ARCHIVED - Annual Report to Parliament 2010-2011 - Privacy Act

Introduction

The purpose of the Privacy Act is to extend the present laws of Canada that protect the privacy of individuals and that provide individuals with a right of access to personal information about themselves. The federal Privacy Act regulates the collection, use and disclosure of personal information held by the National Research Council of Canada (NRC).

In accordance with Section 72 of the Privacy Act, this twenty-seventh Annual Report on the administration of the Privacy Act at NRC describes how NRC discharged its responsibilities in relation to the Act in the fiscal year 2010-2011. The Annual Report is further tabled in Parliament in accordance with section 72 of the Privacy Act.

National Research Council of Canada - Mandate

The National Research Council of Canada is an agency of the Government of Canada established in 1916 under the NRC Act. Its mandate is to help build an innovative, knowledge-based economy for Canada through research and development, technology commercialization and industry support.

As stated in the NRC Act, the agency is responsible for: undertaking, assisting or promoting scientific and industrial research in different fields of importance to Canada; establishing, operating and maintaining a national science library; publishing and selling or otherwise distributing such scientific and technical information as the Council deems necessary; investigating standards and methods of measurement; working on the standardization and certification of scientific and technical apparatus and instruments and materials used or usable by Canadian industry; operating and administering any astronomical observatories established or maintained by the Government of Canada; administering NRC's research and development activities, including contributions used to support a number of international activities; and providing vital scientific and technological services to the research and industrial communities.

Delegation of Authority

The NRC President has delegated the responsibilities associated with the administration of the Privacy Act to the Secretary General. The Access to Information and Privacy (ATIP) office is part of the Secretary General’s Office (SGO). Operational responsibility for the application of the Act has been delegated to the Access to Information and Privacy Coordinator.

A detailed signed Delegation Order can be found at Annex A.

Organizational Structure

The Secretary General has overall responsibility for ensuring that NRC’s policies, procedures and practices are in line with the application and administration of the Privacy Act. As shown in the Delegation Order, the Secretary General has delegated some of his authority to the Access to Information and Privacy (ATIP) Coordinator.

The ATIP office, under the guidance of the Secretary General, is comprised of one full-time Coordinator and one Officer. The ATIP office is responsible for the coordination and implementation of policies, guidelines and procedures to ensure the organization’s compliance with the Privacy Act. The ATIP office works closely with the Records Manager, IRAP ATIP liaison officer, HR ATIP liaison officer and Senior Management across the organization. The office also provides the following services to the organization:

• Promote awareness of the Privacy Act within NRC
• Processes privacy requests and privacy complaints
• Provides advice and guidance to employees and senior officials on Privacy related matters
• Prepares an Annual Report to Parliament
• Responds to the SGO on the privacy related matters mentioned in the Management Accountability Framework
• Coordinates and implements updates to Info Source
• Administers Privacy Impact Assessments
• Manages the electronic management system
• Develops internal procedures, policies and guidelines
• Participates in forums for the ATIP Community, such as the Treasury Board Secretariat ATIP Community Meetings, Training and Annual Meetings.

The ATIP office is responsible for the implementation of the new TBS directives, and is working diligently to complete a Privacy management framework.

Interpretation of Statistical Report

Annex B provides a summarized statistical report on the privacy requests received and processed by National Research of Council from 1 April 2010 to 31 March 2011. This section provides an interpretation of the statistical report.

During the fiscal year, NRC received twelve (12) new privacy requests. During this reporting period, NRC completed the processing of a total of eleven (11) privacy requests. One request was carried forward into 2011-2012.

Section 15 of the Privacy Act allows institutions to extend the legal deadline for processing a request. NRC invoked an extension in the case of one (1) of the twelve (12) requests. Meeting the original time limit of thirty days would have unreasonably interfered with the operations of the organization. In summary, out of the (12) twelve requests, (8) eight were completed within 30 days or less and three (3) took between 31 and 60 days to complete.

The exemptions invoked were pursuant to sections 26 and 27 of the Privacy Act. Section 26 (information about another individual) was applied in three cases (3) while section 27 (solicitor-client privilege) was applied in one (1) case.

The figures, as reflected in the chart below, indicate the number of requests received and processed over the past three years. The figures do not reflect requests processed informally or other queries that have been received in the ATIP office. NRC does expect that privacy requests and queries concerning privacy-related matters will continue to represent a significant portion of the workload.

Privacy-Related Training and Education

During the fiscal year, the ATIP office launched, in collaboration with Records Services, an Information Awareness Campaign. As part of this campaign, an ATIP & Managing NRC Information Course (3 hours) was developed and promoted by the way of the Human Resources Learning Catalogue. Five courses are scheduled for delivery in 2011-2012.

The ATIP office and Records Services delivered an Information Management awareness session as part of the NRC Business Advantage Seminar Series (15 participants). An awareness session was delivered jointly to the Central Business Support team (10 participants). A privacy-specific session was delivered via teleconference to the management team of the NRC Institute for Fuel Cell Innovation (12 participants). Another privacy-specific training session was held with the Labor Relations Management team (4 participants). An overview of the two laws and NRC procedures was delivered to a new employee in the Contracting Services team.

A notice was posted on the internal website to encourage all employees to participate in an armchair discussion delivered by Privacy Commissioner, Jennifer Stoddart. The number of participants was not tracked.

All awareness sessions included information on the access to information legislation which has been accounted for in the Access to Information Act annual report.

New Procedures, Guidelines and Directives

NRC’s ATIP office has implemented two new guidelines and procedures this year in response to TBS’s renewal initiative. One of these is specific to the Privacy legislation. The ATIP Coordinator informed the Senior Executive Committee of the new TBS directives and sought to obtain approval of two procedural documents: Procedures for Suspected Obstruction of Right of Access and Guidelines on Privacy Breaches. These two documents were approved and implemented at NRC in December 2010. Further to this process, direct training on the implications of these procedures was given to the Finance Management team (10 participants).

The ATIP office, with the support of the Communications Branch, improved the ATIP internet pages (internal and external). Principles for Assisting Requestors have been posted in addition to the two new procedural documents. These principles are now being included in the acknowledgement letters to the requestors. Further procedural changes have been implemented in the contracting field. A Privacy and Access to Information notice was included in the professional services contracting process checklist. These tools have complemented the training sessions and have been effective in generating greater awareness within the organization.

The ATIP office continues to work diligently on implementing the requirements further to the TBS directives. The ATIP office continues to work with the staff of Treasury Board Secretariat to capture the information necessary to satisfy the requirements identified in the Management Accountability Framework (MAF). This year, NRC received a strong MAF rating in the ATIP area.

Privacy Complaints

During this fiscal year, NRC did not receive any privacy complaints.

Privacy Impact Assessment Activities

NRC did not complete any Privacy Impact Assessments during the reporting period.

Section 8(2)(m) Disclosures

There was no disclosure made pursuant to section 8(2)(m) of the Privacy Act during the reporting period.

---

Annex A: Delegation Order

Access to Information and Privacy Acts Delegation Order

The President of the National Research Council of Canada, pursuant to section 73 of the Access to Information Act and the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the person occupying on an acting basis the position, to exercise the powers and functions of the President as the head of a government institution, under the section of the Acts set out in the schedule opposite each position. This Designation Order supersedes all previous designation orders.

Schedule

---

Annex B: Statistical Report

Report on the Privacy Act

Institution: National Research Council Canada

Reporting Period: 04/01/2010 to 03/31/2011

Report on the Privacy Act (PDF version 315KB)