Annual Report to Parliament 2013-2014 - Privacy Act

Annual Report to Parliament 2013‑2014 - Privacy Act (DOCX, 1,499 KB)

I. Introduction

The purpose of the Privacy Act is to extend the present laws of Canada that protect the privacy of individuals and that provide individuals with a right of access to personal information about themselves. The federal Privacy Act regulates the collection, use and disclosure of personal information held by federal institutions including the National Research Council Canada (NRC).

In accordance with Section 72 of the Privacy Act, this thirtieth Annual Report on the administration of the Privacy Act at NRC describes how NRC discharged its responsibilities in relation to the Act in the fiscal year 2013‑2014. The Annual Report is to be tabled in Parliament in accordance with section 72 of the Privacy Act.

The National Research Council Canada is an agency of the Government of Canada established in 1916.  As stated in the NRC Act, the agency is responsible for: undertaking, assisting or promoting scientific and industrial research in different fields of importance to Canada; establishing, operating and maintaining a national science library; publishing and selling or otherwise distributing such scientific and technical information as the Council deems necessary; investigating standards and methods of measurement; working on the standardization and certification of scientific and technical apparatus and instruments and materials used or usable by Canadian industry; operating and administering any astronomical observatories established or maintained by the Government of Canada; administering NRC's research and development activities, including contributions used to support a number of international activities; and providing vital scientific and technological services to the research and industrial communities.

II. Delegation of authority

For the period of this report, the NRC President delegated the responsibilities associated with the administration of the Privacy Act to the Executive Vice President and Secretary General and to the Director, Corporate Governance. Operational responsibility for the application of the Act has been delegated to the Access to Information and Privacy Coordinator.  

A detailed signed Delegation Order can be found at Annex A.

III. Organizational structure

The Executive Vice President and Secretary General had overall responsibility for ensuring that NRC’s policies, procedures and practices are in line with the application and administration of the Access to Information Act.  As shown in the Delegation Order, the Executive Vice President and Secretary General delegated some of this authority to the Director, Corporate Governance and Access to Information and Privacy (ATIP) Coordinator.  During the period covered by this report, the NRC Access to Information and Privacy (ATIP) office was part of the NRC Secretary General’s Office (NRC‑SGO). 

The NRC ATIP office is a 3.5 person team. In 2013‑2014, however, the ATIP Unit went through a period during which there was a shortage of staff, an administrative assistant was hired on a part‑time basis in order to provide support to the team and to manage the electronic software application.

The NRC ATIP office works closely with the NRC Records Services, NRC Industrial Research Assistance Program ATIP liaison officer, NRC Human Resources ATIP liaison officer, NRC Communications Branch and senior management across the organization. Procedures are in place to process all privacy requests.

The ATIP office is responsible for the coordination and implementation of policies, guidelines and procedures to ensure the organization’s compliance with the Privacy Act. To that end, the office provides the following services to the organization:

  • Promote awareness of the Privacy Act within NRC
  • Processes privacy requests and privacy complaints
  • Provides advice and guidance to employees and senior officials on Privacy related matters
  • Prepares an Annual Report to Parliament
  • Responds to the NRC‑SGO on the privacy related matters mentioned in the Management Accountability Framework
  • Coordinates and implements updates to Info Source
  • Administers Privacy Impact Assessments
  • Review Harassment Reports
  • Manages the ATIP electronic management system
  • Develops internal procedures, policies and guidelines
  • Participates in forums for the ATIP Community, such as the Treasury Board Secretariat ATIP Community Meetings, Training and Annual Meetings.

The ATIP office is responsible for the implementation of any new Treasury Board Secretariat directives.

IV. Interpretation of statistical report

Annex B provides a summarized statistical report on the privacy requests received and processed by the National Research Council from 1 April 2013 to 31 March 2014.  This section provides an interpretation of the statistical report. 

During the fiscal year, NRC received eleven (11) new privacy requests. Two (2) requests were outstanding from the previous fiscal year for a total of thirteen (13) privacy requests to process in this fiscal year. During this reporting period, NRC completed the processing of a total of twelve (12) privacy requests.  One (1) request was carried forward into 2014‑2015.

Section 15 of the Privacy Act allows institutions to extend the legal deadline for processing a request. NRC invoked an extension in two (2) cases of the twelve (12) Privacy requests.  Meeting the original time limit of thirty days would have unreasonably interfered with the operations of the organization. In summary, out of the twelve (12) requests, nine (9) were completed within 30 days or less and two (2) took between 31 and 60 days to complete. One (1) request took between 181 and 365 days to complete.

The exemptions section of the Statistical Report is intended to identify the number of requests in cases where specific types of exemptions were invoked. NRC invoked exemptions pursuant to sections 26 and 27 of the Privacy Act.  Section 26 (information about another individual) was applied in three cases (3) and section 27 (solicitor‑client privilege) was applied in one (1) case.

The figures, as reflected in the chart below, indicate the number of requests received and processed over the past three years. The figures do not reflect requests processed informally or other queries that have been received in the ATIP office. NRC does expect that privacy requests and queries concerning privacy‑related matters will continue to represent a significant portion of the workload due to the ongoing organizational changes.

Number of requests received and processed

Long description of the number of requests received and processed follows
2011‑2012 2012‑2013 2013‑2014
received 8 15 11
completed 8 14 12
carried forward 11 12 1

The trends indicate a decrease in the number of privacy requests received, but the complexity of the requests has increased. As per the grid on the next page, the number of pages that had to be reviewed by the ATIP Unit has dramatically increased in the last three years. Due to the way the requests are written, the ATIP Unit is required to retrieve the records from more employees and operating units. In consequence, the analysts have to go through a large amount of paper, which is often duplicates and email chains.

Pages processed

Long description for pages processed follows
Pages processed
2011‑2012 926
2012‑2013 2582
2013‑2014 15715

Within the context of its roles and responsibilities, NRC’s ATIP office reviewed a total of seventy‑six (76) parliamentary questions received for the period of April 2013 to March 2014.

The Access to Information and Privacy Office has a tracking system that keeps track of requests received at NRC. This system is designed to follow the legislative deadlines. The ATIP Office also holds weekly meetings to discuss with the ATIP Coordinator about the active requests and the activities in which the ATIP Office is involved. There is no request for correction of personal information to be reported for the 2013‑2014 period.

The annual statistical report for the fiscal year 2013‑2014 is included at the end of this chapter, as Annex B Footnote 1.

V. Privacy‑related training and education

The ATIP office is committed to providing ongoing development and training to NRC’s employees.

During the fiscal year, six training sessions were offered. The first one was offered on 29 April 2013 to 24 people about ATIP and business information. The second was offered on 14 May 2013 about ATIP processes and legislative requirements. The third session was offered on 18 July 2013 to 24 people about ATIP and business information management. The fourth training session was given on 13 March 2014 to 30 participants about the basics of the Acts and best practices plus tips for avoiding the use of personal information. The fifth session of 24 March 2014 was given to 13 people about ATIP at NRC. Finally, the sixth training session was offered 27 March 2014 to a small group about ATIP at the NRC. All awareness sessions included information on the access to information legislation which has been accounted for in the Access to Information Act annual report.

ATIP employees continually work to sensitize and guide employees, third parties and requesters regarding the requirements of the Privacy Act by means of ongoing dialogue. During the reporting period, ATIP officers responded to inquiries from colleagues, where advice and guidance were provided on various subjects pertaining to Privacy legislation.

ATIP tools are available on NRC external and internal websites.

The ATIP Coordinator and Officers attend different training sessions offered by Treasury Board Secretariat.

VI. New procedures, guidelines and directives

NRC did not implement new and/or revised privacy policies, guidelines or procedures during the reporting period.

VII. Privacy complaints

During this fiscal year, NRC did not receive any privacy complaint.

VIII. Privacy impact assessment activities

In June 2013, NRC completed a Privacy Impact Assessment (PIA) for the new Concierge Service to be operated by the NRC Industrial Research Assistance Program (NRC‑IRAP). The PIA Report reviewed privacy risks associated with this new Service, which will assist small and medium size companies in accessing innovation resources and support programs via a single access point that combines on‑line, by phone and in person tools. The Concierge Service will progressively expand with information about programs and resources supplied by other private and public sector partner organizations. Feedback mechanisms will be implemented to monitor effectiveness and to continually improve services. The PIA Report identified the need for the Concierge Service to establish a unique PIB and Class of Records, and this recommendation is being implemented. There are no material privacy breaches to be reported for the 2013‑2014 period.

IX. Section 8(2)(m) disclosures

Paragraph 8(2)(m) allows for the disclosure of personal information when the public interest clearly outweighs any invasion of privacy or when the disclosure would benefit the individual. There were no disclosures pursuant to paragraph 8(2)(m) for the 2013‑2014 period.

Footnotes

Footnote 1

The accompanying Statistical Tables do not always present data reflecting the total number of requests as they often focus on specific subsets such as the cases that involved exclusions and exemptions; that only reported on closed requests; that report only on requests involving consultations and extensions; or those that list requests that involved the disclosure of all documents or a partial disclosure. Other differences between totals are due to reports that do not include cases when no records existed or when a request was abandoned.

Return to footnote 1 referrer

Annex A: Delegation order

Access to Information and Privacy Acts Delegation Order

The President of the National Research Council of Canada, pursuant to section 73 of the Access to Information Act and the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the person occupying on an acting basis the position, to exercise the powers and functions of the President as the head of a government institution, under the section of the Acts set out in the schedule opposite each position. This Designation Order supersedes all previous designation orders.

Schedule

Position Access to Information Act and Regulations Privacy Act and Regulations
Secretary General Full authority Full authority
Director, Governance Full authority Full authority
Access to Information and Privacy Coordinator Sections 7(1), 8(1), 9, 11(2) to (6), 12(2)(3), 26, 27(1) and (4), 28(1), (2) and (4), 29(1), 22, 37(4), 43(1), 44(2) Section 8(2)(j), 8(4), 8(5), 9(1), 9(4), 10, 14, 15, 17(2)(b), 18(2), 31, 35(1), 35(4), 36(3), 37(3), 51(2)(b)

Dated, at the City of Ottawa
this 18 day of Jan., 2012

John R. McDougall, ing.,
President of the National Research Council of Canada

Annex B: Statistical Report on the Privacy Act

Name of institution: National Research Council Canada

Reporting period: 4/1/2013 to 3/31/2014

PART 1 - Requests under the Privacy Act

Number of Requests
Received during reporting period 11
Outstanding from previous reporting period 2
Total 13
Closed during reporting period 12
Carried over to next reporting period 1

PART 2 – Requests closed during the reporting period

2.1 Disposition and completion time

Completion Time
Disposition of requests 1 to 15
days
16 to 30
days
31 to 60
days
61 to 120
days
121 to 180
days
181 to 365
days
More than 365
days
Total
All disclosed 2 2 0 0 0 0 0 4
Disclosed in part 0 1 2 0 0 1 0 4
All exempted 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0
No records exist 1 2 0 0 0 0 0 3
Request abandoned 1 0 0 0 0 0 0 1
Total 4 5 2 0 0 1 0 12

2.2 Exemptions

Section Number of requests
18(2) 0
19(1)(a) 0
19(1)(b) 0
19(1)(c) 0
19(1)(d) 0
19(1)(e) 0
19(1)(f) 0
20 0
22(1)(a)(i) 0
22(1)(a)(ii) 0
22(1)(a)(iii) 0
22(1)(b) 0
22(1)(c) 0
22(2) 0
22.1 0
22.2 0
22.3 0
23(a) 0
23(b) 0
24(a) 0
24(b) 0
25 0
26 3
27 1
28 0

2.3 Exclusions

Section Number of requests
69(1)(a) 0
69(1)(b) 0
69.1 0
70(1)(a) 0
70(1)(b) 0
70(1)(c) 0
70(1)(d) 0
70(1)(e) 0
70(1)(f) 0
70.1 0

2.4 Format of information released

Disposition Paper Electronic Other formats
All disclosed 4 0 0
Disclosed in part 4 0 0
Total 8 0 0

2.5 Complexity

2.5.1 Relevant pages processed and disclosed
Disposition of requests Number of pages processed Number of pages disclosed Number of requests
All disclosed 51 51 4
Disclosed in part 15664 7474 4
All exempted 0 0 0
All excluded 0 0 0
Request abandoned 0 0 1
2.5.2 Relevant pages processed and disclosed by size of requests
Disposition Less than 100 pages processed 101‑500 pages processed 501‑1000 pages processed 1001‑5000 pages processed More than 5000 pages processed
Number of Requests Pages disclosed Number of Requests Pages disclosed Number of Requests Pages disclosed Number of Requests Pages disclosed Number of Requests Pages disclosed
All disclosed 4 51 0 0 0 0 0 0 0 0
Disclosed in part 1 28 2 636 0 0 0 0 1 6810
All exempted 0 0 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0 0 0
Abandoned 0 0 0 0 0 0 0 0 0 0
Total 6 79 2 636 0 0 0 0 1 6810
2.5.3 Other complexities
Disposition Consultation
required
Legal Advice
Sought
Interwoven
Information
Other Total
All disclosed 0 0 0 0 0
Disclosed in part 1 1 0 1 3
All exempted 0 0 0 0 0
All excluded 0 0 0 0 0
Abandoned 0 0 0 0 0
Total 1 1 0 1 3

2.6 Deemed refusals

2.6.1 Reasons for not meeting statutory deadline
Number of requests closed past
the statutory deadline
Principal Reason
Workload External consultation Internal consultation Other
1 1 0 0 0
2.6.2 Number of days past deadline
Number of days past
deadline
Number of requests
past deadline where
no extension was taken
Number of requests
past deadline where
an extension was taken
Total
1 to 15 days 3 0 3
16 to 30 days 5 0 5
31 to 60 days 1 1 2
61 to 120 days 0 0 0
121 to 180 days 0 0 0
181 to 365 days 0 1 1
More than 365 days 0 0 0
Total 9 2 11

2.7 Requests for translation

Translation Requests Accepted Refused Total
English to French 0 0 0
French to English 0 0 0
Total 0 0 0

PART 3 – Disclosures under subsection 8(2)

Paragraph 8(2)(e) Paragraph 8(2)(m) Total
0 0 0

PART 4 – Requests for correction of personal information and notations

Number
Requests for correction received 0
Requests for correction accepted 0
Requests for correction refused 0
Notations attached 0

PART 5 – Extensions

5.1 Reasons for extensions and disposition of requests

Disposition of requests where an extension was taken 15(a)(i) Interference with operations 15(a)(ii) Consultation 15(b) Translation or conversion
Section 70 Other
All disclosed 0 0 0 0
Disclosed in part 2 0 0 0
All exempted 0 0 0 0
All excluded 0 0 0 0
No records exist 0 0 0 0
Request abandoned 0 0 0 0
Total 2 0 0 0

5.2 Length of extensions

Length of extensions 15(a)(i)Interference with operations 15(a)(ii)Consultation 15(b)Translation purposes
Section 70 Other
1 to 15 days 0 0 0 0
16 to 30 days 2 0 0 0
Total 2 0 0 0

PART 6 – Consultations received from other institutions and organizations

6.1 Consultations received from other government institutions and organizations

Consultations Other government institutions Number of pages to review Other organizations Number of pages to review
Received during the reporting period 0 0 0 0
Outstanding from the previous reporting period 0 0 0 0
Total 0 0 0 0
Closed during the reporting period 0 0 0 0
Pending at the end of the reporting period 0 0 0 0

6.2 Recommendations and completion time for consultations received from other government institutions

Recommendation Number of days required to complete consultation requests
1 to 15 days 16 to 30 days 31 to 60 days 61 to 120 days 121 to 180 days 181 to 365 days than 365 days Total
Disclose entirely 0 0 0 0 0 0 0 0
Disclose in part 0 0 0 0 0 0 0 0
Exempt entirely 0 0 0 0 0 0 0 0
Exclude entirely 0 0 0 0 0 0 0 0
Consult other institution 0 0 0 0 0 0 0 0
Other 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0

6.3 Recommendations and completion time for consultations received from other organizations

Recommendation Number of days required to complete consultation requests
1 to 15 days 16 to 30 days 31 to 60 days 61 to 120 days 121 to 180 days 181 to 365 days than 365 days Total
Disclose entirely 0 0 0 0 0 0 0 0
Disclose in part 0 0 0 0 0 0 0 0
Exempt entirely 0 0 0 0 0 0 0 0
Exclude entirely 0 0 0 0 0 0 0 0
Consult other institution 0 0 0 0 0 0 0 0
Other 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0

PART 7 – Completion time of consultations on Cabinet confidences

Number of days Number of responses received Number of responses received past deadline
1 to 15 0 0
16 to 30 0 0
31 to 60 0 0
61 to 120 0 0
121 to 180 0 0
181 to 365 0 0
More than 365 0 0
Total 0 0

PART 8 – Resources related to the Privacy Act

8.1 Costs
Expenditures Amount
Salaries $48,943
Overtime $0
Goods and Services $26,720
Contracts for privacy impact assessments $21,750
Professional services contracts $0
Other $4,970
Total $75,663
8.2 Human Resources
Resources Dedicated full‑time Dedicated part‑time Total
Full‑time employees 0.35 0.00 0.35
Part‑time and casual employees 0.00 0.00 0.00
Regional staff 0.00 0.00 0.00
Consultants and agency personnel 0.00 0.00 0.00
Students 0.00 0.00 0.00
Total 0.35 0.00 0.35
Date modified: