Report on the administration of the Privacy Act 2014-2015

By Canada Economic Development for Quebec Regions

Download the printer-friendly version (PDF)

About this publication

Publication author : Canada Economic Development for Quebec regions

ISSN number : 2291-7268

Catalog number : Iu90-1/12F-PDF

Publish date : December 1, 2015

Summary :

This report deals with the activities of the Agency in implementing the Privacy Act for the fiscal year 2014-2015.

Introduction

The Privacy Act (the Act), promulgated on July 1, 1983, aims to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution.

The purpose of the Act is to protect personal information by allowing individuals to consult information about themselves. It also imposes strict controls on how such information is gathered, used and shared.

Under section 72 of the Act, The head of every government institution shall prepare an annual report for submission to Parliament. This document therefore reports on the operations of the Economic Development Agency of Canada for the Regions of Quebec in 2012-2013, as required by the Act.

Mandate of the Economic Development Agency of Canada for the Regions of Quebec

Growth and jobs and the success of Quebec’s regions and enterprises are central to the Agency’s mission and consistent with the Government of Canada’s top economic priorities

Present across Quebec through its business offices, the Agency is the key federal actor in the economic development of the regions of Quebec. It supports businesses and economic stakeholders in their development efforts and provides funding for their projects.

In addition to its regular programs, the Agency contributes to the design and implementation of national programs and targeted temporary initiatives to meet the challenges of specific situations in Quebec.

The Agency’s approach is inspired by the best practices identified with respect to regional economic development. It is:

• Consistent with government priorities and national strategies related to its mission and anticipated results;
• Geared to the economic issues and challenges of enterprises and the different regions of Quebec, building on their assets and potential; and
• Collaborative with economic agents, such as local partners, other federal departments and agencies and the Quebec government.

Since April 1, 2012, the Agency has had one regular grants and contributions (G&C) program, the Quebec Economic Development Program (QEDP). In addition to this program, the Agency contributed to the design and implementation in Quebec of Canada-wide programs and targeted ad-hoc initiatives such as:

To learn more about the Agency’s mandate, programming and operations, go to its Web site: www.dec-ced.gc.ca.

Access to information and Privacy Office

The Access to Information and Privacy Office (AIPO) reports directly to the Deputy Minister/President’s Chief of Staff.

AIPO has an access to information and privacy senior officer, as well as a coordinator. The senior officer, with the help of the coordinator, oversees compliance with legislation, regulations, procedures and broad government trends.

Through its delegated authority, AIPO represents the Agency on matters relating to the Act in dealings with the public, Treasury Board Secretariat, the Commissioners of Information and Privacy and other federal departments and institutions.

Delegation of authority

The Agency’s enabling legislation identifies its head as being the Deputy Minister/President. In addition to managing the institution and overseeing management of Agency personnel, the Deputy Minister/President is responsible for application of the Access to Information Act.

To this end, the authority for application of the Act was delegated to the Senior Advisor, Access to Information and Parliamentary Affairs, while most administrative authority was delegated to the Coordinator, Access to Information and Parliamentary Affairs.

Interpreting the statistical report on access to personal information

Requests received and processed

In 2014-2015, only one access to personal in request was received and processed.

Owing to its economic development activities, the Agency holds numerous documents containing information on third parties, but very little in the way of personal information. This is why records of requests for access to personal information are so rare.

The following table illustrates the number of access to personal information requests received over the last five years. As the graph indicates, the Agency only processed 6 requests for access to personal information over that period.

Graph 1 – Requests received

Processing times, disposition, extension and exceptions invoked

For the single request received in 2014-2015, the information was released prior to the 15^th day of processing time. As such, no extension was taken. In addition, there was no exception invoked, thus the requester received the information in its entirety.

Pages processed and disclosed

A total of 34 pages was processed and released. Since the Agency rarely processes access to personal information requests, there is no trend that can be detected.

Consultations

The Agency did not resort to any consultation while processing this access to personal information request. Also, the Agency did not receive any consultation from other institutions.

Cost

Expenditures related to the administration of the Act totalled $11,406 in 2014-2015. That amount includes $9,320 in salaries for 0.15 FTEs. Since the Agency modified its Privacy Impact Assessment, $1,350 was spent on professional services. Also, a total of $736 was spent on travel costs, software leasing, supplies and translation services.

Training

In fiscal 2011-2012, we were able to develop and deliver a series of mandatory training sessions entitled Access to Information and Privacy Protection. This major initiative was conducted by the AIPO team and instructed 316 Agency employees on issues of access to information and protection of personal data. In 2013-2014, AIPO continued with training, focusing on new Agency employees or those who did not have the opportunity to attend the training. To this end, seven training sessions were provided to a total of 43 employees.

In 2014-2015, no training session was delivered to Agency employees, as it is offered every other year. However, the AIPO remains available to deliver specific training to employees, whose duties call for a certain grasp of access to information matters. It should be noted that in 2014-2015, the Agency’s access to information senior advisor lent his services and traveled to Nunavut to deliver five training session to employees of the Canadian Northern Economic Development Agency, as well as Aboriginal Affairs and Northern Development Canada. It is a great example of collaboration between departments and also within the federal access to information community.

Administrative policies and practices

Access to information and personal information procedure

For the past four years, AIPO has had an Access to Information and Personal Information Procedure, submitted to and approved by the Agency’s top management. No amendments were made in 2013-2014.

The procedure meets the demands of the Directive on the Administration of the Access to Information Act, as updated in January 2012. The purpose of this directive is to facilitate compliance with legislative and regulatory strictures, spell out the roles and responsibilities of all those involved in processing access requests and provide an efficient model of practices and processes for handling access requests.

In addition to presenting the roles and responsibilities of the various individuals involved, this procedure presents the process for handling requests, intended to illustrate the various processing and approval stages in effect at the Agency, based on the steps indicated in the following diagram.

Directive on Privacy Practices

In 2014-2015, the Agency developed a Directive on Privacy Practices. Its purpose is to foster, within the organization, a common understanding of every concept related to the protection of personal information. In addition, this directive encompasses, in a single document, consistent and sound privacy management practices of personal information. This directive also contributes to developing proper practices for the creation, collection, use, retention, communication and/or recall of personal information in order to reduce the risks of a privacy breach.

Procedure in conducting a Privacy Impact Assessment

In 2014-2015, the Agency introduced a procedure in conducting a privacy impact assessment. This procedure reiterates that personal information compiled from an individual must only be used for the sole purpose it was collected. In addition, when a new activity or a new program is introduced, or major changes are brought, a privacy impact assessment must be conducted prior to collecting the information. This process helps to determine, evaluate and reduce the risks of a privacy breach

Information available on the Agency’s Web site

One section of the Agency’s site has information about its role in applying the Act. There, one can find especially details of access requests processed by AIPO and for which records have been released. In accordance with the Directive on the Administration of the Access to Information Act, the Agency has been publishing a monthly summary of access to information requests processed since May 2011. Summaries contain the identification, abstract and disposition of requests, as well as the number of pages released.

These Web pages also contain practical supplementary information to help citizens who want to file an access request. This section is intended as a gateway to AIPO’s services.

Complaints and investigations

During fiscal year 2013-2014, the Agency received one complaint about a request for access to personal information processed in 2012-2013. This complaint was resolved over the reporting period. The main issue was the application of section 25 (Safety of individuals) to the request in question. The Office of the Privacy Commissioner concluded after its investigation that there was nothing to indicate that the Agency exercised its discretion in an unreasonable or abusive manner. Essentially, the findings showed that the Agency did correctly exempt information under section 25 of the Act and that the requester was not hindered in accessing his/her personal information.

Monitoring of Time

The AIPO ensures the time to process access to personal information requests is monitored through a weekly report of on-going requests. The report provides details of the day an answer is due for each request. This report is distributed to the Agency’s senior management, including the deputy head.

Material Privacy Breaches

There was no material privacy breach that occurred over the reporting period.

Privacy Impact Assessment (PIA)

In 2013-2014, the Agency made the necessary arrangements for a privacy impact assessment for the Quebec Economic Development Program (QEDP). This program came into effect on April 1^st, 2012 and replaced the Business and Regional Growth program and Community Diversification program, keeping essentially the same objectives and characteristics. Its provides a means for the implementation and management of grants and contributions with the purpose to promote the long-term economic development of the regions of Quebec by giving special attention to those where slow economic growth is prevalent or opportunities for productive employment are inadequate.

The Directive on Privacy Impact Assessment published by the Treasury Board of Canada (TB) on April 1, 2010, states that all government institutions subject to the Privacy Act that create, sponsor or fund programs, projects or initiatives involving the collection, use or disclosure of personal information should consider conducting a PIA before proceeding with their projects and initiatives. The assessment found that there was no merit in creating a personal information bank.

Over the course of 2014, the Agency did collect personal information that could potentially lead to an administrative decision which could have consequences for an entrepreneur. Even if unlikely, there is still a possibility that other clients’ files may lead to gathering similar personal information which could also lead to a decision affecting an individual. Thus, and in accordance with the requirements of paragraph 9(4) of the Privacy Act, the Agency decided to create a personal information bank and to update its December 23, 2013 PIA report, in order to reflect the new operational context of the QEDP.

Disclosure of personal information

In 2014-2015, no information was disclosed pursuant to subsection 8.(2)(m).

Actions planned for 2014-2015

The ATIPO will continue to respond to all requests for access to personal information in accordance with the spirit and letter of the Act.

In addition, it will continue improving its business practices while complying with access to personal information-related directives, regulations and major trends. The improvement of its business practices in 2015-2016 will be achieved in part through a training program offered to all employees and managers following the implementation of the new Privacy Policy.

Appendix - Delegation schedule

Delegation Chart - Privacy Act and Privacy Regulations

The President, pursuant to section 73 of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the President as the head of the Economic Development Agency for the Regions of Quebec, under the provisions of the Act and related regulations set out in the schedule opposite each position. This designation replaces all previous delegation orders.

* Legal advice obtained beforehand

Appendix - Statistical report

Part 1: Requests Under the Privacy Act

Part 2: Requests Closed During the Reporting Period

2.5 Complexity

2.6 Deemed refusals

Part 3 - Disclosures Under Subsection 8(2) and 8(5)

Part 4 - Requests for Correction of Personal Information and Notations

Part 5 - Extensions

Part 6: Consultations Received From Other Institutions and Organizations

Part 7: Completion Time of Consultations on Cabinet Confidences

Part 8: Complaints and Investigations Notices Received

Part 9: Privacy Impact Assessments (PIAs)

Part 10: Resources Related to the Privacy Act

Note: Enter values to two decimal places.