Annual Report to Parliament on the Privacy Act April 1, 2016 to March 31, 2017

Table of Contents

Introduction 
Our Mandate 
Our Mission 
Privacy Activities 
Historical Trend Analysis 
Raising the Bar on Access for Families 
Appendix A - Statistical Report 
Appendix B – Delegation Order 
 

INTRODUCTION

The Office of the Correctional Investigator is pleased to submit to Parliament its annual report on the administration of the Privacy Act (PA) for the fiscal year commencing on April 1, 2016 and ending March 31, 2017. This report is submitted in accordance with section 72 of the Act . This report is tabled in Parliament by the Minister of Public Safety and Emergency Preparedness.

The Privacy Act took effect on July 1, 1983. The PA extends to individuals the right of access to information held by the government, about themselves, subject to certain specific and limited exceptions. The Act also protects individuals' personal information and gives individuals substantial control over its collection, use and disclosure.

OUR MANDATE

The Office of the Correctional Investigator is mandated by Part III of the Corrections and Conditional Release Act as an Ombudsman for federal offenders. The primary function of the Office is to investigate and bring resolution to individual offender complaints. The Office as well, has a responsibility to review and make recommendations on the Correctional Service's policies and procedures associated with the areas of individual complaints to ensure that systemic areas of concern are identified and appropriately addressed.

OUR MISSION

As the ombudsman for federally sentenced offenders, the Office of the Correctional Investigator serves Canadians and contributes to safe, lawful and humane corrections through independent oversight of the Correctional Service of Canada by providing accessible, impartial and timely investigation of individual and systemic concerns. While an independent organization, the Office of the Correctional Investigator is part of the Public Safety and Emergency Preparedness portfolio.

PRIVACY ACTIVITIES

The Minister of Public Safety and Emergency Preparedness is the designated head of the institution for the Privacy Act . The Correctional Investigator has been delegated full authority under the Privacy Act by the Minister. Full authority under the Act has also been delegated to the Access to Information and Privacy Coordinator. The delegation of authority to administer the Act was confirmed by the Minister of Public Safety and Emergency Preparedness on November 30, 2015 ( see Appendix B ).

While the responsibilities of ATIP Coordinator are assigned to the Director of Corporate Services and Planning, the actual processing of requests and any associated activities are generally carried out by a consultant. Given the limited number of requests, it is felt that this is the most cost effective utilization of resources and delivery of these activities.

The ATIP Coordinator is accountable for the development, coordination and implementation of effective policies, guidelines, systems and procedures to ensure the OCI's responsibilities under the Privacy Act are met and to enable appropriate processing and proper disclosure of information. The Coordinator is also responsible for related policies, systems and procedures emanating from the Act .

The main activities of the ATIP Coordinator include:

• Processing requests under the Act ;
• Developing and maintaining policies, procedures and guidelines to ensure the Act is respected by the Office;
• Promoting awareness of the Act to ensure the organization's responsiveness to the obligations imposed on the government;
• Monitoring the Office's compliance with the Act , regulations and relevant procedures and policies;
• Preparing annual reports to Parliament and other statutory reports, as well as other material that may be required by central agencies;
• Representing the Office in dealings with the Treasury Board Secretariat, the Privacy Commissioner and other government agencies regarding the application of the Act as they relate to the OCI; and
• Supporting the Office in meeting its commitments in relation to greater openness and transparency through proactive disclosure of information nd the disclosure of information through informal avenues.

During the Reporting Period:

Nineteen (19) requests were received and there were four (4) outstanding requests from the previous reporting period for a total of twenty-three (23) requests. Sixteen (16) of these requests were disclosed in part; two (2) were released in their entirety; none were exempted in their entirety; none were abandoned; two (2) had no existing records, and three (3) were carried forward to the next reporting period. All but two (2) of these requests were processed within the legislative time frame. Extensions were required for fourteen (14) of the requests. There were no significant issues surrounding the twenty (20) requests closed during the reporting period.

Monitoring, by the ATIP Coordinator, of the time required to process these privacy requests was completed in preparing the historical trend analysis below.

Two (2) formal training sessions were provided during the reporting period, one was a general awareness session and the other was a session on understanding the nuance between a general request and a specific one and the impacts that has on the retrieval of records. Approximately 90% of staff attended the training. All training material is provided to staff, in both official languages, following the session so that those who did not attend have access to it. Moreover, advice, guidance and recommendations were provided by the consultant on an as required basis to Management and staff.

There were no new OCI-specific privacy related procedures, policies or guidelines implemented.

There were no material privacy breaches; no Privacy Impact Assessments (PIAs) were completed; no new data sharing activities took place and the Office made no disclosures of personal information pursuant to subsection 8(2)(m) of the Privacy Act .

The OCI did not receive any complaints.

For 2016-17, the costs directly associated with the administration of the Privacy Act are estimated at $77,897.

Staff - $13,821 
Consultant fees - $64,076

The associated employee resources for 2016-17 are estimated at 0.75 FTE for administering the Privacy Act .

HISTORICAL TREND ANALYSIS

Over a five year period, from 2012-13 to 2016-17, the OCI received an average of seventeen (17) requests annually; the lowest number of requests received in one reporting period was thirteen (13) and the highest number of requests received in one reporting period was twenty-eight (28). The total average completion rate from 1 to 60 days was 73% of all requests. The average completion time within 30 days was 30% of all requests; the average completion time within 60 days was 43% of all requests.

With regards to the number of pages processed, an average of five thousand, eight hundred and five (5,805) was recorded; the highest number of pages processed in one reporting period was nine thousand five hundred and sixty-two (9,562) and the lowest number of pages processed in one reporting period was six hundred and three (603).

The most frequently used exemptions were:

• 26: 51%
• 22(1)(c): 21%
• 22(1)(a): 11%

A total of sixty-one (61) extensions for consultations were recorded for an average of twelve (12) per reporting period; the highest number of extensions in any given reporting period was twenty-five (25) the lowest number of extensions in any given reporting period was four (4). Two (2) consultations were received from other government organizations.

This baseline data will continue to be used in future years to assess trends, inform ongoing improvement in the processing of Privacy requests and implement corrective measures where necessary.

RAISING THE BAR ON ACCESS FOR FAMILIES

The Office of the Correctional Investigator released a special report on August 2, 2106 entitled, “ In the Dark: An Investigation of Death in Custody Information Sharing and Disclosure Practices in Federal Corrections .” This investigation examined CSC's information sharing and disclosure practices with family members following a death in custody. The investigation found that families often face a difficult and protracted process to access information following the death of a family member in federal custody.

As part of this investigation, the Office reviewed seven National Board of Investigation Reports processed by CSC's ATIP Branch for the families of offenders who died in custody between 2013 and 2015. The Office's ATIP analyst reviewed the redacted and unredacted reports through both an Access to Information and Privacy lens to examine the exemptions that were applied and the consistency of the information that was released. The analysis found that the processing of the reports was not done consistently and was not transparent. Of biggest concern was the consistent redaction of information in which possible errors, shortfalls or policy non-compliance were noted in the original report. The practice of exempting errors, shortfalls and policy non-compliance leaves little room for public scrutiny, accountability or in fact legal recourse.

There were also numerous instances where redactions within a section of the report completely change the context of the information that is provided. For example, in one NBOI, CSC exempted all information about how the inmate had threatened to kill himself and that these threats had not been shared amongst CSC staff or documented as is required by policy. However, CSC released information that the Psychologist stated that the inmate had denied any suicidal ideation. The redactions in this case lead the reader to believe that the offender was not suicidal and that CSC staff were compliant with law and policy, when in fact this was not the case. It seems especially disingenuous to apply exemptions that change the context or meaning of the information being released.

The investigation concluded that the Service does not presumptively, proactively or fully disclose or share information with families of a deceased inmate. While there is no specific legal requirement for CSC to share any information, there are principles embedded in the legislation ( CCRA, CCRR , the ATI and Privacy Acts ) and reinforced in CSC's own Mission and Value Statements that could inform a more compassionate, open and transparent approach. Rather than leaving families in the dark, sharing factual and relevant information regarding the circumstances and events immediately preceding the incident as well as treatment, diagnostic and intervention plans would go a long way to providing families with some important context to situate the incident and help them better cope with their family member's unexpected (or unexplained) death.

A total of nine recommendations were provided to the service as a result of this report, including;

In the interest of transparency and openness, investigative reports (Mortality Reviews and National Board of Investigations) in their entirety should be presumptively and routinely shared, in a timely manner, with next of kin.

I recommend that the Commissioner of Corrections routinely consider releasing information to families of deceased inmates under public interest disclosure provisions of the Privacy Act .

CSC agreed with many of the recommendations and has taken steps to better communicate with the families of the deceased. They have agreed to do more to facilitate the disclosure process including training staff so that they are better equipped to provide assistance and support when sharing information with next of kin and they have also created a dedicated team to review NBOIs to ensure consistency and transparency.

APPENDIX A - Statistical Report on the Privacy Act 

Name of institution: Office of the Correctional Investigator

Reporting period: 2016-04-01 to 2017-03-31

PART 1 - Requests Under the Privacy Act 

PART 2 - Requests Closed During the Reporting Period

2.5 Complexity

2.6 Deemed refusals

PART 3 - Disclosures Under Subsection 8(2) and 8(5)

PART 4 - Requests for Correction of Personal Information and Notations

PART 5 - Extensions

PART 6 - Consultations Received from Other Institutions and Organizations

Part 7 - Completion Time of Consultations on Cabinet Confidences

Part 8 - Complaints and Investigations Notices Received

Part 9: Privacy Impact Assessments ( PIA s)

Number of PIA (s) completed: 0

Part 10: Resources Related to the Privacy Act 

Note: Enter values to two decimal places.

Appendix B - Delegation Order

Privacy Act Delegation Order

The Minister of Public Safety and Emergency Preparedness, pursuant to section 73 of the Privacy Act , hereby designates the persons holding the positions set out in the schedule hereto to exercise the powers and perform the duties and functions of the Minister as head of a government institution, that is, the Office of the Correctional Investigator, under the sections of the Act set out in the schedule opposite each position.

Dated at the City of Ottawa this 30th day of November, 2015

Signed by: 
The Honourable Ralph Goodale, P.C., M.P. 
Minister of Public Safety and Emergency Preparedness

Date modified 
2017-07-24