2019 to 2020 Annual report to Parliament on the Privacy Act

TABLE OF CONTENTS

1. Introduction
2. Organizational Structure
3. Delegation Order
4. Highlights of the Statistical Report, 2019-2020
5. Training and Awareness
6. Policies, Guidelines, Procedures and Initiatives
7. Summary of Key Issues and Actions Taken on Complaints or Audits
8. Monitoring Compliance
9. Material Privacy Breaches
10. Privacy Impact Assessments (PIAs)
11. Public Interest Disclosures
    Appendices
    • Appendix A
    • Appendix B
    • Appendix C

1. Introduction

The Privacy Act (Act) was proclaimed was proclaimed into force on July 1, 1983. The Act provides individuals with the right of access to and correction of personal information about themselves that is under the control of a government institution. The Act also provides the legal framework for the collection, retention, use, disclosure, disposition and accuracy of personal information in the administration of programs and activities by government institutions subject to its legislation.

Section 72 of the Actrequires that the head of every government institution prepare for submission to Parliament an annual report on the administration of the Act within the institution during each reporting year.

This annual report is prepared in accordance with section 72 of the Act and describes how Natural Resources Canada (NRCan) administered its responsibilities under the Actduring fiscal year 2019-2020.

Mandate of Natural Resources Canada

NRCan works to improve the quality of life of Canadians by ensuring that our natural resources are developed sustainably, providing a source of jobs, prosperity and opportunity, while preserving our environment and respecting our communities and Indigenous peoples.

The Minister of Natural Resources Canada has responsibilities in relation to more than 30 acts of Parliament. The Minister’s core powers, duties and functions are set forth in the Department of Natural Resources Act, the Resources and Technical Surveys Act, the Forestry Act, the Energy Efficiency Act and the Extractive Sector Transparency Measures Act. The department also works in areas of shared responsibilities with provinces, which includes the environment, public safety, economic development, science and technology, and consultations with Indigenous peoples. To fulfil its responsibilities, the department relies on a number of instruments (e.g. policy, regulation, statutory transfers, grants and contributions) and key activities (e.g. science and technology, partnerships and communications).

NRCan has offices and laboratories across the country. About one-third of our employees are located in the National Capital Region, with the remainder working in regional offices: Atlantic Canada, Quebec, Ontario, the Western and Pacific Regions and Northern Canada.

2. Organizational Structure

NRCan’s Access to Information and Privacy (ATIP) Secretariat provides centralized privacy services for NRCan as well as the Northern Pipeline Agency (NPA) as per a Service Letter of Agreement. 

The ATIP Director has full authority delegated by the Minister for the administration of the Act. The Director is accountable for ensuring compliance with the Privacy Act and its related policy instruments. In addition, the Director is responsible for the development, coordination, and implementation of effective practices and procedures within NRCan in order to enable efficient processing of requests under the Act. 

In 2019-2020, the ATIP Secretariat had one part-time employee (consultant) and one team leader dedicated to the administration of the Privacy Act.

Core functions of the ATIP Secretariat include:

• Processing requests under the Act;
• Responding to consultations from other government departments regarding the application of the Act on records originating from NRCan;
• Representing the department in dealings with the Treasury Board Secretariat, Office of the Privacy Commissioner, and other government departments and agencies regarding the application of the Act;
• Developing procedures and practices to ensure the proper administration of the Act including privacy management;
• Providing advice related to the Act, as well as promoting awareness, to ensure that legislative obligations are respected;
• Providing guidance on the collection, protection, use, retention and disclosure of information in accordance with the Act;
• Monitoring departmental compliance with the Act, its regulations, and relevant procedures and policies;
• Coordinating, reviewing, approving and publishing new entries and modifications to Info Source, an annual Government of Canada publication that assists members of the public in exercising their right of access under the Act;
• Reviewing Personal Information Banks (PIBs);
• Preparing the annual report to Parliament and other statutory reports, as well as other materials that may be required by central agencies; and
• Advising on the collection of personal information for new or modified programs.

Departmental officials gather the relevant records related to requests and provide them to the ATIP Secretariat within the requested timelines.

3. Delegation Order

Section 73 of the Act provides that the head of a government institution may, by Delegation Order, designate one or more officers or employees of that institution to exercise or perform any of the powers, duties or functions of the head regarding the administration of the Act.

Consistent with best practices, the ATIP Director maintains full-delegated authority and is the principal administrator of the Act for NRCan. Full delegation also rests with the ATIP Deputy Director, the Director General responsible for ATIP, the Associate Deputy Minister and the Deputy Minister. 

A copy of NRCan’s signed Delegation Order can be referenced at Appendix A.   

4. Highlights of the Statistical Report, 2019-2020

Multi-year trends 2017-18 to 2019-2020

Increase in requests received: In 2019-2020, NRCan received 43 new privacy requests, an increase of 35% from the previous reporting period. In addition, NRCan processed 49,142 pages, an increase of 90.6% from the previous reporting period. This increase in requests received and pages processed are due to a number of administrative investigations that are being conducted by the department.

Percentage of requests responded to within legislative timelines: From
April 1, 2019 to March 31, 2020, 46 requests were completed. Of these 46 requests, 34 were completed within their legislative timeframe, representing a compliance rate of 73.9%. During the 2018-2019 reporting period, 22 requests were completed. Of these 22 requests, 21 were completed within their legislative timeframe, resulting in a compliance rate of 95%. In 2017-2018, 42 requests were completed. Of these 42 requests, 41 were completed within their legislative timeframe, resulting in a compliance rate of 97.6%. In comparison to the previous reporting periods, where NRCan’s compliance rates maintained a consistent trend between the 90 to 99 percent range, there has been a notable decrease in the current reporting period’s compliance rate. This decrease is mainly due to the significant increase (90.6%) in pages processed.

Application of exemptions and exclusions: The multi-year trend from
2017-2018 to 2019-2020 shows that the personal information exemption (section 26 of the Privacy Act) has been consistently applied. In the current reporting period, section 26 was applied 23 times, which is a notable increase in comparison to the 2017-2018 (applied ten times) and 2018-2019 (applied nine times). This increase is due to the higher number of pages processed where section 26 was applicable. There were no exclusions applied in this reporting period.

Application of extensions: During the current reporting period, NRCan applied extensions to 28.2% of requests completed. The extensions were applied in accordance with section 15 of the Privacy Act (i.e. volume of records). This is a notable increase from the 2017-2018 and 2018-2019 reporting periods where extensions were applied on 14.3% and 4.5% of requests completed, respectively. The increase of extensions applied in 2019-2020 is due to the increase in the volume of pages processed.

Consultations completed from other institutions: During the current reporting period, NRCan completed one privacy consultation received by a government institution. In 2018-2019, NRCan did not receive any privacy consultations and in 2017-2018, one privacy consultation was completed.

For more information, the statistical report can be referenced at Appendix B.

2019-2020 Supplemental Statistical Report on the Privacy Act – Requests affected by COVID-19 measures.

During the 2019-2020 reporting period, no requests were received from
March 14, 2020 to March 31, 2020. Furthermore, no requests were closed during this period.

For more information, the 2019-2020 Supplemental Statistical Report can be referenced at Appendix C.

Impact of COVID-19-related measures on NRCan’s ability to fulfill its Privacy Act responsibilities, and mitigations measures.

NRCan has implemented exceptional workplace measures to curb the spread of novel Coronavirus (COVID-19) and protect federal employees and the public. As a result, all employees, except those providing critical services and support, were directed to work from home. These measures have created significant constraints on regular operations as the ATIP Secretariat depends greatly on its ATIP case management system to process requests, which cannot be accessed remotely. As such, the ATIP Secretariat’s capacity to process requests has been limited, as well as the capacity of parties involved in the retrieval of records and/or provision of representations. However, to mitigate the impact of COVID-19 on NRCan’s ability to fulfill its Access to Information Act responsibilities, the following measures have been implemented:

• All applicants that have active requests with NRCan have been notified by email of the situation and the limited ability to process their requests at this time, including possible delays;
• The ATIP general mailbox now sends out an automated generic response to notify the public of the possible delays in the processing of new requests;
• All departments that have active consultations with NRCan have been notified by email of the situation and the limited ability to process their consultations;
• All ATIP liaison officers have been notified of the situation and have been provided with support to address outstanding and upcoming files;
• All incoming and outgoing access to information requests, access consultations and e-mail correspondence are tracked in order to ensure that they are appropriately actioned;
• All activities related to day-to-day operations and to the processing of files are documented in order to ensure that they are appropriately actioned;
• The ATIP Secretariat has acquired a new digital tool that can be accessed remotely to assist with the processing of files in order to continue to meet legislative obligations; and
• All classified files that are affected by reasons related to COVID-19 are being tracked in order to appropriately address them once the circumstances related to return to work evolve.
• All forms related to the processing of requests have been digitized in order to facilitate the review and approval process.
• Responses to requests and consultations are sent via email to provide timely access to records.

5. Training and Awareness

As part of our continued efforts to promote general ATIP awareness at NRCan, in 2019-2020, the ATIP Secretariat held 29 training sessions, which included a total of 284 participants.

6. Policies, Guidelines, Procedures and Initiatives

NRCan continues to improve its privacy practices and performance in accordance with the department’s Privacy Management Framework and to support the highest standards of service. 

Format of information released: In order to ensure that Canadians’ right of access to their personal information is respected, the ATIP Secretariat continued to provide records in the format requested by the applicant, including machine-readable and reusable formats.

Dedicated privacy mailbox: In order to ensure that all privacy-related matters are addressed in a timely manner, the ATIP Secretariat continued to promote the use of the privacy mailbox. The types of requests typically received via the privacy mailbox include: general privacy advice questions, reporting of privacy breaches / incidents, and privacy training requests.  

Engagement and promotion of privacy management within NRCan: In addition to the privacy training sessions offered to departmental employees, the ATIP Secretariat continued to participate in a number of departmental committees and working groups.  For example, the ATIP Secretariat actively participated in the Information Management Working Group, as a way of ensuring that privacy and data protection integrated into the development of new projects and initiatives.

Open Government: The ATIP Secretariat collaborated and assisted the sectors in meeting their obligations with respect to the Open Government Initiative. The Secretariat continued to work with program areas to ensure that “privacy by design” is considered in open government activities so that the department is proactive and not reactive in considering privacy, security and confidentiality of information.

ATIP Community Working Groups: The ATIP Secretariat participated in the ATIP community working groups related to the Privacy Act reform and privacy-related discussions.  

Duty to Assist: In order to ensure transparency in the ATIP process and in relation to the “Duty to Assist”requirements, the ATIP Secretariat proactively communicated with applicants to provide timely and complete responses.

7. Summary of Key Issues and Actions Taken on Complaints or Audits

In 2019-2020, NRCan received six complaints pursuant to the Privacy Act. All six complaints were related to missing records and closed within the reporting period. The completed complaints were discontinued.

There were no audits or investigations pursuant to the Privacy Act in 2019-2020.

8. Monitoring Compliance

To ensure that the internal ATIP process remains as efficient as possible, the ATIP Secretariat routinely monitored the processing time for privacy requests using generated reports from the ATIP case management system. General information such as the department’s performance statistics, reporting on trends and changes to the ATIP process were communicated through weekly meetings with departmental and senior officials.

9. Material Privacy Breaches

There were no material privacy breaches reported in 2019-2020.

10. Privacy Impact Assessments (PIAs)

NRCan did not complete any PIAs during the reporting period.

11. Public Interest Disclosures

NRCan did not make any public interest disclosures during the reporting period.

Appendix A: Delegation Order – Privacy Act and Privacy Regulations

The Minister of Natural Resources, pursuant to section 73 of the Privacy Act (PA), hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Minister as the head of Natural Resources Canada, under the provisions of the PA and related regulations set out in the schedule below. This designation supersedes all previous delegation orders.

Deputy Minister / Associate Deputy Minister	Full Delegation
Director General, Portfolio Management and Corporate Secretariat (responsible for the Access to Information and Privacy function)	Full Delegation
Access to Information and Privacy Coordinator	Full Delegation
Access to Information and Privacy Deputy Director	Full Delegation
Access to Information and Privacy Team Leaders	10, 15, 17(2)(b), 17(3)(b) of the Privacy Act and 11(2), 11(4) of the Privacy Regulations

Original signed by: The Honourable Seamus O’Regan, P.C., M.P. Minister of Natural Resources Canada
Date: October 15, 2020

Appendix B: Statistical Report on the Privacy Act

Name of institution: Natural Resources Canada

Reporting period: 2019-04-01 to 2020-03-31

Section 1: Requests Under the Access to Information Act

1.1 Number of requests

	Number of Requests
Received during reporting period	43
Outstanding from previous reporting period	11
Total	54
Closed during reporting period	46
Carried over to next reporting period	8

Section 2: Requests Closed During the Reporting Period

2.1 Disposition and completion time

Disposition of Requests	Completion Time
	1 to 15 Days	16 to 30 Days	31 to 60 Days	61 to 120 Days	121 to 180 Days	181 to 365 Days	More Than 365 Days	Total
All disclosed	1	5	0	0	0	0	0	6
Disclosed in part	4	7	2	7	0	2	5	27
All exempted	0	0	0	0	0	0	0	0
All excluded	0	0	0	0	0	0	0	0
No records exist	6	3	0	0	0	0	0	9
Request abandoned	4	0	0	0	0	0	0	4
Neither confirmed nor denied	0	0	0	0	0	0	0	0
Total	15	15	2	7	0	2	5	46

2.2 Exemptions

2.2 Exemptions 1

Section	Number of Requests
18(2)	0
19(1)(a)	0
19(1)(b)	0
19(1)(c)	0
19(1)(d)	0
19(1)(e)	0
19(1)(f)	0
20	0
21	0

2.2 Exemptions 2

Section		Number of Requests
22(1)(a)(i)		0
22(1)(a)(ii)		0
22(1)(a)(iii)		0
22(1)(b)		1
22(1)(c)		0
22(2)		0
22.1		0
22.2		0
22.3		0
22.4		0

2.2 Exemptions 3

Section		Number of Requests
23(a)		0
23(b)		0
24(a)		0
24(b)		0
25		0
26		23
27		4
27.1		0
28		0

2.3 Exclusions

2.4 Format of information released

Paper			Electronic			Other
3			30			0

2.5 Complexity

2.5.1 Relevant pages processed and disclosed

Number of Pages Processed	Number of Pages Disclosed	Number of Requests
49142	4832	37

2.5.2 Relevant pages processed and disclosed by size of requests

Disposition	Less Than 100 Pages Processed		101-500 Pages Processed		501-1000 Pages Processed		1001-5000 Pages Processed		More Than 5000 Pages Processed
	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed
All disclosed	4	42	2	404	0	0	0	0	0	0
Disclosed in part	10	309	4	433	2	579	9	2073	2	992
All exempted	0	0	0	0	0	0	0	0	0	0
All excluded	0	0	0	0	0	0	0	0	0	0
Request abandoned	4	0	0	0	0	0	0	0	0	0
Neither confirmed nor denied	0	0	0	0	0	0	0	0	0	0
Total	18	351	6	837	2	579	9	2073	2	992

2.5.3 Other complexities

Disposition	Consultation Required	Legal Advice Sought	Interwoven Information	Other	Total
All disclosed	0	0	0	0	0
Disclosed in part	10	0	0	0	10
All exempted	0	0	0	0	0
All excluded	0	0	0	0	0
Request abandoned	0	0	0	0	0
Neither confirmed nor denied	0	0	0	0	0
Total	10	0	0	0	10

2.6 Closed requests

2.6.1 Number of requests closed within legislated timelines

						Requests closed within legislated timelines
Number of requests closed within legislated timelines						34
Percentage of requests closed within legislated timelines (%)						73.9

2.7 Deemed refusals

2.7.1 Reasons for not meeting legislated timelines

Number of Requests Closed Past the Legislated Timelines	Principal Reason
	Interference with Operations / Workload	External Consultation	Internal Consultation	Other
12	12	0	0	0

Number of Days Past Legislated Timelines	Number of Requests Past Legislated Timeline Where No Extension Was Taken	Number of Requests Past  Legislated Timelines Where an Extension Was Taken	Total
1 to 15 days	0	1	1
16 to 30 days	0	2	2
31 to 60 days	0	1	1
61 to 120 days	1	0	1
121  to 180 days	0	1	1
181 to 365 days	0	1	1
More than 365 days	1	4	5
Total	2	10	12

2.8 Requests for translation

Translation Requests	Accepted	Refused	Total
English to French	0	0	0
French to English	0	0	0
Total	0	0	0

Section 3: Disclosures Under Subsections 8(2) and 8(5)

Paragraph 8(2)(e)	Paragraph 8(2)(m)	Subsection 8(5)	Total
0	0	0	0

Section 4: Requests for Correction of Personal Information and Notations

Disposition for Correction Requests Received	Number
Notations attached	0
Requests for correction accepted	0
Total	0

Section 5: Extensions

5.1 Reasons for extensions and disposition of requests

Number of requests where an extension was taken	15(a)(i) Interference with operations				15 (a)(ii) Consultation			15(b) Translation purposes or conversion
	Further review required to determine exemptions	Large volume of pages	Large volume of requests	Documents are difficult to obtain	Cabinet Confidence Section (Section 70)	External	Internal
13	0	13	0	0	0	0	0	0

5.2 Length of extensions

Length of Extensions	15(a)(i) Interference with operations				15 (a)(ii) Consultation			15(b) Translation purposes or conversion
	Further review required to determine exemptions	Large volume of pages	Large volume of requests	Documents are difficult to obtain	Cabinet Confidence Section (Section 70)	External	Internal
1 to 15 days	0	0	0	0	0	0	0	0
16 to 30 days	0	13	0	0	0	0	0	0
31 days or greater	0	0	0	0	0	0	0	0
Total	0	13	0	0	0	0	0	0

Section 6: Consultations Received From Other Institutions and Organizations

6.1 Consultations received from other Government of Canada institutions and other organizations

Consultations	Other Government of Canada Institutions	Number of Pages to Review	Other Organizations	Number of Pages to Review
Received during the reporting period	1	4	0	0
Outstanding from the previous reporting period	0	0	0	0
Total	1	4	0	0
Closed during the reporting period	1	4	0	0
Carried over to the next reporting period	0	0	0	0

6.2 Recommendations and completion time for consultations received from other Government of Canada institutions

Recommendation	Number of Days Required to Complete Consultation Requests
	1 to 15 Days	16 to 30 Days	31 to 60 Days	61 to 120 Days	121  to 180 Days	181 to 365 Days	More Than 365 Days	Total
All disclosed	0	1	0	0	0	0	0	1
Disclosed in part	0	0	0	0	0	0	0	0
All exempted	0	0	0	0	0	0	0	0
All excluded	0	0	0	0	0	0	0	0
Consult other institution	0	0	0	0	0	0	0	0
Other	0	0	0	0	0	0	0	0
Total	0	1	0	0	0	0	0	1

6.3 Recommendations and completion time for consultations received from other organizations

Recommendation	Number of Days Required to Complete Consultation Requests
	1 to 15 Days	16 to 30 Days	31 to 60 Days	61 to 120 Days	121  to 180 Days	181 to 365 Days	More Than 365 Days	Total
All disclosed	0	0	0	0	0	0	0	0
Disclosed in part	0	0	0	0	0	0	0	0
All exempted	0	0	0	0	0	0	0	0
All excluded	0	0	0	0	0	0	0	0
Consult other institution	0	0	0	0	0	0	0	0
Other	0	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0	0

Section 7: Completion Time of Consultations on Cabinet Confidences

7.1 Requests with Legal Services

Number of Days	Fewer Than 100 Pages Processed		101-500 Pages Processed		501-1000 Pages Processed		1001-5000 Pages Processed		More than 5000 Pages Processed
	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed
1 to 15	0	0	0	0	0	0	0	0	0	0
16 to 30	0	0	0	0	0	0	0	0	0	0
31 to 60	0	0	0	0	0	0	0	0	0	0
61 to 120	0	0	0	0	0	0	0	0	0	0
121 to 180	0	0	0	0	0	0	0	0	0	0
181 to 365	0	0	0	0	0	0	0	0	0	0
More than 365	0	0	0	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0	0	0	0

7.2 Requests with Privy Council Office

Number of Days	Fewer Than 100 Pages Processed		101-500 Pages Processed		501-1000 Pages Processed		1001-5000 Pages Processed		More than 5000 Pages Processed
	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed
1 to 15	0	0	0	0	0	0	0	0	0	0
16 to 30	0	0	0	0	0	0	0	0	0	0
31 to 60	0	0	0	0	0	0	0	0	0	0
61 to 120	0	0	0	0	0	0	0	0	0	0
121 to 180	0	0	0	0	0	0	0	0	0	0
181 to 365	0	0	0	0	0	0	0	0	0	0
More than 365	0	0	0	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0	0	0	0

Section 8: Complaints and Investigations Notices Received

Section 31	Section 33	Section 35	Court action	Total
6	0	0	0	6

Section 9: Privacy Impact Assessments (PIA) and Personal Information Banks (PIB)

9.1 Privacy Impact Assessments

Number of PIA(s) completed	0

9.2 Personal Information Banks

Personal Information Banks	Active	Created	Terminated	Modified
	0	0	0	0

Section 10: Material Privacy Breaches

Number of material privacy breaches reported to TBS	0
Number of material privacy breaches reported to OPC	0

Section 11: Resources Related to the Privacy Act

11.1 Costs

Expenditures		Amount
Salaries		$96,370
Overtime		$0
Goods and Services		$25,593
• Professional services contracts	$25,593
• Other	$0
Total		$121,963

11.2 Human Resources

Resources	Person Years Dedicated to Privacy Activities
Full-time employees	1.22
Part-time and casual employees	0.00
Regional staff	0.00
Consultants and agency personnel	0.10
Students	0.00
Total	1.32

Appendix C: 2019-2020 Supplemental Statistical Report on the Privacy Act – Requests affected by COVID-19 measures

Table 1 – Requests Received

The following table reports the total number of formal requests received during two periods; 2019-04-01 to 2020-03-13 and 2020-03-14 to 2020-03-31.

	Number of requests
Received from 2019-04-01 to 2020-03-13	43
Received from 2020-03-14 to 2020-03-31	0
Total	43

Table 2 – Requests Closed

The following table reports the total number of requests closed within the legislated timelines and the number of closed requests that were deemed refusals during two periods 2019-04-01 to 2020-03-13 and 2020-03-14 to 2020-03-31.

	Number of requests closed within the legislated timelines	Number of requests closed past the legislated timelines
Received from 2019-04-01 to 2020-03-13 and outstanding from previous reporting periods	34	12
Received from 2020-03-14 to 2020-03-31	0	0
Total	34	12

Table 3 – Requests Carried Over

The following table reports the total number of requests carried over during two periods; 2019-04-01 to 2020-03-13 and 2020-03-14 to 2020-03-31.

	Number of requests
Requests from 2019-04-01 to 2020-03-13 and outstanding from previous reporting period that were carried over to the 2020-2021 reporting period	8
Requests from 2020-03-14 to 2020-03-31 that were carried over to the 2020-2021 reporting period	0
Total	8