Report on the administration of the Privacy Act 2016-2017

Download the PDF version

About this publication

Publication author : Canada Economic Development for the regions of Quebec

ISSN number : 2291-725x

Publish date : September 26, 2017

Summary :

This report deals with the activities of the Agency in implementing the Privacy Act for the fiscal year 2016-2017.

Table of Contents

  1. 1. Introduction
  2. 2. Organizational structure
  3. 3. Delegation order
  4. 4. Highlighs of the statistical report 2016-17
  5. 5. Training
  6. 6. Policies, guidelines, procedures and initiatives
  7. 7. Complaints
  8. 8. Monitoring compliance
  9. 9. Material privacy breaches
  10. 10. Privacy impact assessments
  11. 11. Public interest disclosures
  12. Appendix - Delegation order
  13. Appendix - Statistical report for 2016-17

1. Introduction

Summary of the purpose of the Privacy Act

The Privacy Act (the Act), promulgated on July 1, 1983, aims to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution.

The purpose of the Act is to protect personal information by allowing individuals to consult information about them. It also imposes strict controls on how such information is gathered, used and shared.

The Privacy Act gives individuals general access to personal information about themselves held by federal institutions, subject to certain specific and limited exceptions.

Annual report prepared in accordance with section 72

This document was prepared in response to section 72 of the Act, which requires federal institutions to submit an annual report to Parliament on administration of the Act. This report provides details on activities related to administration of the Act at Canada Economic Development for Quebec Regions (CED).

Mandate of the institution

Under its constituent Act, CED’s mission is to “promote the long-term economic development of the regions of Quebec by giving special attention to those where slow economic growth is prevalent or opportunities for productive employment are inadequate.”

As part of its mission, CED promotes the start-up and performance of businesses. It helps them become more innovative, productive and competitive. It supports communities’ engagement efforts in Quebec’s regions and helps to attract investment that will increase the prosperity of the Quebec and Canadian economies.

CED contributes to the economic vitality of all Quebec regions, by building on their competitive regional advantages. It makes investments that support transition and diversification for those communities that remain dependent on one sector for economic opportunities or that have experienced economic shocks.

CED also pays special attention to communities with low economic growth. In this respect, CED uses an Economic Development Index allows it, among other things, to determine the economic development levels of Quebec’s 104 communities in order to meet their needs more specifically.

Through its business offices, present in the regions of Quebec, CED works directly and indirectly with businesses, primarily small and medium-sized enterprises (SMEs), and through non-profit organizations (NPOs) that support them and the communities. By providing financial assistance for projects, among other things, CED supports their development efforts.

CED’s approach is inspired by the best practices identified with respect to regional economic development. It is:

CED’s Grants and Contributions Programs and Initiatives, in effect in 2016–17

Main program: Quebec Economic Development Program (QEDP)

  • Targeted and/or temporary initiatives:
    • Economic Recovery Initiative for Lac-Mégantic
    • Canadian Initiative for the Economic Diversification of Communities Reliant on Chrysotile
    • Strategic Initiative to Combat the Spruce Budworm Outbreak in Quebec
    • Extension of the natural gas distribution network between Lévis and Sainte-Claire (Bellechasse Pipeline)
    • Linguistic Duality Economic Development Initiative (EDI)(Canada-wide initiative)
    • Canada 150 Community Infrastructure Program (CIP-150 )(Canada-wide initiative)

Canada-wide program implemented in Quebec by CED:

  • Community Futures Program (CFP)

Infrastructure Canada’s delivery partner in Quebec:

  • Building Canada Fund–Quebec (BCF)

The CED’s main grants and contributions program, the QEDP, came into effect on April 1, 2012. The main recipients of the program are SMEs, business groups or associations and NPOs whose principal mission is to support businesses or economic development. The QEDP includes repayable and non-repayable contributions.

To learn more about the Agency’s mandate, programming and operations, go to its Web site: www.dec-ced.gc.ca.

2. Organizational structure

Organizational structure

Access to Information and Privacy Office

CED fulfills its Access to Information Act (ATI) and Privacy Act (PA) responsibilities with an Access to Information and Privacy Office (AIPO) to process requests. The AIPO reports directly to the Deputy Minister / President’s Chief of Staff.

AIPO has an access to information and privacy coordinator, as well as an advisor and a coordinating agent. The coordinator, with the help of the advisor and agent, oversees compliance with legislation, regulations, procedures and broad government trends.

Through its delegated authority, AIPO represents the Agency on matters relating to the Act in dealings with the public, Treasury Board Secretariat, the Commissioners of Information and Privacy and other federal departments and institutions.

AIPO’s chief duties are:

  • Processing requests and coordinating all attendant administrative and legal operations.
  • Assisting applicants.
  • Developing opinions, general guidelines and procedures relating to the application of the ATI and PA.
  • Reporting on CED’s application of the ATI and PA.
  • Meeting the training and information needs CED employees.

3. Delegation order

DEC’s enabling legislation identifies its head as being the Deputy Minister / President. In addition to managing the institution and overseeing management of its personnel, the Deputy Minister / President is responsible for application of the Privacy Act.

To this end, the authority for application of the Act was delegated to the Coordinator, Access to Information and Privacy, while most administrative authority was delegated to the Advisor, Access to Information and Parliamentary Affairs.

A copy of the signed and dated delegation order is attached to this report.

4. Highlighs of the statistical report 2016-17

Requests received and processed

Over fiscal year 2016-17, five privacy requests were received. In addition to these, one request was carried over from the previous year. As a result, the six requests processed in 2016-17 is an increase of 100% over the last year. However, that figure does include abandoned requests. It was the first full year of accepting privacy requests submitted on-line. Some applicants mistakenly selected CED from the drop-down menu to submit their requests. In each of these cases, the AIPO redirected and advised the applicant to submit a new request to the appropriate institution and abandon the request submitted to CED. In all, four requests were abandoned, which brings the total of requests received to one and closed during 2016-17 to two. This level is closer to the averages registered in the last five years. Owing to its economic development activities, CED holds numerous documents containing information on third parties, but very little in the way of personal information.

The following table illustrates the number of privacy requests received since 2012-13. Excluding a request abandoned last year and the four this year, CED has only processed six privacy requests over that period.

Table 1 – Requests received

Requests received

Table 1 - Long description

Requests received

In 2016-2017, 5 requests were received and 1 request was carried over from last fiscal year

In 2015-2016, 3 requests were received

In 2014-2015, 1 request was received

In 2013-2014, no request was received

In 2012-2013, 2 requests were received

Disposition, completion times and extensions

The Act stipulates that privacy requests must normally be answered within 30 calendar days. Extensions may be granted in only rare instances. Excluding abandoned requests, CED closed two requests during the reporting period. Documents were fully disclosed in both requests without invoking any exemptions. Hence, no extension was taken as documents for one request was disclosed prior to day 15 and the other request was answered in less than 30 days.

Disposition and completion time
Disposition of Requests Completion Time
1 to 15 Days 16 to 30 Days 31 to 60 Days 61 to 120 Days 121 to 180 Days 181 to 365 Days More than 365 Days Total
All disclosed 1 1 0 0 0 0 0 2
Disclosed in part 0 0 0 0 0 0 0 0
All exempted 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0
No records exist 0 0 0 0 0 0 0 0
Request abandoned 4 0 0 0 0 0 0 4
Neither confirmed nor denied 0 0 0 0 0 0 0 0
Total 5 1 0 0 0 0 0 6

Pages processed and disclosed

A total of 79 pages was processed and released. Since CED rarely processes privacy requests, there is no trend that can be detected.

Consultations

CED did not resort to any consultation while processing both privacy requests. Also, CED did not process any consultation from other institutions.

Cost

Expenditures related to the administration of the Act totalled $10,850 in 2016-17. That amount includes $10,470 in salaries for 0.18 FTEs. Also, a total of $380 was spent on travel costs, software leasing, supplies and translation services.

A copy of the 2016-17 statistical report on the administration of the Privacy Act is attached to this report.

5. Training

Fiscal year 2015-2016 saw mandatory training sessions on privacy and access to information delivered to all CED employees. This large-scale program, which was led by the AIPO, served as a way to reinforce to 246 CED employees the importance of protecting personal information and adopting good practices.

In 2016-17, no training session was delivered to CED employees, as it is normally offered every other year. However, the AIPO remains available to deliver specific training to employees, whose duties call for a certain grasp of matters that relate to the protection of personal information.

6. Policies, guidelines, procedures and initiatives

Procedure for the application of the security of canada information sharing act (SCISA)

The SCISA seeks to improve the effectiveness and timeliness of information sharing among Government of Canada institutions for national security purposes, while complying with the Canadian Charter of Rights and Freedoms and the Privacy Act. The SCISA does not override existing restrictions on information sharing.

In essence, the SCISA authorizes federal institutions to disclose information, including personal information, to a limited number of institutions whose mandates are linked to national security. The SCISA does not create an obligation to disclose information because the disclosing institution retains the discretion to make that decision.

During the reporting period, a procedure was implemented to guide and facilitate the application of the SCISA at CED. This procedure is available on CED’s Intranet and details explicitly the criteria the AIPO and corporate security must respect in order to disclose information under the SCISA.

Access to information and personal information procedure

No new modification was made to CED’s internal Access to Information and Personal Information procedure during the course of 2016-17. However, already well established since 2011, this procedure enables the AIPO to meet its requirements and ensures that privacy requests are processed in full compliance with the principles set out in the Privacy Act.

7. Complaints

During fiscal year 2016-17, CED did not receive any complaint regarding a privacy request.

Audits and investigations

CED was not the subject of any audit over the reporting period, nor was CED under any investigation.

8. Monitoring compliance

Monitoring of the processing time

The AIPO ensures the time to process privacy requests is monitored through a weekly report of on-going requests. The report provides the details of each request, such as the due date and current status, i.e. documents being retrieved, under review, in consultation or in the approval process. This report is distributed to CED’s senior management, including its Deputy Head.

Since 2011, the AIPO has equipped itself with software to manage and track access to information requests and privacy requests. This program makes it easier to follow every activity and task related to any request and serves as a tool to monitor processing time to comply with the provisions on timeframes as set out in the Act.

9. Material privacy breaches

There was no material privacy breach that occurred over the reporting period.

10. Privacy impact assessments

Social media platforms

A Privacy impact Assessment (PIA) was completed to measure the common uses of official social media accounts at CED. The assessed uses are related to activities that involve official social media accounts widely used by CED in administering its communications program.

The PIA revealed that the current use of CED’s official social media platforms pose a moderate to low privacy risk for individuals.

A summary of this PIA can be found on CED’s website by visiting the following hyperlink: http://www.dec-ced.gc.ca/eng/disclosure/privacy/efvp-ms.html.

11. Public interest disclosures

During fiscal year 2016-17, no information was disclosed pursuant to subsection 8.(2)(m) of the Privacy Act.

Appendix - Delegation order

Delegation Chart - Privacy Act and Privacy Regulations

The President, pursuant to section 73 of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the President as the head of the Economic Development Agency for the Regions of Quebec, under the provisions of the Act and related regulations set out in the schedule opposite each position. This designation replaces all previous delegation orders.

Privacy Act
Provision Description Proposed delegation
Coordinator, Access to information and Privacy Advisor, Access to information
8(2)(j) Disclose personal information for research purposes  
8(2)(m) Disclose personal information in the public interest or in the interest of the individual  
8(4) Retain copy of 8(2)(e) requests and disclosed records
8(5) Notify Privacy Commissioner of 8(2)(m) disclosures
9(1) Retain record of use
9(4) Consistent use
10 Include personal information in personal information banks
14(a) Notice where access requested
14(b) Giving access to the record
15 Extension of time limits
17(2)(b) Language of access
17(3)(b) Access to personal information in alternate format
Exemption Provisions of the Privacy Act
Provision Description Proposed delegation
Coordinator, Access to information and Privacy Advisor, Access to information
18(2) Exemption (exempt bank) Disclosure may be refused  
19(1) Exemption - Personal information obtained in confidence  
19(2) Exemption - Where authorized to disclose  
20 Exemption - Federal-provincial affairs  
21 Exemption - International affairs and defence  
22 Exemption - Law enforcement and investigation  
22.3 Exemption - Public Servants Disclosure Protection Act  
23 Exemption - Security clearances  
24 Exemption - Individuals sentenced for an offence  
25 Exemption - Safety of individuals  
26 Exemption - Information about another individual  
27 Exemption - Solicitor-client privilege  
28 Exemption - Medical record  
Other Provisions of the Privacy Act
Provision Description Proposed delegation
Coordinator, Access to information and Privacy Advisor, Access to information
33(2) Right to make representation  
35(1) Findings and recommendations of Privacy Commissioner (complaints)
35(4) Access to be given
36(3) Report of findings and recommendations (exempt banks)
51(2),(3) Special rules for hearings  
70 Cabinet confidences*  
72 Report to Parliament

* Legal advice obtained beforehand

Privacy Regulations
Provision Description Proposed delegation
Coordinator, Access to information and Privacy Advisor, Access to information
7 Retention of personal information requested under paragraph 8(2)(e)
9 Examination of information
11(2),11(4) Notification concerning corrections
13(1) Disclosure of personal information relating to physical or mental health
14 Examination in presence of medical practitioner or psychologist

I approve the delegation schedule.

Manon Brassard, Deputy Minister / President
Date

Appendix - Statistical report for 2016-17

Part 1: Requests Under the Privacy Act

Number of Requests
Received during reporting period 5
Outstanding from previous reporting period 1
Total 6
Closed during reporting period 6
Carried over to next reporting period 0

Part 2: Requests Closed During the Reporting Period

2.1 Disposition and completion time
Disposition of Requests Completion Time
1 to 15 Days 16 to 30 Days 31 to 60 Days 61 to 120 Days 121 to 180 Days 181 to 365 Days More than 365 Days Total
All disclosed 1 1 0 0 0 0 0 2
Disclosed in part 0 1 0 0 0 0 0 1
All exempted 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0
No records exist 0 0 0 0 0 0 0 0
Request abandoned 4 0 0 0 0 0 0 4
Neither confirmed nor denied 0 0 0 0 0 0 0 0
Total 5 1 0 0 0 0 0 6
2.2 Exemptions
Section Number of Requests
18(2) 0
19(1)(a) 0
19(1)(b) 0
19(1)(c) 0
19(1)(d) 0
19(1)(e) 0
19(1)(f) 0
20 0
21 0
22(1)(a)(i) 0
22(1)(a)(ii) 0
22(1)(a)(iii) 0
22(1)(b) 0
22(1)(c) 0
22(2) 0
22.1 0
22.2 0
22.3 0
23(a) 0
23(b) 0
24(a) 0
24(b) 0
25 0
26 0
27 0
28 0
2.3 Exclusions
Section Number of Requests
69(1)(a) 0
69(1)(b) 0
69.1 0
70(1) 0
70(1)(a) 0
70(1)(b) 0
70(1)(c) 0
70(1)(d) 0
70(1)(e) 0
70(1)(f) 0
70.1 0
2.4 Format of information released
Disposition Paper Electronic Other formats
All disclosed 1 1 0
Disclosed in part 1 0 0
Total 1 1 0

2.5 Complexity

2.5.1 Relevant pages processed and disclosed
Disposition of Requests Number of Pages Processed Number of Pages Disclosed Number of Requests
All disclosed 79 79 2
Disclosed in part 0 0 0
All exempted 0 0 0
All excluded 0 0 0
Request abandoned 0 0 4
Neither confirmed nor denied 0 0 0
Total 79 79 6
2.5.2 Relevant pages processed and disclosed by size of requests
Disposition Less Than 100 Pages Processed 101-500 Pages Processed 501-1000 Pages Processed
Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed
All disclosed 2 79 0 0 0 0
Disclosed in part 0 0 0 0 0 0
All exempted 0 0 0 0 0 0
All excluded 0 0 0 0 0 0
Request abandoned 4 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0 0
Total 6 79 0 0 0 0
2.5.2 Relevant pages processed and disclosed by size of requests (continued)
Disposition 1001-5000 Pages Processed More Than 5000 Pages Processed
Number of Requests Pages Disclosed Number of Requests Pages Disclosed
All disclosed 0 0 0 0
Disclosed in part 0 0 0 0
All exempted 0 0 0 0
All excluded 0 0 0 0
Request abandoned 0 0 0 0
Neither confirmed nor denied 0 0 0 0
Total 0 0 0 0
2.5.3 Other complexities
Disposition Consultation Required Legal Advice Sought Interwoven Information Other Total
All disclosed 0 0 0 0 0
Disclosed in part 0 0 0 0 0
All exempted 0 0 0 0 0
All excluded 0 0 0 0 0
Request abandoned 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0
Total 0 0 0 0 0

2.6 Deemed refusals

2.6.1 Reasons for not meeting statutory deadline
Number of Requests Closed Past the Statutory Deadline Principal Reason
Workload External Consultation Internal Consultation Other
0 0 0 0 0
2.6.2 Number of days past deadline
Number of Days Past Deadline Number of Requests Past Deadline Where No Extension Was Taken Number of Requests Past Deadline Where An Extension Was Taken Total
1 to 15 days 0 0 0
16 to 30 days 0 0 0
31 to 60 days 0 0 0
61 to 120 days 0 0 0
121 to 180 days 0 0 0
181 to 365 days 0 0 0
More than 365 days 0 0 0
Total 0 0 0
2.7 Requests for translation
Translation Requests Accepted Refused Total
English to French 0 0 0
French to English 0 0 0
Total 0 0 0

Part 3 - Disclosures Under Subsection 8(2) and 8(5)

Paragraph 8(2)(e) Paragraph 8(2)(m) Subsection 8(5) Total
0 0 0 0

Part 4 - Requests for Correction of Personal Information and Notations

Disposition for Correction Requests Received Number
Notations attached 0
Requests for correction accepted 0
Total 0

Part 5 - Extensions

5.1 Reasons for extensions and disposition of requests
Disposition of Requests Where an Extension Was Taken 15(a)(i)
Interference With Operations
15(a)(ii)
Consultation
15(b)
Translation or Conversion
Section 70 Other
All disclosed 0 0 0 0
Disclosed in part 0 0 0 0
All exempted 0 0 0 0
All excluded 0 0 0 0
No records exist 0 0 0 0
Request abandoned 0 0 0 0
Total 0 0 0 0
5.2 Length of extensions
Length of Extensions 15(a)(i)
Interference with operations
15(a)(ii)
Consultation
15(b)
Translation purposes
Section 70 Other
1 to 15 days 0 0 0 0
16 to 30 days 0 0 0 0
Total 0 0 0 0

Part 6: Consultations Received From Other Institutions and Organizations

6.1 Consultations received from other Government of Canada institutions and other organizations
Consultations Other Government of Canada Institutions Number of Pages to Review Other Organizations Number of Pages to Review
Received during the reporting period 0 0 0 0
Outstanding from the previous reporting period 0 0 0 0
Total 0 0 0 0
Closed during the reporting period 0 0 0 0
Pending at the end of the reporting period 0 0 0 0
6.2 Recommendations and completion time for consultations received from other Government of Canada institutions
Recommendation Number of Days Required to Complete Consultation Requests
1 to 15 Days 16 to 30 Days 31 to 60 Days 61 to 120 Days 121 to 180 Days 181 to 365 Days More Than 365 days Total
All disclosed 0 0 0 0 0 0 0 0
Disclose in part 0 0 0 0 0 0 0 0
All exempted 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0
Consult other institution 0 0 0 0 0 0 0 0
Other 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0
6.3 Recommendations and completion time for consultations received from other organizations
Recommendation Number of days required to complete consultation requests
1 to 15 Days 16 to 30 Days 31 to 60 Days 61 to 120 Days 121 to 180 Days 181 to 365 Days More Than 365 Days Total
All Disclosed 0 0 0 0 0 0 0 0
Disclose in part 0 0 0 0 0 0 0 0
All exempted 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0
Consult other institution 0 0 0 0 0 0 0 0
Other 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0

Part 7: Completion Time of Consultations on Cabinet Confidences

7.1 Requests with Legal Services
Number of Days Pages Processed 101-500 Pages Processed 501-1000 Pages Processed
Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed
1 to 15 0 0 0 0 0 0
16 to 30 0 0 0 0 0 0
31 to 60 0 0 0 0 0 0
61 to 120 0 0 0 0 0 0
121 to 180 0 0 0 0 0 0
181 to 365 0 0 0 0 0 0
More than 365 0 0 0 0 0 0
Total 0 0 0 0 0 0
7.1 Requests with Legal Services (continued)
Number of Days 1001-5000 Pages Processed More than 5000 Pages Processed
Number of Requests Pages Disclosed Number of Requests Pages Disclosed
1 to 15 0 0 0 0
16 to 30 0 0 0 0
31 to 60 0 0 0 0
61 to 120 0 0 0 0
121 to 180 0 0 0 0
181 to 365 0 0 0 0
More than 365 0 0 0 0
Total 0 0 0 0
7.2 Requests with Privy Council Office
Number of Days Pages Processed 101-500 Pages Processed 501-1000 Pages Processed
Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed
1 to 15 0 0 0 0 0 0
16 to 30 0 0 0 0 0 0
31 to 60 0 0 0 0 0 0
61 to 120 0 0 0 0 0 0
121 to 180 0 0 0 0 0 0
181 to 365 0 0 0 0 0 0
More than 365 0 0 0 0 0 0
Total 0 0 0 0 0 0
7.2 Requests with Privy Council Office (continued)
Number of Days 1001-5000 Pages Processed More than 5000 Pages Processed
Number of Requests Pages Disclosed Number of Requests Pages Disclosed
1 to 15 0 0 0 0
16 to 30 0 0 0 0
31 to 60 0 0 0 0
61 to 120 0 0 0 0
121 to 180 0 0 0 0
181 to 365 0 0 0 0
More than 365 0 0 0 0
Total 0 0 0 0

Part 8: Complaints and Investigations Notices Received

Section 31 Section 33 Section 35 Court action Total
0 0 0 0 0

Part 9: Privacy Impact Assessments (PIAs)

Number of PIA(s) completed 1

Part 10: Resources Related to the Privacy Act

10.1 Costs
Expenditures Amount
Salaries $10,470
Overtime $0
Goods and Services $380
  • Professional services contracts
$0  
  • Other
$380
Total $10,850
10.2 Human Resources
Resources Person Years Dedicated to Privacy Activities
Full-time employees 0.18
Part-time and casual employees 0.00
Regional staff 0.00
Consultants and agency personnel 0.00
Students 0.00
Total 0.18

Note: Enter values to two decimal places.

Date modified: