2009-10 Annual Report on the Privacy Act
This publication is available upon request in accessible formats. Contact:
Multimedia Services Section
Communications and Marketing Branch
Room 264D, West Tower
235 Queen Street
Ottawa ON K1A 0H5
This publication is also available electronically on the World Wide Web at the following address: Information and Privacy Rights Administration (IPRA): References
Permission to Reproduce
The information in this publication may be reproduced, in part or in whole and by any means, without charge or further permission from Industry Canada, provided that due diligence is exercised in ensuring the accuracy of the information reproduced; that Industry Canada is identified as the source institution; and that the reproduction is not represented as an official version of the information reproduced, nor as having been made in affiliation with, or with the endorsement of, Industry Canada.
For permission to reproduce the information in this publication for commercial redistribution, please email: email@example.com
Cat. No. Iu1-4/1-2010
- Preface and Purpose
- About the Organization
- Industry Canada's Mission Mandate
- Context and Environment
- Departmental Structure
- 2009–10 Highlights
- ATIP Policies, Procedures and Business Practices
- Privacy Impact Assessments and Preliminary Privacy Impact Assessments
- Disclosures Made Pursuant to Paragraph 8(2) — Permissible Disclosures
- Data-Matching and Data-Sharing Activities
- Privacy Impact of any Legislative, Policy and Service Delivery Initiatives
- Improvements to Privacy Protection
- Info Source
- Use of CDs
- Informal Practices
- Publicly Accessible Information, Website and Enquiry Points
- ATIP Website
- Reading Rooms
- Privacy — Trends and Statistics
- Significant Trends
- Statistical Report — Interpretation and Explanation
- Complaints, Investigations and Appeals
- Changes Resulting from Issues Raised by Officers of Parliament
Preface and Purpose
The Privacy Act (Revised Statutes of Canada, Chapter A–1, 1985) was proclaimed on July 1, 1983.
The purpose of the Privacy Act "is to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution and to provide individuals with a right of access to that information" (Section 2 of the Act). The law also protects an individual's privacy by preventing others from having access to that personal information and allows an individual specific rights concerning the collection and use of his/her information.
Section 72 of the Privacy Act requires that the head of every government institution prepare for submission to Parliament an annual report on the administration of this Act within the institution during each financial year.
This annual report describes how Industry Canada administered its responsibilities in the twenty-sixth year of operation of the Privacy Act.top of page
About the Organization
Industry Canada's Mission and Mandate
Industry Canada's mission is to foster a growing, competitive, knowledge-based Canadian economy. The Department works with Canadians throughout the economy, and in all parts of the country, to improve conditions for investment, improve Canada's innovation performance, increase Canada's share of global trade, and build an efficient and competitive marketplace.
Industry Canada's mandate is to help make Canadian industry more productive and competitive in the global economy, thus improving the economic and social well-being of Canadians. The many and varied activities Industry Canada carries out to deliver on its mandate are organized around three interdependent and mutually reinforcing strategic outcomes, each linked to a separate key strategy. The key strategies are shown in the illustration below.
Figure 1: Key StrategiesDescription Link for Figure 1.
- The Canadian marketplace is efficient and competitive
- Advancing the marketplace
- Industry Canada fosters competitiveness by developing and administering economic framework policies that promote competition and innovation; support investment and entrepreneurial activity; and instill consumer, investor and business confidence.
- Advancing the marketplace
- Science and technology, knowledge, and innovation are effective drivers of a strong Canadian economy
- Fostering the knowledge-based economy
- Industry Canada invests in science and technology to generate knowledge and equip Canadians with the skills and training they need to compete and prosper in the global, knowledge-based economy. These investments help ensure that discoveries and breakthroughs take place here in Canada and that Canadians realize the social and economic benefits.
- Fostering the knowledge-based economy
- Competitive businesses are drivers of sustainable wealth creation
- Supporting business
- Industry Canada encourages business innovation and productivity because businesses generate jobs and wealth creation. Promoting economic development in communities encourages the development of skills, ideas and opportunities across the country.
- Supporting business
Context and Environment
Industry Canada works on a broad range of matters related to industry and technology, trade and commerce, science, consumer affairs, corporations and corporate securities, competition and restraint of trade, weights and measures, bankruptcy and insolvency, patents and copyright, investment, small business, and tourism.
Given the role the Department plays in promoting economic development and regulating the marketplace, there is significant public interest in the information collected and produced. Key areas of interest in 2009–10 included the auto industry, tourism, small business, as well as various statutes, namely the Competition Act, the Canada Investment Act and the Copyright Act.
In 2009–10 Industry Canada played an important role in implementing the Government of Canada's Economic Action Plan (EAP), introduced in January 2009 as part of Budget 2009. The EAP focuses on ensuring Canada makes a quick recovery from the global recession, sustains long-term economic growth at home and plays a leading role in the coordinated international effort to produce a worldwide economic recovery.
The high profile EAP initiatives implemented by Industry Canada included distribution of stimulus funding to traditional industries, including the manufacturing sector, and providing assistance to the Canadian automotive sector to support the orderly restructuring of this critical industry, with the goal of maintaining Canada's share of North American production.
In addition, through the Knowledge Infrastructure Program, the Department is providing $2 billion over two years to create jobs in communities across Canada by revitalizing research and training facilities at Canadian universities and colleges. These initiatives have generated significant public interest in the activities of the Department.
Given Industry Canada's mandate and mission, it is understandable that there is little activity conducted under the Privacy Act.top of page
The Department employs 5800 professionals across the country, including economists, engineers, scientists, commerce officers, inspectors, metrologists, statisticians, accountants and lawyers, supported by others carrying out corporate functions such as human resources and financial management, communications, and information management/information technology support.
The Department is organized into 11 sectors and four corporate branches (see www.ic.gc.ca). In addition to its headquarters and other offices in Ottawa, the Department has five regional offices (Pacific, Prairie and Northern, Ontario, Quebec, and Atlantic), located in Vancouver, Edmonton, Toronto, Montréal and St. John's, respectively. The Department's regional presence also encompasses the Federal Economic Development Initiative of Northern Ontario (FedNor) and the Federal Economic Development Agency for Southern Ontario (FedDev Ontario).
Each of these sectors and branches are responsible for searching and retrieving documents responsive to official access requests received under the Access to Information Act and Privacy Act (ATIP). However, Information and Privacy Rights Administration (IPRA) is legally responsible for implementing and managing the ATIP program and services for Industry Canada, including decisions on the release or non-release of information pursuant to the legislation.
Information Management Branch
Given that the effective management of information is critical to the administration of the Access to Information Act and Privacy Act, IPRA resides with the Information Management Branch (IMB), a branch in Small Business and Marketplace Services Sector (SBMS). IMB directs and supports an Information Management (IM) program to ensure the effective and efficient management of information within Industry Canada. The IM program provides strategic direction and services related to recordkeeping, public access to departmental information, departmental access to commercially published information and information management policy, accountability, governance, planning and reporting. As a result, departmental program managers can more readily deliver their programs and services, as well as meet their obligations under the Government's Policy on Information Management, the Library and Archives Canada Act, the Access to Information Act, the Privacy Act and the Federal Accountability Act. Further, it ensures that the Department respects the intellectual property rights of commercial publishers.
IMB provides services to the Department from four Directorates: Corporate Integrated Records Services (CIRS), the Library and Knowledge Centre (LKC), IM Policy, Planning and Innovation (IMPPI), and Information and Privacy Rights Administration (IPRA).
Information and Privacy Rights Administration
IPRA is responsible for the implementation and management of the Access to Information Act and Privacy Act programs and services for Industry Canada. Specifically, IPRA makes decisions on the disposition of access requests; promotes awareness of the legislation to ensure departmental responsiveness to the obligations imposed by law; monitors and advises on departmental compliance with the Acts, regulations, procedures and policies; and acts as the spokesperson for the Department when dealing with the Treasury Board Secretariat, the Information Commissioner, the Privacy Commissioner, and other government departments and agencies. IPRA is also responsible for conducting consultations with other federal departments with respect to access to information and privacy issues.
IPRA has a complement of 15 employees including one Director, three managers, nine advisors and two support staff, all of whom are dedicated to processing access and privacy requests, along with related functions.
Delegation of Authority
The current Access to Information and Privacy (ATIP) Delegation Order was approved by the Minister in July 2009, and provides full-delegated authority to the Assistant Deputy Minister of SBMS, the Director General of IMB, the Director and the managers of IPRA. The designation of the Director General position is for purposes of providing strategic support and advice to the executive management of the Department concerning ATIP issues, if and when required. For all daily ATIP activities and operations, the Director and the managers of IPRA exercise full responsibility (see Appendix III).
The Director of IPRA is responsible for the development, coordination and implementation of effective policies, guidelines and procedures to manage the Department's compliance with the Acts. The administration of the legislation in Industry Canada is managed by IPRA, but is also facilitated at the Sector, branch and regional office levels. Each sector and corporate branch has an ATIP Liaison Officer (reporting to an Assistant Deputy Minister, Regional Executive Director, etc.) who coordinates activities and provides guidance on the administrative processes and procedures of the Acts. IPRA, which is located in Ottawa, responds to all formal requests submitted under the applicable Acts.top of page
In 2009–10, the Department saw an increase in the volume of privacy requests received under the Privacy Act as compared to the previous year. In total 32 formal requests were received as compared to nine in 2008–09, however, this is but a fraction of the overall work managed by IPRA.
More frequently privacy activities will involve awareness, training and policy issues concerning defining and managing personal information within Industry Canada. Departmental officials will regularly consult with IPRA before collecting personal information; review rules related to consistent use and/or disclosure in accordance with the purpose for which the information was obtained or compiled and seek advice concerning other privacy issues.
Although IPRA did face a number of challenges in 2009–10, it also achieved a number of accomplishments as described in the 2009–10 Annual Report on the Access to Information Act. However, one constant challenge remains and that is the resourcing issue to support the ATIP program and services.
- Resources — Human and Financial
- In 2009–10, IPRA continued to face challenges in managing and retaining staff to perform its daily operations and meet its legal compliance requirements. A new organizational structure was implemented to better meet the increasing business demands and to allow IPRA to expand on policy advice and outreach services; however, there was no change to the overall resourcing. IPRA now consists of three teams (see Appendix II), with two teams responsible for the daily operations and one for policy and outreach. IPRA continues to operate within an allocation of 15 full-time employees and an operating budget of approximately $1.2 million.
- In order to be more competitive in a high-demand market, and to be more attractive as an employer, IPRA provides career progression opportunities with the use of the ATIP Professional Development Program (ATIP–PDP). IPRA has also been innovative, using inter-departmental staffing processes where possible and other recruitment/staffing tools, all of which have positively influenced retention and succession planning.
- Resources and Workload
- Of the 15 IPRA positions, 13 were staffed for the majority of the reporting period. The 13 positions consisted of the Director, three managers (PM–06), three senior advisors (PM–05), three advisors at the PM–04 level and one at the PM–03 level, plus two support positions (PM–02 and AS–01). During part of the reporting period, a consultant was hired to assist with the workload.
- In 2009–10, the policy and outreach unit, consisting of two people (PM–06 and PM–05), was responsible for maintaining the various partnerships with other functional areas, overseeing various projects/initiatives (e.g., ATIP case management tool, IM initiatives, Info Source Renewal, etc.), and delivering ATIP advice/guidance including providing training and awareness sessions across the Department. They completed the following activities:
(Questions/Reviews/Emails/ Reports, etc.)
|Provide ATIP guidance and advice to Industry Canada officials||56|
|Provide ATIP advice to OGDs||36|
|Review of audit and evaluation reports prior to being publicly posted on the departmental website||10|
|Review of parliamentary questions and responses||83|
|Review of proactive disclosures prior to being publicly posted on the departmental website||955
|Prepare and deliver ATIP training/awareness sessions to departmental officials||23|
|Review and approval of Preliminary Privacy Impact Assessments/Privacy Impact Assessments||20|
|Update to IPRA public website||X|
|Preparing and tabling annual reports and statistical reports||X|
|Input to MAF and DPR (ATIP user fees)||X|
|Managing Info Source updates and providing submission to TBS||X|
|Review and update business practices and procedures for IPRA||X|
|Participate in various initiatives across IC (e.g., enterprise wiki, IM initiatives (IM outcomes, Business-Based Classification System, etc.)||X|
IPRA — ATIP Policies, Procedures and Business Practices
IPRA ensures that Treasury Board ATIP policies are respected and implemented in the form of internal guidelines, procedures, and business practices. This has allowed IPRA to increase performance and efficiency in managing the ATIP programs and services for the Department. Over the years, IPRA has developed and implemented a number of initiatives to promote privacy awareness and improve compliance with legislative requirements. These have included the following:
Over the years, IPRA has implemented various approaches to better assist and respond to applicants. Established practices include the following:
- The applicant's identity is not considered during the processing of a request, nor is it revealed to departmental officials, unless there is a need to know to retrieve information and/or if consent is provided by the applicant;
- Regular communication is established with applicants to clarify and narrow requests, provide updates and explain the privacy process and rights pursuant to the Act;
- Accurate, timely and complete responses are compiled in good faith. Alternate solutions may be suggested, such as previously released, or publicly accessible information, and, if applicable, referrals to other organizations involved;
- Records are provided in the format requested. Since 2001, IPRA has been providing processed documents on CD-ROM in PDF format at no cost to the applicant. At times, releases of data extracts are provided in Excel, Lotus and/or ASCII format and if the material is less than 50 pages, a hard copy is provided;
- Other practices involve facilitating discussions and/or meetings with program officials, providing interim responses when possible and limiting fees charged to the applicant where possible.
Over the past few years, in an effort to mitigate risks and ultimately reduce workload, IPRA has established a number of working partnerships with core administrative functional areas. These partnerships have continued to flourish, and included the following:
- Comptrollership and Administration Sector (CAS)
- As part of the government's policy on the mandatory publication of travel and hospitality expenses for selected government officials (proactive disclosure), IPRA reviews the information regarding travel and hospitality expenses before it is posted publicly on the departmental website. The review ensures that no personal information is included in the information.
- Chief Informatics Office (CIO)
- The governance framework for IT projects includes Threat and Risk Assessments, Preliminary Privacy Impact Assessments (PPIAs) and Privacy Impact Assessments (PIAs) among the core documents. IPRA is responsible for reviewing and approving the PPIAs and PIAs, and for providing advice to departmental officials regarding their content.
- Human Resources Branch (HRB)
- Providing general advice and guidance concerning privacy issues related to employees; reviewing reports such as harassment/grievance/disciplinary to ensure the balance of privacy and right of access.
- Partnering in the delivery of orientation sessions to new employees joining Industry Canada.
Information Management Initiatives
As noted earlier, effective and efficient information management is crucial to IPRA maintaining its high-level performance and ensuring compliance with its legal obligations. IPRA contributes to a multi-year IM Agenda which guides the Department in delivering on its long-term Information Management (IM) program objectives, which are to support program and service delivery, foster informed decision-making, facilitate accountability, transparency and collaboration, and preserve access to information and records for the benefit of present and future generations. Initiatives under the IM Agenda are designed to achieve the following outcomes:
- Effective IM Governance — The continuous and effective management of information is assured through appropriate governance structures, policies and guidelines.
- IM Informed Workforce — Employees have the know-how and expertise to manage and access information to support business outcomes.
- Sustainable Corporate Support — Corporate IM tools based on effective standards, methods and practices are in place, supported by a sustainable info-structure and infrastructure.
ATIP Case Management Tool
IPRA is implementing a new electronic ATIP Case Management tool. This new tool will improve monitoring and tracking, as well as address the increased reporting requirements, thereby allowing IPRA to manage its day-to-day workflow more effectively.
Education and Training Activities
Enhanced awareness and knowledge of ATIP obligations on the part of departmental officials improves compliance with legal obligations, turnaround times, and the quality of responses.
In 2009–10, IPRA prepared and delivered 23 ATIP training sessions (including one to regional officials) and reached more than 600 employees. Upon request, sessions are tailored to suit the needs of a specific group. In addition to these formal sessions, an intranet site is used to create awareness and disseminate information to employees.
IPRA also worked with other IM domains to develop and deliver a more integrated IM outreach program to departmental officials. Messages highlighted the connections and inter-dependence existing between the ATIP functions and information management activities such as security classification, retention/disposal and business value of information, as well as providing practical tips and best practices.
ATIP — Professional Development Program
Industry Canada's ATIP — Professional Development Program (ATIP–PDP) has been in effect since 2005. Its purpose is to develop employees from the PM–01 to the PM–04 level within the ATIP function. The program's objective is to provide management with a tool to recruit, train and retain resources interested in building a career in the ATIP field. The program has proven effective in the recruitment and development of resources. It has also reduced the number of lengthy staffing processes and actions, and has had a positive influence on retention and succession planning.
Privacy Impact Assessments (PIA) and Preliminary Privacy Impact Assessments (PPIA)
When the PIA Policy came into effect, IPRA established a process for Industry Canada that consisted of the following:
- PPIA and/or PIA is prepared by the responsible Sector/Project Manager;
- PPIA/PIA is forward to IPRA for review, discussion, approval and reporting purposes;
- Once a PIA is finalized and approved, IPRA provides a copy to the Office of the Privacy Commissioner (OPC) for review;
- OPC will return the PIA with recommendations, as required;
- IPRA will return the PIA with recommendations to the Sector/Project Manager for action;
- IPRA will liaise between the Department and OPC as required until the PIA is finalized;
- Once complete, the Sector/Project Manager is to prepare a brief summary of the PIA for publication purposes and/or posting on the websites; and,
- IPRA will report on all PPIAs and PIAs at the end of each fiscal year in the Department's Annual Report to Parliament on the Administration of the Privacy Act.
There were no PIAs initiated or completed during this reporting period and, therefore, none were forwarded to the Office of the Privacy Commissioner.
As noted in Appendix I, a total of 20 PPIAs were initiated, reviewed and completed during this reporting period. The PPIAs consisted, for the most part, of updates to existing electronic tools/ applications related to existing programs and initiatives, and based upon legislative requirements. It was also determined that the PPIAs described enhanced tools with little change to content and that there was no change to the purpose, collection, use, disclosure and retention of personal information.
In addition, it was concluded that the content was related to commercial/business information required by the Department to deliver on its mandate. Personal information in these cases consisted of a name and contact information, which was a business address required for communication purposes.
Disclosures Made Pursuant to Paragraph 8(2) — Permissible Disclosures
- Section 8(2)(e) — disclosure made to an investigative body (as described in the Regulations): A total of three requests were received and completed during this reporting period.
- Section 8(2)(m) — disclosure in the public interest: No disclosure was made during this reporting period.
Data-Matching and Data-Sharing Activities
This Department is not active in any data-matching or data-sharing activities and as a result, there are no activities of this nature to report for 2009–10.
Privacy Impact of any Legislative, Policy and Service Delivery Initiatives (Including Data-Matching and Data-Sharing Agreements)
There is no information to report with regard to this item for 2009–10.
Improvements to Privacy Protection
A Departmental Security Policy was introduced on October 1, 2006. The Security Policy is designed to protect employees, preserve the confidentiality, integrity, availability and value of Industry Canada's departmental assets, and assure the continued delivery of services.
IPRA is responsible for providing a full accounting of the Department's information holdings to the Treasury Board Secretariat and it ensures that updates are provided on a timely basis for inclusion in Info Source. Info Source may be obtained through public and academic libraries, or may be viewed online at Info Source Publications.
In 2009–10, IPRA updated the work plan concerning the renewal of Info Source and began implementing the process to update the existing Personal Information Banks (PIBs) listed for Industry Canada, including the Standard PIBs in accordance with Treasury Board Secretariat directives. The renewal of Info Source will also reflect the last approved Program Activity Architecture (PAA) for the Department.
Use of CDs
This initiative has reduced paperburden and eliminated reproduction fees and on-site visits from applicants, as well as improved timeliness and efficiency in managing the ATIP program and services. The Department does not charge for CDs.
Consistent with the principle that the Act is intended to complement, rather than replace, existing procedures for access to government information, informal requests may be addressed directly to branches within the Department. IPRA routinely directs requesters to the relevant sectors with public research centers or public sites.
Publicly Accessible Information, Website and Enquiry Points
The Department is broad and diverse in nature and manages various distinct laws that legally allow for publicly accessible information. Industry Canada has a comprehensive website and provides a number of enquiry points where the public may submit a query and obtain information on an informal basis, specifically:
- Canada Business
- Canadian Consumer Information Gateway
- Canadian Intellectual Property Office
- Corporations Canada
- Office of the Superintendent of Bankruptcy
IPRA also has its own internet site (Information and Privacy Rights Administration (IPRA)). The site contains general information, points of contacts and links to other key departments and agencies, including the ATIP Offices for the Industry Portfolio.
A reading room is available at Industry Canada headquarters and in all regional offices as required. Current departmental manuals are available for review by the public upon request. The manuals may also be provided electronically.top of page
Privacy — Trends and Statistics
As stated earlier, Industry Canada's mandate is focused on Canadian businesses. The Department's programs and initiatives assist in building a more productive, competitive and knowledge-based economy for Canada. As a result, there are few privacy requests and issues.
Since there were few official requests received during the reporting period, no significant trend was noted. The few privacy requests received involved issues related to staffing exercises (such as rating guides and screening processes), performance, personal comments and bankruptcy files held by the Office of the Superintendent of Bankruptcy.
Statistical Report — Interpretation and Explanation
A summarized statistical report on Privacy Act requests processed from April 1, 2009 to March 31, 2010, is found in Appendix I. An explanation and interpretation of information contained in the appendix follows.
I. Requests Received under the Privacy Act
Of the 35 requests processed during this reporting period, three were outstanding from previous years and 32 requests were new. Two requests were carried forward into the new fiscal year. A total of 33 requests were completed and more than 7,300 pages reviewed.
II. Disposition of Requests Completed
Of the 35 active requests, 33 were completed during the 2009–10 reporting period and two requests remained to be processed as of March 31, 2010. The completed requests fall into the following categories:
- All Disclosed — In 14 cases, the requester was granted full access.
- Disclosed in Part — In six cases, the requesters were granted partial access.
- Unable to Process — 11 requests could not be processed.
- Abandoned by Applicant — Two requests were abandoned by the applicant.
- Transferred — No requests were transferred.
III. Exemptions Invoked
As noted in Appendix I, the Department invoked exempting provisions pursuant to sections 26 and 27 of the Privacy Act.
IV. Exclusions Cited
The Department did not invoke any exclusions pursuant to the Act.
V. and VI. Completion Time and Extensions
Of the 33 completed cases, the Department was able to respond within the legislated 30 days or less in 13 cases, or 40 percent of the time. Approximately 24 percent of completed cases required extensions under the Act to allow external consultation with other government departments and agencies, and 30 percent were completed within 31 to 60 days. Of the remaining 10 requests, 18 percent were completed within 61 to 120 days and 12 percent over 121 days for a total 30 percent completed after the legislated time period as noted in Appendix I.
No translations were undertaken in dealing with these requests.
VIII. Method of Access
In response to 20 requests, copies of the records were provided to the applicants by hard copy or by transferring the records onto CDs. There were no requests for on-site examination.
IX. Corrections and Notation
No requests for corrections or notation were received.
Total salary costs associated with administering Privacy Act activities were estimated at $67 567 for this reporting period. Non-salary costs were estimated at $11 596 for a total cost of $79 163. The associated human resources (including both IPRA and departmental officials) required to fulfill this function were estimated at one full-time employee.
Complaints, Investigations and Appeals
Applicants have the right of complaint pursuant to the Act and may exercise this right at any time during the processing of their request. The Department received two complaints for this reporting period. One complaint was related to use and disclosure while the other involved right of access. The complaint investigations were completed and the Privacy Commissioner concluded that the complaints were not well-founded.
No appeals were filed with the Federal Court of Canada during the reporting period.
Changes Resulting from Issues Raised by Officers of Parliament
Office of the Privacy Commissioner of Canada
Other than the complaints noted above, there is nothing to report for 2009–10.
Office of the Auditor General of Canada
There is nothing to report for 2009–10.top of page
Appendix I — Report on the Privacy Act (2009–10)top of page
Appendix II — IPRA Organizational Structure (2009–10)top of page
Appendix III — Delegation of Authority
- Date modified: