Annual Report on the Privacy Act 2022-2023

Table of Contents

• 1 Introduction
• 2 The Public Prosecution Service of Canada
• 3 The ATIP Office
  • 3.1 Organizational structure
• 4 Delegated authorities
• 5 Performance
  • 5.1 Requests received under the Privacy Act
    • 5.1.1 Number of requests
  • 5.2 Requests closed during the fiscal year
    • 5.2.1 Disposition of requests
    • 5.2.2 Number of pages processed
    • 5.2.3 Completion time
    • 5.2.4 Exemptions
    • 5.2.5 Exclusions
    • 5.2.6 Format of information released
    • 5.2.7 Complexity
    • 5.2.8 Deemed refusals
    • 5.2.9 Requests for translation
  • 5.3 Requests for correction of personal information and notations
  • 5.4 Extensions
  • 5.5 Consultations received from other institutions
    • 5.5.1 Number of consultations
    • 5.5.2 Sources of consultations
    • 5.5.3 Disposition and recommendations
    • 5.5.4 Completion time
  • 5.6 Consultations on Cabinet confidences
  • 5.7 Costs
• 6 Training and awareness activities
• 7 Policies, guidelines, procedures, and initiatives
  • 7.1 ATIP governance structure
  • 7.2 Info Source
  • 7.3 Initiatives to improve privacy
  • 7.4 COVID-19 mitigation measures
• 8 Complaints and investigations
• 9 Monitoring compliance
• 10 Material privacy breaches
• 11 Privacy impact assessments
• 12 Public interest disclosures
• 13 Appendix A – Delegation order
• 14 Appendix B – Statistical report on the Privacy Act
• 15 Appendix C – Supplemental statistical report on the Access to Information Act and the Privacy Act

1 Introduction

The Privacy Act (the Act) came into force on July 1, 1983. The purpose of the Actis to protect the privacy of individuals with respect to personal information about themselves held by government institutions as well as to provide individuals with a right of access to that information.

The Public Prosecution Service of Canada (PPSC) became subject to the Actwhen it was established as an independent organization on December 12, 2006, with the coming into force of the Director of Public Prosecutions Act (Part 3 of the Federal Accountability Act).

Pursuant to section 72 of the Act, this 2022-2023 Annual Report on theAct has been prepared for tabling in the House of Commons and the Senate. This Report provides an analysis of the information contained in the PPSC's Statistical Report on theAct. In addition, it reports on emerging trends, training activities, internal policies, guidelines, and procedures with respect to the PPSC's administration of the Act.

2 The Public Prosecution Service of Canada

The PPSC's mandate is set out in the Director of Public Prosecutions Act (DPPA). The DPPA empowers the Director of Public Prosecutions (DPP), as Deputy Attorney General of Canada, to:

• Initiate and conduct federal prosecutions;
• Intervene in proceedings that raise a question of public interest that may affect the conduct of prosecutions or related investigations;
• Issue guidelines to federal prosecutors;
• Advise law enforcement agencies or investigative bodies on general matters relating to prosecutions and on particular investigations that may lead to prosecutions;
• Communicate with the media and the public on all matters that involve the initiation and conduct of prosecutions;
• Exercise the authority of the Attorney General of Canada in respect of private prosecutions; and
• Exercise any other power or carry out any other duty or function assigned by the Attorney General of Canada that is compatible with the office of the DPP.

The DPPA also empowers the DPP to:

• Initiate and conduct prosecutions under the Canada Elections Act; and
• Act, when requested by the Attorney General of Canada, in matters under the Extradition Act and the Mutual Legal Assistance in Criminal Matters Act.

The DPP has the rank and status of a deputy head of a department and, in this capacity, is responsible for the management of the PPSC as a distinct government institution.

3 The ATIP Office

The ATIP Office holds primary responsibility for the implementation and administration of the Privacy Act, along with the Access to Information Act (collectively known as ATIP). The Office deals directly with the public in relation to personal information requests, liaises with Offices of Primary Interest (the subject matter experts) to prepare responses, and serves as the centre of ATIP expertise within the PPSC.

The ATIP Officefulfills its responsibilities by:

• Processing requests for personal information in accordance with the Privacy Act, the Privacy Regulations (the Regulations), and the Treasury Board of Canada's policies, directives, and guidelines;
• Responding to consultations submitted by other federal government institutions or other levels of government on PPSC records being considered for release, including the review of solicitor-client privilege in records related to criminal proceedings;
• Providing advice to PPSC managers and employees regarding the application and interpretation of the Act, the Regulations, and Treasury Board policies and directives;
• Reviewing PPSC policies, procedures, and agreements as well as making recommendations to ensure that they comply with the requirements of the Act;
• Monitoring the PPSC's compliance with the Act, its Regulations, and Treasury Board policies and directives;
• Communicating with investigators of the Office of the Privacy Commissioner of Canada to resolve complaints filed against the PPSC;
• Reviewing documents relevant to proactive publication prior to their publication on the PPSC's website, ensuring that they do not contain personal information;
• Delivering training sessions intended to familiarize the PPSC's managers and employees with the requirements of the Act, the Regulations, and Treasury Board policies and directives;
• Updating the PPSC's chapter of the federal government's publication known as Info Source: Sources of Government and Employee Information;
• Submitting an annual statistical report on the administration of the Actto the Treasury Board of Canada Secretariat (TBS); and
• Preparing an annual reporton the administration of the Act for tabling in both Houses of Parliament.

3.1 Organizational structure

The Director General, Communications and Parliamentary Affairs (CPA), acts as the PPSC's ATIP Coordinator. The Director of the ATIP Office reports to the Director General, CPA.

During the period from April 1, 2022, to March 31, 2023, the ATIP Office comprised the Director, two (2) Senior Advisors, two (2) Advisors, and one (1) ATIP Officer. There were no consultants during this time. The positions of one of the Advisors and the ATIP Officer were vacant at the beginning of the fiscal year. They were filled during the second half of the reporting period.

Section 73.1 of the Act allows for the PPSC to exchange ATIP services with another government institution within the same ministerial portfolio. There were no such service agreements undertaken during this period.

The following chart outlines the organizational structure of the ATIP Office on March 31, 2023:

4 Delegated authorities

Pursuant to section 73 of the Act, the head of a government institution may designate one or more officers or employees of that institution, by order, to exercise or perform any of the powers, duties, or functions of the head of the institution under the Act.

The DPP, as the "head of institution," has designated this authority to the Director General, CPA, as well as the Senior Director General, Corporate Services, and the ATIP Director (Delegation Order in Appendix A). The ATIP Director exercises this authority in the absence of the Director General, CPA. The Senior Director General, Corporate Services, exercises this authority in the absence of both the Director General, CPA, and the ATIP Director.

5 Performance

The following section provides an overview of key data on the PPSC's performance for the fiscal year, as reflected in the 2022-2023 Statistical Report ontheAct in Appendix B of this report as well as the 2022-2023 Supplemental Statistical Report in Appendix C.

5.1 Requests received under the Privacy Act

5.1.1 Number of requests

Note: As the PPSC was created on December 12, 2006, data for 2006-2007 only reflects a three-month period.

5.2 Requests closed during the fiscal year

5.2.1 Disposition of requests

The PPSC responded to 17 of the 19 requests received in 2022-2023 or carried over from the previous year, three (3) more than those closed during the last reporting period.

The proportion of requests that are closed in a given year has increased recently. The trend is described in the chart below, which sets out the closure rate from the past five fiscal years:

Two (2) requests remained outstanding as of March 31, 2023, and were carried forward to the next fiscal year, which is fewer than the four (4) requests outstanding at the end of the previous year.

The requests still active at the end of the 2022-2023 reporting period were received in earlier years, one (1) in 2020-2021 and the other in 2016-2017. Extensions to the initial 30-day statutory deadline were taken on both files to process a high volume of pages. Despite these extensions, further time is needed for processing and they are now past the extended deadline.

The disposition of requests closed in 2022-2023 is as follows:

Of the 17 requests closed in 2022-2023, records were disclosed in full or in part in seven (7) cases. On average, 63% of requests closed over the past five reporting periods have resulted in a full or partial disclosure of records to applicants.

In 2022-2023, the PPSC closed the following requests which did not result in the disclosure of any records:

No records exist

Five (5) requests could not be processed because relevant records under the control of the PPSC did not exist. Where possible, applicants were advised of other government institutions that may have records and were provided with contact information accordingly.

Abandoned

Three (3) requests were abandoned by applicants. In most abandoned cases, clarification is needed from the applicants in order to process their requests. When the applicants do not provide clarification, the requests are considered to be abandoned. In other cases, the applicants choose to abandon their requests.

All exempted

Records were exempted entirely in the remaining two (2) cases. These requests involved confidential records relevant to an anticipated prosecution and which were obtained as part of an ongoing criminal investigation.

5.2.2 Number of pages processed

For the 17 cases closed in 2022-2023, the PPSC processed 3,033 pages relevant to the requests, which is significantly less than the 13,388 pages processed in the previous period. The high volume at that time was partially due to a handful of requests representing nearly all of the pages processed that year. In contrast, only one (1) request in 2022-2023 involved more than 1,000 pages.

The PPSC ATIP Office also reviewed an additional 6,802 pages received from across the organization that were deemed not relevant to the requests and were therefore not included as part of the responses.

The following is a summary of the relevant pages processed by the PPSC over the last five fiscal years:

5.2.3 Completion time

Of those 17 requests closed in 2022-2023, 12 were processed within the initial 30-day statutory deadline, representing 71% of requests. This is two (2) more than the number closed within the same timeframe in 2021-2022.

The proportion of requests closed within 30 days of receipt has fluctuated in the last five fiscal years. On average, the PPSC has processed 74% of requests within that timeframe. The rate slowly increased since 2018-2019, only to dip further in the past two periods. This year's decline could be attributed to reduced human resources at the beginning of the fiscal year as well as the highest number of access to information requests ever received at the PPSC during the same period.

The overall trend is demonstrated in the chart that follows:

The following table is a breakdown of the number of days taken to respond to requests in 2022-2023:

5.2.4 Exemptions

An individual's right of access to his or her personal information is subject to limited and specific exceptions. Limitations to the right of access are set out in sections 18 through 28 of the Act.

The following is a breakdown of the exemptions applied by the PPSC in 2022-2023 for closed requests:

Over the last five fiscal years, sections 26 (information about another individual) and 27 (solicitor-client privilege) of the Act have been most often invoked by the PPSC when exempting information from disclosure. This reflects the mandate of the PPSC to conduct federal prosecutions, which often involve personal information about individuals, and to provide legal advice to law enforcement agencies and investigative bodies on matters relating to prosecutions.

5.2.5 Exclusions

Records or parts thereof to which the Actdoes not apply are considered to be "excluded." Pursuant to section 69, the Act does not apply to library or museum material preserved solely for public record or material placed in Library and Archives Canada. Records containing confidences of the King's Privy Council of Canada, also known as Cabinet confidences, and which have been in existence for less than 20 years are also excluded from the Act pursuant to section 70.

The PPSC did not invoke any exclusions in 2022-2023.

5.2.6 Format of information released

Information was released electronically for all seven (7) requests where the PPSC fully or partially disclosed records in 2022-2023.

Overall, in the last five fiscal years, 94% of releases have been in electronic format, whether by email or compact disk, while 6% have been paper-based.

The proportion of electronic to paper-based releases of records from year to year is as follows:

5.2.7 Complexity

Due to the nature of the PPSC's work, processing requests can be challenging, and requests are regularly deemed "complex" based on a number of factors:

• The applicant's personal information can be intermixed with that of another individual. In these cases, section 26 of the Act could be applied to protect the personal information of other individuals. Intermixed personal information was the main complicating factor in six (6) requests closed in 2022-2023, similar to previous years.
• Legal advice may also be sought by the ATIP Office, which was the case for two (2) other requests closed in 2022-2023.

Adding to the complexity, many of these requests also required that the PPSC retrieve records from regions across the country. In general, regional searches most frequently involved the Quebec Regional Office, which was tasked three (3) times in the current period.

5.2.8 Deemed refusals

Requests that are not closed within the initial 30-day statutory deadline or within a timeframe covered by an extension provided by the Act are referred to as "deemed refusals." Further information on the circumstances in which an extension to the original deadline is permitted by the Act is available in section 5.4 (Extensions) of this report.

The majority of the 17 requests closed in 2022-2023 were responded to within the initial deadline or within an extended timeframe, representing 82% of cases.

Three (3) requests were closed as deemed refusals, one (1) more than in the previous period. These delays were principally due to a high overall workload among ATIP staff as well as an unexpectedly lengthy consultation undertaken with another government institution. In general, extensions to the initial statutory deadline were taken in two (2) of the cases closed as deemed refusals but each required more time to process than the maximum 30 additional days allowed under the Act.

5.2.9 Requests for translation

During the 2022-2023 fiscal year, the PPSC did not receive any requests from applicants to translate records from one official language to the other. This is consistent with the last five fiscal years.

5.3 Requests for correction of personal information and notations

5.4 Extensions

Paragraph 15(a) of the Act allows for an extension of the initial statutory deadline for a maximum of 30 additional days in cases where meeting the original deadline would unreasonably interfere with the operations of the government institution processing the request, or when consultations with other government institutions are necessary and cannot be reasonably completed within the original deadline.

The PPSC took four (4) extensions to process requests closed during the 2022-2023 reporting period, one (1) more than the previous period.

The following table summarizes the length and reasons for the extensions:

5.5 Consultations received from other institutions

5.5.1 Number of consultations

The PPSC received one (1) consultation from another government institution for processing under the Act in 2022-2023, as was the case in the last two fiscal years. No consultations were carried over from the previous period.

The PPSC has received 122 consultations in total since December 12, 2006. There was a sharp increase in the number of consultations in 2010-2011, but since then and especially in recent fiscal years, the number of consultations received by the PPSC has generally declined.

The following chart illustrates this trend:

Note: As the PPSC was created on December 12, 2006, data for 2006-2007 only reflects a three-month period.

5.5.2 Sources of consultations

The consultation received in 2022-2023 originated from the Canada Revenue Agency, which is also subject to the Act and has been an occasional source of personal information consultations received by the PPSC in recent years.

5.5.3 Disposition and recommendations

The PPSC responded to the one (1) consultation received in 2022-2023. Accordingly, there were no consultations outstanding as of March 31, 2023.

The PPSC processed 444 pages to respond to the consultation. In comparison, only six (6) pages were processed in 2021-2022.

The number of pages processed over the last five fiscal periods has considerably fluctuated from year to year, which is demonstrated in the following chart:

For the consultation completed in 2022-2023, the PPSC recommended that the records be disclosed in part. Over the last five fiscal years, the PPSC has never recommended full exemption of records sent in consultation.

5.5.4 Completion time

The consultation closed in 2022-2023 was completed within 38 days of receipt.

Over the last five fiscal years, half of the consultations received were completed within the first 30 days.

5.6 Consultations on Cabinet confidences

No consultations regarding section 70 (Cabinet confidences) of the Actwere carried out during fiscal year 2022-2023.

5.7 Costs

In the 2022-2023 fiscal year, the PPSC spent a total of $193,651 administering theAct, of which salaries accounted for nearly all expenditures at $192,070, while goods and services accounted for the remaining $1,581.

No overtime expenditures were incurred during this period.

6 Training and awareness activities

Two (2) formal awareness sessions occurred in 2022-2023. One (1) was a general overview of ATIP responsibilities delivered to legal counsels at the PPSC Headquarters. The other (1) concerned security and privacy breaches. This session was delivered jointly to the PPSC executive by the ATIP Office, Security Services and the Information Management team. The presentation served as a reminder of every employee's responsibility to safeguard material classified as "Protected C," which is information that poses the gravest risk of harm or injury to individuals should the material be improperly handled or breached. An overview of ATIP Office activities was also presented to the PPSC's new Senior Director General, Corporate Services, during the same period.

Presentations were delivered in the past to raise awareness of corporate responsibilities regarding ATIP. These materials continue to be made available to all PPSC employees through the internal website.

ATIP personnel provided informal learning to employees on an ad hoc basis regarding the processing of personal information requests and regularly provided advice to PPSC officials on the interpretation of the Act, including the appropriate collection, use, disclosure, and safeguarding of personal information.

7 Policies, guidelines, procedures, and initiatives

7.1 ATIP governance structure

The PPSC ATIP Governance Structure was approved by the PPSC's Executive Council in October 2011. It outlines the reporting relationships within the PPSC and establishes clear responsibilities for decision-making for the purposes of administering the Act.

7.2 Info Source

Info Source: Sources of Government and Employee Information is published on the Government of Canada's canada.ca website. It provides information about the functions, programs, activities, and related information holdings of government institutions subject to the Access to Information Act and the Privacy Act.

It also serves as the Government's repository of personal information banks, which outline how personal information is collected, used, disclosed, retained, and disposed of in order to administer the Government's programs and services.

At least once a year, the PPSC ATIP Office reviews and updates information, if necessary, about the PPSC's activities and information holdings in the publication. No updates were required in 2022-2023.

7.3 Initiatives to improve privacy

During the 2022-2023 fiscal year, the PPSC ATIP Office streamlined internal procedures to reduce the levels of administrative approval needed to informally release personal information. These steps were taken to empower senior ATIP staff with decision-making authority outside of the PPSC's ATIP Delegation Order. Additionally, the process improvements were needed so that the organization may respond to all types of requests more efficiently, particularly in light of the record number of formal access to information requests received during the reporting period.

The PPSC also expects to develop revised policies and procedures in coming years in preparation for updated directives supporting the Act and the ongoing modernization of ATIP digital services.

7.4 COVID-19 mitigation measures

The COVID-19 pandemic did not affect ATIP operations in 2022-2023. The ATIP Office had adapted its business processes in previous years so no additional measures were needed to mitigate the impact of the pandemic on services provided to request applicants.

Further information on operational capacity during the pandemic is available in the 2022-2023 Supplemental Statistical Report in Appendix C of this report.

8 Complaints and investigations

Decisions made under the Actare subject to a two-tiered system of review. This ensures government institutions' compliance with their privacy protection obligations as well as respect for applicants' right of access to their personal information and fair treatment. The first level of review is a formal complaint made to the Privacy Commissioner. The second level is an application for judicial review to the Federal Court.

The PPSC reviews the outcomes of all Office of the Privacy Commissioner (OPC) investigations and incorporates lessons learned into business processes, where appropriate.

No new complaints investigations were formally opened during the 2022-2023 fiscal year, no investigations were closed, or none were outstanding as of March 31, 2023.

The Commissioner did not undertake any privacy audits involving the PPSC in 2022-2023. There were also no applications for judicial review filed with the Federal Court during this same period.

9 Monitoring compliance

The ATIP Office maintains a comprehensive statistical reporting and performance measurement system to track the processing of formal requests, informal requests, and consultations received by the PPSC.

Each ATIP staff member is responsible for monitoring the time taken to process files that they are assigned on a regular basis, while the Senior ATIP Advisors meet with the ATIP Director twice a week to review timelines and address challenges that could affect the PPSC's ability to meet its legal obligations under the Act. The ATIP Director meets weekly with the ATIP Coordinator on the status of active requests, complaints, and any issues that have arisen.

When records originating from or involving another institution are reviewed, the ATIP Coordinator, with the support of the ATIP Office, assesses whether a consultation is required. The factors under consideration in the exercise of discretion to consult depend on the circumstances of each file. These factors include cases where disclosure is contemplated, whether exemptions or exclusions are applicable, how similar records from past requests were processed, the expertise of the ATIP Office and other PPSC officials in the subject matter, as well as the expected timelines for receiving a response to the consultation. In this way, the PPSC aims to limit consultations so that requests are responded to within the shortest timelines possible.

The ATIP Office also provides reports to the PPSC's senior management on an ad hoc basis about its activities, caseload, performance metrics, and privacy trends. In addition to reporting, the Office advises various PPSC officials on appropriate privacy protections to be included in contracts and information sharing agreements, on request.

The PPSC did not undertake a review in 2022-2023 to assess the feasibility of making frequently requested personal information available through informal means outside of the ATIP Office context.

10 Material privacy breaches

A privacy breach involves improper or unauthorized collection, use, disclosure, retention, or disposal of sensitive personal information.

The ATIP Office received seven (7) privacy breach reports in 2022-2023, three (3) of which were considered to be material breaches. A material privacy breach could reasonably be expected to cause serious injury or harm to the individual to whom it relates. These cases are to be reported to the TBS and the OPC, as required by the Treasury Board's Directive on Privacy Practices.

All seven (7) breaches involved insufficient safeguarding of packages to be submitted as disclosure to the defence counsel and the accused in the context of legal proceedings. These packages contained personal information of the accused as well other individuals connected to the criminal investigations. In particular, two (2) cases involved disclosure packages made available through digital repositories. The three (3) material breaches involved the inadvertent disclosure of information within these packages that could potentially identify confidential informants involved in criminal investigations, thereby risking the safety of these individuals.

11 Privacy impact assessments

A privacy impact assessment (PIA) is a tool that assists a government institution in meeting its privacy responsibilities regarding the management of personal information. Institutions initiate PIAs when assessing the privacy implications of new or substantially modified programs and activities involving personal information.

The PPSC completed one (1) PIA in 2022-2023 regarding its National Fine Recovery Program (NFRP). The PPSC is responsible for administering the recovery of outstanding federal fines under the terms of an assignment issued by the Attorney General of Canada in 2007. Through the NFRP, the PPSC enforces sentences by recovering outstanding court-ordered fines levied against individuals and companies convicted under federal statutes, tracking and managing the fines as they become in default. It outsources a portion of fine recovery efforts to private collection agencies.

A PIA was required when the PPSC changed its recovery model to a hybrid approach. In addition to collection agencies, the NFRP now collects, discloses, and retains more information with various other partners such as credit bureaus and federal, provincial, and territorial government institutions.

An overview of the PIA and the privacy risks that were identified is available online: https://www.ppsc-sppc.gc.ca/eng/tra/pia-efp/nfrp-pnra.html.

12 Public interest disclosures

Subsection 8(2) of theAct describes the circumstances under which personal information under the control of a government institution may be disclosed without the individual's consent.

In particular, disclosures without consent may be made in the public interest, pursuant to paragraph 8(2)(m) of the Act. The PPSC did not make any such disclosures in 2022-2023.

13 Appendix A – Delegation order

The Director of Public Prosecutions, pursuant to section 73 of the Access to Information Act and section 73 of the Privacy Act, as they existed prior to June 21, 2019, and pursuant to the current subsection 95(1) of the Access to Information Act and subsection 73(1) of the Privacy Act, hereby designates to the persons holding the positions set out in the schedule hereto the powers, duties and functions of the Director of Public Prosecutions as the head of the Office of the Director of Public Prosecutions, under the under the provisions of the Acts and related regulations set out in the schedule opposite each position. This designation replaces all previous delegation orders.

Schedule

Dated, at the City of Ottawa, this 22 ^nd day of February, 2021.

(original signed by)

Kathleen Roussel
Director of Public Prosecutions

14 Appendix B – Statistical report on the Privacy Act

Name of institution: Public Prosecution Service of Canada

Reporting period: 2022-04-01 to 2023-03-31

Section 1: Requests Under the Privacy Act

Section 2: Informal requests

Section 3: Requests Closed During the Reporting Period

3.5 Complexity

3.6 Closed requests

3.7 Deemed refusals

Section 4: Disclosures Under Subsections 8(2) and 8(5)

Section 5: Requests for Correction of Personal Information and Notations

Section 6: Extensions

Section 7: Consultations Received from Other Institutions and Organizations

Section 8 – Completion Time of Consultations on Cabinet Confidences

Section 9 – Complaints and Investigations Notices Received

Section 10 – Privacy Impact Assessments (PIAs)

Section 11 – Material Privacy Breaches

Section 12 – Resources related to the Privacy Act

Note: Enter values to three decimal places.

15 Appendix C – Supplemental statistical report on the Access to Information Act and the Privacy Act

Name of institution: Public Prosecution Service of Canada

Reporting period: 2022-04-01 to 2023-03-31

Section 1: Capacity to Receive Requests under the Access to Information Act and the Privacy Act

Section 2: Capacity to Process Records under the Access to Information Act and the Privacy Act

Section 3: Open Requests and Complaints Under the Access to Information Act

Row 11, Col. 3 of Section 3.1 must equal Row 7, Col. 1 of Section 1.1 of the 2022-2023 Statistical Report on the Access to Information Act

Section 4: Open Requests and Complaints Under the Privacy Act

Row 11, Col. 3 of Section 4.1 must equal Row 7, Col. 1 of Section 1.1 of the 2022-2023 Statistical Report on the Privacy Act

Section 5: Social Insurance Number (SIN)

Section 6: Universal Access under the Privacy Act

Row 1, Col. 1 of Section 6 must be equal to or less than Row 1, Col. 1 of Section 1.1 of 2022-2023 Statistical Report on the Privacy Act

Date modified:

2023-10-16