2024-2025 Annual Report on the Administration of the Privacy Act
-
Copyright
© His Majesty the King in Right of Canada, as represented by the Minister of Housing, Infrastructure and Communities, 2025.
Cat. No. Iu151-2E-PDF
ISSN 2819-7313
1. Introduction
Purpose of the Privacy Act
The Privacy Act establishes obligations on federal government institutions to respect the privacy rights of individuals by limiting the collection, use and disclosure of personal information. It also provides individuals with the right of access to their personal information and the right to request the correction of that information.
In accordance with section 72 of the Privacy Act, this annual report detailing the administration of the Act was prepared and tabled in Parliament.
This annual report describes how Housing, Infrastructure and Communities Canada (HICC) administered the Privacy Act from April 1, 2024, to March 31, 2025.
Mandate of Housing, Infrastructure and Communities Canada
Housing, Infrastructure and Communities Canada’s policies, programs and investments help build sustainable, inclusive and climate-resilient communities while addressing challenges Canadians face every day, including access to:
- safe and affordable housing;
- modern and accessible public transit;
- climate-resilient infrastructure to protect communities in the face of climate change;
- safe and clean water; and
- inclusive cultural and recreational community spaces.
HICC does this by:
- investing in housing and infrastructure that fosters more inclusive and sustainable Canadian communities and supporting efforts to prevent and eliminate chronic homelessness;
- collaborating with all orders of government, Indigenous communities and key stakeholders to create world-class, modern public infrastructure, reliable public transit systems and affordable housing;
- working with Indigenous partners, Crown corporations, other levels of government and the private sector to address housing needs and deliver major infrastructure projects, and leveraging alternative financing and investment options to promote economic growth;
- supporting climate-ready structural and natural infrastructure projects to mitigate the impacts of natural disasters triggered by climate change and help communities adapt and build resilience; and
- conducting research and economic analysis and collecting data to identify community priorities and supporting long-term planning toward a net-zero, low-carbon and climate-resilient future.
HICC is not reporting on behalf of a non-operational subsidiary or non-operational institution.
2. Organizational structure
How HICC is organized to fulfill its Privacy Act responsibilities
The Deputy Minister (DM) of Housing, Infrastructure and Communities Canada is the head of the institution under the Act. The DM is supported by the Assistant Deputy Ministers of Policy and Results, Communities and Infrastructure Programs, Corporate Services, Community Policy and Programs, and Investment, Partnerships and Innovation, as well as the Directors General of Communications and the Corporate Secretariat, and the Chief Audit and Evaluation Executive.
Structure of the Access to Information and Privacy (ATIP) Office
The ATIP Office at HICC is led by the Director of ATIP and Executive Correspondence, who reports to the Director General of the Corporate Secretariat. At the end of the reporting period, the ATIP Office was comprised of 11 members: the Director, one manager, three team leaders, five ATIP analysts and one casual split between the ATIP Operations and the Privacy Policy teams.
HICC follows the hybrid work model. While on-site, most employees work in the Ottawa office, with one employee working in the Montréal office. The ATIP Office did not have any consultants during fiscal year 2024-2025.
The work of the ATIP Office under the Act involves:
- processing Privacy Act requests and related activities;
- processing consultations received from other institutions;
- providing advice and guidance to employees and senior officials on privacy‑related matters;
- developing privacy-related instruments to ensure sound privacy management practices and clearly defined responsibilities throughout the Department;
- developing and delivering training to departmental employees; and
- representing HICC in engagements with the Treasury Board of Canada Secretariat (TBS), the Office of the Privacy Commissioner of Canada and other government institutions regarding the application of the ATIP legislation.
There was no service agreement under section 73.1 of the Privacy Act for HICC during this reporting period.
3. Delegation order
The delegation order in effect at the end of this reporting period was signed in January 2025. Under this order, full authority to exercise the powers, duties and functions of the Deputy Minister for all sections of the Act is delegated to all Assistant Deputy Ministers, the Chief Audit and Evaluation Executive, the Director of ATIP and Executive Correspondence, and the Manager of ATIP. Some authority was delegated to the ATIP team leaders.
A copy of the signed and dated delegation order can be found in Annex A of this report.
4. Performance overview 2024-2025
The Statistical Report on the Privacy Act is prepared by government institutions to assist TBS in analyzing trends and exercising oversight. The analysis in this section compares data found in HICC’s 2024-2025 Statistical Report on the Privacy Act with data from the three previous fiscal years to produce a four-year trend analysis.
Percentage of requests responded to within legislated timelines
One of the key measures of HICC ATIP’s performance is the number of requests closed within legislated timelines. In 2024-2025, HICC closed 22 requests within the legislated timelines, giving an overall compliance rate of 100% for this reporting period. HICC maintained a 100% compliance rate for the past four consecutive fiscal years, demonstrating exemplary performance in responding to privacy requests and closing files within legislated timelines.
Table 1 compares the number of requests closed within legislated timelines for the past four fiscal years.
| Requests responded to within legislated timelines | 2021-2022 | 2022-2023 | 2023-2024 | 2024-2025 |
|---|---|---|---|---|
| Number of requests closed | 7 | 2 | 27 | 22 |
| Number of requests closed within legislated timelines | 7 | 2 | 27 | 22 |
| Percentage of requests closed within legislated timelines | 100% | 100% | 100% | 100% |
Number of completed requests broken down by completion times
Section 14 of the Privacy Act requires institutions to provide a response to the requester within 30 days of receipt of the request or to notify the requester that an extension is required. Of the 22 requests completed during the reporting period, 15 (68%) were completed within one to 30 days, and 7 requests (32%) were completed within 31 to 60 days.
For a comparison of processing times over the past four fiscal years, please refer to Table 2 below.
| Processing time | Number of requests | |||
|---|---|---|---|---|
| 2021-2022 | 2022-2023 | 2023-2024 | 2024-2025 | |
| 1 to 30 days | 7 | 2 | 23 | 15 |
| 31 to 60 days | 0 | 0 | 4 | 7 |
| 61 to 120 days | 0 | 0 | 0 | 0 |
Overview of active requests broken down by specific fiscal year in which they were received
At the end of the fiscal year, one active request received in 2024-2025 was carried forward into 2025-2026. The request was still within legislated timelines, as shown in the table below. HICC consistently strives to meet the legislated timelines by concentrating efforts to expedite the retrieval of records and effectively coordinate consultations with stakeholders.
| Open requests that were received in the fiscal year | Open requests that are within legislated timelines as of March 31, 2025 | Open requests that are beyond legislated timelines as of March 31, 2025 | Total |
|---|---|---|---|
| Received in 2024-2025 | 1 | 0 | 1 |
| Received in 2023-2024 | 0 | 0 | 0 |
| Total | 1 | 0 | 1 |
Overview of active complaints broken down by fiscal year in which they were received
In 2024-2025, HICC did not receive any new complaints nor have any active complaints outstanding as of the last day of the reporting period.
Reasons for extensions
The Act recognizes that some requests may require more than 30 days to process. Therefore, section 15 of the Act allows institutions to extend the time limit by a maximum of 30 days. In 2024-2025, seven extensions were taken under 15(a)(i) of the Act. Table 4 shows the reasons for extensions over the past four fiscal years.
| Reasons for extensions | 2021-2022 | 2022-2023 | 2023-2024 | 2024-2025 |
|---|---|---|---|---|
| Interference with operations 15(a)(i) | 0 | 0 | 4 | 7 |
| Consultations 15(a)(ii) | 0 | 0 | 4 | 0 |
| Translation or conversion 15(b) | 0 | 0 | 0 | 0 |
Consultations from other government institutions and organizations
When other institutions and organizations retrieve information that concerns or originates from HICC in response to Privacy Act requests, they may consult the HICC ATIP Office for recommendations on release. Other government institutions are defined as federal institutions subject to the Act. Other organizations include the governments of provinces, territories and municipalities, and of other countries.
In 2024-2025, HICC did not receive any consultation requests.
Percentage of completed requests for which records were all disclosed and disclosed in part
During the reporting period, HICC disclosed in part 15 privacy requests (68%) and disclosed in full three requests (14%). No records existed for the other four requests. Table 5 compares the percentage of requests all disclosed and disclosed in part for the past four fiscal years.
| Completed requests | 2021-2022 | 2022-2023 | 2023-2024 | 2024-2025 |
|---|---|---|---|---|
| Percentage of requests all disclosed | 0 (0%) | 0 (0%) | 7 (26%) | 3 (14%) |
| Percentage of requests disclosed in part | 4 (57%) | 1 (50%) | 18 (67%) | 15 (68%) |
| Total | 4 (57%) | 1 (50%) | 25 (93%) | 18 (82%) |
5. Training and awareness
Institution-specific training was offered in a variety of formats to best suit the needs of employees across the Department. Employees are encouraged to complete the Canada School of Public Service (CSPS) course titled Access to Information and Privacy Fundamentals prior to attending any HICC internal training sessions. This CSPS course is on HICC’s mandatory training list, and it must be completed within six months of the start date of employment with HICC, and/or when beginning a supervisor, manager or executive role. These requirements are monitored directly by the employee’s manager.
The ATIP Office offered and delivered Processing ATIP Requests and the institution-specific privacy training in both official languages three times per year to all HICC employees and customized group sessions, as requested, to maintain consistent and up-to-date approaches to privacy functions across the Department.
During 2024-2025, six sessions of the 60-minute HICC training course Processing ATIP Requests were delivered by the ATIP Office to 616 employees. The ATIP Office also hosted an ATIP training for executives with 13 attendees. Both courses contained a privacy component.
As part of HICC’s internal Privacy Policy, all employees must attend privacy training every three years. In 2024-2025, six sessions of the 60-minute institution-specific privacy training were delivered to a total of 619 employees. These sessions covered and ensured employees were aware of polices, procedures and legal responsibilities under the Privacy Act. The high attendance rates at HICC are attributed to the mandatory nature of the training, continued advertising of the trainings through department-wide calendar invitations and the ease of attending the training virtually.
In addition to the general ATIP training, ad hoc training was provided to 130 employees across five sessions on Microsoft Teams. These training sessions contained a privacy component and were tailored to meet the specific content needs of attendees. Ad hoc training on privacy considerations for the use of videorecording and transcription was also delivered throughout the fiscal year to a total of 65 employees across 22 sessions.
The ATIP Office maintains an internal webpage which includes resources on the HICC Privacy Policy, the HICC Directive on Privacy Practices, principles of privacy protection, privacy breach management and frequently asked questions.
The ATIP Office publishes articles related to privacy in the internal departmental newsletter. This reporting period, the ATIP Office published articles on the obligations and responsibilities of public servants under the Privacy Act, obligations regarding privacy notice statements, introducing ATIP’s Privacy Policy inbox and updates to HICC’s Privacy Policy. These articles included 10 tips to help guide daily work, highlighting responsibilities under the Privacy Act, TBS requirements for privacy notice statements and when they are required, the launch of a new Privacy Policy inbox for policy inquiries, and key updates to the HICC Privacy Policy in accordance with changes to the TBS Policy on Privacy Protection.
The ATIP Office ensures that all employees are informed of any updates to privacy policies and directives related to the administration of the Act through regular internal newsletter articles, updating our internal-facing ATIP INFRAnet page and engaging with employees who have functional or delegated responsibilities under the Act to provide targeted guidance and advice as needed.
Lastly, employees in the ATIP Office with functional and delegated responsibilities under the Act and its associated Regulations regularly participate in training and information sessions offered by TBS and the ATIP community to keep up to date on policies and procedures related to the administration of the Act and ensuring they participate in ongoing in-depth training.
6. Policies, guidelines and procedures
The ATIP Office continued to update privacy policies, guidelines and procedures, and ensured alignment with TBS updates made during this reporting period.
The HICC Privacy Policy, first published in fiscal year 2022-2023, lays out the foundation for sound privacy management practices and clearly defined responsibilities throughout the Department. This policy was updated in November 2024 in response to the revised TBS Policy on Privacy Protection.
HICC continues to utilize the policy tool outlining privacy considerations on the use of video recording and transcription on MS Teams. This ensures that employees are aware of their obligations under the Act prior to the collection of personal information. HICC Information Technology (IT) Services periodically reviews and removes access permissions for employees who have the video recording and transcription feature enabled on Microsoft Teams (when no longer needed).
The HICC ATIP Office takes privacy breaches very seriously. Training and guidance on how to mitigate and manage privacy breaches is available to all employees via the HICC Directive on Privacy Practices, as well as during formal training courses. Following a confirmed privacy breach, it is HICC’s practice to recommend that all employees involved in the breach attend a privacy training course to better understand their role in protecting personal information and preventing future breaches. The ATIP Office tracks and analyses the types of privacy breaches that have occurred in our institution to find trends and implement targeted solutions to prevent similar breaches.
The ATIP Office works in collaboration with Information Management (IM) on an ongoing email cleanup campaign across the Department, which encourages staff to take time to review their email inbox on a regular basis and sort out the emails of business value from the transitory information. The IM landing page is available for employees to review policies and directives related to email management and access tools to help maintain a tidy inbox. This helps to ensure that personal information of a transitory nature is not kept longer than necessary.
The ATIP Office continues to update its internal procedures including, but not limited to, analyst resources, reporting requirements and roles and responsibility documentation to comply with new TBS policies and directives.
HICC did not receive authority for any new collections or consistent uses of Social Insurance Numbers during this reporting period.
7. Initiatives and projects to improve privacy
HICC implemented initiatives to improve access to personal information and privacy within the institution, including technological improvements to modernize the delivery of services and facilitate the processing of requests.
This reporting period, the ATIP Office introduced a new generic inbox for the Privacy Policy Team to improve the efficiency and effectiveness of operations. This has streamlined the triage of privacy policy inquires away from the ATIP Operations inbox and ensures inquiries can be actioned more quickly and securely by the Privacy Policy Team.
HICC completed the configuration and testing of a new ATIP processing software and will transition to the new software at the start of fiscal year 2025-2026. The new software is expected to improve the overall efficiency of ATIP Operations, reduce the administrative burden on the ATIP Office and improve overall processing times. It also features an electronic document review functionality which is used to quickly filter, sort and de-duplicate documents, including emails and other file types.
During the reporting period, the ATIP Office established the ATIP Process Working Group (APWG), comprised of ATIP contacts from every branch throughout the Department. This group is dedicated to sharing best practices, new methodologies, lessons learned and ATIP-related knowledge. The network facilitates the smooth implementation of new initiatives and procedures and is a forum for providing updates, exchanging knowledge and fostering a collaborative community. Through regular meetings and discussions, the group ensures that all branches are aligned and informed, enhancing the overall efficiency and effectiveness of HICC’s ATIP processes.
HICC is committed to privacy practices that advance Indigenous reconciliation, including removing barriers to personal information for Indigenous requesters by responding to requests in a timely manner, providing interim responses for large volume requests, processing a large variety of document formats, keeping open lines of communication with requesters and applying limited exemptions to the records. In alignment with the Access to Information and Privacy Implementation Notice 2023-01: Advancing Reconciliation with Indigenous Peoples by Providing Culturally Appropriate Services, HICC included the recommended courses in the learning and development plans for the entire ATIP team, and the training is mandatory for all new members of the ATIP Office.
8. Summary of key issues and actions taken on complaints
No complaints were received or concluded during the reporting period.
9. Material privacy breaches
A privacy breach is defined by TBS as the improper or unauthorized access to creation, collection, use, disclosure, retention or disposal of personal information. A material privacy breach is defined by TBS as a privacy breach that could reasonably be expected to create a real risk of significant harm to an individual.
During the reporting period, one material privacy breach was reported to TBS and the OPC. The incident involved the improper use of an HICC device that contained personal information. There were no known impacts to any individual, and no personal information is known to have been accessed or used. HICC ATIP notified individuals of the incident out of an abundance of caution.
10. Privacy impact assessments
Privacy impact assessments (PIAs) are risk management tools to determine whether privacy risks are present in new or existing departmental programs, initiatives or projects that collect, use and retain personal information. PIAs promote transparency and accountability and contribute to continued public confidence in the way the Government manages personal information. HICC conducts PIAs to develop an informed assessment of the privacy risks associated with new initiatives and to inform recommendations to mitigate any identified privacy risks to an acceptable level.
During the reporting period, five new PIAs were completed and three PIAs were modified.
A PIA on the Climate Toolkit Initiative was completed on HICC’s open access Climate Toolkit platform. The platform was established in response to Canada’s National Adaptation Strategy (NAS), which outlines the path to a more climate-resilient country. The platform contains tools, guidance, data and resources, and offers direct support to communities through a help desk and a roster of climate and infrastructure practitioners.
A PIA was completed on the National Infrastructure Assessment (NIA), designed to identify the needs and priorities for Canada’s infrastructure and to plan for a net zero emissions future by 2050. The NIA has three priorities: to assess Canada’s infrastructure needs and establish a long-term vision; to improve coordination among infrastructure owners and funders; and to determine the best ways to fund and finance infrastructure.
A PIA on Monitoring Hybrid Compliance at HICC was completed on monitoring designed to improve the accuracy and sustainability of reporting, making the hybrid compliance process more efficient and secure.
A PIA was completed on the Canada Housing Infrastructure Fund (CHIF), which aims to accelerate the construction and upgrading of housing-enabling drinking water, wastewater, stormwater and solid-waste infrastructure, directly supporting the creation of new homes and increasing densification. This investment is part of the Government of Canada’s commitment to address the impacts of the housing crisis on communities of all sizes across the country.
A PIA was completed on the National Housing Council (NHC), an advisory body to the Minister of Housing and Infrastructure that promotes participation and inclusion in the development of Canada’s housing policy surrounding urgent housing issues. The work of the NHC involves engaging with communities through review panels, public outreach activities and public engagement sessions.
All HICC PIA summaries are available online here: Privacy Impact Assessment Summaries.
In addition, three PIAs were modified during the reporting period. This includes the Research and Knowledge Initiative PIA Addendum, the Canada Public Transit Fund (formerly Permanent Public Transit Program) PIA Addendum and the National Housing Council PIA Addendum.
11. Public interest disclosures
Paragraph 8(2)(m) permits the disclosure of personal information where, in the opinion of the head of the institution, the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure, or the disclosure would clearly benefit the individual to whom the information relates. No disclosure was made under paragraph 8(2)(m) of the Privacy Act during the reporting period.
12. Monitoring compliance
HICC makes every effort to meet statutory deadlines and actively monitors the time taken to process requests. Monitoring begins as soon as a request is received by the ATIP Office, entered into the case management system and assigned to an ATIP analyst. Deadlines are tracked and monitored electronically, highlighting files nearing completion or targeted deadlines. The analysts and management monitor the time taken to process personal information requests on an ongoing basis. Statistics on the active caseload are provided to, and analyzed by, the Director of ATIP and Executive Correspondence on a weekly basis. Any required action is taken as a result of this analysis to ensure timely access to documents requested.
Instrumental to ensuring HICC’s compliance with the legislation, the ATIP Office maintained positive working relationships with the employees tasked with the retrieval of records by engaging in early discussions of requests, providing guidance and following up as needed.
The ATIP Office continues to collaborate with HICC Procurement Services and the branches responsible for rolling out new initiatives to ensure appropriate privacy protections are included in contracts, agreements and arrangements. In response to the Treasury Board Secretariat’s revisions to the Policy on Privacy Protection and the Directive on Privacy Practices, HICC Procurement Services updated its processes to align with the new TBS direction. Contracts involving personal information are flagged to the ATIP Office at the earliest stage possible to assist in mitigating privacy risks for new initiatives and ensuring that relevant privacy clauses are included in contracts.
Annexes
Annex A: Privacy Act Delegation Order
Access to Information Act and Privacy Act Delegation Order / Arrêté de délégation en vertu de la Loi sur l'accès à l'information et de la Loi sur la protection des renseignements personnels
The Deputy Minister of Housing, lnfrastructure and Communities, pursuant to section 95(1) of the Access to Information Act and section 73(1) of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Deputy Minister as the head of Housing, lnfrastructure and Communities Canada under the provisions of the Act and related regulations set out in the schedule opposite each position. This designation replaces all previous delegation orders.
En vertu de l'article 95(1) de la Loi sur l'accès à l'information et de l'article 73(1) de la Loi sur la protection des renseignements personnels, le sous-ministre de Logement, Infrastructures et Collectivités délègue aux titulaires des postes mentionnés à l'annexe ci-après, ainsi qu'aux personnes occupant à titre intérimaire lesdits postes, les attributions dont il est, en qualité de responsable de Logement, Infrastructures et Collectivités Canada, investie par les dispositions de la Loi ou de son règlement mentionnées en regard de chaque poste. Le présent document remplace et annule tout arrêté antérieur.
| Position / Poste | Access to Information Act and Regulations / Loi sur l'accès à l'information et Règlement | Privacy Act and Regulations / Loi sur la protection des renseignements personnels et Règlement |
|---|---|---|
| Assistant Deputy Ministers / Sous-ministre adjoint(e)s | Full authority / Autorité absolue | Full authority/ Autorité absolue |
| Chief Audit and Evaluation Executive / Dirigeant(e) principal(e) de la vérification et de l'évaluation | Full authority / Autorité absolue | Full authority / Autorité absolue |
| Director General of Communications / Directeur (trice) général (e) des communications | Full authority / Autorité absolue | Full authority / Autorité absolue |
| Director, ATIP and Executive Correspondence / Directeur(trice) de l'AIPRP et de la correspondance de la haute direction | Full authority / Autorité absolue | Full authority / Autorité absolue |
| Manager ATIP (PM 06) / Gestionnaire de l'AIPRP (PM 06) | Full authority / Autorité absolue | Full authority / Autorité absolue |
| ATIP Team Lead (PM-05) / Chef d'équipe de l'AIPRP (PM-05) |
Access to Informotion Act / Loi sur l'accès d l'information
|
Privacy Act / Loi sur la protection des renseignements personnels
|
Paul Halucha
Deputy Minister of Housing, Infrastructure and Communities / Sous-ministre de Logement, Infrastructures et Collectivités
Signed and dated:
January 7, 2025
Give feedback about this page
- Date modified: