSA ATIP Office is involved in many horizontal privacy initiatives and recommendations. The ATIP Office works collaboratively with program sectors to ensure that privacy requirements are reflected in contracts, MOUs, and information sharing agreements. The ATIP Office is also focused on the development of tools, guides, and policies to raise awareness, maintain compliance and report on access and privacy processes and procedures.

The ATIP Office produces weekly reports to monitor performance within the CSA. The weekly reports are sent to the Vice-Presidents, Chief Information Officer, Communications, Innovation, Science and Economic Development Canada (ISED), and other groups who may have interest in the subject matter of the request.

Conclusion

The CSA ATIP Office continues to implement its mandate to respond to all requests for access to personal information in accordance with the Privacy Act.

Annex A - Delegation Order

Approved in May 2021

Canadian Space Agency

Annex B - Statistical Report on the Privacy Act

Name of institution: Canadian Space Agency

Reporting period: 2023-04-01 to 2024-03-31

Annex C – Supplemental Statistical Report