Annual Report on the Privacy Act 2024-2025

Table of Contents

• 1 Introduction
• 2 The Public Prosecution Service of Canada
• 3 The ATIP Office
  • 3.1 Organizational structure
• 4 Delegated authorities
• 5 Performance
  • 5.1 Requests received under the Privacy Act
    • 5.1.1 Number of requests
  • 5.2 Requests closed during the fiscal year
    • 5.2.1 Disposition of requests
    • 5.2.2 Number of pages processed
    • 5.2.3 Completion time
    • 5.2.4 Exemptions
    • 5.2.5 Exclusions
    • 5.2.6 Format of information released
    • 5.2.7 Complexity
    • 5.2.8 Deemed refusals
    • 5.2.9 Requests for translation
  • 5.3 Requests for correction of personal information and notations
  • 5.4 Extensions
  • 5.5 Consultations received from other institutions
    • 5.5.1 Number of consultations
    • 5.5.2 Sources of consultations
    • 5.5.3 Disposition and recommendations
    • 5.5.4 Completion time
  • 5.6 Consultations on Cabinet confidences
  • 5.7 Costs
• 6 Training and awareness activities
• 7 Policies, guidelines, procedures, and initiatives
• 8 Initiatives and projects to improve privacy
• 9 Complaints and investigations
• 10 Monitoring compliance
• 11 Material privacy breaches
• 12 Privacy impact assessments
• 13 Public interest disclosures
• 14 Appendix A – Delegation order

1 Introduction

The Privacy Act (the Act) came into force on July 1, 1983. The purpose of the Act is to protect the privacy of individuals with respect to personal information about themselves held by government institutions as well as to provide individuals with a right of access to that information.

The Public Prosecution Service of Canada (PPSC) became subject to the Act when it was established as an independent organization on December 12, 2006, with the coming into force of the Director of Public Prosecutions Act (Part 3 of the Federal Accountability Act).

Pursuant to section 72 of the Act, this 2024-2025 Annual Report on the Act has been prepared for tabling in the House of Commons and the Senate. It provides an analysis of key statistics for the year, and also includes information on emerging trends, training activities, internal policies, guidelines, and procedures with respect to the PPSC’s administration of the Act.

Because the PPSC does not have any subsidiaries, information in that regard has not been included.

2 The Public Prosecution Service of Canada

The PPSC’s mandate is set out in the Director of Public Prosecutions Act (DPPA). The DPPA empowers the Director of Public Prosecutions (DPP), as Deputy Attorney General of Canada, to:

• Initiate and conduct federal prosecutions;
• Intervene in proceedings that raise a question of public interest that may affect the conduct of prosecutions or related investigations;
• Issue guidelines to federal prosecutors;
• Advise law enforcement agencies or investigative bodies on general matters relating to prosecutions and on particular investigations that may lead to prosecutions;
• Communicate with the media and the public on all matters that involve the initiation and conduct of prosecutions;
• Exercise the authority of the Attorney General of Canada in respect of private prosecutions; and
• Exercise any other power or carry out any other duty or function assigned by the Attorney General of Canada that is compatible with the office of the DPP.

The DPPA also empowers the DPP to:

• Initiate and conduct prosecutions under the Canada Elections Act; and
• Act, when requested by the Attorney General of Canada, in matters under the Extradition Act and the Mutual Legal Assistance in Criminal Matters Act.

The DPP has the rank and status of a deputy head of a department and, in this capacity, is responsible for the management of the PPSC as a distinct government institution.

3 The ATIP Office

The ATIP Office holds primary responsibility for the implementation and administration of the Privacy Act, along with the Access to Information Act (collectively known as ATIP). The Office deals directly with the public in relation to personal information requests, liaises with Offices of Primary Interest (the subject matter experts) to prepare responses, and serves as the centre of ATIP expertise within the PPSC.

The ATIP Office fulfills its responsibilities by:

• Processing requests for personal information in accordance with the Privacy Act, the Privacy Regulations (the Regulations), and the Treasury Board of Canada’s policies, directives, and guidelines;
• Responding to consultations submitted by other federal government institutions or other levels of government on PPSC records being considered for release, including the review of solicitor-client privilege in records related to criminal proceedings;
• Providing advice to PPSC managers and employees regarding the application and interpretation of the Act, the Regulations, and Treasury Board policies and directives;
• Reviewing PPSC policies, procedures, and agreements as well as making recommendations to ensure that they comply with the requirements of the Act;
• Monitoring the PPSC’s compliance with the Act, its Regulations, and Treasury Board policies and directives;
• Communicating with investigators of the Office of the Privacy Commissioner of Canada (OPC) to resolve complaints filed against the PPSC;
• Reviewing documents relevant to proactive publication prior to their publication on the PPSC’s website, ensuring that they do not contain personal information;
• Delivering training sessions intended to familiarize the PPSC’s managers and employees with the requirements of the Act, the Regulations, and Treasury Board policies and directives;
• Updating the PPSC’s chapter of the federal government’s publication known as Info Source: Sources of Government and Employee Information, which describes the functions, programs, activities, and related information holdings of government institutions subject to ATIP;
• Submitting an annual statistical report on the administration of the Act to the Treasury Board of Canada Secretariat (TBS); and
• Preparing an annual report on the administration of the Act for tabling in both Houses of Parliament.

3.1 Organizational structure

The Director General, Communications and Parliamentary Affairs (CPA), acts as the PPSC’s ATIP Coordinator. The Director of the ATIP Office reports to the Director General, CPA.

During the period from April 1, 2024, to March 31, 2025, the ATIP Office comprised the Director, two (2) Senior Advisors, one (1) Advisor, and one (1) ATIP Officer. A second Advisor position was vacant throughout the fiscal year.

Section 73.1 of the Act allows for the PPSC to exchange ATIP services with another government institution within the same ministerial portfolio. There were no such service agreements undertaken during this period.

The following chart outlines the organizational structure of the ATIP Office on March 31, 2025:

4 Delegated authorities

Pursuant to section 73 of the Act, the head of a government institution may designate one or more officers or employees of that institution, by order, to exercise or perform any of the powers, duties, or functions of the head of the institution under the Act.

The DPP, as the “head of institution,” has designated this authority to the Director General, CPA, as well as the Senior Director General, Corporate Services, and the ATIP Director. The ATIP Director exercises this authority in the absence of the Director General, CPA. The Senior Director General, Corporate Services, exercises this authority in the absence of both the Director General, CPA, and the ATIP Director.

A signed copy of the ATIP Delegation Order is available in Appendix A of this report.

5 Performance

The following section provides an overview of key data on the PPSC’s performance for the 2024-2025 fiscal year.

5.1 Requests received under the Privacy Act

5.1.1 Number of requests

The PPSC received 26 formal personal information requests in 2024-2025, 63% more than the 16 received in the previous fiscal year.

Additionally, two (2) requests were carried over from previous fiscal years: 2020-2021 and 2023-2024. Altogether, the PPSC had 28 requests to process in 2024-2025.

Since its creation on December 12, 2006, the PPSC has received 281 personal information requests in total. Over time, the organization has experienced periodic, sharp increases in the number of requests received each year. The current period represents the highest number of personal information requests received so far in the organization’s history. The following chart illustrates this trend:

5.2 Requests closed during the fiscal year

5.2.1 Disposition of requests

The PPSC responded to 24 of the 28 requests received in 2024-2025 or carried over from the previous year, 86% of all requests and eight (8) more than those closed during the last reporting period.

The proportion of requests closed each year rose from 68% during the first year of the global COVID-19 pandemic in 2020, when early public health measures limited workplace access. The rate has since stabilized, where an average of 82% of all requests to process are closed. The trend is described in the chart below, which sets out the closure rate for the past five fiscal years:

Four (4) requests remained outstanding as of March 31, 2025, and were carried forward to the next fiscal year, two (2) more than those remaining at the end of the previous year.

Three (3) of the requests still active at the end of the 2024-2025 reporting period were received within the last fiscal quarter and were still within legislated timelines going into the next fiscal year. The other outstanding request was received in 2020-2021. An extension to the initial statutory deadline of 30 days, which is the maximum time permitted under the Act, was taken to process a high volume of pages. Despite the extension, further time is needed for processing and it has since past the extended deadline.

The disposition of requests closed in 2024-2025 is as follows:

Records were disclosed in response to nine (9) of the 24 requests closed in 2024-2025, whether in full or in part. On average, 51% of requests closed over the past five reporting periods have resulted in full or partial disclosure of records to applicants.

In 2024-2025, the PPSC closed the following requests which did not result in the disclosure of any records:

No records exist

Nine (9) requests could not be processed because relevant records under the control of the PPSC did not exist. Where possible, applicants were advised of other government institutions that may have records and were provided with contact information accordingly.

Abandoned

Six (6) requests were abandoned by applicants. In most abandoned cases, clarification is needed from the applicants in order to process their requests. When the applicants do not provide clarification, the requests are considered to be abandoned. In other cases, the applicants choose to abandon their requests.

5.2.2 Number of pages processed

For the 24 cases closed in 2024-2025, the PPSC processed 22,482 relevant pages. This represents a significant increase compared to recent years. The unusually high volume is primarily due to the closing of a single request, which accounted for 92% of all pages processed. The remaining 23 requests involved the processing of 1,833 pages in total, a volume more consistent with the amount processed in the previous fiscal year.

The PPSC ATIP Office also reviewed an additional 1,771 pages received from across the organization that were deemed not relevant to the requests and were therefore not included as part of the responses. This is substantially more than the 147 non-relevant pages received in the previous period.

The following is a summary of the relevant pages processed by the PPSC over the last five fiscal years:

5.2.3 Completion time

Of those 24 requests closed in 2024-2025, 19 were processed within the initial 30-day statutory deadline, representing 79% of requests. This is six (6) more than the number closed within the same timeframe in 2023-2024.

On average, over the last five fiscal years, the PPSC has processed 77% of requests within 30 days of receipt. The proportion of requests closed within that timeframe has fluctuated from year to year. The overall trend is demonstrated in the chart that follows:

The following table is a breakdown of the number of days taken to respond to requests in 2024-2025:

5.2.4 Exemptions

An individual’s right of access to his or her personal information is subject to limited and specific exceptions. Limitations to the right of access are set out in sections 18 through 28 of the Act.

The following is a breakdown of the exemptions applied by the PPSC in 2024-2025 for closed requests:

Over the past five fiscal years, the PPSC has most frequently invoked sections 26 (information about another individual) and 27 (solicitor-client privilege) of the Act to exempt information from disclosure. This trend reflects the PPSC’s mandate to conduct federal prosecutions – which often involve personal information about the affected individuals – and to provide legal advice to law enforcement agencies and investigative bodies on prosecution-related matters.

5.2.5 Exclusions

Records or parts thereof to which the Act does not apply are considered to be “excluded.” Pursuant to section 69, the Act does not apply to library or museum material preserved solely for public record or material placed in Library and Archives Canada. Records containing confidences of the King’s Privy Council of Canada, also known as Cabinet confidences, and which have been in existence for less than 20 years are also excluded from the Act pursuant to section 70.

The PPSC did not invoke any exclusions in 2024-2025.

5.2.6 Format of information released

Information was released electronically for all nine (9) requests where the PPSC fully or partially disclosed records in 2024-2025.

In the last five fiscal years, all releases have been in electronic format. At the onset of the COVID-19 pandemic, the PPSC, along with the majority of government agencies and the private sector, had shifted its services to a digital-first environment in order to comply with public health measures. While paper-based release packages can be made available upon request so that the ATIP process remains accessible to all Canadians, PPSC applicants no longer request this option.

5.2.7 Complexity

Due to the nature of the PPSC’s work, processing requests can be challenging, and requests are regularly deemed “complex” based on a number of factors:

• The applicant’s personal information may be interwoven with that of other individuals. In these cases, section 26 of the Act could be applied to protect the personal information of other individuals.
• The ATIP Office may seek legal advice regarding the relevance or disclosure of records, which can further complicate the processing of a request.
• Many requests require the retrieval of records from regional offices across the country. The Ontario Regional Office was the region most frequently engaged in the search for records, responding to seven (7) separate requests that were closed in 2024-2025.

5.2.8 Deemed refusals

Requests that are not closed within the initial 30-day statutory deadline or within a timeframe covered by an extension provided by the Act are referred to as “deemed refusals.” Further information on the circumstances in which an extension to the original deadline is permitted by the Act is available in section 5.4 (Extensions) of this report.

All 24 requests closed in 2024-2025 were responded to within the initial deadline or within an extended timeframe, representing 100% of cases. No request was closed in this period as a deemed refusal.

5.2.9 Requests for translation

During the 2024-2025 fiscal year, the PPSC did not receive any requests from applicants to translate records from one official language to the other. This is consistent with the last five fiscal years.

5.3 Requests for correction of personal information and notations

Under paragraph 12(2)(a) of the Act, individuals who are given access to their personal information have the right to request a correction if the following conditions are met:

• They believe there is an error or omission in the information; and
• The information has been, is being used, or is available for use for an administrative purpose (i.e., a decision-making process that directly affects the individual).

There were no requests for correction of personal information or notations in 2024-2025. This has been typical of the last five fiscal years.

5.4 Extensions

Paragraph 15(a) of the Act allows for an extension of the initial statutory deadline for a maximum of 30 additional days in cases where:

• Meeting the original deadline would unreasonably interfere with the operations of the government institution processing the request;
• Consultations with other government institutions are necessary and cannot be reasonably completed within the original deadline; or
• The applicant requests translation or format conversion of records to be released to them.

In 2024-2025, the PPSC extended timelines to process five (5) requests, applying one (1) extension per request. This is two (2) fewer extensions than in the previous reporting period. Over the past five fiscal years, the PPSC has taken an average of three (3) extensions per year under the Act.

The following summarizes the length and reasons for the extensions taken in 2024-2025:

5.5 Consultations received from other institutions

5.5.1 Number of consultations

The PPSC received one (1) consultation from other government institutions for processing under the Act in 2024-2025, two (2) less than in the previous period. No consultations had carried over from previous fiscal years.

The PPSC has received 126 consultations in total since December 12, 2006. There was a sharp increase in the number of consultations in 2010-2011, but since then, the number of consultations received by the PPSC has largely declined.

The following chart illustrates this trend:

5.5.2 Sources of consultations

The consultation received in 2024-2025 originated from Statistics Canada. The sources for consultations received by the PPSC typically vary from year to year. 

5.5.3 Disposition and recommendations

The PPSC responded to the single consultation received in 2024-2025. Accordingly, there were no consultations outstanding as of March 31, 2025.

The PPSC processed 33 pages to respond to this consultation. The number of pages processed over the last five fiscal periods has considerably fluctuated from year to year, which is demonstrated in the following chart:

For the consultation closed in 2024-2025, the PPSC recommended that Statistics Canada disclose the records in part. Over the last five fiscal years, the PPSC has never recommended full exemption of records sent in consultation.

5.5.4 Completion time

The consultation completed in 2024-2025 was closed within 30 days of receipt.

Over the last five fiscal years, 75% of the consultations completed were closed within the first 30 days. Any consultations closed past that point involved a large number of records to process.

5.6 Consultations on Cabinet confidences

No consultations regarding section 70 (Cabinet confidences) of the Act were carried out during fiscal year 2024-2025.

5.7 Costs

In the 2024-2025 fiscal year, the PPSC spent a total of $202,087 administering the Act, of which salaries accounted for nearly all expenditures at $201,704, while goods and services accounted for the remaining $383. No overtime expenditures were incurred during this period.

Over the past five fiscal years, the costs associated with administering the Act have fluctuated, peaking in 2023–2024. The substantial increase in expenditures during that period was related to goods and services, specifically the purchase of licenses for new ATIP case management software. In 2024–2025, costs returned to levels more consistent with previous years.

The following chart illustrates these fluctuations:

6 Training and awareness activities

No formal training sessions were delivered to PPSC employees in 2024-2025.

Updated training materials were developed in the meantime, to be implemented in the next fiscal year. The PPSC will monitor their rollout to ensure all employees participate as part of their mandatory privacy training obligations under the Treasury Board Directive on Personal Information Requests and Correction of Personal Information.

The ATIP Office also ensures all employees with functional or delegated responsibility for administering the Act and its Regulations at the PPSC are provided with annual opportunities to update their knowledge of the legislation, related policies, and directives, and are kept informed of emerging trends, issues, and best practices.

Presentations were delivered in the past to raise awareness of corporate responsibilities regarding ATIP. These materials continue to be made available to all PPSC employees through the internal website. Communiqués on ATIP topics were also distributed throughout the year to employees, which included promoting Data Privacy Day 2025.

ATIP personnel provided informal learning to employees on an ad hoc basis regarding the processing of personal information requests and regularly provided advice to PPSC officials on the interpretation of the Act, including the appropriate collection, use, disclosure, and safeguarding of personal information.

7 Policies, guidelines, and procedures

No new or revised internal policies, guidelines, and procedures related to privacy were implemented in 2024-2025.

The PPSC ATIP Office continued to update office correspondence templates to ensure accuracy and accessibility, improved communications with applicants and PPSC officials, and alignment with Treasury Board requirements.

8 Initiatives and projects to improve privacy

No new initiatives or projects were implemented in 2024-2025.

The PPSC recently procured a new electronic case management system with enhanced features for processing ATIP requests. It was configured and tested throughout the current reporting period and will be launched into production in 2025-2026.

9 Complaints and investigations

Decisions made under the Act are subject to a two-tiered system of review. This ensures government institutions’ compliance with their privacy protection obligations as well as fair treatment for all applicants. The first level of review is a formal complaint made to and investigated by the Privacy Commissioner, supported by the Office of the Privacy Commissioner (OPC). The second level is an application for judicial review to the Federal Court. The PPSC reviews the outcomes of all investigations and incorporates lessons learned into business processes, where appropriate.

No new complaint was filed against the PPSC in 2024-2025, nor were any carried over from previous years. For this reason, there were no open complaints by the start of the next reporting period.

The OPC did not undertake any privacy audits in 2024-2025 involving the PPSC. There were also no applications for judicial review filed with the Federal Court during this same period.

10 Monitoring compliance

The ATIP Office maintains a comprehensive statistical reporting and performance measurement system to track the processing of formal requests, informal requests, and consultations received by the PPSC.

Each ATIP staff member is responsible for monitoring the time taken to process files that they are assigned on a regular basis, while the Senior ATIP Advisors meet with the ATIP Director twice a week to review timelines and address challenges that could affect the PPSC’s ability to meet its legal obligations under the Act. The ATIP Director meets weekly with the ATIP Coordinator on the status of active requests, complaints, and any issues that have arisen. The ATIP Office also formally reports to the PPSC’s senior management on a monthly basis about its activities, caseload, performance metrics, and privacy trends.

In addition to reporting, the ATIP Office advises various PPSC officials on appropriate privacy protections to be included in contracts and information sharing agreements or arrangements, on request.

11 Material privacy breaches

A privacy breach involves improper or unauthorized collection, use, disclosure, retention, or disposal of sensitive personal information.

The ATIP Office received 11 privacy breach reports in 2024-2025, two (2) of which were considered to be material. A material privacy breach could reasonably be expected to cause serious injury or harm to the individual to whom it relates. These cases are to be reported to the TBS and the OPC, as required by the Treasury Board’s Directive on Privacy Practices.

The two (2) material privacy breaches involved insufficient safeguarding of sensitive information within disclosure packages submitted by the PPSC to defence counsels representing the accused in legal proceedings. These packages contained information that could potentially identify confidential informants involved in criminal investigations, thereby placing their safety at risk. In both cases, the PPSC and the relevant law enforcement agencies took appropriate steps to mitigate the impact, while avoiding any actions that could further risk the informants. Where appropriate, disclosure packages were returned or destroyed, and the law enforcement agencies notified the affected individuals. No harm to the individuals was reported as a result of the breaches.

12 Privacy impact assessments

A privacy impact assessment (PIA) is a tool that assists a government institution in meeting its privacy responsibilities regarding the management of personal information. Institutions initiate PIAs when assessing the privacy implications of new or substantially modified programs and activities involving personal information.

One (1) new PIA was completed by the PPSC Human Resources Directorate in 2024–2025. The PIA identified potential privacy risks involved in adopting virtual staffing tools at the PPSC, specifically the Vidcruiter application suite, and outlined strategies to mitigate these risks for candidates participating in a virtual selection process. Such software was considered a substantial modification to how personal information is collected and managed in the context of staffing activities. In its review of the PPSC’s PIA submission, the OPC recommended additional mitigation measures to strengthen privacy protection in the use of virtual staffing tools, which the PPSC committed to implementing.

Further information about this PIA, and others, is available on the PPSC’s webpage listing summaries of its completed privacy impact assessments.

13 Public interest disclosures

Subsection 8(2) of the Act describes the circumstances under which personal information under the control of a government institution may be disclosed without the individual’s consent.

In particular, disclosures without consent may be made in the public interest, pursuant to paragraph 8(2)(m) of the Act. The PPSC did not make any such disclosures in 2024-2025.

14 Appendix A – Delegation order

The Director of Public Prosecutions, pursuant to section 73 of the Access to Information Act and section 73 of the Privacy Act, as they existed prior to June 21, 2019, and pursuant to the current subsection 95(1) of the Access to Information Act and subsection 73(1) of the Privacy Act, hereby designates to the persons holding the positions set out in the schedule hereto the powers, duties and functions of the Director of Public Prosecutions as the head of the Office of the Director of Public Prosecutions, under the provisions of the Acts and related regulations set out in the schedule opposite each position. This designation replaces all previous delegation orders.

Date modified:

2025-10-06