INTRODUCTION
The Office of the Correctional Investigator is pleased to submit to Parliament its annual report on the administration of the Privacy Act (PA or the Act) for the fiscal year commencing on April 1, 2022 and ending March 31, 2023. This report is submitted in accordance with section 72 of the PA. This report is tabled in Parliament by the Minister of Public Safety, Democratic Institutions and Intergovernmental Affairs.
The Privacy Act took effect on July 1, 1983. The PA extends to individuals the right of access to information held by the government about themselves, subject to certain specific and limited exceptions. The Act also protects individuals’ personal information and gives them substantial control over its collection, use and disclosure.
OUR MANDATE
The Office of the Correctional Investigator is mandated by Part III of the Corrections and Conditional Release Act as an Ombudsman for federal offenders. The primary function of the Office is to investigate and bring resolution to offender complaints. The Office also has a responsibility to review and make recommendations on the Correctional Service of Canada's policies and procedures to ensure that systemic areas of concern are identified and appropriately addressed.
OUR MISSION
PRIVACY ACTIVITIES
The Minister of Public Safety is the designated head of the institution for the Privacy Act. The Correctional Investigator has been delegated full authority under the Privacy Act by the Minister. Full authority under the Act has also been delegated to the Access to Information and Privacy Coordinator. The delegation of authority to administer the Act was confirmed by the Minister of Public Safety and Emergency Preparedness on November 30, 2015 (see Appendix C).
While the responsibilities of the ATIP Coordinator are assigned to the Director and Legal Counsel, the actual processing of requests and any associated activities are generally carried out by a consultant. Given the limited number of requests, it is felt that this is the most cost-effective utilization of resources and delivery of these activities.
The ATIP Coordinator is accountable for the development, coordination and implementation of effective policies, guidelines, systems and procedures to ensure the OCI’s responsibilities under the Privacy Act are met and to enable appropriate processing and proper disclosure of information. The Coordinator is also responsible for related policies, systems and procedures emanating from the Act.
The main activities of the ATIP Coordinator include:
- Processing requests under the Act;
- Developing and maintaining policies, procedures and guidelines to ensure the Act is respected;
- Promoting awareness of the Act to ensure the organization’s responsiveness to the obligations imposed on the government;
- Monitoring the Office’s compliance with the Act, regulations and relevant procedures and policies;
- Preparing annual reports to Parliament and other statutory reports, as well as other material that may be required by central agencies;
- Representing the Office in dealings with the Treasury Board Secretariat, the Privacy Commissioner and other government agencies regarding the application of the Act as they relate to the OCI; and
- Supporting the Office in meeting its commitments in relation to greater openness and transparency through proactive disclosure of information and the disclosure of information through informal avenues.
The OCI is not subject to any agreements under section 73.1 of the Privacy Act.
DURING THE REPORTING PERIOD
Fourteen (14) requests were received and there were five (5) outstanding requests from the previous reporting period. Of these requests;
Fourteen (14) were disclosed in part (78%)
One (1) was disclosed in their entirety (5%)
None were exempted or excluded in their entirety
None were abandoned
Three (3) had no records (17%)
One (1) was carried forward to the next reporting period (5%)
Three (3) requests were outstanding from the 2021-2022 reporting period and were closed during the reporting period.
There were no consultations received.
Contrary to past years, all but one request, which was received through the online portal, were received by email during the reporting period. Due to our requesters being incarcerated individuals, receiving requests by mail has always been the most common way to receive requests for the Office. Not one request was received by mail as the majority of requests were submitted by inmates’ lawyers.
Five (5) extensions were taken for consultations with another government department. In order to alleviate extensive delays when consulting with the Correctional Service of Canada, the Office and CSC have come to an agreement that consultations will only be done when absolutely necessary.
The Office could not meet the statutory response time for fourteen (14) requests during the reporting period.
The OCI responded to 22% of requests within the legislated timelines. Completing requests within legislated timelines presented challenges over the reporting period, mostly due to a lack of human resources. The OCI is in the process of resolving this shortage within 2023-2024.
Monitoring , of the time required to process these privacy requests was completed by the ATIP Coordinator in preparing the historical trend analysis below. The Executive Director and the ATIP Coordinator are advised by way of a briefing note when requests are not closed within the required time limits. The briefing note advises of the reason for the late response.
No training sessions were provided during the reporting period. Advice, guidance and recommendations were provided by the consultant on an as required basis to Management and staff.
There were no material privacy breaches reported this year.
The OCI received no complaints during the reporting year.
No Privacy Impact Assessments (PIAs) were completed; no new data sharing activities took place and the Office made no disclosures of personal information pursuant to subsection 8(2)(m) of the Privacy Act. There are no new collection or new consistent uses of Social Insurance Numbers.
COVID-19 RELATED MEASURES
While COVID-19 related measures have been phased out, the maintenance of hybrid work required some pragmatic adjustments over the reporting period as the majority of requesters are incarcerated and have no access to electronic communications.
COSTS
For 2022-2023, the costs directly associated with the administration of the Privacy Act are estimated at $27,625.
Staff $11,007
Consultant fees $14,116
Other $ 2,502
The associated employee resources for 2022-2023 are estimated at 0.148 FTE for administering the Privacy Act.
Staff shortages has required the direct involvement of members of the Senior Management team to ensure the day-to-day operations, which explains the relative higher costs associated with the administration of the Access to Information Act during the reporting period.
FIVE-YEAR HISTORICAL TREND ANALYSIS
Over a five-year period, from 2018-2019 to 2022-2023, the OCI received an average of fifteen (15) requests annually.
Over the last five years, the OCI has maintained a 63% completion rate of requests processed between 1-60 days.
With regards to the number of pages processed, an average of one thousand, seven hundred and eighty-four (1,784) are processed per year.
The most frequently used exemptions remain:
- 26 at 56%
- 22(1)(c) at 25%
- 21(1)(c) at 8%
A total of seventeen (17) extensions for consultations were recorded for an average of three (3) per reporting period. A total of two (2) consultations were received from other government organizations.
This baseline data will continue to be used in future years to assess trends, inform ongoing improvements in the processing of Privacy requests and implement corrective measures where necessary.
Appendix A: Delegation Order
Appendix B: Statistical Report
Appendix C: Supplemental Statistical Report
