ARCHIVED — 2008–09 Annual Report on the Privacy Act

warning View the most recent version. The following document is out of date.

Archived Content

Information identified as archived on the Web is for reference, research or recordkeeping purposes. It has not been altered or updated after the date of archiving. Web pages that are archived on the Web are not subject to the Government of Canada Web Standards. As per the Communications Policy of the Government of Canada, you can request alternate formats on the "Contact Us" page.

2008–2009 Annual Report on the Privacy Act

PDF version
(147 KB, 23 pages)

Information on downloading a PDF reader

This publication is available upon request in accessible formats. Contact:

Multimedia Services Section
Communications and Marketing Branch
Industry Canada
Room 264D, West Tower
235 Queen Street
Ottawa ON K1A 0H5

Telephone: 613-948-1554
Fax: 613-947-7155
Email: multimedia.production@ic.gc.ca

This publication is also available electronically on the World Wide Web at the following address: Information and Privacy Rights Administration (IPRA): References

Permission to Reproduce
The information in this publication may be reproduced, in part or in whole and by any means, without charge or further permission from Industry Canada, provided that due diligence is exercised in ensuring the accuracy of the information reproduced; that Industry Canada is identified as the source institution; and that the reproduction is not represented as an official version of the information reproduced, nor as having been made in affiliation with, or with the endorsement of, Industry Canada.

For permission to reproduce the information in this publication for commercial redistribution, please email: copyright.droitdauteur@pwgsc.gc.ca

Cat. No. Iu1-4/1-2009
ISBN 978-1-100-50058-4

top of page

Contents

top of page

Preface and Purpose

The Privacy Act (Revised Statutes of Canada, Chapter A–1, 1985) was proclaimed on July 1, 1983.

The purpose of the Privacy Act "is to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution and to provide individuals with a right of access to that information" (Section 2 of the Act). The law also protects an individual's privacy by preventing others from having access to that personal information and allows an individual specific rights concerning the collection and use of his/her information.

Section 72 of the Privacy Act requires that the head of every government institution prepare for submission to Parliament an annual report on the administration of this Act within the institution during each financial year.

This annual report describes how Industry Canada administered its responsibilities in the twenty-sixth year of operation of the Privacy Act.

top of page

About the Organization

Industry Canada's Mandate

Industry Canada's mandate is to help make Canadians more productive and competitive in the knowledge-based economy, thus improving the standard of living and quality of life in Canada. The Department's policies, programs and services help grow a dynamic and innovative economy that:

  • provides more and better-paying jobs for Canadians;
  • supports stronger business growth through continued improvements in productivity and innovation performance;
  • gives consumers, businesses and investors confidence that the marketplace is fair, efficient and competitive;
  • ensures a more sustainable economic, environmental and social future for Canadians.

Industry Canada aims to help Canadians contribute to the knowledge economy and improve productivity and innovation performance through its three strategic objectives:

  1. a fair, efficient and competitive marketplace
  2. an innovative economy
  3. a competitive industry and sustainable communities

In order to foster growth and create high-quality, well-paying jobs, the Government of Canada has set as one of its core priorities the building of a 21st-century economy. Industry Canada will continue to work in support of this priority through its strategic objectives. For example, sound marketplace frameworks help establish a business environment that supports innovation, investment and entrepreneurial activity.

Fostering innovation in science and technology helps ensure that discoveries and breakthroughs happen here in Canada, and that the social and economic benefits of these innovations contribute to Canadians' standard of living and quality of life.

Promoting economic development in communities encourages an innovative, knowledge-based economy by supporting the development of skills, ideas and opportunities across the country.

Taken together, the Department's strategic objectives support growth in employment, income, productivity and sustainable development in Canada.

Context and Environment

Industry Canada's mandate is broad in nature, with responsibility for approximately 50 distinct pieces of legislation and over 80 programs and initiatives involving all levels of government and multiple professional stakeholders. The Department works, inter alia, on matters related to industry and technology, trade and commerce, science, consumer affairs, corporations and corporate securities, competition and restraint of trade, weights and measures, bankruptcy and insolvency, patents and copyright, investment, and small business and tourism.

In addition to its headquarters and other offices in the National Capital Region, the Department has five regional offices (Pacific, Prairie and Northern, Ontario, Quebec, and Atlantic), located in Vancouver, Edmonton, Toronto, Montréal and St. John's, respectively. The Department's regional presence also encompasses the Federal Economic Development Initiative of Northern Ontario (FedNor), 10 sub-offices and numerous district offices. Regional networks of staff (e.g., the Competition Bureau, Measurement Canada, the Office of the Superintendent of Bankruptcy Canada, and Spectrum Management and Telecommunications) enable the Department to deliver distinct services to clients across Canada.

In addition, to help deliver on its strategic objectives, Industry Canada partners with other government departments to offer businesses and consumers a variety of programs and services.

In the 2009 Budget, the Government announced the launch of several new initiatives and programs. A number of these were assigned to Industry Canada to implement and manage, in particular, the Knowledge Infrastructure Program, the Marquee Tourism Events program, the Recreational Infrastructure Canada Program, and the Southern and Eastern Ontario Development Programs. As a result, the Department realigned itself to better meet its increased responsibilities and respond to the Government's priorities. To learn more, visit Industry Canada, Canada Business and Canadian Consumer Information Gateway.

In 2008–09, by virtue of its mandate, Industry Canada played and continues to play an important role in implementing and advising on the Government of Canada's economic policy agenda, particularly in light of the ongoing economic slowdown in Canada and around the world. This has generated significant public interest in the activities of the Department.

Departmental Structure

Industry Canada employs approximately 5 800 employees across Canada and is broken into several sectors with distinct responsibilities to deliver its key priorities. Each sector is responsible for searching and retrieving documents responsive to official access requests received under the Access to Information Act and Privacy Act (ATIP). However, Information and Privacy Rights Administration (IPRA) is legally responsible for implementing and managing the ATIP program and services for Industry Canada, including decisions on the release or non-release of information pursuant to the legislation.

The closely intertwined relationship between effective information management and compliance with the provisions of the ATIP legislation led to the decision in 2007 that IPRA would be best positioned within the Information Management Branch (IMB) of the Small Business and Marketplace Services Sector (SBMS).

As one of the larger sectors, SBMS represents slightly more than 20 percent of the department's employees. Its mission is to foster business and consumer confidence in the marketplace, as well as small business competitiveness, by championing and administering responsive legislation, policies, programs and services.

Information Management Branch

IMB has a multi-faceted responsibility for Information Management (IM), addressing the needs of several distinct clients. IMB services direct and support effective and efficient management of information in the organization, from planning and systems development, to disposal and/or long-term preservation. More specifically, the Branch provides departmental oversight and operational services related to record keeping, public access to departmental information, departmental access to commercial information and strategic direction related to elements of management practice and accountability. As a result, program managers can more readily meet their obligations under the Government's Policy on Information Management, the Library and Archives Canada Act, the Access to Information Act, the Privacy Act and the Federal Accountability Act, and the Department can respect the intellectual property rights of commercial publishers. A key priority for IMB is the development and implementation of the IM Agenda for Industry Canada.

Information and Privacy Rights Administration

IPRA is responsible for the implementation and management of the Access to Information Act and Privacy Act programs and services for Industry Canada. IPRA has a complement of 15 employees including one Director, three managers, nine advisors and two support staff, all of whom are dedicated to processing access and privacy requests, along with other related functions.

IPRA makes decisions on the disposition of access requests; promotes awareness of the legislation to ensure departmental responsiveness to the obligations imposed by law; monitors and advises on departmental compliance with the Acts, regulations, procedures and policies; and acts as the spokesperson for the Department when dealing with the Treasury Board Secretariat, the Information Commissioner, the Privacy Commissioner, and other government departments and agencies. IPRA is also responsible for conducting consultations with other federal departments with respect to access to information and privacy issues.

Delegation of Authority

In 2008–09, the Access to Information and Privacy (ATIP) Delegation Order was updated and approved by the new Minister. Full delegated authority is provided to the Assistant Deputy Minister of SBMS, the Director General of IMB, and the Director and managers of IPRA. For the daily ATIP operations, both the Director and managers of IPRA exercise full responsibility (see Appendix III).

The Director of IPRA is responsible for the development, coordination and implementation of effective policies, guidelines and procedures to manage the department's compliance with the Acts. The administration of the legislation in Industry Canada is also facilitated at the branch and regional office levels. Each organizational sector has a Liaison Officer (reporting to an Assistant Deputy Minister, Regional Executive Director, etc.) who coordinates activities and provides guidance on the administrative processes and procedures of the Acts. IPRA, which is located in Ottawa, responds to all formal requests submitted under the applicable Acts.

2008–09 Highlights

Challenges and Responses

1. Human Resources

Consistent with many ATIP offices, IPRA continued to face challenges in recruiting, developing and retaining staff in 2008–09. Of the 15 IPRA positions, only 12 were staffed for the majority of the reporting period. The 12 positions consisted of the Director, one manager (PM –06), three senior advisors (PM–05), one advisor at the PM–04 level and four at the PM–03 level, plus two support positions. A number of the employees were, for the most part, in development due to promotion, acting assignments and new arrivals. During part of the reporting period, a consultant was hired to assist with the workload.

To address the continued challenges of recruitment and retention, IPRA implemented an ATIP — Professional Development Program (ATIP–PDP). IPRA also completed a review and restructuring of the unit to better meet the increasing business demands and expand on its policy advice and outreach services.

Reorganization

In 2008–09, IPRA had an independent review of its existing structure and resources. The new structure was approved in January 2009. The intent of the reorganization was to ensure that the appropriate level of resources were established to better meet the legal obligations of IPRA while allowing for increased career development opportunities that would be attractive to employees and new recruits, as well as improve retention. The new structure consists of three units. Two are operational and manage the daily activities in responding to formal requests received pursuant to the legislation. The third is responsible for policy and outreach (advice and training to departmental officials).

IPRA was focused on implementing the new structure as described in Appendix II over the course of the last months of the reporting period and will continue with the implementation in the new fiscal year.

ATIP — Professional Development Program

Industry Canada's ATIP — Professional Development Program (ATIP–PDP) has been in effect since 2005 for the purpose of developing employees from the PM–01 to the PM–04 level within the ATIP function. The program's objective is to provide management with a tool to recruit, train and retain new resources interested in building a career in the ATIP field. The program provides for developing knowledge of the ATIP legislation, policy and directives, as well as other core competencies such as analytical thinking, decision-making and leadership that are needed now and in the future. Participants progressively acquire new competencies to meet both statutory and institutional needs, while maintaining and enhancing existing competencies to meet operational needs. Upon completion of the program, participants are fully functioning ATIP specialists (PM–04 or equivalent).

In 2009, two IPRA employees graduated to the PM–04 level. One new candidate successfully completed the entrance exam and has been admitted to the program for a total of five participants.

The program has been instrumental in facilitating the recruitment and retention of resources. It has also been effective in reducing the number of lengthy staffing processes and actions, and has been a positive influence on retention.

2. Volume of work

In 2008–09, the volume of privacy requests (11) represented only a fraction of the work managed by IPRA compared to requests received under the Access to Information Act. Typically, the Department processes 10 to 20 official privacy requests per year. In this reporting period, there was an increase in demand for advice and guidance related to policy and outreach issues.

Departmental employees are made aware of their responsibilities regarding the proper management of personal information holdings on an ongoing basis. Responsible sectors are also required to consult with IPRA before collecting any personal information. IPRA must also be notified when personal information in a personal information bank is used or disclosed for a use consistent with the purpose for which the information was obtained or compiled, but was not identified in the statement of consistent uses published in Info Source.

Most of the work of IPRA falls under the Access to Information Act. In 2008–09, the Department received 660 access requests and continued to process 118 outstanding cases from previous years for a total workload of 778 cases. In addition, the Department received one hundred and thirty-five consultation requests from more than 32 other government departments and agencies.

The number of ATI requests received almost doubled from the previous year (to 660 from 342), while the scope, complexity and volume of the documents captured also continued to increase. Overall, the Department completed a total of 653 requests (526 access and 127 consultations) as compared to 431 the previous year. The volume of documents requested also significantly increased to more than 689 000 pages as compared to 183 000 pages in 2007–08.

The Department has launched a number of initiatives to help manage the increasing volume of work required to meet its ATIP obligations.

Case Document Management

Because timely, complete and accurate document retrieval and processing is the foundation of the ATIP legislation, IPRA will continue to promote IM/IT solutions that will permit better document management outside of its own office,. For its part, IPRA continues to work towards improving its case management processes and has purchased a new electronic ATIP System to be implemented over the course of the next fiscal year. This new tool will improve monitoring and tracking, as well as address the increased reporting requirements, allowing IPRA to manage its day-to-day workflow more effectively.

Working Partnerships

Over the past few years, in an effort to mitigate risks and ultimately reduce workload, IPRA has established a number of working partnerships with core administrative functional areas, such as the Chief Informatics Office (CIO), the Comptrollership and Administration Sector (CAS), the Human Resources Branch (HRB), the Audit and Evaluation Branch (AEB), Central Integrated Records Services (CIRS), and the Corporate and Portfolio Office (CPO). These partnerships have included the following activities:

  • Comptrollership and Administration Sector (CAS)
    • The recently amended Security Policy refers to the ATIP legislation. Consequently, IPRA has an informal working relationship with Security Services reviewing departmental policies and directives, and providing advice.
    • As part of the government's policy on the mandatory publication of travel and hospitality expenses for selected government officials (proactive disclosure), IPRA reviews the information regarding travel and hospitality expenses before it is posted publicly on the departmental website. The review ensures that no personal information is included in the information. In 2008–09, IPRA completed a review of more than 1100 items.
  • Chief Informatics Office (CIO)
    • The CIO, in building its governance framework for IT projects, has included Threat Risk Assessments (TRAs), Preliminary Privacy Impact Assessments (PPIAs) and Privacy Impact Assessments (PIAs) among the core documents. IPRA is responsible for reviewing and approving the PPIAs and PIAs, and for providing guidance to departmental officials regarding their content. In 2008–09, IPRA provided advice on, and reviewed and approved, 10 PPIAs concerning updates to existing electronic tools.
  • Corporate Integrated Records Services (CIRS)
    • IPRA continues to work closely with CIRS on many fronts, in particular, providing guidance and advice on issues related to retention/disposal, ownership and control of documents in keeping with legal and accountability requirements.
  • Human Resources Branch
    • IPRA provides general advice and guidance to HRB concerning privacy issues related to employees. Other services include completing reviews of reports such as harassment/grievance/disciplinary to ensure the balance of privacy and right of access.
Education and Training Activities

Enhanced awareness and knowledge of ATIP obligations of departmental officials improves compliance with legal obligations, turnaround times and the quality of responses.

In 2008–09, IPRA prepared and delivered 25 ATIP training sessions (including 6 to regional officials) and reached more than 500 employees. This is a 92 percent increase from the previous year. Upon request, sessions may be tailored to suit the needs of a specific group. In addition to these formal sessions, an intranet site is used to create awareness and disseminate information to employees.

ATIP Policies, Procedures and Business Practices

Industry Canada ensures that Treasury Board policies are implemented, either through internal departmental policies and/or directives and guidelines. IPRA has also implemented and documented various business practices to increase performance and efficiency in managing the ATIP programs and services, including the following highlights:

Privacy Impact Assessments and Preliminary Privacy Impact Assessments

There were no PIAs initiated or completed during this reporting period and, therefore, none were forwarded to the Office of the Privacy Commissioner. However, ten PPIAs were initiated and completed during the period.

IPRA reviewed and approved ten PPIAs as part of its working partnership with the CIO. The PPIAs consisted, for the most part, of updates to existing electronic tools/ applications related to existing programs and initiatives, and based upon legislative requirements. It was also determined that the PPIAs described enhanced tools with little change to content and that there was no change to the purpose, collection, use, disclosure and retention of personal information.

In addition, it was concluded that the content was related to commercial/business information required by the department to deliver on its mandate. Personal information in these cases consisted of a name and contact information, which was a business address required for communication purposes.

Disclosures Made Pursuant to Paragraph 8(2) — Permissible Disclosures

  • Section 8(2)(e) — disclosure made to an investigative body (as described in the Regulations)
    No disclosure was made during this reporting period.
  • Section 8(2)(f) — disclosure under agreement or arrangement between the Government of Canada and a provincial or foreign government
    No disclosure was made during this reporting period.
  • Section 8(2)(g) — disclosure to a Member of Parliament
    No disclosure was made during this reporting period.
  • Section 8(2)(m) — disclosure in the public interest
    No disclosure was made during this reporting period.

Data-Matching and Data-Sharing Activities

This Department is not active in any data-matching or data-sharing activities and as a result, there are no activities of this nature to report for 2008–09.

Privacy Impact of any Legislative, Policy and Service Delivery Initiatives (Including Data-Matching and Data-Sharing Agreements)

There is no information to report with regard to this item for 2008–09.

Improvements to Privacy Protection

A Departmental Security Policy was introduced on October 1, 2006. The Security Policy is designed to protect employees, preserve the confidentiality, integrity, availability and value of Industry Canada's departmental assets, and assure the continued delivery of services.

Assisting Applicants

Over the years, IPRA has implemented and established various approaches to better assist and respond to applicants. In 2008–09, IPRA began documenting the following established business practices to assist applicants:

  • Regular communication is established with applicants to clarify and narrow requests, provide updates and explain the privacy rights pursuant to the Act;
  • Accurate, timely and complete responses are completed in good faith. Alternate solutions may be suggested, such as informal processes, publicly accessible information and, if applicable, referrals to other organizations involved;
  • Records are provided in the format requested. Since 2001, IPRA has been providing processed documents on CD–ROM in PDF format at no cost to the applicant and if the material is less than 50 pages, a hard copy is provided;
  • Other practices involve facilitating discussions and/or meetings with program officials and providing interim responses when possible.

Informal Practices

Consistent with the principle that the Act is intended to complement, rather than replace, existing procedures for access to government information, informal requests may be addressed directly to branches within the Department. IPRA routinely directs requesters to the relevant sectors.

Publicly Accessible Information, Website and Enquiry Points

The Department is broad and diverse in nature and manages various distinct laws that legally allow for publicly accessible information. Industry Canada has a comprehensive website and provides a number of enquiry points where the public may submit a query and obtain information on an informal basis, specifically:

  • ic.gc.ca (formerly "Strategis")
  • Canada Business
  • Canadian Consumer Information Gateway
  • Canadian Intellectual Property Office
  • Corporations Canada
  • Office of the Superintendent of Bankruptcy

ATIP Website

IPRA also has its own Internet site. The site contains general information, points of contacts and links to other key departments and agencies, including the ATIP Offices for the Industry Portfolio.

Info Source

IPRA is responsible for providing a full accounting of the department's information holdings to the Treasury Board Secretariat and it ensures that updates are provided on a timely basis for inclusion in Info Source. Info Source may be obtained through public and academic libraries, or may be viewed online at Info Source.

Reading Rooms

A reading room is available at Industry Canada headquarters and in all regional offices as required. Current departmental manuals are available for review by the public upon request. They may also be provided electronically.

top of page

Privacy — Trends and Statistics

Significant Trends

As stated earlier, Industry Canada's mandate is focused on Canadian businesses. The department's programs and initiatives assist in building a more productive, competitive and knowledge-based economy for Canada. As a result, there are few privacy requests and issues.

Since there were few official requests received during the reporting period, no significant trend was noted. The few privacy requests received most frequently involved issues related to staffing exercises (such as rating guides and screening processes), performance, personal comments and bankruptcy files held by the Office of the Superintendent of Bankruptcy.

Statistical Report — Interpretation and Explanation

A summarized statistical report on Privacy Act requests processed from April 1, 2008 to March 31, 2009, is found in Appendix I. An explanation and interpretation of information contained in the appendix follows.

I. Requests Received under the Privacy Act

Of the 11 requests processed during this reporting period, two were outstanding from previous years and nine requests were new.  Three requests were carried forward into the new fiscal year. A total of eight requests were completed and 3,500 pages reviewed.

II. Disposition of Requests Completed

Of the 11 active requests, eight requests were completed during the 2008–09 reporting period and three requests remained to be processed as of March 31, 2009. The completed requests fall into the following categories:

  • All Disclosed — In one case, the requester was granted full access.
  • Disclosed in Part — In two cases, the requesters were granted partial access.
  • Unable to Process — two requests could not be processed.
  • Abandoned by Applicant — three requests were abandoned by the applicant.
  • Transferred — No requests were transferred.

III. Exemptions Invoked

As noted in Appendix I, the Department invoked exempting provisions pursuant to sections 26 and 27 of the Privacy Act.

IV. Exclusions Cited

The Department did not invoke any exclusions pursuant to the Act.

V. and VI. Completion Time and Extensions

The Department processed all eight cases within legislated time periods as noted in Appendix I.

VII. Translations

No translations were undertaken in dealing with these requests.

VIII. Method of Access

In response to three requests, copies of the records were provided to the applicants by hard copy or by transferring the records onto CDs. There were no requests for on-site examination.

IX. Corrections and Notation

No requests for corrections or notation were received.

X. Costs

Total salary costs associated with administering Privacy Act activities were estimated at $11 269 for this reporting period. Non-salary costs were estimated at $1 741 for a total cost of $13 010. The associated human resources (including both IPRA and departmental officials) required to fulfill this function were estimated at less than one full-time employee.

Complaints, Investigations and Appeals

Applicants have the right of complaint pursuant to the Act and may exercise this right at any time during the processing of their request. The Department received two new complaints for this reporting period. Both complaints received were related to time delays in processing the requests. One complaint was found to have merit and the other is still under investigation.

There was one appeal filed with the Federal Court of Canada during the reporting period. The Court dismissed the case.

Changes Resulting from Issues Raised by Officers of Parliament

Office of the Privacy Commissioner of Canada

Other than the complaints noted above, there is nothing to report for 2008–09.

Office of the Auditor General of Canada

There is nothing to report for 2008–09.

top of page

Appendices

Appendix I — Report on the Privacy Act (2008–09)

Report on the Privacy Act (2008–09)

top of page

Appendix II — IPRA Organizational Structure

IPRA Organizational Structure

top of page

Appendix III — Delegation of Authority

Delegation of Authority

Information on Downloading a PDF Reader
To access the Portable Document Format (PDF) version you must have a PDF reader installed. If you do not already have such a reader, there are numerous PDF readers available for free download or for purchase on the Internet: