Annual Report on the Privacy Act 2021-2022

Table of Contents

• 1 Introduction
• 2 The Public Prosecution Service of Canada
• 3 The ATIP Office
  • 3.1 Organizational structure
• 4 Delegated authorities
• 5 Performance
  • 5.1 Requests received under the Privacy Act
    • 5.1.1 Number of requests
  • 5.2 Requests closed during the fiscal year
    • 5.2.1 Disposition of requests
    • 5.2.2 Number of pages processed
    • 5.2.3 Completion time
    • 5.2.4 Exemptions
    • 5.2.5 Exclusions
    • 5.2.6 Format of information released
    • 5.2.7 Complexity
    • 5.2.8 Deemed refusals
    • 5.2.9 Requests for translation
  • 5.3 Requests for correction of personal information and notations
  • 5.4 Extensions
  • 5.5 Consultations received from other institutions
    • 5.5.1 Number of consultations
    • 5.5.2 Sources of consultations
    • 5.5.3 Disposition and recommendations
    • 5.5.4 Completion time
  • 5.6 Consultations on Cabinet confidences
  • 5.7 Costs
• 6 Training and awareness activities
• 7 Policies, guidelines, procedures, and initiatives
  • 7.1 ATIP governance structure
  • 7.2 Information about Programs and Information Holdings
  • 7.3 Initiatives
  • 7.4 COVID-19 mitigation measures
• 8 Complaints and investigations
• 9 Monitoring compliance
• 10 Material privacy breaches
• 11 Privacy impact assessments
• 12 Public interest disclosures
• 13 Appendix A – Delegation order
• 14 Appendix B – Statistical report on the Privacy Act
• 15 Appendix C – Supplemental statistical report on the Access to Information Act and the Privacy Act

1 Introduction

The Privacy Act (the Act) came into force on July 1, 1983. The purpose of the Actis to protect the privacy of individuals with respect to personal information about themselves held by government institutions as well as to provide individuals with a right of access to that information.

The Public Prosecution Service of Canada (PPSC) became subject to the Actwhen it was established as an independent organization on December 12, 2006, with the coming into force of the Director of Public Prosecutions Act (Part 3 of the Federal Accountability Act).

Pursuant to section 72 of the Act, this 2021-2022 Annual Report on theAct has been prepared for tabling in the House of Commons and the Senate. This Report provides an analysis of the information contained in the PPSC's Statistical Report on theAct. In addition, it reports on emerging trends, training activities, internal policies, guidelines, and procedures with respect to the PPSC's administration of the Act.

2 The Public Prosecution Service of Canada

The PPSC's mandate is set out in the Director of Public Prosecutions Act (DPPA). The DPPA empowers the Director of Public Prosecutions (DPP), as Deputy Attorney General of Canada, to:

• Initiate and conduct federal prosecutions;
• Intervene in proceedings that raise a question of public interest that may affect the conduct of prosecutions or related investigations;
• Issue guidelines to federal prosecutors;
• Advise law enforcement agencies or investigative bodies on general matters relating to prosecutions and on particular investigations that may lead to prosecutions;
• Communicate with the media and the public on all matters that involve the initiation and conduct of prosecutions;
• Exercise the authority of the Attorney General of Canada in respect of private prosecutions; and
• Exercise any other power or carry out any other duty or function assigned by the Attorney General of Canada that is compatible with the office of the DPP.

The DPPA also empowers the DPP to:

• Initiate and conduct prosecutions under the Canada Elections Act; and
• Act, when requested by the Attorney General of Canada, in matters under the Extradition Act and the Mutual Legal Assistance in Criminal Matters Act.

The DPP has the rank and status of a deputy head of a department and, in this capacity, is responsible for the management of the PPSC as a distinct government institution.

3 The ATIP Office

The ATIP Office holds primary responsibility for the implementation and administration of the Privacy Act, along with the Access to Information Act (collectively known as ATIP). The Office deals directly with the public in relation to personal information requests, liaises with Offices of Primary Interest (the subject matter experts) to prepare responses, and serves as the centre of ATIP expertise within the PPSC.

The ATIP Officefulfills its responsibilities by:

• Processing requests for personal information in accordance with the Privacy Act, the Privacy Regulations (the Regulations), and the Treasury Board of Canada's policies, directives, and guidelines;
• Responding to consultations submitted by other federal government institutions or other levels of government on PPSC records being considered for release, including the review of solicitor-client privilege in records related to criminal proceedings;
• Providing advice to PPSC managers and employees regarding the application and interpretation of the Act, the Regulations, and Treasury Board policies and directives;
• Reviewing PPSC policies, procedures, and agreements as well as making recommendations to ensure that they comply with the requirements of the Act;
• Monitoring the PPSC's compliance with the Act, its Regulations, and Treasury Board policies and directives;
• Communicating with investigators of the Office of the Privacy Commissioner of Canada to resolve complaints filed against the PPSC;
• Reviewing documents relevant to proactive publication, such as briefing note titles and contracts over $10,000, prior to their publication on the PPSC's website, ensuring that they do not contain personal information;
• Delivering training sessions intended to familiarize the PPSC's managers and employees with the requirements of the Act, the Regulations, and Treasury Board policies and directives;
• Updating the PPSC's chapter of the federal government's Information About Programs and Information Holdings publication (formerly known as Info Source: Sources of Government and Employee Information);
• Submitting an annual statistical report on the administration of the Actto the Treasury Board of Canada Secretariat (TBS); and
• Preparing an annual reporton the administration of the Act for tabling in both Houses of Parliament.

3.1 Organizational structure

The Director General, Communications and Parliamentary Affairs (CPA), acts as the PPSC's ATIP Coordinator.

During the period from April 1, 2021, to March 31, 2022, the ATIP Office comprised a Manager, two Senior Advisors, two Advisors, and an ATIP Officer.

The following chart outlines the organizational structure of the ATIP Office on March 31, 2022:

4 Delegated authorities

Pursuant to section 73 of the Act, the head of a government institution may designate one or more officers or employees of that institution, by order, to exercise or perform any of the powers, duties, or functions of the head of the institution under the Act.

The DPP, as the "head of institution," has designated this authority to the Director General, CPA, as well as the Senior Director General, Corporate Services, and the ATIP Manager (Delegation Order in Appendix A). The ATIP Manager exercises this authority in the absence of the Director General, CPA. The Senior Director General, Corporate Services, exercises this authority in the absence of both the Director General, CPA, and the ATIP Manager.

5 Performance

The following section provides an overview of key data on the PPSC's performance for the fiscal year, as reflected in the 2021-2022 Statistical Report ontheAct in Appendix B of this report as well as the 2021-2022 Supplemental Statistical Report in Appendix C.

5.1 Requests received under the Privacy Act

5.1.1 Number of requests

The following chart illustrates this trend:

Note: As the PPSC was created on December 12, 2006, data for 2006-2007 only reflects a three-month period.

5.2 Requests closed during the fiscal year

5.2.1 Disposition of requests

The PPSC has responded to 78% of the 18 requests received in 2021-2022 or carried over from the previous period, 14 in total, which is one (1) fewer than the 15 requests closed in the previous fiscal year. The proportion of closed requests is also similar to the rate in earlier reporting periods.

The trend is described in the chart below, which sets out the closure rate from the past five fiscal years:

Four (4) requests remained outstanding as of March 31, 2022, and were carried forward to the next fiscal year, which is three (3) fewer than the number of outstanding requests at the end of the previous reporting period.

Of these four (4) requests, two (2) were received within the current fiscal year and were still within legislated timelines at the end of the same reporting period. The other active requests were received earlier, one (1) in 2020-2021 and the other in 2016-2017. Extensions to the initial 30-day statutory deadline were taken on both files to process a high volume of pages. Despite these extensions, further time is needed for processing and they are now past the extended deadline.

The disposition of requests closed in 2021-2022 is as follows:

Of the 14 requests closed in 2021-2022, records were partially disclosed in 10 cases. No records were disclosed in full. On average, 64% of requests closed over the past five reporting periods have resulted in a full or partial disclosure of records to applicants.

The four (4) remaining requests could not be processed because relevant records did not exist under the control of the PPSC. Where possible, applicants were advised of other government institutions that may have records and were provided with contact information accordingly.

There were no requests closed in 2021-2022 where records were all exempted or excluded, as was the case in the past two fiscal years.

5.2.2 Number of pages processed

For the 14 cases closed in 2021-2022, the PPSC processed 13,388 pages relevant to the requests, which is significantly more than the 1,273 pages processed for a similar number of requests closed in the previous period. The sharp increase is partially due to closing a single request relating to a prosecution that involved 6,148 pages. Additionally, there were three (3) other requests where more than a thousand pages of records were processed. Altogether, these four (4) requests accounted for nearly all of the pages processed over the past fiscal year (12,464 pages in total).

The PPSC ATIP Office also reviewed an additional 4,752 pages received from across the organization that were deemed to be not relevant to the requests and were therefore not included as part of the responses.

The following is a summary of the relevant pages processed by the PPSC over the last five fiscal years:

5.2.3 Completion time

Of those closed in 2021-2022, 10 requests were processed within the initial 30-day statutory deadline, representing 71% of requests. This is two (2) fewer than those closed within the same timeframe in 2020-2021.

The proportion of requests closed within 30 days of receipt has steadily increased since the 2017-2018 reporting period, where fewer requests were closed within that timeframe due to a shortage of human resources in the ATIP Office. This trend is demonstrated in the chart that follows:

Over the four (4) most recent fiscal years, the PPSC has processed 74% of closed requests within the first 30 days, on average.

The following table is a breakdown of the number of days taken to respond to requests in 2021-2022:

Note: Each percentage has been rounded to the nearest whole value. For this reason, the percentages set out in the chart do not add up to an exact 100%.

5.2.4 Exemptions

An individual's right of access to his or her personal information is subject to limited and specific exceptions. Limitations to the right of access are set out in sections 18 through 28 of the Act.

The following is a breakdown of the exemptions applied by the PPSC in 2021-2022 for closed requests:

Over the last five fiscal years, sections 26 (information about another individual) and 27 (solicitor-client privilege) of the Act have been most often invoked by the PPSC when exempting information from disclosure. This reflects the mandate of the PPSC to conduct federal prosecutions, which often involve personal information about individuals, and to provide legal advice to law enforcement agencies and investigative bodies on matters relating to prosecutions.

5.2.5 Exclusions

Records or parts thereof to which the Actdoes not apply are considered to be "excluded." Pursuant to section 69, the Act does not apply to library or museum material preserved solely for public record or material placed in Library and Archives Canada. Records containing confidences of the Queen's Privy Council for Canada, also known as Cabinet confidences, and which have been in existence for less than 20 years are also excluded from the Act pursuant to section 70.

The PPSC did not invoke any exclusions in 2021-2022.

5.2.6 Format of information released

Information was released electronically for all 10 requests where the PPSC partially disclosed records in 2021-2022.

Overall, in the last five fiscal years, 89% of releases have been in electronic format, whether by email or compact disk, while 11% have been paper-based.

The proportion of electronic to paper-based releases of records from year to year is as follows:

5.2.7 Complexity

Due to the nature of the PPSC's work, processing requests can be challenging, and requests are regularly deemed "complex" based on a number of factors:

•  Records held by the PPSC often contain information relating to criminal or regulatory investigations or prosecutions that also frequently involve other organizations at the federal, provincial or territorial level. This was the main source of complexity for one (1) case closed in 2021-2022.
• The applicant's personal information can be intermixed with that of another individual. In these cases, section 26 of the Act could be applied to protect the personal information of other individuals. Intermixed personal information was the main complicating factor in five (5) requests closed in 2021-2022, as was the case in the previous fiscal year.
• Regarding other requests closed during the fiscal year, four (4) were deemed complex primarily due to a need to retrieve records from regions across the country. In general, regional searches most frequently involved the Ontario Regional Office, which was tasked four (4) times in the current period.

5.2.8 Deemed refusals

Requests that are not closed within the initial 30-day statutory deadline or within a timeframe covered by an extension provided by the Act are referred to as "deemed refusals." Further information on the circumstances in which an extension to the original deadline is permitted by the Act is available in section 5.4 (Extensions) of this report.

The vast majority of the 14 requests closed in the reporting period were responded to within the initial deadline or within an extended timeframe, representing 86% of cases.

Two (2) requests, involving records related to prosecutions, were closed as deemed refusals in 2021-2022, one (1) more than in the previous period. These delays were principally due to interference with operations and a high workload – both files combined represented 61% of the pages processed in the current period.

5.2.9 Requests for translation

During the 2021-2022 fiscal year, the PPSC did not receive any requests from applicants to translate records from one official language to the other. This is consistent with the last five fiscal years.

5.3 Requests for correction of personal information and notations

Paragraph 12(2)(a) of the Actprovides every individual that is given access to their personal information the right to request correction if:

5.4 Extensions

Paragraph 15(a) of the Act allows for an extension of the initial statutory deadline for a maximum of 30 additional days in cases where meeting the original deadline would unreasonably interfere with the operations of the government institution processing the request, or when consultations with other government institutions are necessary and cannot be reasonably completed within the original deadline.

5.5 Consultations received from other institutions

5.5.1 Number of consultations

The PPSC received one (1) consultation from another government institution for processing under the Act in 2021-2022, as was the case in 2020-2021. No consultations were carried over from the previous period.

The PPSC has received 121 consultations in total since December 12, 2006. There was a sharp increase in the number of consultations in 2010-2011, but since then and especially in recent fiscal years, the number of consultations received by the PPSC has generally declined.

The following chart illustrates this trend:

Note: As the PPSC was created on December 12, 2006, data for 2006-2007 only reflects a three-month period.

5.5.2 Sources of consultations

The consultation received in 2021-2022 originated from the Public Health Agency of Canada, which is also subject to the Act. This is not typical of personal information consultations undertaken with the PPSC. Instead, the Royal Canadian Mounted Police, the Canada Border Services Agency, and the Ministry of Alberta Justice and the Solicitor General have been the most frequent sources of consultations over the last five fiscal years.

5.5.3 Disposition and recommendations

The PPSC responded to the one (1) consultation received in 2020-2021. Accordingly, there were no consultations outstanding as of March 31, 2022, and carried forward to the next fiscal year.

The PPSC processed six (6) pages in closing the consultation, which is a significant decrease from the 686 pages processed in 2020-2021.

The number of pages processed over the last five fiscal periods have considerably fluctuated from year to year, which is demonstrated in the following chart:

For the consultation completed in 2021-2022, the PPSC recommended that the records be disclosed in part. Over the last five fiscal years, the PPSC has never recommended full exemption of the records sent in consultation.

5.5.4 Completion time

The consultation closed in 2021-2022 was completed within the first 30 days of receipt.

Over the last five fiscal years, half of the consultations received were completed within this timeframe.

5.6 Consultations on Cabinet confidences

No consultations regarding section 70 (Cabinet confidences) of the Actwere carried out during fiscal year 2021-2022.

5.7 Costs

In the 2021-2022 fiscal year, the PPSC spent a total of $219,501 administering theAct, of which salaries accounted for nearly all expenditures at $218,492, while goods and services accounted for the remaining $1,009.

No overtime expenditures were incurred during this period.

6 Training and awareness activities

No formal ATIP awareness sessions were delivered in 2021-2022.

Presentations were delivered in the recent past to raise awareness of corporate responsibilities regarding ATIP. These materials continue to be made available to all PPSC employees through the internal website. Communiqués on ATIP topics were also distributed throughout the year as part of the PPSC's corporate newsletters, which included promoting Data Privacy Day 2022.

ATIP personnel provided informal learning to employees on an ad hoc basis regarding the processing of personal information requests and regularly provided advice to PPSC officials on the interpretation of the Act, including the appropriate collection, use, disclosure, and safeguarding of personal information.

7 Policies, guidelines, procedures, and initiatives

7.1 ATIP governance structure

The PPSC ATIP Governance Structure was approved by the PPSC's Executive Council in October 2011. It outlines the reporting relationships within the PPSC and establishes clear responsibilities for decision-making for the purposes of administering the Act.

7.2 Information about Programs and Information Holdings

Information about Programs and Information Holdings (formerly known as Info Source: Sources of Government and Employee Information) is published on the Government of Canada's canada.ca website. It provides information about the functions, programs, activities, and related information holdings of government institutions subject to the Access to Information Act and the Privacy Act.

It also serves as the Government's repository of personal information banks, which outline how personal information is collected, used, disclosed, retained, and disposed of in order to administer the Government's programs and services.

At least once a year, the PPSC ATIP Office reviews and updates information, if necessary, about the PPSC's activities and information holdings in the publication. No updates were required in 2021-2022.

7.3 Initiatives

The PPSC did not implement any new initiatives relating to privacy during the 2021-2022 fiscal year. The organization expects to develop revised privacy policies and procedures in upcoming years in preparation for updated government-wide directives as well as the ongoing modernization of ATIP digital services.

Privacy tools were updated as needed in 2021-2022, such as procedural manuals for PPSC officials, so that the organization may continue to process requests efficiently and protect personal information in compliance with the Act and Treasury Board policies and directives.

7.4 COVID-19 mitigation measures

The ongoing COVID-19 pandemic continues to present a unique challenge for the ATIP Office. In response to emergency public health measures put in place at the end of the 2019-2020 fiscal period, the Office had transferred the majority of its operations to a remote working environment.

As the frequency of total lockdowns declined and more targeted restrictions on business activities were implemented within the community to manage later pandemic case surges, ATIP Office staff were authorized to return to work onsite based on operational requirements. Minor processing delays sometimes occurred, dependent on the volume of records involved or when staff could obtain prior approval to work onsite. Further information on operational capacity is available in the 2021-2022 Supplemental Statistical Report in Appendix C of this report.

While the ATIP Office experienced some limitations in managing operations remotely, every effort was made to ensure applicants received complete responses within established timelines.

8 Complaints and investigations

Decisions made under the Actare subject to a two-tiered system of review. This ensures government institutions' compliance with their privacy protection obligations as well as respect for applicants' right of access to their personal information and fair treatment. The first level of review is a formal complaint made to the Privacy Commissioner. The second level is an application for judicial review to the Federal Court.

The PPSC reviews the outcomes of all Office of the Privacy Commissioner (OPC) investigations and incorporates lessons learned into business processes, where appropriate.

During the 2021-2022 fiscal year, one (1) new complaint investigation was opened against the PPSC and closed during the same period. The maximum extension permitted under the Act was taken to process the large volume of pages relevant to the request under complaint. Additional time was then needed beyond the extended timeframe to manage the workload and the applicant filed a complaint with the OPC on account of the delay. During the course of the investigation, the PPSC released the relevant records to the applicant. The OPC closed their investigation accordingly, deeming the complaint to be well-founded and resolved.

There was one (1) complaint investigation that remained outstanding as of March 31, 2022, and carried forward to the next fiscal year. This complaint was opened in 2018-2019.

The Commissioner did not undertake any privacy audits involving the PPSC in 2021-2022. There were also no applications for judicial review filed with the Federal Court during this same period.

9 Monitoring compliance

The ATIP Office maintains a comprehensive statistical reporting and performance measurement system. The ATIP Manager meets with the ATIP Coordinator weekly on the status of active requests, complaints, and any issues that have arisen.

The ATIP Office also provides reports to the PPSC's senior management on an ad hoc basis about its activities, caseload, investigations, and trends related to privacy.

10 Material privacy breaches

A material privacy breach involves improper or unauthorized collection, use, disclosure, retention, or disposal of sensitive personal information, which could be reasonably expected to cause serious injury or harm to the individual to whom it relates. These cases are to be reported to the TBS and the OPC, as required by the Treasury Board's Directive on Privacy Practices.

The ATIP Office did not receive any reports of material privacy breaches having occurred at the PPSC in 2021-2022.

11 Privacy impact assessments

A privacy impact assessment (PIA) is a tool that assists a government institution in meeting its privacy responsibilities regarding the management of personal information. Institutions initiate PIAs when assessing the privacy implications of new or substantially modified programs and activities involving personal information.

The PPSC did not complete any PIAs in 2021-2022.

12 Public interest disclosures

Subsection 8(2) of theAct describes the circumstances under which personal information under the control of a government institution may be disclosed without the individual's consent.

In particular, disclosures without consent may be made in the public interest, pursuant to paragraph 8(2)(m) of the Act. The PPSC did not make any such disclosures during the current fiscal year.

13 Appendix A – Delegation order

The Director of Public Prosecutions, pursuant to section 73 of the Access to Information Act and section 73 of the Privacy Act, as they existed prior to June 21, 2019, and pursuant to the current subsection 95(1) of the Access to Information Act and subsection 73(1) of the Privacy Act, hereby designates to the persons holding the positions set out in the schedule hereto the powers, duties and functions of the Director of Public Prosecutions as the head of the Office of the Director of Public Prosecutions, under the under the provisions of the Acts and related regulations set out in the schedule opposite each position. This designation replaces all previous delegation orders.

Schedule

Dated, at the City of Ottawa, this 22 ^nd day of February, 2021.

(original signed by)

Kathleen Roussel
Director of Public Prosecutions

14 Appendix B – Statistical report on the Privacy Act

Name of institution: Public Prosecution Service of Canada

Reporting period: 2021-04-01 to 2022-03-31

Section 1: Requests Under the Privacy Act

Section 2: Informal requests

Section 3: Requests Closed During the Reporting Period

3.5 Complexity

3.6 Closed requests

3.7 Deemed refusals

Section 4: Disclosures Under Subsections 8(2) and 8(5)

Section 5: Requests for Correction of Personal Information and Notations

Section 6: Extensions

Section 7: Consultations Received from Other Institutions and Organizations

Section 8 – Completion Time of Consultations on Cabinet Confidences

Section 9 – Complaints and Investigations Notices Received

Section 10 – Privacy Impact Assessments (PIAs)

Section 11 – Material Privacy Breaches

Section 12 – Resources related to the Privacy Act

Note: Enter values to three decimal places.

15 Appendix C – Supplemental statistical report on the Access to Information Act and the Privacy Act

Name of institution: Public Prosecution Service of Canada

Reporting period: 2021-04-01 to 2022-03-31

Section 1: Capacity to Receive Requests

Section 2: Capacity to Process Records

Section 3: Open Requests and Complaints Under the Access to Information Act

Row 8, Col. 3 of Section 3.1 must equal Row 7, Col. 1 of S 2021-2022 Statistical Report on the Access to Information

Section 4: Open Requests and Complaints Under the Privacy Act

Row 8, Col. 3 of Section 4.1 must equal Row 7, Col. 1 of S 2021-2022 Statistical Report on the Privacy Act

Section 5: Social Insurance Number (SIN)

Date modified:

2022-11-07