Annual Report to Parliament on the Administration of the Privacy Act 2023-2024

Table of Contents

• Introduction
  • Purpose of the Privacy Act
  • Mandate of Fisheries and Oceans Canada
• Organizational Structure
  • Departmental Organization
  • Access to Information and Privacy Secretariat
• Delegation Order
• Performance 2023-24
  • Overview of 2023-24 Requests under the Privacy Act
    • Deemed Refusals
    • Completion Times
    • Active Requests that are outstanding from the previous reporting periods
    • Active Complaints that are outstanding from previous reporting periods
    • Extensions
    • Completion Time of Consultation on Cabinet Confidences
    • Consultations
    • Overview of Information Released
    • Disposition
    • Exemptions and Exclusions
• Other Requests
• Training and Awareness
• Policies, Guidelines, and Procedures
• Initiatives and Projects to Improve Privacy
  • Digital Strategy
• Summary of Key Issues and Actions Taken on Complaints
• Material Privacy Breaches
• Privacy Impact Assessments
• Public Interest Disclosures
• Monitoring Compliance
• Appendix A: Delegation Orders
• Appendix B: 2023-24 Statistical Report on the Privacy Act

Introduction

Purpose of the Privacy Act

The Privacy Act (Act) came into effect on July 1, 1983. The Act protects the privacy of individuals with respect to their personal information by imposing limits on federal institutions’ collection, use and disclosure of personal information. The Act also provides individuals with a right of access to their personal information held by federal institutions and the right to request correction to that information.

Section 72 of the Privacy Act requires that the head of every government institution prepare and submit an annual report to Parliament that details the administration of the Act within the institution each fiscal year.

This annual report describes how Fisheries and Oceans Canada (DFO) administered the Privacy Act from April 1, 2023, to March 31, 2024. The report is tabled in both the House of Commons and the Senate on any of the first 15 sitting days on which the house is sitting after September 1, 2024.

Mandate of Fisheries and Oceans Canada

DFO is responsible for safeguarding Canadian waters and managing Canada's fisheries and oceans resources. DFO helps to ensure healthy and sustainable aquatic ecosystems through habitat protection and sound science. DFO supports economic growth in the marine and fisheries sectors, and innovation in areas such as aquaculture and biotechnology. DFO is committed to working with fishers, coastal, and Indigenous communities to enable their continued prosperity from fish and seafood.

The Canadian Coast Guard (CCG) is a special operating agency of DFO that works to ensure the safety of mariners in Canadian waters and protect Canada’s marine environment. It supports Canada’s economic growth through the safe and efficient movement of maritime trade. CCG helps to ensure our country’s sovereignty and security through its presence in Canadian waters. The CCG also supports other government organizations by providing a civilian fleet and a broadly distributed shore-based infrastructure.

Organizational Structure

Departmental Organization

DFO has a presence across Canada, with the majority of employees working outside the national headquarters in one of the seven DFO regions or four CCG operational regions. National objectives, policies, procedures, and standards for DFO and CCG are established at the national headquarters in Ottawa. Regions are responsible for delivering programs and activities according to national and regional priorities and within national performance parameters.

Access to Information and Privacy Secretariat

The Access to Information and Privacy (ATIP) Director reports to the Director General, Public Affairs Branch.

The ATIP Director is accountable for the development, coordination and implementation of effective ATIP-related policies, guidelines, systems and procedures. This accountability ensures that DFO’s responsibilities under the Access to Information Act and Privacy Act(Acts) are met and enables appropriate processing and proper disclosure of information.

The ATIP Secretariat is divided along two business lines according to their main functions, and the business lines are managed by Deputy Directors.

The Operations Division is responsible for the following activities:

• Processing requests under the Access to Information Act and Privacy Act
• Responding to consultation requests from other governments or other federal institutions
• Supporting DFO’s legislative compliance obligations under the Acts by providing advice and guidance to senior management and staff of DFO on ATIP legislation
• Representing DFO in ATIP communities of practitioners, such as at TBS ATIP Community meetings
• Drafting and implementing internal ATIP procedures, guidance documents, and working aids on the administration of the Acts

The Operations Division is supported by:

• An Intake Unit, which oversees all incoming requests and liaises with requesters, programs, and regions
• An Administrative Support Group, which handles scanning/uploading records, file management, and quality control
• A team of analysts, which is responsible for the overall processing of requests including the review of records

The ATIP Policy and Privacy Division (PPD) acts as the ATIP Policy and Governance centre for DFO and is responsible for many of the remaining responsibilities related to the administration of the Act. PPD:

• Provides advice to departmental officials on access to information and privacy matters
• Oversees proactive publication and reporting requirements which includes updating DFO’s Info Source chapter and producing statistical reports and annual reports on the administration of the Acts
• Investigates and responds to suspected privacy breach incidents
• Supports DFO programs in completing Privacy Impact Assessments, Personal Information Banks, and Privacy Notice Statements in compliance with TBS requirements
• Advises senior management on changes related to the Act and relevant Treasury Board of Canada Secretariat (TBS) policies
• Liaises with the wider ATIP community
• Supports the ATIP Program with staffing processes and hiring contracted resources
• Maintains its case management tools, including leading strategic projects to improve the overall delivery of the ATIP program
• Tracks departmental performance and coordinates access to information training to ensure the ongoing sound application of the Acts

The ATIP Secretariat works with a network of ATIP contacts from each Office of Primary Interest (OPI) within the Department who act as liaisons for their respective region, sector, or program.

In total, throughout the course of this reporting period, the ATIP Secretariat employed approximately13.25 full-time equivalents (FTEs) devoted to Privacy Act activities; this included 12.31 full-time employees, as well as part-time and casual employees, and students.

During this reporting period, the DFO ATIP Secretariat was not party to any service agreements under section 73.1 of the Privacy Act.

Delegation Order

Responsibility for the administration of the Privacy Act at DFO is delegated from the Minister to the Director and Deputy Directors of the ATIP Secretariat. A copy of the signed Delegation Order is included as Appendix A.

Performance 2023-24

The Statistical Report on the Privacy Act is prepared by government institutions to assist TBS to analyze trends and exercise oversight.

DFO’s complete 2023-24 Statistical Report on the Privacy Act is included as Appendix B. Previous years’ statistical reports can be obtained from the ATIP Secretariat upon request.

Overview of 2023-24 Requests under the Privacy Act

The analysis in this section compares data found in DFO’s 2023-24 Statistical Report on the Privacy Act with data from 2021-22 to produce a three-year trend analysis.

In 2023-24, DFO received 100 requests under the Privacy Act; this represents a 25% increase compared to the previous reporting period. DFO also processed 11 requests outstanding from previous reporting periods. Of the 111 requests processed, DFO completed 93 and carried forward 18 into the next reporting period.

Compliance remains excellent for 2023-24. Of the 93 requests completed, 86 were closed within the statutory deadline.

Table 1 shows compliance for 2023 was 92.47% and illustrates a steady increase in compliance rate over the past three years.

Deemed Refusals

When a government institution fails to respond to a request or give access to a record (in whole or in part) within the time limits set out in the Act (30 calendar days or the length of time taken under an extension), the institution is deemed to have refused access. This situation is commonly referred to as a deemed refusal.

During the 2023-24 reporting period, the ATIP Secretariat closed 7 requests (7.5%) past the legislated timeline.

The principal reason for delay in the requests closed past the statutory deadline is related to interference with operations/workload.

Completion Times

Section 14 of the Actrequires institutions to provide a response to the requester within 30 days of receipt of the request, or to notify the requester that an extension is required. Of the 93 requests completed during the reporting period, 53 requests (57%) were completed within 30 days, 26 requests (28%) were completed in 31 to 60 days, eleven requests (12%) were completed in 61 to 120 days, one request (1%) was completed in 121 to 180 days, and two requests (2%) required more than 365 days to process.

Active Requests that are outstanding from the previous reporting periods

Table 2 shows, DFO carried over a total of 18 active requests to the next reporting period. The table provides an overview of these requests according to the reporting period in which they were received. Two-thirds of the active requests carried forward into 2024-25 were received during the 2023-2024 reporting period.

Active Complaints that are outstanding from previous reporting periods

Table 3 shows, DFO had a total of 4 active complaints with the Privacy Commissioner as of the last day of the reporting period. The table provides an overview of these complaints carried over to the next reporting period, according to the reporting period in which they were received.

Extensions

Section 15 of the Act provides for the extension of statutory time limits if processing a request within the original time limit would unreasonably interfere with the Department’s operations, if consultations are necessary, if additional time is necessary for translation purposes, or for converting the personal information into an alternative format.

Reasons for Extensions and Disposition of Requests

During the reporting period, 39 extensions were taken under subparagraph 15(a)(i) because processing the request within the original time limit would unreasonably interfere with the operations of DFO. Of these,

• Eight extensions were required to determine exemptions
• 13 exemptions were taken due to a large number of pages
• 13 exemptions were taken due to a large volume of requests
• Five exemptions were taken because documents were difficult to obtain

Length of Extensions

All extensions were taken within a period of up to 30 days beyond the initial 30-day statutory deadline.

Completion Time of Consultation on Cabinet Confidences

The ATIP Secretariat consults with DFO’s Legal Services Unit regarding the application of all section 70 (Cabinet Confidence) exclusions. On occasion, Legal Services will forward the consultation to the Privy Council Office (PCO) for additional advice. For the purposes of the Statistical Report, when a consultation is forwarded in this manner, it is recorded as a PCO consultation instead of a Legal Services consultation.

The ATIP Secretariat received a response from Legal Services for one consultation in 2023-2024. The response was received between 31 and 60 days. No consultation on Cabinet Confidences was forwarded to PCO during the 2023-24 reporting period.

Consultations

When other institutions and organizations retrieve information that concerns or originates from DFO in response to Privacy Act requests, they may consult the DFO ATIP Secretariat for recommendations on disclosure. Other institutions are defined as federal institutions subject to the Privacy Act. Organizations include the governments of Canadian provinces, territories and municipalities as well as governments of foreign states and international bodies of states.

In 2023-2024, DFO received one consultation request. No request remained outstanding from the previous reporting period. The request was from another Government of Canada institution. DFO completed the single consultation request within 30 days.

Overview of Information Released

In 2023-24, the ATIP Secretariat processed a total of 134,266 relevant pages under the Privacy Act. Of these, 76,708 (57.1%) pages were disclosed in whole or in part.

Of the 93 requests DFO closed during the reporting period, 5 requests required the processing of more than 5,000 pages. The total number of pages processed for these five requests was 106,153, or 79% of the total number of pages processed during the reporting period.

When requests are complete, requesters may receive the information in paper or electronic formats, or they may view the records at a DFO office. Among the requests for information during the reporting year, the format of disclosure was as follows: 12 in paper format, 42 in e-record format and 11 in data set format.

Disposition

Table 4 shows the manner in which the 93 requests completed by DFO in 2023-24 were finalized.

No request was processed where all relevant information was exempted or excluded.

Exemptions and Exclusions

The Privacy Act gives individuals a right of access to their personal information under the control of the institution, subject to limited and specific exceptions. These exceptions are called exemptions and exclusions.

Exemptions are provisions of the Act that allow or require the heads of federal government institutions to withhold information requested under the legislation.

Exclusions are provisions of the Act that remove certain records from the application of the legislation. Records excluded from the requirements of the Act include published material and confidences of the Queen’s Privy Council (Cabinet Confidences).

Table 5 shows the three most frequently invoked exceptions by DFO in 2023-24.

See Appendix B for further information on the exemptions and exclusions invoked by DFO in 2023-24, presented by section, subsection and paragraph. For the purposes of this report, if an exemption or exclusion was claimed several times within the same request, it is reported only once in Appendix B.

Other Requests

In addition to processing requests under the Act, developing policy tools, and delivering training, the ATIP Secretariat engages in a significant number of activities related to the administration of the Privacy Act. These activities include:

• preventing, assessing, containing, mitigating, and reporting on privacy breach incidents in accordance with privacy breach management requirements;
• overseeing disclosures pursuant to subsection 8(2) of the Act, such as to an investigative body under 8(2)(e);
• supporting departmental processes for TB submissions;
• providing advice and guidance to departmental officials on privacy impact assessments, privacy notice statements, and agreements that involve personal information such as in memorandums of understanding, information sharing agreements and contracts;
• disclosing information outside of the formal ATIP request process, where appropriate;
• reviewing investigation reports for privacy considerations, to protect personal information as needed, prior to making a disclosure to the involved parties. Examples include reports resulting from incidents of workplace harassment or violence, misconduct, breach of values and ethics, etc.  

Training and Awareness

As per the requirements of the DFO Privacy Policy, employees and managers at all levels must take privacy training at least once every five years. In support of this policy, DFO promotes awareness of federal access to information and privacy legislation and the corresponding responsibilities of DFO employees through ongoing training delivery, informative articles and awareness events.

The ATIP Secretariat continued offering training to employees and managers at all levels through a predictable 12-month training schedule which was implemented during the 2021-22 reporting period. The ATIP Secretariat also responded to demands for ad-hoc training sessions which were offered upon request and tailored to programs’ needs. ATIP also provides training further to files being treated or when trends in ATIP indicate a need for training on a specific subject matter related to either Access to Information or Privacy.

Training and awareness content was updated regularly to enhance participants’ learning experience in a hybrid environment through the use of various interactive tools and in-office technologies. Virtual training continued to allow DFO to meet the training needs of various groups across the Department including in its regions. During the 2023-24 reporting period, 1213 participants received ATIP training through sessions offered by the ATIP Secretariat, 54 of whom were Executives. These sessions focused on processing access to information requests and protecting and managing personal information.

During the reporting period, the ATIP Secretariat also made additional efforts to promote courses offered by the Canada School of Public Service (CSPS) to DFO employees. During this reporting period, 357 participants completed CSPS ATIP-related training courses.

Table 6 highlights all ATIP-related training activities undertaken during the reporting period.

The ATIP Secretariat continued to publish various articles to promote training and awareness about privacy protection principles as well as about ATIP request processes and best practices, and to ensure all employees have completed mandatory training and are aware of policies, procedures and legal responsibilities under both Acts.

Additionally, the ATIP Secretariat continued to engage ATIP contacts across the Department through regular meetings. These meetings serve as an additional forum to share new information and guidance to ATIP contacts about a variety of topics, such as the records retrieval process, meeting proactive publications requirements, the Privacy Impact Assessment process, ATIP related responsibilities and expectations, and opportunities for improvements within the Department.

In September the ATIP Secretariat observed Right To Know (RTK) Week, to raise awareness of the right of access to government information, and to foster freedom of information as essential to both democracy and good governance. Events included a hybrid and well-attended in-person Speaker Panel event centered on Indigenous data sovereignty, government institutions’ collection and use of Indigenous Traditional Knowledge, and barriers faced by Indigenous peoples with respect to accessing government information. The panel of speakers included officials from DFO, Treasury Board of Canada Secretariat (TBS) and Crown-Indigenous Relations and Northern Affairs Canada (CIRNAC). RTK week activities also included an interactive magazine, a RTW Week quiz, and a frequently visited information booth.

Policies, Guidelines, and Procedures

The ATIP Secretariat continued to implement TBS policy instruments, including revisions and updates introduced during the reporting period, and made revisions to the department’s ATIP policy suite as needed. The suite of tools was developed to help DFO employees understand their responsibilities with regards to the protection of personal information. Included in the policy suite are the DFO Privacy Policy, the Directive on Privacy Practices, the Standard on Privacy Breaches, the Standard on Permissible Disclosures of Personal Information, Framework for Proactive Disclosure and related tools such as Guidelines for the Informal Release of Information and various forms and templates to ensure departmental compliance to legal ATIP requirements.

Initiatives and Projects to Improve Privacy

Digital Strategy

The ATIP Secretariat continued to expand upon its Digital Strategy that was initiated in the 2019-2020 reporting period.  The ATIP Secretariat’s implementation of digital solutions over the years has resulted in the department continuing to meet its legislative obligations to provide responsive records to requesters while reducing the departmental carbon footprint.

In 2023-2024, the department made an acquisition which will serve both ATIA and Privacy Act requests when implemented following a review and assessment of available options to replace its current ATIP Request Processing Software Solution (RPSS). The new solution will leverage new technology and result in more efficient processing of all requests. Implementation of the new is already underway and expected to be complete in 2024-2025.

Additionally DFO continues to use the Access Online Management Tool (AOMT) which is administered by TBS. The latest version of AOMT allows institutions to send documents such as extension letters and release packages; the tool also allows for multiple exchanges with requesters.

Summary of Key Issues and Actions Taken on Complaints

The Office of the Privacy Commissioner (OPC) reviews complaints resulting from either a refusal by the head of a government institution to disclose personal information or an institution’s handling of personal information. DFO reviews the outcomes of each OPC investigation or audit and where appropriate, DFO incorporates lessons learned into its business processes.

In 2023-24 DFO received 13 complaints from the OPC, of which 10 have been completed. From these, DFO was taken to court on one complaint and the complaint was completed. Additionally, included in the 10 completed complaints are all outstanding complaints about DFO’s implementation of the TBS Policy on COVID-19 Vaccination which were reported on in the last Annual Report.

Material Privacy Breaches

A privacy breach is defined by the Office of the Privacy Commissioner as the loss of, unauthorized access to, or disclosure of, personal information. A material privacy breach is defined by TBS as involving sensitive information that could reasonably be expected to cause serious injury or harm to the individual and/or involves a large number of affected individuals.

During the reporting period, DFO ATIP Secretariat reported 11 privacy breaches, none of which were material privacy breaches.

Privacy Impact Assessments

To fulfill its mandate, many of DFO’s activities require the collection, use and disclosure of personal information. In accordance with the TBS Directive on Privacy Impact Assessment,  a privacy impact assessment (PIA) is completed when necessary to identify and mitigate risks to privacy for new or substantially modified departmental programs or activities (initiatives) that collect, use, disclosure or retain personal information as part of a decision-making process that affects the individual.

On all new initiatives involving personal information, a preliminary assessment takes place to determine whether a PIA is required. Where a PIA is required, the responsible Senior Manager may choose to complete a PIA in-house with DFO’s ATIP Secretariat guiding them through the  process and providing the final analysis and recommendations, or contract a consultant with the necessary expertise to complete the PIA. In the latter case, ATIP will review the resulting PIA to ensure compliance with TBS requirements and provide advice and recommendations as required.

Where a PIA is not required but potential risk to privacy has been identified, ATIP will work with program officials to implement mitigation measures in order to be compliant with privacy law requirements.

Three PIAs were completed during the reporting period. A brief description of each and a link to its summary on DFO’s web site are as follows:

Open Source Information Collection (OSIC) Initiative

DFO’s Conservation and Protection program’s OSIC technology relies on publicly accessible information to collect data which may consequently be used by DFO to detect and address violations to relevant legislation.

FishingBC APP and National Recreational Licensing System (NRLS) Integration Initiative

DFO collaborated with the Sports Fishing Institute of BC (SFI) to develop an application that links the FishingBC App to DFO’s National Recreational Licensing System (NRLS) so that licence and catch records for chinook salmon, halibut, and lingcod can be synchronized between the two systems. This application is intended tol support enforcement by Fishery Officers and make reporting activities efficient and user-friendly for licence holders.

SAP S/4HANA – Government of Canada Finance and Material Management Solution

SAP is a financial management system to manage the department’s budget and finances. DFO leveraged the SAP solution developed by TBS’s Office of the Comptroller General and introduced additional capabilities to support DFO requirements bringing benefits such as streamlined and automated business processes, strengthened controls, enhanced multi-year financial planning and analysis, and real time forecasting and reporting.

Public Interest Disclosures

Subsection 8(2) of the Privacy Act describes certain instances in which personal information under the control of a federal government institution may be disclosed without the consent of the individual to whom the information relates.

Paragraph 8(2)(m) allows institutions to disclose personal information in circumstances where the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure, or where disclosure would clearly benefit the individual to whom the information relates.

In 2023-24, DFO made no disclosure in the public interest.

Monitoring Compliance

DFO makes every effort to meet statutory deadlines and actively monitors the time taken to process requests for personal information. Monitoring begins as soon as a request is received by the DFO ATIP Secretariat, it is entered into the case management system and assigned to an analyst. All requests, including requests for consultations or advice on ATIP related matters are entered into the case management system for tracking. This tracking of deadlines is essential as analysts work on numerous requests at any given time, each with multiple actions with specific deadlines. Analysts meet with their respective team leaders on a weekly basis to identify issues with requests that might result in delays. Issues are raised with the ATIP management team, and if necessary the Director and / or Deputy Directors of the ATIP Secretariat get involved in files where they can use their authority as the Minister’s delegates under the Acts to promote compliance with deadlines and deliverables. Upon request, ATIP provides performance reports to OPIs.

The department also proactively discloses records to meet statutory requirements or in response to requests outside the formal ATIP process. Although proactive publication requirements are pursuant to Part 2 of the ATIA, the ATIP program reviews all records before disclosures are made to ensure that information disclosed is in accordance with both the Acts.

In response to frequent inquiries from departmental programs for guidance on releasing information, on a case-by case basis ATIP provides clear guidance on a range of ATIP practices to implement including practices that will ensure privacy protections are in place.

Appendix A: Delegation Orders

Appendix B: 2023-24 Statistical Report on the Privacy Act

Section 1: Requests Under the Privacy Act

Section 2: Informal requests

Section 3: Requests Closed During the Reporting Period

3.5 Complexity

3.6 Closed requests

3.7 Deemed refusals

Section 4: Disclosures Under Subsections 8(2) and 8(5)

Section 5: Requests for Correction of Personal Information and Notations

Section 6: Extensions

Section 7: Consultations Received From Other Institutions and Organizations

Section 8: Completion Time of Consultations on Cabinet Confidences

Section 9: Complaints and Investigations Notices Received

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

Section 11: Privacy Breaches

Section 12: Resources Related to the Privacy Act