Report on the administration of the Privacy Act 2017-2018

Summary of the purpose of the Privacy Act

The Privacy Act (the Act), promulgated on July 1, 1983, aims to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution.

The purpose of the Act is to protect personal information by allowing individuals to consult information about them. It also imposes strict controls on how such information is gathered, used and shared.

Annual report prepared in accordance with section 72

This document was prepared in response to section 72 of the Act, which requires federal institutions to submit an annual report to Parliament on administration of the Act. This report provides details on activities related to administration of the Act at Canada Economic Development for Quebec Regions (CED).

Mandate of the institution

CED is part of the Innovation, Science and Economic Development Portfolio, which is comprised of 17 departments and agencies, including the Regional Development Agencies (such as CED) and other federal agencies, such as the National Research Council (NRC) and the Business Development Bank of Canada (BDC). Their mandate is to “further the government’s goal of building a knowledge-based economy in all regions of Canada and to advance the government’s jobs and growth agenda.”

CED is the key economic development player for Quebec’s regions for small and medium-sized enterprises (SMEs). As part of its mission, CED fosters business start-ups and growth. It helps them become more innovative, productive and competitive. It supports efforts to engage the regions of Quebec and attract investments that will help boost the economic well-being of Quebec and Canada.

CED contributes to the economic vitality of all of Quebec’s regions by leveraging their competitive regional advantages, such as wind power and marine technologies. It also supports the transition and diversification of communities that remain dependent on a limited number of sectors or that have been affected by an economic shock, such as the closure of the chrysotile mines.

CED achieves its results by supporting businesses, primarily SMEs, and non-profit organizations (NPOs), through strategic investments. Through its 12 business offices across Quebec’s regions, its engagement strategy and the relationships it has developed with other economic development players, CED stays abreast of the needs of the regions and businesses and is able to offer financial support to carry out projects that support businesses and communities in their economic development efforts.

CED’s Grants and Contributions Programs and Initiatives, in effect in 2017-18

The CED’s main grants and contributions program, the QEDP, came into effect on April 1, 2012. The main recipients of the program are SMEs, business groups or associations and NPOs whose principal mission is to support businesses or economic development. The QEDP includes repayable and non-repayable contributions.

To learn more about the Agency’s mandate, programming and operations, go to its Web site: www.dec-ced.gc.ca.

Access to Information and Privacy Office

CED fulfills its Access to Information Act (ATI) and Privacy Act (PA) responsibilities with an Access to Information and Privacy Office (AIPO) to process requests. The AIPO reports directly to the Deputy Minister / President’s Chief of Staff.

AIPO has an access to information and privacy coordinator, as well as an advisor and a coordinating agent. The coordinator, with the help of the advisor and agent, oversees compliance with legislation, regulations, procedures and broad government trends.

Through its delegated authority, AIPO represents the Agency on matters relating to the Act in dealings with the public, Treasury Board Secretariat, the Commissioners of Information and Privacy and other federal departments and institutions.

CED’s enabling legislation identifies its head as being the Deputy Minister / President. In addition to managing the institution and overseeing management of its personnel, the Deputy Minister / President is responsible for application of the Privacy Act.

To this end, the authority for application of the Act was delegated to the Coordinator, Access to Information and Privacy, while most administrative authority was delegated to the Advisor, Access to Information and Parliamentary Affairs.

A copy of the signed and dated delegation order is attached to this report.

Requests received and processed

Over fiscal year 2017-18, seven privacy requests were received. There was no request carried over from the previous year. As a result, the seven requests processed in 2017-18 is a slight increase over the last year. However, that figure does include abandoned requests. Ever since CED has been accepting privacy requests submitted on-line, more requests are abandoned. Indeed, applicants have a tendency to select the wrong institution from the drop-down menu when they submit a request. In each of these cases, the AIPO redirected and advised the applicant to submit a new request to the appropriate institution and abandon the request submitted to CED. In all, five requests were abandoned, which brings the total of requests closed during 2016-17 to two. This level is closer to the averages registered in the last five years. Owing to its economic development activities, CED holds numerous documents containing information on third parties, but very little in the way of personal information.

The following table illustrates the number of privacy requests received since 2013-14. Excluding abandoned requests, CED has only processed five privacy requests over that period.

Disposition, completion times and extensions

The Act stipulates that privacy requests must normally be answered within 30 calendar days. Extensions may be granted in only rare instances. Excluding the five requests that were abandoned, CED closed two requests during the reporting period. One request had no existing records and the remaining request was disclosed partially. Hence, no extension was taken as one request was closed prior to day 15 and the other request was within 30 days.

Exemption and exclusion invoked

If we take into account the only request where information was provided, the AIPO partially disclosed the information being sought by invoking protection under section 26 of the Privacy Act. Indeed, the documents included information about another individual. Besides the exemption detailed in the following table, no exclusion was invoked.

Pages processed and disclosed

A total of 871 pages was processed and released. Since CED rarely processes privacy requests, there is no trend that can be detected. However, that number is significantly higher than the 79 pages that were processed in 2016-2017.

Consultations

CED did not resort to any consultation while processing both privacy requests. Also, CED did not process any consultation from other institutions.

Cost

Expenditures related to the administration of the Act totalled $12,386 in 2017-18. That amount includes $12,121 in salaries for 0.15 FTEs. Also, a total of $265 was spent on travel costs, software leasing, supplies and translation services.

A copy of the 2017-18 statistical report on the administration of the Privacy Act is attached to this report.

In 2017-18, no training session was delivered to CED employees, as it is normally offered every other year. However, the AIPO remains available to deliver specific training to employees, whose duties call for a certain grasp of access to information matters.

However, in anticipation of Bill C-58, which will amend the Access to Information Act and the Privacy Act and to make consequential amendments to other Acts, a number of meetings were held in order to increase the awareness of employees which will be called upon to implement the new proactive disclosure requirements.

Lastly, in 2017-18, CED’s Access to Information and Privacy Coordinator became an associated faculty member of the Canada School of Public Service. In that capacity, he delivered courses titled “Access to Information in the Government of Canada” and “Privacy in the Government of Canada Privacy in the Government of Canada”.

Implementation plan for bill c-58: act to amend the access to information act and the privacy act and to make consequential amendments to other acts

An implementation plan was put into place in order for CED to comply with the new proactive disclosure requirements once royal assent is given to Bill C-58, which will amend the Access to Information Act and the Privacy Act and to make consequential amendments to other Acts. This plan details the actions CED has to undertake to proactively disclose new information, such as Briefing packages for new or changing deputy heads, briefing package prepared for the deputy head and public servants for parliamentary committee appearances and titles and tracking numbers of briefing notes to submitted to the minister and deputy heads.

Complaints

During fiscal year 2017-18 CED did not receive any complaint regarding a privacy request.

Audits and investigations

CED was not the subject of any audit over the reporting period, nor was CED under any investigation.

Monitoring of the processing time

The AIPO ensures the time to process privacy requests is monitored through a weekly report of on-going requests. The report provides the details of each request, such as the due date and current status, i.e. documents being retrieved, under review, in consultation or in the approval process. This report is distributed to CED’s senior management, including its Deputy Head.

Since 2011, the AIPO has equipped itself with software to manage and track access to information requests and privacy requests. This program makes it easier to follow every activity and task related to any request and serves as a tool to monitor processing time to comply with the provisions on timeframes as set out in the Act.

Requests for correction

Requests for correction of personal information are processed by the AIPO and a record is kept within an internal tracking system. There was no request for correction of personal information made over the reporting period.

There was no material privacy breach that occurred over the reporting period.

No privacy impact assessment was conducted over the reporting period.

During fiscal year 2017-18, no information was disclosed pursuant to subsection 8.(2)(m) of the Privacy Act.

The President, pursuant to section 73 of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the President as the head of the Economic Development Agency for the Regions of Quebec, under the provisions of the Act and related regulations set out in the schedule opposite each position. This designation replaces all previous delegation orders.

* Legal advice obtained beforehand

I approve the delegation schedule.

Name of institution: Canada Economic Development for Quebec Regions

Reporting period: 2017-04-01 to 2018-03-31

Part 1: Requests Under the Privacy Act

Part 2: Requests Closed During the Reporting Period

2.5 Complexity

2.6 Deemed refusals

Part 3 - Disclosures Under Subsection 8(2) and 8(5)

Part 4 - Requests for Correction of Personal Information and Notations

Part 5 - Extensions

Part 6: Consultations Received From Other Institutions and Organizations

Part 7: Completion Time of Consultations on Cabinet Confidences

Part 8: Complaints and Investigations Notices Received

Part 9: Privacy Impact Assessments (PIAs)

Part 10: Resources Related to the Privacy Act

Note: Enter values to two decimal places.