Annual Report on the Privacy Act 2023-2024
ISSN 2561-8253 (Online)
Table of Contents
- 1 Introduction
- 2 The Public Prosecution Service of Canada
- 3 The ATIP Office
- 4 Delegated authorities
- 5 Performance
- 6 Training and awareness activities
- 7 Policies, guidelines, and procedures
- 8 Complaints and investigations
- 9 Monitoring compliance
- 10 Material privacy breaches
- 11 Privacy impact assessments
- 12 Public interest disclosures
- 13 Appendix A – Delegation order
- 14 Appendix B – Statistical report on the Privacy Act
- 15 Appendix C – Supplemental statistical report on the Access to Information Act and the Privacy Act
1 Introduction
The Privacy Act (the Act) came into force on July 1, 1983. The purpose of the Act is to protect the privacy of individuals with respect to personal information about themselves held by government institutions as well as to provide individuals with a right of access to that information.
The Public Prosecution Service of Canada (PPSC) became subject to the Act when it was established as an independent organization on December 12, 2006, with the coming into force of the Director of Public Prosecutions Act (Part 3 of the Federal Accountability Act).
Pursuant to section 72 of the Act, this 2023-2024 Annual Report on the Act has been prepared for tabling in the House of Commons and the Senate. It provides an analysis of the information contained in the PPSC’s Statistical Report on the Act. It also includes information on emerging trends, training activities, internal policies, guidelines, and procedures with respect to the PPSC’s administration of the Act. Because the PPSC does not have any subsidiaries, information in that regard has not been included.
2 The Public Prosecution Service of Canada
The PPSC’s mandate is set out in the Director of Public Prosecutions Act (DPPA). The DPPA empowers the Director of Public Prosecutions (DPP), as Deputy Attorney General of Canada, to:
- Initiate and conduct federal prosecutions;
- Intervene in proceedings that raise a question of public interest that may affect the conduct of prosecutions or related investigations;
- Issue guidelines to federal prosecutors;
- Advise law enforcement agencies or investigative bodies on general matters relating to prosecutions and on particular investigations that may lead to prosecutions;
- Communicate with the media and the public on all matters that involve the initiation and conduct of prosecutions;
- Exercise the authority of the Attorney General of Canada in respect of private prosecutions; and
- Exercise any other power or carry out any other duty or function assigned by the Attorney General of Canada that is compatible with the office of the DPP.
The DPPA also empowers the DPP to:
- Initiate and conduct prosecutions under the Canada Elections Act; and
- Act, when requested by the Attorney General of Canada, in matters under the Extradition Act and the Mutual Legal Assistance in Criminal Matters Act.
The DPP has the rank and status of a deputy head of a department and, in this capacity, is responsible for the management of the PPSC as a distinct government institution.
3 The ATIP Office
The ATIP Office holds primary responsibility for the implementation and administration of the Privacy Act, along with the Access to Information Act (collectively known as ATIP). The Office deals directly with the public in relation to personal information requests, liaises with Offices of Primary Interest (the subject matter experts) to prepare responses, and serves as the centre of ATIP expertise within the PPSC.
The ATIP Office fulfills its responsibilities by:
- Processing requests for personal information in accordance with the Privacy Act, the Privacy Regulations (the Regulations), and the Treasury Board of Canada’s policies, directives, and guidelines;
- Responding to consultations submitted by other federal government institutions or other levels of government on PPSC records being considered for release, including the review of solicitor-client privilege in records related to criminal proceedings;
- Providing advice to PPSC managers and employees regarding the application and interpretation of the Act, the Regulations, and Treasury Board policies and directives;
- Reviewing PPSC policies, procedures, and agreements as well as making recommendations to ensure that they comply with the requirements of the Act;
- Monitoring the PPSC’s compliance with the Act, its Regulations, and Treasury Board policies and directives;
- Communicating with investigators of the Office of the Privacy Commissioner of Canada to resolve complaints filed against the PPSC;
- Reviewing documents relevant to proactive publication prior to their publication on the PPSC’s website, ensuring that they do not contain personal information;
- Delivering training sessions intended to familiarize the PPSC’s managers and employees with the requirements of the Act, the Regulations, and Treasury Board policies and directives;
- Updating the PPSC’s chapter of the federal government’s publication known as Info Source: Sources of Government and Employee Information;
- Submitting an annual statistical report on the administration of the Act to the Treasury Board of Canada Secretariat (TBS); and
- Preparing an annual reporton the administration of the Act for tabling in both Houses of Parliament.
3.1 Organizational structure
The Director General, Communications and Parliamentary Affairs (CPA), acts as the PPSC’s ATIP Coordinator. The Director of the ATIP Office reports to the Director General, CPA.
During the period from April 1, 2023, to March 31, 2024, the ATIP Office comprised the Director, two (2) Senior Advisors, two (2) Advisors, and one (1) ATIP Officer. There was one (1) consultant during this time. The position of one (1) of the Advisors became vacant midway through the fiscal year.
Section 73.1 of the Act allows for the PPSC to exchange ATIP services with another government institution within the same ministerial portfolio. There were no such service agreements undertaken during this period.
The following chart outlines the organizational structure of the ATIP Office on March 31, 2024:
Text Version
Organizational structure
- ATIP Director
- Senior ATIP Policy and Operations Advisor
- ATIP Officer
- Senior ATIP Policy and Operations Advisor
- ATIP Advisor
- ATIP Advisor
- Senior ATIP Policy and Operations Advisor
4 Delegated authorities
Pursuant to section 73 of the Act, the head of a government institution may designate one or more officers or employees of that institution, by order, to exercise or perform any of the powers, duties, or functions of the head of the institution under the Act.
The DPP, as the “head of institution,” has designated this authority to the Director General, CPA, as well as the Senior Director General, Corporate Services, and the ATIP Director. The ATIP Director exercises this authority in the absence of the Director General, CPA. The Senior Director General, Corporate Services, exercises this authority in the absence of both the Director General, CPA, and the ATIP Director.
A signed copy of the ATIP Delegation Order is available in Appendix A of this report.
5 Performance
The following section provides an overview of key data on the PPSC’s performance for the fiscal year, as reflected in the 2023-2024 Statistical Report on the Act in Appendix B of this report as well as the 2023-2024 Supplemental Statistical Report in Appendix C.
5.1 Requests received under the Privacy Act
5.1.1 Number of requests
The PPSC completely received all but three (3) personal information requests via an online channel, known as the ATIP Online Request Service. This is part of a larger trend in increasingly digital ATIP services.
The PPSC received 16 formal personal information requests in 2023-2024, one (1) more than the 15 received in the previous fiscal year.
Additionally, two (2) requests were carried over from 2022-2023. Altogether, the PPSC had 18 requests to process in 2023-2024.
Since its creation on December 12, 2006, the PPSC has received 255 personal information requests in total. Over time, the organization has experienced periodic, sharp increases in the number of requests received each year. The following chart illustrates this trend:
Note: As the PPSC was created on December 12, 2006, data for 2006-2007 only reflects a three-month period.
Text Version
Fiscal year | Number of requests |
---|---|
2006-2007 | 1 |
2007-2008 | 9 |
2008-2009 | 7 |
2009-2010 | 17 |
2010-2011 | 8 |
2011-2012 | 13 |
2012-2013 | 16 |
2013-2014 | 21 |
2014-2015 | 11 |
2015-2016 | 14 |
2016-2017 | 23 |
2017-2018 | 16 |
2018-2019 | 19 |
2019-2020 | 19 |
2020-2021 | 19 |
2021-2022 | 11 |
2022-2023 | 15 |
2023-2024 | 16 |
Total | 255 |
5.2 Requests closed during the fiscal year
5.2.1 Disposition of requests
The PPSC responded to 16 of the 18 requests received in 2023-2024 or carried over from the previous year, one (1) less than those closed during the last reporting period.
The overall proportion of requests that are closed in a given year has increased since the first two years of the COVID-19 pandemic and is now back at pre-pandemic levels. The trend is described in the chart below, which sets out the closure rate for the past five fiscal years:
Text Version
Fiscal year | Number of requests received or carried over from the previous fiscal year | Number of requests closed | % of requests closed |
---|---|---|---|
2019-2020 | 27 | 24 | 89% |
2020-2021 | 22 | 15 | 68% |
2021-2022 | 18 | 14 | 78% |
2022-2023 | 19 | 17 | 89% |
2023-2024 | 18 | 16 | 89% |
Two (2) requests remained outstanding as of March 31, 2024, and were carried forward to the next fiscal year, which is the same number of requests outstanding at the end of the previous year.
One (1) of the requests still active at the end of the 2023-2024 reporting period was also received at that time and was therefore within legislative timelines going into the next fiscal year. The other outstanding request was received in 2020-2021. An extension to the initial statutory deadline of 30 days, which is the maximum time permitted under the Act, was taken to process a high volume of pages. Despite the extension, further time is needed for processing and it is now past the extended deadline.
The disposition of requests closed in 2023-2024 is as follows:
Text Version
Disposition of requests | Number of requests | % |
---|---|---|
All disclosed | 2 | 13% |
Disclosed in part | 6 | 38% |
No records exist | 3 | 19% |
Abandoned | 5 | 31% |
Total | 16 | 100% |
Records were disclosed in response to half of the 16 requests closed in 2023-2024, whether in full or in part. On average, 56% of requests closed over the past five reporting periods have resulted in full or partial disclosure of records to applicants.
In 2023-2024, the PPSC closed the following requests which did not result in the disclosure of any records:
- No records exist
- Three (3) requests could not be processed because relevant records under the control of the PPSC did not exist. Where possible, applicants were advised of other government institutions that may have records and were provided with contact information accordingly.
- Abandoned
- Five (5) requests were abandoned by applicants. In most abandoned cases, clarification is needed from the applicants in order to process their requests. When the applicants do not provide clarification, the requests are considered to be abandoned. In other cases, the applicants choose to abandon their requests.
5.2.2 Number of pages processed
For the 16 cases closed in 2023-2024, the PPSC processed 2,527 pages relevant to the requests, which is 17% less than the pages processed in the previous period.
The PPSC ATIP Office also reviewed an additional 147 pages received from across the organization that were deemed not relevant to the requests and were therefore not included as part of the responses. This is substantially less than the 6,802 non-relevant pages received in the previous period.
The following is a summary of the relevant pages processed by the PPSC over the last five fiscal years:
Text Version
Fiscal year | Number of pages |
---|---|
2019-2020 | 3,631 |
2020-2021 | 1,273 |
2021-2022 | 13,388 |
2022-2023 | 3,033 |
2023-2024 | 2,527 |
Total | 23,852 |
Average | 7,951 |
5.2.3 Completion time
Of those 16 requests closed in 2023-2024, 13 were processed within the initial 30-day statutory deadline, representing 81% of requests. This is one (1) more than the number closed within the same timeframe in 2022-2023.
On average, over the last five fiscal years, the PPSC has processed 77% of requests within 30 days of receipt. The proportion of requests closed within that timeframe has fluctuated from year to year. In particular, last fiscal year’s decline could be attributed to reduced human resources at the beginning of the year as well as the highest number of access to information requests ever received at the PPSC during the same period. This year, with the sharp reduction of new access to information requests to process, the rate of personal information requests closed within the first 30 days has rebounded.
The overall trend is demonstrated in the chart that follows:
Text Version
Fiscal year | % of closed requests |
---|---|
2019-2020 | 79% |
2020-2021 | 80% |
2021-2022 | 71% |
2022-2023 | 71% |
2023-2024 | 81% |
The following table is a breakdown of the number of days taken to respond to requests in 2023-2024:
Completion time | Number of requests | % |
---|---|---|
1 to 15 days | 5 | 31% |
16 to 30 days | 8 | 50% |
31 to 60 days | 0 | 13% |
61 to 120 days | 0 | 0% |
121 to 180 days | 0 | 0% |
181 to 365 days | 0 | 0% |
More than 365 days | 1 | 6% |
Total | 16 | 100% |
5.2.4 Exemptions
An individual’s right of access to his or her personal information is subject to limited and specific exceptions. Limitations to the right of access are set out in sections 18 through 28 of the Act.
The following is a breakdown of the exemptions applied by the PPSC in 2023-2024 for closed requests:
Text Version
Exemptions | Number of requests |
---|---|
Subparagraph 22(1)(a)(i) | 1 |
Paragraph 22(1)(b) | 2 |
Section 26 | 5 |
Section 27 | 5 |
Over the last five fiscal years, sections 26 (information about another individual) and 27 (solicitor-client privilege) of the Act have been most often invoked by the PPSC when exempting information from disclosure. This reflects the mandate of the PPSC to conduct federal prosecutions, which often involve personal information about individuals, and to provide legal advice to law enforcement agencies and investigative bodies on matters relating to prosecutions.
5.2.5 Exclusions
Records or parts thereof to which the Actdoes not apply are considered to be “excluded.” Pursuant to section 69, the Act does not apply to library or museum material preserved solely for public record or material placed in Library and Archives Canada. Records containing confidences of the King’s Privy Council of Canada, also known as Cabinet confidences, and which have been in existence for less than 20 years are also excluded from the Act pursuant to section 70.
The PPSC did not invoke any exclusions in 2023-2024.
5.2.6 Format of information released
Information was released electronically for all eight (8) requests where the PPSC fully or partially disclosed records in 2023-2024.
Overall, in the last five fiscal years, 98% of releases have been in electronic format, while 2% have been paper-based. At the onset of the COVID-19 pandemic in early 2020, the PPSC, along with the majority of government agencies and the private sector, had shifted its services to a digital-first environment in order to comply with public health measures. While paper-based disclosure packages continue to remain available so that the request process is accessible to all Canadians, PPSC applicants no longer request this option.
The proportion of electronic to paper-based releases of records from year to year is as follows:
Text Version
Fiscal year | Paper | Electronic |
---|---|---|
2019-2020 | 8% | 92% |
2020-2021 | 0% | 100% |
2021-2022 | 0% | 100% |
2022-2023 | 0% | 100% |
2023-2024 | 0% | 100% |
5.2.7 Complexity
Due to the nature of the PPSC’s work, processing requests can be challenging, and requests are regularly deemed “complex” based on a number of factors:
- The applicant’s personal information can be intermixed with that of another individual. In these cases, section 26 of the Act could be applied to protect the personal information of other individuals. Intermixed personal information was the main complicating factor in three (3) requests closed in 2023-2024. Legal advice may also be sought by the ATIP Office regarding the relevancy or disclosure of records, which can add complexity to how a request is processed. This was predominantly the case for another request closed within the reporting period.
- Many requests also required that the PPSC retrieve records from regions across the country. The searches undertaken for requests closed this fiscal year were evenly distributed between most regional offices, which were tasked one to two (1 to 2) times each.
5.2.8 Deemed refusals
Requests that are not closed within the initial 30-day statutory deadline or within a timeframe covered by an extension provided by the Act are referred to as “deemed refusals.” Further information on the circumstances in which an extension to the original deadline is permitted by the Act is available in section 5.4 (Extensions) of this report.
All but one (1) of the 16 requests closed in 2023-2024 were responded to within the initial deadline or within an extended timeframe, representing 94% of cases.
Regarding the one (1) request closed as a deemed refusal, the delay was principally due to the large volume of records involved as well as the complexity of the subject matter, which would have also required extensive consultations with various law enforcement agencies across Canada had the request not been abandoned by the applicant during the fiscal year. Because of these factors, while an extension to the initial statutory deadline was taken, the file required more time to process than the maximum 30 additional days allowed under the Act.
5.2.9 Requests for translation
During the 2023-2024 fiscal year, the PPSC did not receive any requests from applicants to translate records from one official language to the other. This is consistent with the last five fiscal years.
5.3 Requests for correction of personal information and notations
Where correction is not possible, an individual has the right to request that a notation about the error or omission be placed on their file.
Paragraph 12(2)(a) of the Act provides every individual that is given access to their personal information the right to request correction if:
- The individual believes there is an error or omission regarding their information; and
- The information has been, is being used, or is available for use for an administrative purpose (i.e., a decision-making process that directly affects the individual).
There were no requests for correction of personal information or notations in 2023-2024. This has been typical of the last five fiscal years.
5.4 Extensions
Paragraph 15(a) of the Act allows for an extension of the initial statutory deadline for a maximum of 30 additional days in cases where:
- Meeting the original deadline would unreasonably interfere with the operations of the government institution processing the request;
- Consultations with other government institutions are necessary and cannot be reasonably completed within the original deadline; and
- Translation or format conversion of records is requested by the applicant.
Over the last five fiscal years, the PPSC has taken three (3) extensions under the Act each year, on average.
The PPSC took three (3) extensions to process three (3) requests closed in 2023-2024, one (1) less than in the previous period.
All extensions were taken for the maximum length of time permitted by the Act. One (1) extension was mainly due to a high volume of records to process. In the other two (2) cases, additional time was needed because further analysis was required to determine whether exemptions would apply to the records in question and doing so within the original timeframe would have interfered with the PPSC’s operations.
The following table summarizes the length and reasons for the extensions:
Length of extensions | Reasons for extensions | |||||||
---|---|---|---|---|---|---|---|---|
Sub-paragraph 15(a)(i) – Interference with operations | Sub-paragraph 15(a)(ii) – Consultation | Paragraph 15(b) – Translation purposes or conversion | ||||||
Further review required to determine exemptions | Large volume of pages | Large volume of records | Records are difficult to obtain | Cabinet confidences (Section 70) | External | Internal | ||
15 days or less | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
16 to 30 days | 2 | 1 | 0 | 0 | 0 | 0 | 0 | 0 |
Total | 2 | 1 | 0 | 0 | 0 | 0 | 0 | 0 |
5.5 Consultations received from other institutions
5.5.1 Number of consultations
The PPSC received three (3) consultations from other government institutions for processing under the Act in 2023-2024, two (2) more than in the previous period.
The PPSC has received 125 consultations in total since December 12, 2006. There was a sharp increase in the number of consultations in 2010-2011, but since then and especially in recent fiscal years, the number of consultations received by the PPSC has largely declined.
The following chart illustrates this trend:
Note: As the PPSC was created on December 12, 2006, data for 2006-2007 only reflects a three-month period.
Text Version
Fiscal year | Number of consultations |
---|---|
2006-2007 | 2 |
2007-2008 | 6 |
2008-2009 | 7 |
2009-2010 | 16 |
2010-2011 | 24 |
2011-2012 | 10 |
2012-2013 | 12 |
2013-2014 | 13 |
2014-2015 | 7 |
2015-2016 | 8 |
2016-2017 | 2 |
2017-2018 | 5 |
2018-2019 | 5 |
2019-2020 | 1 |
2020-2021 | 2 |
2021-2022 | 1 |
2022-2023 | 1 |
2023-2024 | 3 |
Total | 125 |
5.5.2 Sources of consultations
The consultations received in 2023-2024 originated from provincial governments: two (2) from Service Nova Scotia and one (1) from Service Alberta and Red Tape Reduction. The sources for consultations received by the PPSC typically vary from year to year.
5.5.3 Disposition and recommendations
The PPSC responded to all three (3) consultations received in 2023-2024. Accordingly, there were no consultations outstanding as of March 31, 2024.
The PPSC processed 18 pages to respond to these consultations. In comparison, 444 pages were processed in 2022-2023. The number of pages processed over the last five fiscal periods has considerably fluctuated from year to year, which is demonstrated in the following chart:
Text Version
Fiscal year | Number of pages processed |
---|---|
2019-2020 | 1 |
2020-2021 | 686 |
2021-2022 | 6 |
2022-2023 | 444 |
2023-2024 | 18 |
For the consultations completed in 2023-2024, the PPSC recommended that the records either be fully disclosed in one (1) case or disclosed part in the other two (2) cases. Over the last five fiscal years, the PPSC has never recommended full exemption of records sent in consultation.
5.5.4 Completion time
All three (3) consultations completed in 2023-2024 were closed within 30 days of receipt.
Over the last five fiscal years, 75% of the consultations completed were closed within the first 30 days. Any consultations closed past that point involved a large number of records to process.
5.6 Consultations on Cabinet confidences
No consultations regarding section 70 (Cabinet confidences) of the Act were carried out during fiscal year 2023-2024.
5.7 Costs
In the 2023-2024 fiscal year, the PPSC spent a total of $301,882 administering the Act, of which salaries accounted for 71% of expenditures at $214,862, while goods and services accounted for the remaining $87,020. No overtime expenditures were incurred during this period.
The substantial increase in expenditures related to goods and services, as compared with previous fiscal years, is due to the purchase of licenses for new ATIP case management software.
6 Training and awareness activities
No formal training sessions were delivered to PPSC employees in 2023-2024.
Presentations were delivered in the past to raise awareness of corporate responsibilities regarding ATIP. These materials continue to be made available to all PPSC employees through the internal website. Communiqués on ATIP topics were also distributed throughout the year to all employees, which included promoting Data Privacy Week 2024.
ATIP personnel provided informal learning to employees on an ad hoc basis regarding the processing of personal information requests and regularly provided advice to PPSC officials on the interpretation of the Act, including the appropriate collection, use, disclosure, and safeguarding of personal information.
7 Policies, guidelines, and procedures
7.1 ATIP governance structure
The PPSC ATIP Governance Structure was approved by the PPSC’s Executive Council in October 2011. It outlines the reporting relationships within the PPSC and establishes clear responsibilities for decision-making for the purposes of administering the Act.
7.2 Info Source
Info Source: Sources of Government and Employee Information is published on the Government of Canada’s canada.ca website. It provides information about the functions, programs, activities, and related information holdings of government institutions subject to the Access to Information Act and the Privacy Act.
It also serves as the Government’s repository of personal information banks (PIBs), which outline how personal information is collected, used, disclosed, retained, and disposed of in order to administer the Government’s programs and services.
At least once a year, the PPSC ATIP Office reviews and updates information, if necessary, about the PPSC’s activities and information holdings in the publication. Standard PIBs were updated in 2023-2024 to align with changes made by the Treasury Board of Canada Secretariat.
7.3 Updates and initiatives to improve privacy
During the 2023-2024 fiscal year, the PPSC ATIP Office continued to update office correspondence templates to ensure accuracy, improve communications with applicants and PPSC officials, and align with Treasury Board requirements.
No new or revised internal policies, guidelines, and procedures were implemented during the reporting period. The PPSC expects to develop new or revised instruments in coming years to align with updated Treasury Board directives supporting the Act and in preparation for open government initiatives and the ongoing modernization of ATIP digital services.
8 Complaints and investigations
Decisions made under the Act are subject to a two-tiered system of review. This ensures government institutions’ compliance with their privacy protection obligations as well as respect for applicants’ right of access to their personal information and fair treatment. The first level of review is a formal complaint made to the Privacy Commissioner. The second level is an application for judicial review to the Federal Court.
The PPSC reviews the outcomes of all Office of the Privacy Commissioner (OPC) investigations and incorporates lessons learned into business processes, where appropriate.
One (1) new complaint was filed with the OPC against the PPSC in 2023-2024, while another complaint investigation remained open from the previous period. Altogether, the PPSC responded to two (2) complaints throughout the current fiscal year, the investigations of which were all completed by March 31, 2024. As a result, there were no open complaints at the start of the next reporting period.
In the case of the newly received complaint, the PPSC advised the applicant that no records exist within the organization that would be relevant to their request. In response, the applicant filed a complaint with the OPC alleging that the PPSC failed to conduct a reasonable search for records. After reviewing the request processing file, the OPC resolved the complaint with the applicant through their early resolution process and closed the investigation accordingly, with no further action required on the PPSC’s part.
Similarly, in the case of the one (1) complaint outstanding from the previous period, the complainant alleged that the PPSC failed to conduct a reasonable search for records after receiving none in response to their request. After reviewing the file, the OPC determined that the complaint was not well-founded.
The following table summarizes the reasons for the complaint received by the PPSC in fiscal year 2023-2024 as well as the OPC’s findings for the concluded investigations:
Reason for complaint | Number of complaints | Results of investigations | |||
---|---|---|---|---|---|
Well-founded | Not well-founded | Discontinued | OPC has yet to issue its findings | ||
Refusal – Exemptions and exclusions | 0 | 0 | 0 | 0 | 0 |
Refusal – General | 2 | 0 | 1 | 1 | 0 |
Delay | 0 | 0 | 0 | 0 | 0 |
Total | 2 | 0 | 1 | 1 | 0 |
The Commissioner did not undertake any privacy audits involving the PPSC in 2023-2024. There were also no applications for judicial review filed with the Federal Court during this same period.
9 Monitoring compliance
The ATIP Office maintains a comprehensive statistical reporting and performance measurement system to track the processing of formal requests, informal requests, and consultations received by the PPSC.
Each ATIP staff member is responsible for monitoring the time taken to process files that they are assigned on a regular basis, while the Senior ATIP Advisors meet with the ATIP Director twice a week to review timelines and address challenges that could affect the PPSC’s ability to meet its legal obligations under the Act. The ATIP Director meets weekly with the ATIP Coordinator on the status of active requests, complaints, and any issues that have arisen.
When records originating from or involving another institution are reviewed, the ATIP Coordinator, with the support of the ATIP Office, assesses whether a consultation is required. The factors under consideration in the exercise of discretion to consult depend on the circumstances of each file. These factors include:
- Cases where disclosure is contemplated;
- Whether exemptions or exclusions are applicable;
- How similar records from past requests were processed;
- The expertise of the ATIP Office and other PPSC officials in the subject matter; and
- The expected timelines for receiving a response to the consultation.
In this way, the PPSC aims to limit consultations so that requests are responded to within the shortest timelines possible.
The ATIP Office also formally reports to the PPSC’s senior management on a monthly basis about its activities, caseload, performance metrics, and privacy trends. In addition to reporting, the Office advises various PPSC officials on appropriate privacy protections to be included in contracts and information sharing agreements, on request.
The PPSC did not undertake a review in 2023-2024 to assess the feasibility of making frequently requested personal information available to individuals through informal means outside of the ATIP Office context.
10 Material privacy breaches
A privacy breach involves improper or unauthorized collection, use, disclosure, retention, or disposal of sensitive personal information.
The ATIP Office received 14 privacy breach reports in 2023-2024, four (4) of which were considered to be material breaches. A material privacy breach could reasonably be expected to cause serious injury or harm to the individual to whom it relates. These cases are to be reported to the TBS and the OPC, as required by the Treasury Board’s Directive on Privacy Practices.
Three (3) of the four (4) material breaches involved insufficient safeguarding of sensitive materials within disclosure packages submitted by the PPSC to defence counsels and the accused as part of legal proceedings. These packages contained information that could potentially identify confidential informants involved in criminal investigations, thereby risking the safety of these individuals. In all three (3) cases, the PPSC and relevant law enforcement agencies took appropriate steps to mitigate the impact of these breaches while avoiding any actions that could potentially create more risk for the informants. The disclosure packages were returned or destroyed where possible. Law enforcement agencies also notified the affected individuals where appropriate, and no harm had been reported as a result of the breaches.
In the remaining case, a material, government-wide breach occurred when suspicious and unauthorized activity was identified on third-party systems belonging to Sirva Worldwide systems. This company provides relocation services to Government of Canada employees through institutional contracts, one of which belonging to the PPSC. Personal information regarding past and present employees that used relocation services, as well as their spouses and dependents, were found on a dark website and included financial and passport data. The TBS led government efforts to mitigate the breach’s impact on the affected individuals. For its part, the PPSC notified affected employees and provided free access to credit monitoring services.
11 Privacy impact assessments
A privacy impact assessment (PIA) is a tool that assists a government institution in meeting its privacy responsibilities regarding the management of personal information. Institutions initiate PIAs when assessing the privacy implications of new or substantially modified programs and activities involving personal information.
No PIAs were completed at the PPSC in 2023-2024.
12 Public interest disclosures
Subsection 8(2) of the Act describes the circumstances under which personal information under the control of a government institution may be disclosed without the individual’s consent.
In particular, disclosures without consent may be made in the public interest, pursuant to paragraph 8(2)(m) of the Act. The PPSC did not make any such disclosures in 2023-2024.
13 Appendix A – Delegation order
The Director of Public Prosecutions, pursuant to section 73 of the Access to Information Act and section 73 of the Privacy Act, as they existed prior to June 21, 2019, and pursuant to the current subsection 95(1) of the Access to Information Act and subsection 73(1) of the Privacy Act, hereby designates to the persons holding the positions set out in the schedule hereto the powers, duties and functions of the Director of Public Prosecutions as the head of the Office of the Director of Public Prosecutions, under the under the provisions of the Acts and related regulations set out in the schedule opposite each position. This designation replaces all previous delegation orders.
Schedule
Position | Access to Information Act and Regulations | Privacy Act and Regulations |
---|---|---|
Senior Director General, Corporate Services | Full Authority | Full Authority |
Director General, Communications and Parliamentary Affairs | Full Authority | Full Authority |
Manager, ATIP | Full Authority | Full Authority |
Dated, at the City of Ottawa, this 22 nd day of February, 2021.
(original signed by)
Kathleen Roussel
Director of Public Prosecutions
14 Appendix B – Statistical report on the Privacy Act
- Name of institution
- Public Prosecution Service of Canada
- Reporting period
- 2023-04-01 to 2024-03-31
Section 1: Requests Under the Privacy Act
Number of Requests | |
---|---|
Received during reporting period | 16 |
Oustanding from previous reporting periods
|
2 |
Total | 18 |
Closed during reporting period | 16 |
Carried over to next reporting period
|
2 |
Source | Number of Requests |
---|---|
Online | 13 |
3 | |
0 | |
In person | 0 |
Phone | 0 |
Fax | 0 |
Total | 16 |
Section 2: Informal requests
Number of Requests | |
---|---|
Received during reporting period | 1 |
Outstanding from previous reporting periods
|
0 |
Total | 1 |
Closed during reporting period | 1 |
Carried over to next reporting period | 0 |
Source | Number of Requests |
---|---|
Online | 0 |
1 | |
0 | |
In person | 0 |
Phone | 0 |
Fax | 0 |
Total | 1 |
1 to 15 Days | 16 to 30 Days | 31 to 60 Days | 61 to 120 Days | 121 to 180 Days | 181 to 365 Days | More Than 365 Days | Total |
---|---|---|---|---|---|---|---|
1 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
Less Than 100 Pages Released |
100-500 Pages Released |
501-1000 Pages Released |
1001-5000 Pages Released |
More Than 5000 Pages Released |
|||||
---|---|---|---|---|---|---|---|---|---|
Number of Requests | Pages Released | Number of Requests | Pages Released | Number of Requests | Pages Released | Number of Requests | Pages Released | Number of Requests | Pages Released |
0 | 0 | 1 | 226 | 0 | 0 | 0 | 0 | 0 | 0 |
Section 3: Requests Closed During the Reporting Period
Disposition of requests | Completion Time | |||||||
---|---|---|---|---|---|---|---|---|
0 to 15 days | 16 to 30 days | 31 to 60 days | 61 to 120 days | 121 to 180 days | 181 to 365 days | More than 365 days | Total | |
All disclosed | 0 | 2 | 0 | 0 | 0 | 0 | 0 | 2 |
Disclosed in part | 0 | 4 | 2 | 0 | 0 | 0 | 0 | 6 |
All exempted | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
All excluded | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
No records exist | 1 | 2 | 0 | 0 | 0 | 0 | 0 | 3 |
Request abandoned | 4 | 0 | 0 | 0 | 0 | 0 | 1 | 5 |
Neither confirmed nor denied | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Total | 5 | 8 | 2 | 0 | 0 | 0 | 1 | 16 |
Section | Number of Requests |
---|---|
18(2) | 0 |
19(1)(a) | 0 |
19(1)(b) | 0 |
19(1)(c) | 0 |
19(1)(d) | 0 |
19(1)(e) | 0 |
19(1)(f) | 0 |
20 | 0 |
21 | 0 |
22(1)(a)(i) | 1 |
22(1)(a)(ii) | 0 |
22(1)(a)(iii) | 0 |
22(1)(b) | 2 |
22(1)(c) | 0 |
22(2) | 0 |
22.1 | 0 |
22.2 | 0 |
22.3 | 0 |
22.4 | 0 |
23(a) | 0 |
23(b) | 0 |
24(a) | 0 |
24(b) | 0 |
25 | 0 |
26 | 5 |
27 | 5 |
27.1 | 0 |
28 | 0 |
Section | Number of Requests |
---|---|
69(1)(a) | 0 |
69(1)(b) | 0 |
69.1 | 0 |
70(1) | 0 |
70(1)(a) | 0 |
70(1)(b) | 0 |
70(1)(c) | 0 |
70(1)(d) | 0 |
70(1)(e) | 0 |
70(1)(f) | 0 |
70.1 | 0 |
Paper | Electronic | Other | |||
---|---|---|---|---|---|
E-record | Data set | Video | Audio | ||
0 | 8 | 0 | 0 | 0 | 0 |
3.5 Complexity
Number of Pages Processed | Number of Pages Disclosed | Number of Requests |
---|---|---|
2527 | 2203 | 13 |
Disposition | Less than 100 Pages Processed | 100-500 Pages Processed | 501-1000 Pages Processed | 1001-5000 Pages Processed | More than 5000 Pages Processed | |||||
---|---|---|---|---|---|---|---|---|---|---|
Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | |
All disclosed | 1 | 1 | 0 | 0 | 0 | 0 | 1 | 1881 | 0 | 0 |
Disclosed in part | 4 | 147 | 2 | 498 | 0 | 0 | 0 | 0 | 0 | 0 |
All exempted | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
All excluded | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Request abandoned | 5 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Neither confirmed nor denied | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Total | 10 | 148 | 2 | 498 | 0 | 0 | 1 | 1881 | 0 | 0 |
Number of Minutes Processed | Number of Minutes Disclosed | Number of Requests |
---|---|---|
0 | 0 | 0 |
Disposition | Less than 60 Minutes processed | 60-120 Minutes processed | More than 120 Minutes processed | |||
---|---|---|---|---|---|---|
Number of requests | Minutes Processed | Number of requests | Minutes Processed | Number of requests | Minutes Processed | |
All disclosed | 0 | 0 | 0 | 0 | 0 | 0 |
Disclosed in part | 0 | 0 | 0 | 0 | 0 | 0 |
All exempted | 0 | 0 | 0 | 0 | 0 | 0 |
All excluded | 0 | 0 | 0 | 0 | 0 | 0 |
Request abandoned | 0 | 0 | 0 | 0 | 0 | 0 |
Neither confirmed nor denied | 0 | 0 | 0 | 0 | 0 | 0 |
Total | 0 | 0 | 0 | 0 | 0 | 0 |
Number of Minutes Processed | Number of Minutes Disclosed | Number of Requests |
---|---|---|
0 | 0 | 0 |
Disposition | Less than 60 Minutes processed | 60-120 Minutes processed | More than 120 Minutes processed | |||
---|---|---|---|---|---|---|
Number of requests | Minutes Processed | Number of requests | Minutes Processed | Number of requests | Minutes Processed | |
All disclosed | 0 | 0 | 0 | 0 | 0 | 0 |
Disclosed in part | 0 | 0 | 0 | 0 | 0 | 0 |
All exempted | 0 | 0 | 0 | 0 | 0 | 0 |
All excluded | 0 | 0 | 0 | 0 | 0 | 0 |
Request abandoned | 0 | 0 | 0 | 0 | 0 | 0 |
Neither confirmed nor denied | 0 | 0 | 0 | 0 | 0 | 0 |
Total | 0 | 0 | 0 | 0 | 0 | 0 |
Disposition | Consultation Required | Legal Advice Sought | Interwoven Information | Other | Total |
---|---|---|---|---|---|
All disclosed | 0 | 0 | 0 | 1 | 1 |
Disclosed in part | 0 | 1 | 2 | 3 | 6 |
All exempted | 0 | 0 | 0 | 1 | 1 |
All excluded | 0 | 0 | 0 | 0 | 0 |
Request abandoned | 0 | 0 | 1 | 0 | 1 |
Neither confirmed nor denied | 0 | 0 | 0 | 0 | 0 |
Total | 0 | 1 | 3 | 5 | 9 |
3.6 Closed requests
Number of requests closed within legislated timelines | Percentage of requests closed within legislated timelines (%) |
---|---|
15 | 93.75 |
3.7 Deemed refusals
Number of requests closed past the legislated timelines | Principal Reason | |||
---|---|---|---|---|
Interference with Operations / Workload | External Consultation | Internal Consultation | Other | |
1 | 1 | 0 | 0 | 0 |
Number of days past legislated timelines | Number of requests past legislated timeline where no extension was taken | Number of requests past legislated timeline where an extension was taken | Total |
---|---|---|---|
1 to 15 days | 0 | 0 | 0 |
16 to 30 days | 0 | 0 | 0 |
31 to 60 days | 0 | 0 | 0 |
61 to 120 days | 0 | 0 | 0 |
121 to 180 days | 0 | 0 | 0 |
181 to 365 days | 0 | 0 | 0 |
More than 365 days | 0 | 0 | 0 |
Total | 0 | 1 | 1 |
Translation Requests | Accepted | Refused | Total |
---|---|---|---|
English to French | 0 | 0 | 0 |
French to English | 0 | 0 | 0 |
Total | 0 | 0 | 0 |
Section 4: Disclosures Under Subsections 8(2) and 8(5)
Paragraph 8(2)(e) | Paragraph 8(2)(m) | Paragraph 8(5) | Total |
---|---|---|---|
0 | 0 | 0 | 0 |
Section 5: Requests for Correction of Personal Information and Notations
Disposition for Correction Requests Received | Number |
---|---|
Notations attached | 0 |
Requests for correction accepted | 0 |
Total | 0 |
Section 6: Extensions
Number of extensions taken | 15(a)(i) Interference with operations | 15 (a)(ii) Consultation | 15(b) Translation purposes or conversion | |||||
---|---|---|---|---|---|---|---|---|
Further review required to determine exemptions | Large volume of pages | Large volume of requests | Documents are difficult to obtain | Cabinet Confidence Section (Section 70) | External | Internal | ||
3 | 2 | 1 | 0 | 0 | 0 | 0 | 0 | 0 |
Length of Extensions | 15(a)(i) Interference with operations | 15 (a)(ii) Consultation | 15(b) Translation purposes or conversion | |||||
---|---|---|---|---|---|---|---|---|
Further review required to determine exemptions | Large volume of pages | Large volume of requests | Documents are difficult to obtain | Cabinet Confidence Section (Section 70) | External | Internal | ||
1 to 15 days | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
16 to 30 days | 2 | 1 | 0 | 0 | 0 | 0 | 0 | 0 |
31 days or greater | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Total | 2 | 1 | 0 | 0 | 0 | 1 | 0 | 0 |
Section 7: Consultations Received from Other Institutions and Organizations
Consultations | Other Government of Canada Institutions | Number of Pages to Review | Other Organizations | Number of Pages to Review |
---|---|---|---|---|
Received during the reporting period | 0 | 0 | 3 | 18 |
Outstanding from the previous reporting period | 0 | 0 | 0 | 0 |
Total | 0 | 0 | 3 | 18 |
Closed during the reporting period | 0 | 0 | 3 | 18 |
Carried over within negotiated timelines | 0 | 0 | 0 | 0 |
Carried over beyond negotiated timelines | 0 | 0 | 0 | 0 |
Recommendation | Number of Days Required to Complete Consultation Requests | |||||||
---|---|---|---|---|---|---|---|---|
0 to 15 days | 16 to 30 days | 31 to 60 days | 61 to 120 days | 121 to 180 days | 181 to 365 days | More than 365 days | Total | |
All disclosed | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Disclose in part | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
All exempted | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
All excluded | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Consult other institution | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Other | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Total | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Recommendation | Number of Days Required to Complete Consultation Requests | |||||||
---|---|---|---|---|---|---|---|---|
0 to 15 days | 16 to 30 days | 31 to 60 days | 61 to 120 days | 121 to 180 days | 181 to 365 days | More than 365 days | Total | |
All disclosed | 1 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
Disclose in part | 0 | 2 | 0 | 0 | 0 | 0 | 0 | 2 |
All exempted | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
All excluded | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Consult other institution | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Other | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Total | 1 | 2 | 0 | 0 | 0 | 0 | 0 | 3 |
Section 8 – Completion Time of Consultations on Cabinet Confidences
Number of Days | Fewer Than 100 Pages Processed | 101-500 Pages Processed | 501-1000 Pages Processed | 1001-5000 Pages Processed | More than 5000 Pages Processed | |||||
---|---|---|---|---|---|---|---|---|---|---|
Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | |
1 to 15 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
16 to 30 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
31 to 60 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
61 to 120 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
121 to 180 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
181 to 365 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
More than 365 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Total | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Number of Days | Fewer Than 100 Pages Processed | 101-500 Pages Processed | 501-1000 Pages Processed | 1001-5000 Pages Processed | More than 5000 Pages Processed | |||||
---|---|---|---|---|---|---|---|---|---|---|
Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | Number of Requests | Pages Disclosed | |
1 to 15 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
16 to 30 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
31 to 60 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
61 to 120 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
121 to 180 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
181 to 365 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
More than 365 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Total | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Section 9 – Complaints and Investigations Notices Received
Section 31 | Section 33 | Section 35 | Court Action | Total |
---|---|---|---|---|
1 | 0 | 2 | 0 | 3 |
Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)
Number of PIAs completed | Number of PIAs modified |
---|---|
0 | 0 |
Personal Information Banks | Active | Created | Terminated | Modified |
---|---|---|---|---|
Institution-specific | 6 | 0 | 0 | 0 |
Central | 0 | 0 | 0 | 0 |
Total | 6 | 0 | 0 | 0 |
Section 11 – Material Privacy Breaches
Number of material privacy breaches reported to TBS | Number of material privacy breaches reported to OPC |
---|---|
4 | 4 |
Number of non-material privacy breaches |
---|
10 |
Section 12 – Resources related to the Privacy Act
Expenditures | Amount |
---|---|
Salaries | $214,862 |
Overtime | $0 |
Goods and Services
|
$87,020 |
Total | $301,882 |
Resources | Person Years Dedicated to Privacy Activities |
---|---|
Full-time employees | 2.020 |
Part-time and casual employees | 0.000 |
Regional staff | 0.000 |
Consultants and agency personnel | 0.000 |
Students | 0.000 |
Total | 2.020 |
15 Appendix C – Supplemental statistical report on the Access to Information Act and the Privacy Act
- Name of institution
- Public Prosecution Service of Canada
- Reporting period
- 2023-04-01 to 2024-03-31
Section 1: Open Requests and Complaints Under the Access to Information Act
Fiscal Year Open Requests Were Received | Open Requests that are Within Legislated Timelines as of March 31, 2024 | Open Requests that are Beyond Legislated Timelines as of March 31, 2024 | Total |
---|---|---|---|
Received in 2023-24 | 1 | 0 | 1 |
Received in 2022-23 | 0 | 0 | 0 |
Received in 2021-22 | 1 | 1 | 2 |
Received in 2020-21 | 0 | 0 | 0 |
Received in 2019-20 | 0 | 1 | 1 |
Received in 2018-19 | 0 | 0 | 0 |
Received in 2017-18 | 0 | 0 | 0 |
Received in 2016-17 | 0 | 0 | 0 |
Received in 2015-16 | 0 | 0 | 0 |
Received in 2014-15 or earlier | 0 | 0 | 0 |
Total | 2 | 2 | 4 |
Fiscal Year Open Complaints Were Received by Institution | Number of Open Complaints |
---|---|
Received in 2023-24 | 0 |
Received in 2022-23 | 0 |
Received in 2021-22 | 0 |
Received in 2020-21 | 0 |
Received in 2019-20 | 0 |
Received in 2018-19 | 0 |
Received in 2017-18 | 0 |
Received in 2016-17 | 0 |
Received in 2015-16 | 0 |
Received in 2014-15 or earlier | 0 |
Total | 0 |
Section 2: Open Requests and Complaints Under the Privacy Act
Fiscal Year Open Requests Were Received | Open Requests that are Within Legislated Timelines as of March 31, 2024 | Open Requests that are Beyond Legislated Timelines as of March 31, 2024 | Total |
---|---|---|---|
Received in 2023-24 | 1 | 0 | 1 |
Received in 2022-23 | 0 | 0 | 0 |
Received in 2021-22 | 0 | 0 | 0 |
Received in 2020-21 | 0 | 1 | 1 |
Received in 2019-20 | 0 | 0 | 0 |
Received in 2018-19 | 0 | 0 | 0 |
Received in 2017-18 | 0 | 0 | 0 |
Received in 2016-17 | 0 | 0 | 0 |
Received in 2015-16 | 0 | 0 | 0 |
Received in 2014-15 or earlier | 0 | 0 | 0 |
Total | 1 | 1 | 2 |
Fiscal Year Open Complaints Were Received by Institution | Number of Open Complaints |
---|---|
Received in 2023-24 | 0 |
Received in 2022-23 | 0 |
Received in 2021-22 | 0 |
Received in 2020-21 | 0 |
Received in 2019-20 | 0 |
Received in 2018-19 | 0 |
Received in 2017-18 | 0 |
Received in 2016-17 | 0 |
Received in 2015-16 | 0 |
Received in 2014-15 or earlier | 0 |
Total | 0 |
Section 3: Social Insurance Number
Has your institution begun a new collection or a new consistent use of the SIN in 2023-24? |
---|
No |
Section 4: Universal Access under the Privacy Act
How many requests were received from foreign nationals outside of Canada in 2023-24? |
---|
0 |
- Date modified: