2020-2021: Annual report to Parliament - Privacy Act

Table of Contents

B1. Introduction
B2. Organizational Structure
B3. Delegation Order
B4. Performance 2020-2021
B5. Training and Awareness
B6. Policies, Guidelines, Procedures and Initiatives
B7. Summary of Key Issues and Actions Taken on Complaints
B8. Monitoring Compliance
B9. Material Privacy Breaches
B10. Privacy Impact Assessments (PIAs)
B11. Public Interest Disclosures
Appendix A: Delegation Order
Appendix B: Statistical Report
Appendix C: Supplemental Statistical Report

Section B: Annual Report on the Privacy Act, 2020-2021

B1. Introduction

The Privacy Act (Act) was proclaimed into force on July 1, 1983. The Act provides individuals with the right of access to and correction of personal information about themselves that is under the control of a government institution. The Act also provides the legal framework for the collection, retention, use, disclosure, disposition and accuracy of personal information in the administration of programs and activities by government institutions subject to its legislation.

Section 72 of the Actrequires that the head of every government institution prepare for submission to Parliament an annual report on the administration of the Act within the institution during each reporting year.

This annual report is prepared in accordance with section 72 of the Act and describes how Natural Resources Canada (NRCan) administered its responsibilities under the Actduring fiscal year 2020-2021.

Mandate of Natural Resources Canada

NRCan works to improve the quality of life of Canadians by ensuring that our natural resources are developed sustainably, providing a source of jobs, prosperity and opportunity, while preserving our environment and respecting our communities and Indigenous peoples.

The Minister of Natural Resources Canada has responsibilities in relation to more than 30 acts of Parliament. The Minister’s core powers, duties and functions are set forth in the Department of Natural Resources Act, the Resources and Technical Surveys Act, the Forestry Act, the Energy Efficiency Act and the Extractive Sector Transparency Measures Act. The department also works in areas of shared responsibilities with provinces, which includes the environment, public safety, economic development, science and technology, and consultations with Indigenous peoples. To fulfil its responsibilities, the department relies on a number of instruments (e.g. policy, regulation, statutory transfers, grants and contributions) and key activities (e.g. science and technology, partnerships and communications).

NRCan has offices and laboratories across the country. About one-third of our employees are located in the National Capital Region, with the remainder working in regional offices: Atlantic Canada, Quebec, Ontario, the Western and Pacific Regions and Northern Canada.

B2. Organizational Structure

NRCan’s Access to Information and Privacy (ATIP) Secretariat provides centralized privacy services for NRCan as well as the Northern Pipeline Agency (NPA) as per a Service Letter of Agreement.

The ATIP Director has full authority delegated by the Minister for the administration of the Act. The Director is accountable for ensuring compliance with the Privacy Act and its related policy instruments. In addition, the Director is responsible for the development, coordination, and implementation of effective practices and procedures within NRCan in order to enable efficient processing of requests under the Act.

In 2020-2021, the ATIP Secretariat had one team leader position dedicated to the administration of the Privacy Act.

Core functions of the ATIP Secretariat include:

• Processing requests under the Act;
• Responding to consultations from other government departments regarding the application of the Act on records originating from NRCan;
• Representing the department in dealings with the Treasury Board Secretariat, Office of the Privacy Commissioner, and other government departments and agencies regarding the application of the Act;
• Developing procedures and practices to ensure the proper administration of the Act including privacy management;
• Providing advice related to privacy activities, as well as promoting awareness, to ensure that legislative obligations are respected;
• Providing guidance on the collection, protection, use, retention and disclosure of information in accordance with the Act, including new or modified programs;
• Monitoring departmental compliance with the Act, its regulations, and relevant procedures and policies;
• Coordinating, reviewing, approving and publishing new entries and modifications to Info Source, an annual Government of Canada publication that assists members of the public in exercising their right of access under the Act;
• Reviewing Personal Information Banks (PIBs); and
• Preparing the annual report to Parliament and other statutory reports, as well as other materials that may be required by central agencies.

Departmental officials are responsible for gathering relevant records related to requests and providing them to the ATIP Secretariat within the requested timelines. Program officials also work with the ATIP Secretariat through the course of new programs or activities where personal information is being collected.

B3. Delegation Order

Section 73 of the Act provides that the head of a government institution may, by Delegation Order, designate one or more officers or employees of that institution to exercise or perform any of the powers, duties or functions of the head regarding the administration of the Act.

Consistent with best practices, the ATIP Director maintains full-delegated authority and is the principal administrator of the Act for NRCan. Full delegation also rests with the ATIP Deputy Director, the Director General responsible for ATIP, the Associate Deputy Minister and the Deputy Minister.

A copy of NRCan’s signed Delegation Order can be referenced at Appendix A.

B4. Performance 2020-2021

Multi-year trends 2018-2019 to 2020-2021

Text Version

Overview for Privacy Act Requests

In 2018-2019, 28 requests were received, 22 requests were completed and 21 requests were completed within the legislated timelines.

In 2019-2020, 43 requests were received, 46 requests were completed and 34 requests were completed within the legislated timelines.

In 2020-2021, 15 requests were received, 20 requests were completed and 16 requests were completed within the legislated timelines.

Requests received: In 2020-2021, NRCan received15 new privacy requests, a decrease of 65% from the previous reporting period. In 2019-2020, the department received a greater number of privacy requests that were linked to departmental administrative investigations. This was not the case in this reporting period, and therefore reflected a lower number of privacy requests received.

In comparison to the previous reporting period, NRCan reported an increase of 6.1% in its compliance rate. The department experienced an increase in compliance as there were far less requests and pages to process during the current reporting period.

The following tables illustrate the number of requests completed, broken down by completion times and the percentage of requests responded to within their legislative timelines:

Text Version

Completion Times of Privacy Requests

3 requests with a disposition of all disclosed and 7 requests with a disposition of disclosed in part were completed within 30 days.

1 request with a disposition of all disclosed and 3 requests with a disposition of disclosed in part were completed between 31 and 120 days.

0 requests with a disposition of all disclosed and 2 requests with a disposition of disclosed in part were completed in 121 days or more.

Text Version

Percentage of Privacy Requests Completed within Legislated Timelines

In 2018-2019, 95.0 percent of Privacy requests were completed within their legislated timelines.

In 2019-2020, 73.9 percent of Privacy requests were completed within their legislated timelines.

In 2020-2021, 80.0 percent of Privacy requests were completed within their legislated timelines.

Application of exemptions and exclusions:

• Exemptions: The multi-year trend from 2018-2019 to 2020-2021 shows that the personal information exemption (section26 of the Privacy Act) has been consistently applied. In the current reporting period, section 26 was applied 9 times, which is consistent with the 2018-2019 reporting period where section 26 was applied 9 times. In the 2019-2020 reporting period, section 26 was applied 23 times.
• Exclusions: There were no exclusions applied during this reporting period.
• Application of extensions: During the current reporting period, NRCan applied extensions to 30% of requests completed. The extensions were applied in accordance with section 15 of the Privacy Act (i.e. volume of records). The percentage of extensions applied in this reporting period is consistent with the previous period where extensions were invoked to 28.2% of requests completed.
• Consultations completed from other institutions: In this reporting period, there were no privacy consultations received by NRCan. In 2019-2020, NRCan completed one privacy consultation and in 2018-2019, NRCan did not receive any privacy consultations.

For more information, a copy of the 2020-2021 Statistical Report can be referenced at Appendix B.

2020-2021 Supplemental Statistical Report on the Privacy Act:

During the 2020-2021 reporting period, NRCAN was able to process requests.

For more information, a copy of the 2020-2021 Supplemental Statistical Report can be referenced at Appendix C.

Requests for which records were “all disclosed” and “disclosed in part”:

From April 1, 2020 to March 31, 2021, 4 requests were completed for which the records were all disclosed, and 12 requests were completed for which the records were disclosed in part. This represents 20% and 60%, respectively, of the privacy requests completed during the current reporting period.

Impact of COVID-19-related measures on NRCan’s ability to fulfill its Privacy Act responsibilities and implemented mitigation measures:

In 2020-2021, NRCan implemented exceptional workplace measures to curb the spread of novel Coronavirus (COVID-19) and protect federal employees and the public. As a result, all employees, except those providing critical services and support, were directed to work from home.

These measures impacted the operations of the ATIP Secretariat as well as the capacity of parties involved in the retrieval of records and/or provision of representations. In addition, ATIP requests residing on the secure network could not be accessed remotely and capacity to process classified requests was in turn affected.

In order to mitigate the impact of COVID-19 on NRCan’s ability to fulfill its Privacy Act responsibilities, the following measures were implemented:

• All applicants that have active requests with NRCan were notified by email of the situation and the limited ability to process their requests, including possible delays;
• The ATIP general mailbox was set up to notify the public of the possible delays in the processing of new requests;
• All departments that had active consultations with NRCan were notified by email of the situation, including possible delays;
• All ATIP liaison officers were notified of the situation and were supported by the Secretariat to address outstanding and upcoming files;
• All incoming and outgoing privacy requests, access consultations and e-mail correspondence were tracked in order to ensure that they were appropriately actioned;
• In order to continue to meet legislative obligations under the Act, the ATIP Secretariat acquired the ATIP case management system on the non-secure network to allow for the processing of non-classified requests;
• All classified files that were affected by reasons related to COVID-19 are being tracked in order to appropriately address them once the circumstances related to return to work evolve;
• All forms related to the processing of requests were digitized in order to facilitate the ATIP review and approval process; and
• Responses to requests and consultations were sent via email to provide timely access to records.

B5. Training and Awareness

As part of our continued efforts to promote general ATIP awareness at NRCan, in
2020-2021, the ATIP Secretariat held 3 one-hour web seminars with various program areas. A total of 36 employees participated.

B6. Policies, Guidelines, Procedures and Initiatives

NRCan continues to improve its privacy practices and performance in accordance with the department’s Privacy Management Framework and to support the highest standards of service.

Format of information released: In order to ensure that Canadians’ right of access to their personal information is respected, the ATIP Secretariat continued to provide records in the format requested by the applicant, including machine-readable and reusable formats.

Dedicated privacy mailbox: In order to ensure that all privacy-related matters are addressed in a timely manner, the ATIP Secretariat continued to promote the use of the privacy mailbox. The types of requests typically received via the privacy mailbox include: general privacy advice questions, reporting of privacy breaches / incidents, and privacy training requests.

Engagement and promotion of privacy management within NRCan: In addition to the privacy training sessions offered to departmental employees, the ATIP Secretariat continued to participate in a number of departmental committees and working groups. As a result of this engagement, the ATIP Secretariat processed 30 privacy advice files related to new programs and services within NRCan.

Open Government: The ATIP Secretariat collaborated and assisted the sectors in meeting their obligations with respect to the Open Government Initiative. The Secretariat continued to work with program areas to ensure that “privacy by design” is considered in open government activities so that the department is proactive and not reactive in considering privacy, security and confidentiality of information.

ATIP Community Working Groups: The ATIP Secretariat participated in the ATIP community working groups related to the Privacy Act reform and privacy-related discussions.

Duty to Assist: In order to ensure transparency in the ATIP process and in relation to the “Duty to Assist”requirements, the ATIP Secretariat proactively communicated with applicants to provide timely and complete responses.

B7. Summary of Key Issues and Actions Taken on Complaints

There were no investigations undertaken pursuant to the Privacy Act in 2020-2021.

B8. Monitoring Compliance

To ensure that the internal ATIP process remains as efficient as possible, the ATIP Secretariat routinely monitored the processing time for privacy requests using generated reports from the ATIP case management system. General information such as the department’s performance statistics, reporting on trends and changes to the ATIP process were communicated through weekly meetings with departmental and senior officials.

As a result of the exceptional workplace measures that were put into place to curb the spread of COVID-19, additional trackers were developed to ensure that decisions related to the processing of ATIP requests are properly documented and actioned.

B9. Material Privacy Breaches

There were no material privacy breaches reported in 2020-2021.

B10. Privacy Impact Assessments (PIAs)

NRCan completed one PIA during the reporting period related to MyGreenCar Smartphone Application.  A summary of the PIA can be accessed at the following link: https://natural-resources.canada.ca/transparency/access-information-and-privacy/privacy-impact-assessment-pia-mygreencar-smartphone-application/23880.

B11. Public Interest Disclosures

NRCan did not make any public interest disclosures during the reporting period.

Appendix A: Delegation Order

Delegation Order – Privacy Act and Privacy Regulations

The Minister of Natural Resources, pursuant to section 73 of the Privacy Act (PA), hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Minister as the head of Natural Resources Canada, under the provisions of the PA and related regulations set out in the schedule below. This designation supersedes all previous delegation orders.

Deputy Minister / Associate Deputy Minister	Full delegation
Director General, Portfolio Management and Corporate Secretariat (responsible for the access toInformation and privacy [ATIP] function)	Full delegation
Access to Information and Privacy Director	Full delegation
Access to Information and Privacy Deputy Director	Full delegation
Access to Information and Privacy Team Leader	10, 15, 17(2)(b), 17(3)(b) of the Privacy Act and 11(2), 11(4) of the Privacy Regulations

Original signed by: The Honourable Jonathan Wilkinson, P.C., M.P. Minister of Natural Resources Canada
Date: November 17, 2021

Appendix B: Statistical Report

Section 1: Requests Under the Privacy Act

1.1 Number of requests

Section 2: Requests Closed During the Reporting Period

2.1 Disposition and completion time

2.2 Exemptions

2.3 Exclusions

2.4 Format of information released

2.5 Complexity

2.5.1 Relevant pages processed and disclosed 2.5.2 Relevant pages processed and disclosed by size of requests 2.5.3 Other complexities

2.6 Closed requests

2.6.1 Number of requests closed within legislated timelines

2.7 Deemed refusals

2.7.1 Reasons for not meeting legislated timelines 2.7.2 Requests closed beyond legislated timelines (including any extension taken)

2.8  Requests for translation

Section 3: Disclosures Under Subsections 8(2) and 8(5)

Section 4: Requests for Correction of Personal Information and Notations

Section 5: Extensions

5.1  Reasons for extensions and disposition of requests

5.2 Length of extensions

Section 6: Consultations Received From Other Institutions and Organizations

6.1 Consultations received from other Government of Canada institutions and other organizations

6.2 Recommendations and completion time for consultations received from other Government of Canada institutions

6.3 Recommendations and completion time for consultations received from other organizations

Section 7: Completion Time of Consultations on Cabinet Confidences

7.1 Requests with Legal Services

7.2 Requests with Privy Council Office

Section 8: Complaints and Investigations Notices Received

Section 9: Privacy Impact Assessments (PIA) and Personal Information Banks (PIB)

9.1 Privacy Impact Assessments

9.2 Personal Information Banks

Section 10: Material Privacy Breaches

Section 11: Resources Related to the Privacy Act

11.1  Costs

11.2  Human Resources

Appendix C: Supplemental Statistical Report

Section 1: Capacity to Receive Requests

Enter the number of weeks your institution was able to receive ATIP requests through the different channels.

Section 2: Capacity to Process Records

2.1 Enter the number of weeks your institution was able to process paper records in different classification levels.

2.2 Enter the number of weeks your institution was able to process electronic records in different classification levels.