Annual Report on the Privacy Act 2015-2016

Table of Contents

Introduction

The Privacy Act (the Act) came into force on July 1, 1983. The purpose of the Act is to protect the privacy of individuals with respect to personal information about themselves held by government institutions and to provide individuals with a right of access to that information.

The Public Prosecution Service of Canada (PPSC) became subject to the Act when it was established as an independent organization on December 12, 2006, with the coming into force of the Director of Public Prosecutions Act (Part 3 of the Federal Accountability Act).

Pursuant to section 72 of the Act, the PPSC has prepared this 2015-2016 Annual Report on the Privacy Act for tabling in the House of Commons and the Senate. This Report provides an analysis of the information contained in the PPSC’s Statistical Report on the Privacy Act. In addition, it reports on emerging trends, training activities and newly implemented or revised internal policies, guidelines and procedures with respect to the PPSC’s administration of the Act.

The Public Prosecution Service of Canada

The PPSC’s mandate is set out in the Director of Public Prosecutions Act (DPPA). The DPPA empowers the Director of Public Prosecutions (DPP) as Deputy Attorney General of Canada to:

The DPPA also empowers the DPP to:

The DPP has the rank and status of a deputy head of a department, and in this capacity is responsible for the management of the PPSC as a distinct governmental organization.

Commissioner of Canada Elections

The Commissioner of Canada Elections (CCE) is responsible for ensuring that the Canada Elections Act and the Referendum Act are complied with and enforced. While the CCE is part of the PPSC, it remains operationally independent.

All privacy requests and consultations regarding the Office of the CCE are processed by the PPSC’s Access to Information and Privacy Office.

Access to Information and Privacy (ATIP) Office

The ATIP Office holds primary responsibility for the implementation and administration of the Act. The Office deals directly with the public in relation to privacy requests, liaises with Offices of Primary Interest to prepare responses, and serves as the centre of expertise for ATIP within the PPSC.

The ATIP Office fulfills its responsibilities by:

Organization Structure

Organizational Chart of Access to Information and Privacy Governance Structure

Text Version
  • ATIP Coordinator
    • Counsel
    • ATIP Manager
      • Senior ATIP Analyst, Policy & Governance
      • ATIP Advisor
      • ATIP Advisor
      • Junior ATIP Analyst

As of March 31, 2015, the ATIP Office comprises a Manager, a Senior Analyst, two Advisors and one Junior Analyst. The Director, Corporate Planning and External Relations Division, is the organization’s ATIP Coordinator. Counsel for the Corporate Planning and External Relations Division provides legal advice to the ATIP Coordinator, the ATIP Office and PPSC managers on the application and interpretation of the Act and relevant case law.

Delegated Authorities

Pursuant to section 73 of the Act, the head of a government institution may, by order, designate one or more officers or employees of that institution to exercise or perform any of the powers, duties of function of the head of the institution under the Act.

The DPP, as the “head of institution”, has designated the authority to exercise the powers and to perform the duties and functions conferred to him under the Act to the Director, Corporate Planning and External Relations Division, and the ATIP Manager (see Delegation Order in Appendix A). The ATIP Manager exercises this authority in the absence of the Director.

Interpretation of the Statistical Report

The following section provides a summary and analysis of the information contained in the Statistical Report on the Privacy Act in Appendix B of this report.

Part 1 – Requests Under the Privacy Act

The PPSC received 14 requests for personal information in 2015-2016, which is a 21% increase in the number of requests received in the previous reporting period. In addition, two (2) requests were carried forward from fiscal year 2014-2015.

The number of requests fluctuates year over year. However, the PPSC saw a steady increase in the number of requests received since 2010-2011, reaching an all-time high of 21 during the 2013-2014 fiscal year. Following a small decrease in the previous fiscal year, the PPSC had a modest increase in the number of requests during this reporting period.

Part 2 – Requests Closed During the Reporting Period

Disposition of requests

The PPSC responded to 10 requests for personal information during the 2015-2016 reporting period. A total of 1,620 pages were reviewed, representing a 39% decrease in volume from the previous reporting period. This decrease may be attributable to six (6) requests for personal information which were carried over to the next reporting period involving a large volume of records.

Disposition of the 10 completed requests can be broken down as follows:

Percentage of the Disposition of Requests
Disclosed in part (5) Abandoned (2) No records exist (3)
50% 20% 30%

Requests which resulted in no disclosure of records fell into the following categories:

No Records Exist
Request abandoned

Completion time

The chart below represents a breakdown of the length of time (in days) required to process requests for personal information during the 2015-2016 reporting period.

Percentage of requests by completion time
1 to 15 days (3) 16 to 30 days (4) 31 to 60 days (1) 61 to 120 days (2)
30% 40% 10% 20%

Of the 10 requests that were completed during fiscal year 2015-2016, seven (7) were processed within the 30-day statutory response period. One (1) request was responded to within 31 to 60 days, and two (2) requests required 61 to 120 days to complete.

Over the last five (5) reporting periods, 65% of the PPSC’s requests for personal information were responded to within the 30-day statutory deadline.

Exemptions

An individual’s right of access to his or her personal information is subject to limited and specific exceptions. Limitations to the right of access are set out in sections 18 through 28 of the Act.

The following is a breakdown of the exemptions that were applied by the PPSC during the 2015-2016 reporting period.

Exemptions that were invoked by the PPSC during the 2015-2016 reporting period
paragraph 19(1)(a) Section 21 Section 26 Section 27
1 1 5 3

Over the last five (5) reporting periods, section 26 [Information about another individual] and section 27 [Solicitor-client privilege] of the Act are the exemptions that were most often applied. This reflects the mandate of the PPSC which is to conduct federal prosecutions and advise law enforcement agencies and investigative bodies on matters relating to prosecutions.

The PPSC records often contain a significant amount of personal information, including information about accused, witnesses, and victims.

Exclusions

Records or parts thereof to which the Act does not apply are considered to be “excluded”. Pursuant to section 69, the Act does not apply to library or museum material preserved solely for public record, and material placed in Library and Archives Canada. Records containing Confidences of the Queen's Privy Council for Canada that have been in existence for less than 20 years are also excluded from the Act pursuant to section 70.

During the 2015-2016 reporting period, no exclusions pursuant to sections 69 and 70 of the Act were applied by the PPSC.

Format of information released

For responses in which information was disclosed, the information was provided to the applicant electronically by e-mail or on a compact disk in 60% of cases. Paper copies of records were provided in 40% of cases.

Complexity

The mandate of the PPSC is to prosecute offences under federal jurisdiction and to provide advice on prosecution-related matters to investigative agencies. Due to the nature of the organization’s work, processing privacy requests can be challenging. Records held by the PPSC often contain information relating to criminal or regulatory investigations or prosecutions that also frequently involve other organizations and government departments at the federal, provincial or territorial level.

During the 2015-2016 reporting period, the PPSC consulted with other government institutions on two (2) occasions. Legal advice was sought in order to respond to one (1) request. Five (5) requests were also considered complex due to the personal information of another individual being intermixed with the information of the applicant.

Deemed refusals

The PPSC was in deemed refusal on two (2) occasions during the 2015-2016 reporting period due to the large volume of records that required processing. On both occasions, the PPSC took a 30-day extension; however, the organization was unable to complete the processing of the request within the 60-day time period. In addition, the PPSC’s ATIP Office faced challenges in retaining experience and qualified personnel during the period, as it had a turnover of 60% of its staff.

Requests for translation

The PPSC received no requests from applicants for translation from one official language to the other.

Part 3 – Disclosures under Subsection 8(2) and 8(5)

Subsection 8(2) of the Act describes the circumstances under which personal information under the control of a government institution may be disclosed without the consent of the individual to whom the information pertains.

There were no disclosures made to federal investigative bodies for the purpose of enforcing any law of Canada or a province, or for carrying out a lawful investigation [paragraph 8(2)(e)] in fiscal year 2015-2016, nor were any disclosures made in the public interest [paragraph 8(2)(m)].

Part 4 – Requests for Correction of Personal Information and Notations

Paragraph 12(2)(a) of the Act provides that every individual who is given access to personal information about themselves that has been used, is being used, or is available for use for an administrative purpose (i.e. in a decision making process that directly affects the individual) is entitled to request correction of the information where the individual believes there is an error or omission.

There were no requests for correction of personal information nor were notations required during this reporting period.

Part 5 – Extensions

Paragraph 15(a) of the Act allows for an extension of the 30-day statutory time limit for a maximum of 30 days in cases where meeting the original time limit would unreasonably interfere with the operations of the institution processing the request, or when consultations with other government institutions are necessary and cannot reasonably be completed within the original time limit.

Reason for extensions

A total of three (3) extensions were taken during the 2015-2016 reporting period. In all instances, the extension was sought on the basis that meeting the original time limit would unreasonably interfere with the operations of the PPSC.

Length of extensions

All of the extensions taken during the reporting period were for a duration of 16 to 30 days.

Part 6 – Consultations Received from Other Institutions and Organizations

Number of consultations

The PPSC received eight (8) privacy consultations in 2015-2016, which is a 13% increase in the number of consultations received during the previous reporting period.

Sources of consultations

The Royal Canadian Mounted Police (RCMP) sent three (3) consultations, while the Department of Justice (JUS), the Public Service Commission (PSC), Correctional Service Canada (CSC), Environment Canada (EC) and the Alberta Justice and Solicitor General each sent one (1).

Percentage of consultations by other government institutions
RCMP (3) JUS (1) PSC (1) CSC (1) EC (1) Alberta DoJ (1)
37.5% 12.5% 12.5% 12.5% 12.5% 12.5%

Recommendations

The PPSC responded to eight (8) consultations during the 2015-2016 reporting period. A total of 50 pages were reviewed.

Recommendations made by the PPSC in respect of completed consultations during the reporting period can be broken down as follows:

Percentage of the completed consultations
Disclosed entirely (2) Disclosed in part (5) Other (1)
25% 62% 13%

The PPSC’s disclosure rates in 2015-2016 are consistent with the average rate over the five (5) previous years. The PPSC processed 51 consultations from fiscal years 2011-2012 to 2015-2016. In 84% of cases, the PPSC recommended that information be released in whole or in part. During 2015-2016, full or partial disclosure of information was recommended in 88% of cases.

Completion time

Of the eight (8) consultations that were completed, seven (7) were responded to within 15 days or less. The one (1) remaining consultation required between 16 to 30 days to complete.

Over the last five (5) reporting periods, 87% of privacy consultations received by the PPSC were responded to within 30 days. From 2011-2012 to 2015-2016, 63% of consultations completed were processed in 15 days or less while an additional 24% were completed within 16 to 30 days.

Part 7 – Completion Time of Consultations on Cabinet Confidences

No consultations on the application of section 70 [Cabinet confidences] of the Act were carried out during the 2015-2016 reporting period.

Part 8 – Complaints and Investigations Notices Received

Complaints

Decisions made under the Act are subject to a two-tiered system of review. The first level of review is a formal complaint to the Office of the Privacy Commissioner of Canada (OPC); the second level is an application for judicial review to the Federal Court.

A total of three (3) complaints were filed with the OPC against the PPSC during the 2015-2016 reporting period. Two (2) additional complaints were carried over from a previous reporting period. The PPSC submitted representations in connection with three (3) of these complaints to OPC investigators.

The following table is a breakdown of the reasons for the complaints as well as the findings of the OPC’s investigations.

Reason for Complaint Number of Complaints Results of OPC Investigations
Well Founded Not Well Founded Discontinued OPC has yet to issue its findings
Refusal/Exemptions 2 1 1 0 0
Miscellaneous 1 0 1 0 0
Explanation of the Results of Investigations

Federal Court review

During this reporting period, no application for judicial review was filed with the Federal Court pursuant to section 41 of the Act with respect to privacy requests submitted to the PPSC.

Part 9 – Privacy Impact Assessments (PIAs)

A Privacy Impact Assessment (PIA) is a tool used to assist an organization to meet its privacy responsibilities with regard to the management of personal information. PIAs are initiated when assessing the privacy implications of new or substantially modified programs and activities involving personal information.

During this reporting period, no PIAs were completed by the PPSC.

Part 10 – Resources Related to the Privacy Act

During this reporting period, the PPSC spent a total of $151,147 to administer the Act, of which salaries accounted for $144,500 and Goods and Services accounted for $6,647. No overtime expenditures were incurred.

Training Activities

During this reporting period, the ATIP Office provided a training and awareness session regarding the PPSC’s processes and employee obligations under the Act to approximately 15 employees of the PPSC’s Saskatchewan Regional Office.

An information session regarding the PPSC’s privacy breach policies was provided to the organization’s Senior Advisory Board, which includes Senior Management, all Chief Federal Prosecutors, all Associate Chief Federal Prosecutors, all Headquarter Directors, and Corporate Counsel. The session was provided to approximately 35 employees.

In addition, ATIP personnel provided informal training to employees on various privacy-related matters on an ad hoc basis.

New or Revised Policies, Guidelines and Procedures

In 2015-2016, the PPSC revised the ATIP Governance Structure to take into account the addition of the Commissioner of Canada Elections. The ATIP Governance Structure outlines the reporting relationships within the PPSC and establishes clear responsibilities for decision-making for the purposes of administering the Act.

Monitoring of Processing Time

The ATIP Office maintains a comprehensive statistical reporting and performance measurement system. Monthly reports are provided to the ATIP Coordinator identifying the number of active privacy requests, the sources and due dates of the requests, as well as the length of any extensions taken.

Information relating to the processing time of requests for correction of personal information is included in the monthly reports.

Privacy Breaches

A material privacy breach involves improper or unauthorized collection, use, disclosure, retention or disposal of sensitive personal information which could reasonably be expected to cause serious injury or harm to the individual to whom it relates.

During this reporting period, the Office of the Privacy Commissioner and the Treasury Board Secretariat were notified of four (4) occurrences of material privacy breaches. These breaches consist of one case in which two envelopes containing documents were incorrectly labelled and sent by mail to the incorrect recipients; one case of information believed to have been lost on PPSC premises; and two cases of information lost while in transit.

The PPSC took immediate steps to mitigate these breaches. In addition, the PPSC reviewed its internal processes, provided additional training to employees, and reminded employees and agents of their responsibilities to ensure that such situations do not reoccur.

Appendix A – Delegation Order

The Director of Public Prosecutions, pursuant to section 73 of the Access to Information Act and the Privacy Act, hereby designates the persons appointed to the positions of:

Director, Corporate Planning and External Relations Directorate; and

Manager, ATIP, Access to Information and Privacy Office;

to exercise the powers, duties and functions of the Director as the head of the Office of the Director of Public Prosecutions, under the provisions of the Access to Information Act and of the Privacy Act and related regulations.

This order replaces all previous delegation orders made pursuant to the Acts by the Director.

Dated, at the City of Ottawa, this 30 day of October, 2015.

Signature of Brian Saunders
Brian Saunders
Director of Public Prosecutions

Appendix B – Statistical Report on the Privacy Act

Name of institution: Public Prosecution Service of Canada

Reporting period: 2015-04-01 to 2016-03-31

Part 1: Requests Under the Privacy Act

  Number of Requests
Received during reporting period 14
Oustanding from previous reporting period 2
Total 16
Closed during reporting period 10
Carried over to next reporting period 6

Part 2: Requests Closed During the Reporting Period

2.1 Disposition and completion time

Disposition of requests Completion Time
1 to 15 Days 16 to 30 Days 31 to 60 Days 61 to 120 Days 121 to 180 Days 181 to 365 Days More than 365 Days Total
All disclosed 0 0 0 0 0 0 0 0
Disclosed in part 0 2 1 2 0 0 0 5
All exempted 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0
No records exist 2 1 0 0 0 0 0 3
Request abandoned 1 1 0 0 0 0 0 2
Neither confirmed nor denied 0 0 0 0 0 0 0 0
Total 3 4 1 2 0 0 1 10

2.2 Exemptions

Section Number of Requests
18(2) 0
19(1)(a) 1
19(1)(b) 0
19(1)(c) 0
19(1)(d) 0
19(1)(e) 0
19(1)(f) 0
20 0
21 1
22(1)(a)(i) 0
22(1)(a)(ii) 0
22(1)(a)(iii) 0
22(1)(b) 0
22(1)(c) 0
22(2) 0
22.1 0
22.2 0
22.3 0
23(a) 0
23(b) 0
24(a) 0
24(b) 0
25 0
26 5
27 3
28 0

2.3 Exclusions

Section Number of Requests
69(1)(a) 0
69(1)(b) 0
69.1 0
70(1)(a) 0
70(1)(b) 0
70(1)(c) 0
70(1)(d) 0
70(1)(e) 0
70(1)(f) 0
70.1 0

2.4 Format of information released

Disposition Paper Electronic Other Formats
All disclosed 0 0 0
Disclosed in part 2 3 0
Total 2 3 0

2.5 Complexity

2.5.1 Relevant pages processed and disclosed
Disposition of Requests Number of Pages Processed Number of Pages Disclosed Number of Requests
All disclosed 0 0 0
Disclosed in part 1620 1559 5
All exempted 0 0 0
All excluded 0 0 0
Request abandoned 0 0 0
Neither confirmed nor denied 0 0 0
Total 1620 1559 7
2.5.2 Relevant pages processed and disclosed by size of requests
Disposition Less than 100 Pages Processed 101-500 Pages Processed 501-1000 Pages Processed 1001-5000 Pages Processed More than 5000 Pages Processed
Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed
All disclosed 0 0 0 0 0 0 0 0 0 0
Disclosed in part 4 216 0 0 0 0 1 1343 0 0
All exempted 0 0 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0 0 0
Request abandoned 2 0 0 0 0 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0 0 0 0 0 0
Total 6 216 0 0 0 0 1 1343 0 0
2.5.3 Other complexities
Disposition Consultation Required Legal Advice Sought Interwoven Information Other Total
All disclosed 0 0 0 0 0
Disclosed in part 2 1 5 5 13
All exempted 0 0 0 0 0
All excluded 0 0 0 0 0
Request abandoned 0 0 0 1 1
Neither confirmed nor denied 0 0 0 0 0
Total 2 1 5 6 14

2.6 Deemed refusals

2.6.1 Reasons for not meeting statutory deadline
Number of Requests Closed Past the Statutory Deadline Principal Reason
Workload External Consultation Internal Consultation Other
2 2 0 0 0
2.6.2 Number of days past deadline
Number of Days Past Deadline Number of Requests Past Deadline Where No Extension WasTaken Number of Requests Past Deadline Where An Extension Was Taken Total
1 to 15 days 0 1 1
16 to 30 days 0 0 0
31 to 60 days 0 1 1
61 to 120 days 0 0 0
121 to 180 days 0 0 0
181 to 365 days 0 0 0
More than 365 days 0 0 0
Total 0 2 2

2.7 Requests for translation

Translation Requests Accepted Refused Total
English to French 0 0 0
French to English 0 0 0
Total 0 0 0

Part 3: Disclosures Under Subsection 8(2) and 8(5)

Paragraph 8(2)(e) Paragraph 8(2)(m) Subsection 8(5) Total
0 0 0 0

Part 4: Requests for Correction of Personal Information and Notations

Disposition for Correction Requests Received Number
Notations attached 0
Requests for correction accepted 0
Total 0

Part 5: Extensions

5.1 Reasons for extensions and disposition of requests

Disposition of Requests Where an Extension Was Taken 15(1)(a) Interference With Operations 15(1)(b) Consultation 15(1)(c) Translation or Conversion
Section 70 Other
All disclosed 0 0 0 0
Disclosed in part 3 0 0 0
All exempted 0 0 0 0
All excluded 0 0 0 0
No records exist 0 0 0 0
Request abandoned 0 0 0 0
Total 3 0 0 0

5.2 Length of extensions

Length of Extensions 15(1)(a) Interference with operations 15(1)(b) Consultation 15(1)(c) Translation purposes
Section 70 Other
1 to 15 days 0 0 0 0
16 to 30 days 3 0 0 0
Total 3 0 0 0

Part 6: Consultations Received From Other Institutions and Organizations

6.1 Consultations received from other Government of Canada institutions and other organizations

Consultations Other Government of Canada Institutions Number of Pages to Review Other Organizations Number of Pages to Review
Received during reporting period 7 50 1 4
Outstanding from the previous reporting period 0 0 0 0
Total 7 50 1 4
Closed during the reporting period 7 50 1 4
Pending at the end of the reporting period 0 0 0 0

6.2 Recommendations and completion time for consultations received from other Government of Canada institutions

Recommendation Number of Days Required to Complete Consultation Requests
1 to 15 Days 16 to 30 Days 31 to 60 Days 61 to 120 Days 121 to 180 Days 181 to 365 Days More than 365 Days Total
All disclosed 2 0 0 0 0 0 0 2
Disclosed in part 3 1 0 0 0 0 0 4
All exempted 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0
Consult other institution 0 0 0 0 0 0 0 0
Other 1 0 0 0 0 0 0 1
Total 6 1 0 0 0 0 0 7

6.3 Recommendations and completion time for consultations received from other organizations

Recommendation Number of Days Required to Complete Consultation Requests
1 to 15 Days 16 to 30 Days 31 to 60 Days 61 to 120 Days 121 to 180 Days 181 to 365 Days More than 365 Days Total
All disclosed 0 0 0 0 0 0 0 0
Disclosed in part 1 0 0 0 0 0 0 1
All exempted 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0
Consult other institution 0 0 0 0 0 0 0 0
Other 0 0 0 0 0 0 0 0
Total 1 0 0 0 0 0 0 1

Part 7: Completion Time of Consultations on Cabinet Confidences

7.1 Requests with Legal Services

Number of Days Fewer than 100 Pages Processed 101-500 Pages Processed 501-1000 Pages Processed 1001-5000 Pages Processed More than 5000 Pages Processed
Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed
Total 0 0 0 0 0 0 0 0 0 0
1 to 15 0 0 0 0 0 0 0 0 0 0
16 to 30 0 0 0 0 0 0 0 0 0 0
31 to 60 0 0 0 0 0 0 0 0 0 0
61 to 120 0 0 0 0 0 0 0 0 0 0
121 to 180 0 0 0 0 0 0 0 0 0 0
181 to 365 0 0 0 0 0 0 0 0 0 0
More than 365 0 0 0 0 0 0 0 0 0 0

7.2 Requests with Privy Council Office

Number of Days Fewer than 100 Pages Processed 101-500 Pages Processed 501-1000 Pages Processed 1001-5000 Pages Processed More than 5000 Pages Processed
Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed
Total 0 0 0 0 0 0 0 0 0 0
1 to 15 0 0 0 0 0 0 0 0 0 0
16 to 30 0 0 0 0 0 0 0 0 0 0
31 to 60 0 0 0 0 0 0 0 0 0 0
61 to 120 0 0 0 0 0 0 0 0 0 0
121 to 180 0 0 0 0 0 0 0 0 0 0
181 to 365 0 0 0 0 0 0 0 0 0 0
More than 365 0 0 0 0 0 0 0 0 0 0

Part 8: Complaints and Investigation Notices Received

Section 31 Section 33 Section 35 Court action Total
3 3 2 0 8

Part 9: Privacy Impact Assessments (PIAs)

Number of PIA(s) completed 0

Part 10: Resources Related to the Privacy Act

10.1 Costs

Expenditures Amount
Salaries $144,500
Overtime $0
Goods and Services $6,647
• Professional services contracts $4,527  
• Other $2,120
Total $151,147

10.2 Human Resources

Resources Person Years Dedicated to Privacy Activities
Full-time employees 1.81
Part-time and casual employees 0.00
Regional staff 0.00
Consultants and agency personnel 0.00
Students 0.00
Total 1.81

Note: Enter values to two decimal places.

Date modified: