2019-20 Annual Report on the Administration of the Privacy Act

1. Introduction

Purpose of the Privacy Act

The Privacy Act protects the privacy of individuals with respect to their personal information that is held by government institutions, and provides these individuals with a right of access to this information. In addition, the Privacy Act gives individuals rights over the collection, use and disclosure of their personal information.

Section 72 of the Privacy Act requires that the head of every government institution prepare and submit an annual report to parliament, detailing the administration of the Act within the institution for each fiscal year.

This annual report describes how Infrastructure Canada (INFC) administered the Privacy Act from April 1, 2019 to March 31, 2020.

Mandate of Infrastructure Canada

Infrastructure Canada (INFC) was established in 2002 to ensure that Canadians benefit from world-class public infrastructure from coast to coast to coast. As the federal lead on the Government of Canada's $180 billion Investing in Canada plan, INFC develops strategic, long-term and collaborative plans in support of economically vibrant, sustainable and inclusive communities.

INFC's mandate includes enabling investments in social, green, public transit and other core public infrastructure, as well as trade and transportation infrastructure to:

• provide long-term, predictable support to help Canadians benefit from world-class, modern public infrastructure;
• make investments, build partnerships, develop policies, deliver programs, and foster knowledge about public infrastructure in Canada; and
• help address complex challenges that Canadians face every day – ranging from the rapid growth of our cities, to climate change, and environmental threats to our water and land.

INFC works in partnership with provinces, territories, municipalities, Indigenous communities, other federal departments and agencies, the private sector and not-for-profit organizations to achieve its mandate.

2. Organizational structure

Departmental organization

INFC is overseen by the Minister of Infrastructure and Communities and the Minister for Women and Gender Equality and Rural Economic Development. The Ministers are supported by the Deputy Minister of Infrastructure and Communities, who is supported by the Assistant Deputy Ministers of Policy and Results, Program Operations, Corporate Services, Communities and Rural Economic Development, and Investment, Partnerships and Innovation as well as the Directors General of Communications, the Corporate Secretariat, and the Chief Audit and Evaluation Executive.

INFC is part of the Infrastructure and Communities portfolio which includes the Jacques Cartier and Champlain Bridges Incorporated, the Windsor-Detroit Bridge Authority, the Canada Infrastructure Bank, and federal interests in the Toronto Waterfront Revitalization Corporation.

There was no service agreement under section 73.1 of the Privacy Act for INFC during this reporting period.

Organization of the Access to Information and Privacy (ATIP) Division

The ATIP Division at INFC is led by the Director, ATIP and Executive Correspondence, who reports to the Director General of the Corporate Secretariat. As of the end of the reporting period, the division was fully staffed and was comprised of eight members: the director, team leader, part-time senior ATIP advisor, two full-time senior analysts, and three full-time junior analysts. The work of the division under the Act involves:

• processing Privacy Act requests and related activities;
• providing advice and guidance to employees and senior officials on privacy-related matters;
• developing and delivering training to departmental employees; and
• representing INFC in dealings with the Treasury Board Secretariat, the Privacy Commissioner, and other government institutions regarding the application of the ATIP legislation.

Section 11 of Annex B shows a breakdown of resources as they relate solely to the administration of the Privacy Act.

3. Delegation order

INFC updated its delegation instrument in February 2020 to reflect changes introduced under Bill C-58 and to provide partial delegation to the senior analyst and team leader (PM-05s). Full authority to exercise the powers, duties and functions of the Deputy Minister for all sections of the Act is delegated to all Assistant Deputy Ministers, the Chief Audit and Evaluation Executive, the Director General of Communications and the Director, ATIP and Executive Correspondence. The team leader and senior ATIP advisor are delegated the ability to notify requesters where access is requested, and to notify of an extension to the time limits of a request.

See Annex A for a copy of the signed delegation order.

4. Performance overview 2019 - 2020

The Statistical Report on the Privacy Act is prepared by government institutions to assist the Treasury Board of Canada Secretariat (TBS) to analyze trends and exercise oversight. INFC's 2019-20 annual statistical report is provided in Annex B and Annex C (Supplemental Statistical Report – Requests affected by COVID-19 measures).

Privacy requests closed within legislated timelines

One of the key measures of INFC privacy request performance is the number of requests closed within legislated timelines. In 2019-20, INFC closed 15 requests within the legislated timelines, giving an overall compliance rate of 100% for this reporting period. This is consistent with the two previous fiscal years as outlined in the table below.

Table 1: Number of requests closed within legislated timelines

Overview of requests received and closed

The department received a significant increase in requests pursuant to the Privacy Act during 2019-20 (16 versus one the previous reporting period) and carried forward no requests from 2018-19. INFC is in a healthy position, closing 94% of requests received in this reporting period. The one request being carried forward into 2020-21 in the table below is a request that straddles reporting periods, not a request that is overdue.

Table 2: Number of Privacy requests received

Overview on completion times of closed requests and extensions

Section 14 of the Privacy Act requires institutions to provide a response to the requester within 30 days of receipt of the request, or to notify the requester that an extension is required. Section 15 allows institutions to extend the time limit by a maximum of another 30 days. Of the 15 requests completed during the reporting period, all 15 were completed within 30 days allowing for one-hundred percent of responses to be completed within legislated timelines. Over the past fiscal year, INFC has improved its ability to respond quickly to straightforward requests. This trend is illustrated in the first row of the following table. It shows that in 2019-20, INFC completed 80% of requests in 15 days or less, up by 80% from last fiscal year and completed 100% of closed requests within 30 days or less.

Table 3: Processing time for completed requests

Consultations from other government institutions and organizations

When other institutions and organizations retrieve information that concerns or originates from INFC in response to Privacy Act requests, they may consult the INFC ATIP Division for recommendations on release. Other government institutions are defined as federal institutions subject to the Act. Other organizations include the governments of the provinces, territories and municipalities, and of other countries.

INFC did not receive any consultation requests in this reporting period.

Impact of COVID-19

The Privacy Act protects the privacy of individuals with respect to their personal information held by government institutions, and provides these individuals with a right of access to this information. Due to exceptional measures put in place to curb the spread of COVID-19, departments have faced challenges to maintain this important function while operating within a fully remote work environment. At the end of the fiscal year, INFC was able to continue to process and complete requests in a timely manner and was operating at nearly full working capacity. This is because of procedures previously put in place by the department, and the ATIP Division, to help reduce the operational impact of administering the Act, as well as new measures adopted in light of the remote working environment.

In recent years, the department issued tablets and cellphones to all employees, allowing for greater flexibility to work remotely. This included upgrading our network to allow for secure remote access and the ability to process records from a distance. In addition, the ATIP Division had previously begun transitioning from many paper-based operations to more electronic practices where possible, prior to the COVID-19 pandemic.

INFC has been working remotely since March 16, 2020. During this time the division has been able to conduct all record retrieval and approval processes electronically through the use of departmental shared drives and encrypted email exchanges. Email is used for external correspondence whenever possible. Limitations due to file size have posed some challenges to the ATIP Division, however, ATIP continues to adapt and find new avenues to increase its functionality and maintain its high rate of compliance.

Annex C includes statistical information related to impact of COVID-19.

5. Training and awareness

The ATIP Division provided eight formal training sessions in 2019-20 to 109 employees. All sessions contained a privacy component and included Processing ATIP Requests 101, Privacy 101 and ATIP Essentials for Executives. This represents a 36% increase in employee training from the 2018-19 reporting period.

The formal ATIP training framework, which was implemented in the previous fiscal year, establishes training expectations for employees, as well as course criteria, duration and frequency. The framework capitalizes on training offered by the Canada School of Public Service, as employees are required to take the school's introductory ATIP course as a pre-requisite to the institution-specific training. Not only does this framework standardize ATIP training offerings and uptake, but also facilitates the ability to track and plan for future training needs.

Institution-specific training was offered in a variety of formats to best suit the needs of employees across the department. Courses offered included a two-hour general ATIP course available to all employees, a 90-minute ATIP essentials course for executives and a 90-minute course devoted solely to privacy. In addition, group training outside of the regularly scheduled sessions was offered to meet the specific content needs and schedules of teams or employees. Lastly, the division offered 1-on-1 coaching to all newly appointed ATIP contacts, to ensure consistency and comfort in this role across the department.

Information related to training offered by the ATIP Division can be accessed by all employees through our newly updated intranet webpage. Over the past fiscal year, the ATIP Division has expanded its web presence by redesigning the webpage to include a variety of resources related to roles and responsibilities under the Privacy Act. The updated webpage includes resources on processing privacy requests, identifying sensitive information, how to protect personal information, ATIP training, and frequently asked questions.

The ATIP Division will continue to offer three training sessions per year to all INFC employees, 1-on-1 coaching for new ATIP contacts and customized group sessions, as requested. This will help to maintain consistent and current approaches to privacy functions across the department.

6. Policies, guidelines, procedures and initiatives

In 2019-20, the ATIP Division made a number of positive changes, focusing on measures to reduce our reliance on paper-based functions and on the commencement of the design of a privacy policy suite of tools.

The ATIP Division continued to roll out several electronic initiatives throughout the past fiscal year. These new initiatives allowed INFC to maintain full ATIP operations when the public health measures were put in place to curb the spread of COVID-19 and protect the health and safety of Canadians. Employees within the ATIP office are equipped with tablets and VPN access to telework. The rollout of electronic record retrieval and approvals throughout the entire department has proven to be an effective means of reducing retrieval times and lessening the operational burden of paper-based retrieval on our Offices of Primary Interest. Shared drives are setup as a means to assist with the process and email within the network is used for smaller files.

The ATIP Division began working with our Information Technology Division and third party vendor to launch a major case management and redaction system update. This update will automate many administrative tasks and allow the division to process privacy requests more efficiently. The update to the system is expected to launch in late 2020.

INFC also commenced a major review of the department's privacy practices and procedures, with the goal of creating a consolidated privacy policy suite of tools. The new suite, which is expected to roll out next fiscal year, will inform all employees of their responsibilities under the Privacy Act, including the protection of personal information throughout its lifecycle.

In 2019-20, ATIP conducted an interval review of all INFC forms with the goal of ensuring forms in use by the department contain a privacy notice statement. As part of this process, privacy notice statements were drafted using a standard template which includes the necessary elements listed in the Treasury Board Secretariat Directive on Privacy Practices. This review encompassed a total of 63 forms, leading to 31 new privacy notice statements in total being drafted. The final step of this project is to place the privacy notice statements on the forms and upload the revised version onto the intranet for use by the department. This project is expected to be finalized next fiscal year.

7. Key issues and actions taken on complaints or audits

No complaints were received, nor audits or investigations concluded during the reporting period. No requests for judicial review were filed.

8. Monitoring compliance

INFC makes every effort to meet statutory deadlines and actively monitors the time taken to process privacy requests and requests for the correction of personal information. Monitoring begins as soon as a request is received by the ATIP Division, entered into the case management system and assigned to an analyst. Deadlines are tracked electronically as well as on whiteboards in the office (prior to the pandemic), which highlight files nearing completion or targeted deadlines. Maintaining positive working relationships with the programs areas by engaging in early discussions of requests, providing guidance when needed, and sending weekly status reports to the offices of the Assistant Deputy Ministers/Directors General (highlighting the requests in retrievals, under consultation and in approvals) has been instrumental to ensuring INFC's compliance with the legislation.

Due to INFC's ability to respond to requests within 30 days, no additional monitoring of processing times was required in the reporting period. There were no requests for correction of information.

9. Material privacy breaches

A privacy breach is defined by the Office of the Privacy Commissioner as the loss of, unauthorized access to, or disclosure of, personal information. A material privacy breach is defined by the Treasury Board Secretariat (TBS) as involving sensitive information that could reasonably be expected to cause serious injury or harm to the individual and/or involves a large number of affected individuals.

No material privacy breaches were reported to the Office of the Privacy Commissioner or to the Treasury Board of Canada Secretariat during the reporting period.

10. Privacy impact assessments

Privacy impact assessments (PIAs) are risk management tools to determine whether privacy risks are present in new or existing departmental programs, initiatives or projects that collect, use and retain personal information.

During the reporting period, the department did not complete any PIAs, but it initiated two PIA Needs Analyses.

11. Public interest disclosures

Paragraph 8(2(m) allows institutions to disclose personal information in circumstances where the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure, or where disclosure would clearly benefit the individual to whom the information relates. No disclosure was made under paragraph 8(2(m) of the Privacy Act during the reporting period.

Annexes

Annex A: Privacy Act Delegation Order

Annex B: 2019-20 Statistical Report on the Privacy Act

Annex C: Supplemental Statistical Report – Requests affected by COVID-19 measures

Annex A: Privacy Act Delegation Order

Access to Information Act and Privacy Act Delegation Order /
Arrêté de délégation en vertu de la Loi sur l'accès à l'information et de la Loi sur la protection des renseignements personnels

The Deputy Minister of Infrastructure and Communities, pursuant to section 95(1) of the Access to Information Act and section 73(1) of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Deputy Minister as the head of Infrastructure and Communities, under the provisions of the Act and related regulations set out in the schedule opposite each position. This designation replaces all previous delegation orders.

En vertu de l'article 95(1) de la Loi sur l'accès à l'information et de l'article 73(1) de la Loi sur la protection des renseignements personnels, la sous-ministre de l’Infrastructure et des Collectivités délègue aux titulaires des postes mentionnés à l'annexe ci-après, ainsi qu'aux personnes occupant à titre intérimaire lesdits postes, les attributions dont elle est, en qualité de responsable de l’Infrastructure et des Collectivités, investie par les dispositions de la Loi ou de son règlement mentionnées en regard de chaque poste. Le présent document remplace et annule tout arrêté antérieur.

Kelly Gillis

Deputy Minister of Infrastructure and Communities / Sous-ministre de l’Infrastructure et des Collectivités

Signed and dated:

February 19, 2020

Annex B: 2019-20 Statistical Report on the Privacy Act

Statistical Report on the Privacy Act

Name of the institution: Infrastructure Canada

Reporting period: 2019-04-01 to 2020-03-31

Section 1: Requests Under the Privacy Act

1.1 Number of requests

Section 2: Requests Closed During the Reporting Period

2.1 Disposition and completion time

2.2 Exemptions

2.3 Exclusions

2.4 Format of information released

2.5 Complexity

2.5.1 Relevant pages processed and disclosed

2.5.2 Relevant pages processed and disclosed by size of requests

2.5.3 Other complexities

2.6 Closed requests

2.6.1 Number of requests closed within legislated timelines

2.7 Deemed refusals

2.7.1 Reasons for not meeting legislated timelines

2.7.2 Requests closed beyond legislated timelines (including any extension taken)

2.8 Requests for translation

Section 3: Disclosures Under Subsections 8(2) and 8(5)

Section 4: Requests for Correction of Personal Information and Notations

Section 5: Extensions

5.1  Reasons for extensions and disposition of requests

5.2 Length of extensions

Section 6: Consultations Received From Other Institutions and Organizations

6.1 Consultations received from other Government of Canada institutions and other organizations

6.2 Recommendations and completion time for consultations received from other Government of Canada institutions

6.3 Recommendations and completion time for consultations received from other organizations

Section 7: Completion Time of Consultations on Cabinet Confidences

7.1 Requests with Legal Services

7.2 Requests with Privy Council Office

Section 8: Complaints and Investigations Notices Received

Section 9: Privacy Impact Assessments (PIA) and Personal Information Banks (PIB)

9.1 Privacy Impact Assessments

9.2 Personal Information Banks

Section 10: Material Privacy Breaches

Section 11: Resources Related to the Privacy Act

11.1  Costs

11.2  Human Resources

Note: Enter values to two decimal places.

Annex C: 2019-20 Supplemental Statistical Report – Requests affected by COVID-19 measures

In addition to completing the forms for the Statistical Reports on the ATIA and Privacy Act for 2019-20, institutions are asked to complete this Supplemental Report to help identify the impact of COVID-19 measures on institutional performance for 2019-20 and going forward. The data requirements are set out in the tables below.

The following table reports the total number of formal requests received during two periods; 2019-04-01 to 2020-03-13 and 2020-03-14 to 2020-03-31

Supplemental Statistical Report on the Access to Information Act

The following table reports the total number of formal requests received during two periods; 2019-04-01 to 2020-03-13 and 2020-03-14 to 2020-03-31

Table 1 – Requests Received

The following table reports the total number of requests closed within the legislated timelines and the number of closed requests that were deemed refusals during two periods 2019-04-01 to 2020-03-13 and 2020-03-14 to 2020-03-31.

Table 2 – Requests Closed

The following table reports the total number of requests carried over during two periods; 2019-04-01 to 2020-03-13 and 2020-03-14 to 2020-03-31.

Table 3 – Requests Carried Over

Supplemental Statistical Report on the Privacy Act

The following table reports the total number of formal requests received during two periods; 2019-04-01 to 2020-03-13 and 2020-03-14 to 2020-03-31.

Table 4 – Requests Received

The following table reports the total number of requests closed within the legislated timelines and the number of closed requests that were deemed refusals during two periods 2019-04-01 to 2020-03-13 and 2020-03-14 to 2020-03-31

Table 5 – Requests Closed

The following table reports the total number of requests carried over during two periods; 2019-04-01 to 2020-03-13 and 2020-03-14 to 2020-03-31.

Table 6 – Requests Carried Over