Annual Report on the Administration of the Privacy Act, 2018-19

PDF Version

Help on accessing alternative formats, such as PDF, PPT and ZIP files, can be obtained in the alternate format help section.

1. INTRODUCTION

Purpose

The Privacy Act came into effect on July 1, 1983. The Act protects the privacy of individuals with respect to their personal information that is held by government institutions, and provides these individuals with a right of access to this information. In addition, the Privacy Act gives individuals rights over the collection, use and disclosure of their personal information.

Section 72 of the Privacy Act requires that the head of every government institution prepare and submit an annual report to Parliament, detailing the administration of the Act within the institution for each fiscal year.

This annual report describes how Infrastructure Canada (INFC) administered the Privacy Act from April 1, 2018 to March 31, 2019.

Mandate of Infrastructure Canada

Infrastructure Canada (INFC) was established in 2002 to ensure that Canadians benefit from world-class public infrastructure from coast to coast to coast. As the federal lead on the Government of Canada's $180 billion Investing in Canada plan, INFC develops strategic, long-term and collaborative plans in support of economically vibrant, sustainable and inclusive communities.

INFC's mandate includes enabling investments in modern, green, and resilient infrastructure projects to accomplish goals such as:

  • improving public transit, roads and bridges;
  • renewing and expanding facilities for culture, sports and recreation;
  • improving water systems for healthier and cleaner communities; and
  • upgrading the infrastructure of rural and northern communities, including extending faster, more reliable Internet services to more Canadians.

INFC works in partnership with provinces, territories, municipalities, Indigenous communities, other federal departments and agencies, the private sector and not-for-profit organizations to achieve its mandate.

2. ORGANIZATIONAL STRUCTURE

Departmental Organization

Infrastructure Canada is overseen by the Minister of Infrastructure and Communities, and as of January 2019, provides support to the Minister of Rural Economic Development. The Deputy Minister of Infrastructure and Communities is supported by the Assistant Deputy Minister, Policy and Results; Assistant Deputy Minister, Program Operations; Assistant Deputy Minister, Corporate Services; Assistant Deputy Minister, Rural Economic Development; Assistant Deputy Minister, Investment, Partnerships and Innovation; as well as Director General, Communications; Chief Audit and Evaluation Executive and Director General, Corporate Secretariat.

INFC is part of the Infrastructure and Communities portfolio which includes the Jacques Cartier and Champlain Bridges Incorporated, the Windsor-Detroit Bridge Authority, the Canada Infrastructure Bank, and federal interests in the Toronto Waterfront Revitalization Corporation.

Access to Information and Privacy (ATIP) Division Organization

The ATIP Division at INFC is led by the ATIP Coordinator, who reports to the Director General of the Corporate Secretariat. As of the end of the reporting period, the division was comprised of seven individuals. The work of the division under the Privacy Act involves:

  • processing Privacy Act requests and related activities;
  • processing consultations received from other institutions;
  • providing advice and guidance to employees and senior officials on privacy-related matters;
  • developing and delivering training to departmental employees; and
  • representing INFC in dealings with the Treasury Board Secretariat, the Privacy Commissioner, and other government institutions regarding the application of ATIP legislation.

Part 9 of Annex B shows a breakdown of resources as they relate solely to the administration of the Privacy Act.

3. DELEGATION ORDER

INFC updated its delegation instrument in 2018. Full authority to exercise the duties and functions of the Deputy Minister for all sections of the Act is delegated to all Assistant Deputy Ministers, the Chief Audit and Evaluation Executive, the Director General of Communications and the ATIP Coordinator. See Annex A for a copy of the signed delegation order.

4. HIGHLIGHTS OF THE STATISTICAL REPORT, 2018-19

The Statistical Report on the Privacy Act is prepared by government institutions to assist the Treasury Board of Canada Secretariat (TBS) to analyze trends and exercise oversight. INFC's 2018-19 annual statistical report is provided in Annex B and Annex C (Addendum to the Statistical Report).

Privacy Requests Received

The department received one request pursuant to the Privacy Act during 2018-19 and carried forward one request from 2017-18.

Disposition and Processing Time of Completed Requests

Section 14 of the Privacy Act requires institutions to provide a response to the requester within 30 days of receipt of the request, or to notify the requester that an extension is required. Section 15 allows institutions to extend the time limit by a maximum of another 30 days. Of the two requests completed during the reporting period, both were completed within 30 days and disclosed in electronic format. No extensions were taken. In one of two requests, all records were disclosed. In the other, records were disclosed in part.

Exemptions and Exclusions

Exemptions are provisions of the Privacy Act that allow or require the heads of federal government institutions to withhold information requested under the legislation. Exclusions are provisions of the Act that remove certain records from the application of the legislation.

For the one request in 2018-19 that was disclosed in part, INFC invoked the exemption found in section 26 to protect personal information about individuals other than the requester. No other exemptions or exclusions were applied.

Consultations Received from Other Government Institutions and Organizations

INFC did not receive any consultation requests in the reporting period.

5. TRAINING AND AWARENESS

The ATIP Division provided six access and privacy training sessions to approximately 80 employees in 2018-19.

A formal ATIP training framework was also developed this year. This framework establishes training expectations for employees, as well as course criteria, duration and frequency. The framework capitalizes on training offered by the Canada School of Public Service, requiring employees to take the school's introductory ATIP course as pre-requisite to more institution-specific training. Not only will the new framework standardize ATIP training offerings and uptake, it will facilitate tracking of training going forward.

In addition to training sessions, the INFC intranet was used to promote privacy awareness and ensure that the limited personal information that is held by INFC is well protected.

Work on developing new training and promotional material, expanding its online availability and ensuring adherence to the new training framework will continue.

6. POLICIES, GUIDELINES, PROCEDURES AND INITIATIVES

During the fiscal year, INFC revised its process for conducting privacy assessments of new and existing programs. Previous templates (the Personal Information Questionnaire and the Privacy Protocol templates) were combined and added to a new Privacy Impact Assessment (PIA) – Needs Analysis template. The new PIA – Needs Analysis template concentrates all privacy considerations of a program into one document, and ensures that initial reviews of programs are in-depth enough to warrant definitive recommendations. The benefit of this approach is that all analysed programs will have an approved privacy protocol to guide their practices, whether or not a PIA is ultimately required.

In 2018-19, INFC also conducted a review of all of its internal services forms to assess them for privacy notices. A standard template for privacy notices was adopted to ensure that all INFC notices are consistent and compliant. Work will continue in 2019-20 to update forms.

In 2018-19, the ATIP Division wrote new procedure and best practice documents and created template letters and forms for its case management system. It established internal guidelines for recordkeeping related to ATIP requests, to standardize files so that any analyst can pick up another analyst's file(s) and immediately understand what the next steps should be. It formalized and stabilized its ATIP contact network. It also updated its internet presence to allow requests to be submitted electronically.

7. KEY ISSUES AND ACTIONS TAKEN ON COMPLAINTS OR AUDITS

No complaints were received, nor investigations conducted, nor audits completed during the reporting period. No requests for judicial review were filed.

8. MONITORING COMPLIANCE

INFC makes every effort to meet statutory deadlines and actively monitors the time taken to process privacy requests and requests for the correction of personal information. Monitoring begins as soon as a request is received by the ATIP Division, entered into the case management system and assigned to an analyst. Deadlines are tracked electronically.

Due to INFC's ability to respond to requests within 30 days, no additional monitoring of processing times was required in the reporting period. There were no requests for correction of information.

9. MATERIAL PRIVACY BREACHES

A privacy breach is defined by the Office of the Privacy Commissioner as the loss of, unauthorized access to, or disclosure of, personal information. A material privacy breach is defined by the Treasury Board Secretariat (TBS) as involving sensitive information that could reasonably be expected to cause serious injury or harm to the individual and/or involves a large number of affected individuals.

No material privacy breaches were reported during this period.

10. PRIVACY IMPACT ASSESSMENTS

Privacy impact assessments (PIAs) are risk management tools to determine whether privacy risks are present in new or existing departmental programs, initiatives or projects that collect, use and retain personal information.

During the reporting period, the department did not complete any PIAs, but it initiated two and finalized one PIA Needs Analyses.

11. SPECIAL DISCLOSURES

Subsection 8(2) of the Privacy Act describes certain instances in which personal information under the control of a federal government institution may be disclosed without the consent of the individual to whom the information relates.

Investigative Body Disclosures

Paragraph 8(2)(e) allows institutions to disclose personal information to an investigative body specified in the regulations. INFC made two disclosures under 8(2)(e) in 2018-19.

Public Interest Disclosures

Paragraph 8(2)(m) allows institutions to disclose personal information in circumstances where the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure, or where disclosure would clearly benefit the individual to whom the information relates. No disclosures were made under paragraph 8(2)(m) of the Privacy Act during the reporting period.

Furthermore, no new data matching or sharing activities were undertaken.

ANNEXES

Annex A:
Privacy Act Delegation Order

Annex B:
2018-19 Statistical Report on the Administration of the Privacy Act

Annex C:
Addendum to the Statistical Report

Annex A: Privacy Act Delegation Order

Access to Information Act and Privacy Act Delegation Order

The Deputy Minister of Infrastructure and Communities, pursuant to section 73 of the Access to Information Act and section 73 of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Deputy Minister as the head of Infrastructure and Communities, under the provisions of the Act and related regulations set out in the schedule opposite each position. This designation replaces all previous delegation orders.

En vertu de l'article 73 de la Loi sur l'accès à l'information et de l'article 73 de la Loi sur la protection des renseignements personnels, la sous-ministre de l’Infrastructure et des Collectivités délègue aux titulaires des postes mentionnés à l'annexe ci-après, ainsi qu'aux personnes occupant à titre intérimaire lesdits postes, les attributions dont elle est, en qualité de responsable de l’Infrastructure et des Collectivités, investie par les dispositions de la Loi ou de son règlement mentionnées en regard de chaque poste. Le présent document remplace et annule tout arrêté antérieur.

Schedule/Annexe

Position/Poste Access to Information Act and
Regulations / Loi sur l'accès à l'information et Règlement
Privacy Act and Regulations / Loi
sur la protection des renseignements personnels
et Règlement
Assistant Deputy Ministers /
Sous-ministre adjoint (e)
Full authority / Autorité absolue Full authority / Autorité absolue
Chief Audit and Evaluation Executive / Dirigeant (e) principal (e) de la vérification et de l'évaluation Full authority / Autorité absolue Full authority / Autorité absolue

Director General of Communications / Directeur (trice) général (e) des communications

Full authority / Autorité absolue Full authority / Autorité absolue

Director General of Communications / Directeur (trice) général (e) des communications

Full authority / Autorité absolue Full authority / Autorité absolue

Kelly Gillis
Deputy Minister of Infrastructure and Communities / Sous-ministre de l’Infrastructure et des Collectivités

[Signed and dated:]
November 22, 2018

Annex B: 2018-19 Statistical Report on the Administration of the Privacy Act

Statistical Report on the Privacy Act

Name of institution: Infrastructure Canada

Reporting period: 2018-04-01 to 2019-03-31

Part 1: Requests Under the Privacy Act

Requests

Number of Requests

Received during reporting period

1

Outstanding from previous reporting period

1

Total

2

Closed during reporting period

2

Carried over to next reporting period

0

Part 2: Requests Closed During the Reporting Period

2.1 Disposition and completion time

Disposition of Requests

Completion Time

1 to 15 Days

16 to 30 Days

31 to 60 Days

61 to 120 Days

121 to 180 Days

181 to 365 Days

More Than 365 Days

Total

All disclosed

0

1

0

0

0

0

0

1

Disclosed in part

0

1

0

0

0

0

0

1

All exempted

0

0

0

0

0

0

0

0

All excluded

0

0

0

0

0

0

0

0

No records exist

0

0

0

0

0

0

0

0

Request abandoned

0

0

0

0

0

0

0

0

Neither confirmed nor denied

0

0

0

0

0

0

0

0

Total

0

2

0

0

0

0

0

2

2.2 Exemptions

Section

Number of Requests

Section

Number of Requests

Section

Number of Requests

18(2)

0

22(1)(a)(i)

0

23(a)

0

19(1)(a)

0

22(1)(a)(ii)

0

23(b)

0

19(1)(b)

0

22(1)(a)(iii)

0

24(a)

0

19(1)(c)

0

22(1)(b)

0

24(b)

0

19(1)(d)

0

22(1)(c)

0

25

0

19(1)(e)

0

22(2)

0

26

1

19(1)(f)

0

22.1

0

27

0

20

0

22.2

0

28

0

21

0

22.3

0

   

2.3 Exclusions

Section

Number of Requests

Section

Number of Requests

Section

Number of Requests

69(1)(a)

0

70(1)

0

70(1)(d)

0

69(1)(b)

0

70(1)(a)

0

70(1)(e)

0

69.1

0

70(1)(b)

0

70(1)(f)

0

70(1)(c)

0

70.1

0

 

 

2.4 Format of information released

Disposition

Paper

Electronic

Other formats

All disclosed

0

1

0

Disclosed in part

0

1

0

Total

0

2

0

2.5 Complexity

2.5.1 Relevant pages processed and disclosed

Disposition of Requests

Number of Pages Processed

Number of Pages Disclosed

Number of Requests

All disclosed

51

51

1

Disclosed in part

234

234

1

All exempted

0

0

0

All excluded

0

0

0

Request abandoned

0

0

0

Neither confirmed nor denied

0

0

0

Total

285

285

2

2.5.2 Relevant pages processed and disclosed by size of requests

Disposition

Less Than 100
Pages Processed

101-500
Pages Processed

501-1000
Pages Processed

1001-5000
Pages Processed

More Than 5000
Pages Processed

Number of Requests

Pages Disclosed

Number of Requests

Pages Disclosed

Number of Requests

Pages Disclosed

Number of Requests

Pages Disclosed

Number of Requests

Pages Disclosed

All disclosed

1

51

0

0

0

0

0

0

0

0

Disclosed in part

0

0

1

234

0

0

0

0

0

0

All exempted

0

0

0

0

0

0

0

0

0

0

All excluded

0

0

0

0

0

0

0

0

0

0

Request abandoned

0

0

0

0

0

0

0

0

0

0

Neither confirmed nor denied

0

0

0

0

0

0

0

0

0

0

Total

1

51

1

234

0

0

0

0

0

0

2.5.3 Other complexities

Disposition

Consultation Required

Legal Advice Sought

Interwoven Information

Other

Total

All disclosed

0

0

0

0

0

Disclosed in part

0

0

0

0

0

All exempted

0

0

0

0

0

All excluded

0

0

0

0

0

Request abandoned

0

0

0

0

0

Neither confirmed nor denied

0

0

0

0

0

Total

0

0

0

0

0

2.6 Deemed refusals

2.6.1 Reasons for not meeting statutory deadline

Number of Requests Closed Past the Statutory Deadline

Principal Reason

Workload

External Consultation

Internal Consultation

Other

0

0

0

0

0

2.6.2 Number of days past deadline

Number of Days Past Deadline

Number of Requests Past Deadline Where No Extension Was Taken

Number of Requests Past Deadline Where An Extension Was Taken

Total

1 to 15 days

0

0

0

16 to 30 days

0

0

0

31 to 60 days

0

0

0

61 to 120 days

0

0

0

121 to 180 days

0

0

0

181 to 365 days

0

0

0

More than 365 days

0

0

0

Total

0

0

0

2.7 Requests for translation

Translation Requests

Accepted

Refused

Total

English to French

0

0

0

French to English

0

0

0

Total

0

0

0

Part 3: Disclosures Under Subsections 8(2) and 8(5)

Paragraph 8(2)(e)

Paragraph 8(2)(m)

Subsection 8(5)

Total

2

0

0

2

Part 4: Requests for Correction of Personal Information and Notations

Disposition for Correction Requests Received

Number

Notations attached

0

Requests for correction accepted

0

Total

0

Part 5: Extensions

5.1 Reasons for extensions and disposition of requests

Disposition of Requests Where an Extension Was Taken

15(a)(i)
Interference With Operations

15(a)(ii)
Consultation

15(b)
Translation or Conversion

Section 70

Other

All disclosed

0

0

0

0

Disclosed in part

0

0

0

0

All exempted

0

0

0

0

All excluded

0

0

0

0

No records exist

0

0

0

0

Request abandoned

0

0

0

0

Total

0

0

0

0

5.2 Length of extensions

Length of Extensions

15(a)(i)
Interference with operations

15(a)(ii)
Consultation

15(b)
Translation purposes

Section 70

Other

1 to 15 days

0

0

0

0

16 to 30 days

0

0

0

0

Total

0

0

0

0

Part 6: Consultations Received From Other Institutions and Organizations

6.1 Consultations received from other Government of Canada institutions and other organizations

Consultations

Other Government of Canada Institutions

Number of Pages to Review

Other Organizations

Number of Pages to Review

Received during the reporting period

0

0

0

0

Outstanding from the previous reporting period

0

0

0

0

Total

0

0

0

0

Closed during the reporting period

0

0

0

0

Pending at the end of the reporting period

0

0

0

0

6.2 Recommendations and completion time for consultations received from other Government of Canada institutions

Recommendation

Number of Days Required to Complete Consultation Requests

1 to 15 Days

16 to 30 Days

31 to 60 Days

61 to 120 Days

121 to 180 Days

181 to 365 Days

More Than 365 Days

Total

All disclosed

0

0

0

0

0

0

0

0

Disclosed in part

0

0

0

0

0

0

0

0

All exempted

0

0

0

0

0

0

0

0

All excluded

0

0

0

0

0

0

0

0

Consult other institution

0

0

0

0

0

0

0

0

Other

0

0

0

0

0

0

0

0

Total

0

0

0

0

0

0

0

0

6.3 Recommendations and completion time for consultations received from other organizations

Recommendation

Number of Days Required to Complete Consultation Requests

1 to 15 Days

16 to 30 Days

31 to 60 Days

61 to 120 Days

121 to 180 Days

181 to 365 Days

More Than 365 Days

Total

All disclosed

0

0

0

0

0

0

0

0

Disclosed in part

0

0

0

0

0

0

0

0

All exempted

0

0

0

0

0

0

0

0

All excluded

0

0

0

0

0

0

0

0

Consult other institution

0

0

0

0

0

0

0

0

Other

0

0

0

0

0

0

0

0

Total

0

0

0

0

0

0

0

0

Part 7: Completion Time of Consultations on Cabinet Confidences

7.1 Requests with Legal Services

Number of Days

Fewer Than 100 Pages Processed

101-500 Pages Processed

501-1000
Pages Processed

1001-5000
Pages Processed

More than 5000
Pages Processed

Number of
Requests

Pages Disclosed

Number of
Requests

Pages Disclosed

Number of
Requests

Pages Disclosed

Number of
Requests

Pages Disclosed

Number of
Requests

Pages Disclosed

1 to 15

0

0

0

0

0

0

0

0

0

0

16 to 30

0

0

0

0

0

0

0

0

0

0

31 to 60

0

0

0

0

0

0

0

0

0

0

61 to 120

0

0

0

0

0

0

0

0

0

0

121 to 180

0

0

0

0

0

0

0

0

0

0

181 to 365

0

0

0

0

0

0

0

0

0

0

More than 365

0

0

0

0

0

0

0

0

0

0

Total

0

0

0

0

0

0

0

0

0

0

7.2 Requests with Privy Council Office

Number of Days

Fewer Than 100 Pages Processed

101-500 Pages Processed

501-1000
Pages Processed

1001-5000
Pages Processed

More than 5000
Pages Processed

Number of
Requests

Pages Disclosed

Number of
Requests

Pages Disclosed

Number of
Requests

Pages Disclosed

Number of
Requests

Pages Disclosed

Number of
Requests

Pages Disclosed

1 to 15

0

0

0

0

0

0

0

0

0

0

16 to 30

0

0

0

0

0

0

0

0

0

0

31 to 60

0

0

0

0

0

0

0

0

0

0

61 to 120

0

0

0

0

0

0

0

0

0

0

121 to 180

0

0

0

0

0

0

0

0

0

0

181 to 365

0

0

0

0

0

0

0

0

0

0

More than 365

0

0

0

0

0

0

0

0

0

0

Total

0

0

0

0

0

0

0

0

0

0

Part 8: Complaints and Investigations Notices Received

Section 31

Section 33

Section 35

Court action

Total

0

0

0

0

0

Part 9: Privacy Impact Assessments (PIAs)

Number of PIA(s) completed: 0

Part 10: Resources Related to the Privacy Act

10.1 Cost

Expenditures

Amount

Salaries

$30,097

Overtime

$0

Goods and Services

$155

- Professional services contracts

$0

 

- Other

$155

Total

$30,252

10.2 Human Resources

Resources

Person Years Dedicated to Privacy Activities

Full-time employees

0.48

Part-time and casual employees

0.06

Regional staff

0.00

Consultants and agency personnel

0.00

Students

0.00

Total

0.54

Note: Enter values to two decimal places.

Annex C: Addendum to the Statistical Report

Statistical Report on the Privacy Act

- Additional Requested Information -

Name of institution: Infrastructure Canada

Report period: 2018-04-01 to 2019-03-31

New Exemptions Table

Privacy Act

 

Section

Number of requests

22.4 National Security and Intelligence Committee

0

27.1 Patent or Trademark privilege

0

Date modified: