Annual Report on the Privacy Act—2020–21

Introduction

The Privacy Act gives individuals the right to access information about themselves that is held by the Office of the Auditor General of Canada (OAG), subject to certain specific and limited exceptions. The Privacy Act also protects the privacy of individuals by giving them substantial control over the collection, use, and disclosure of their personal information and by preventing others from having access to that information.

Section 72 of the act requires the head of each government institution to prepare an annual report on the administration of the act within the institution and to submit the report to Parliament.

This annual report on the Privacy Act at the OAG describes how we administered our responsibilities under the act during the 2020–21 fiscal year.

If you require more information or wish to make a request under the Access to Information Act or the Privacy Act, please direct your inquiries to the following:

Who we are

The OAG audits federal government operations and provides Parliament with independent information, advice, and assurance regarding the federal government’s stewardship of public funds. While the OAG may comment on policy implementation in an audit, it does not comment on policy itself.

We are in the business of legislative auditing. We conduct

• performance audits of federal departments and agencies
• annual financial audits of the government’s financial statements
• special examinations and annual financial audits of Crown corporations
• audits of the governments of Nunavut, Yukon, and the Northwest Territories

Since 1995, the OAG has also had a specific environmental and sustainable development mandate, which was established through amendments to the Auditor General Act.

The Auditor General of Canada is the designated head of the institution for the Privacy Act. Pursuant to section 73 of the act, the Auditor General delegated full authority to the Access to Information and Privacy (ATIP) Coordinator.

Access to Information and Privacy team

The ATIP Coordinator is accountable for the development and implementation of effective policies, guidelines, systems, and procedures to ensure that the OAG meets its responsibilities under the Access to Information Act and the Privacy Act.

For the reporting period, the ATIP team at the OAG consisted of

• 1 full-time ATIP Coordinator
• 1 full-time Public Disclosure of Information and Privacy Protection Manager, who performed ATIP duties as required
• 1 full-time employee from the Legal Services group, who helped the ATIP team on a part-time, ad hoc basis
• 1 full-time General Counsel, who managed the ATIP team in addition to fulfilling normal duties as OAG General Counsel

The main activities of the ATIP Coordinator included

• monitoring compliance with ATIP legislation and relevant procedures and policies
• processing requests under both the Access to Information Act and the Privacy Act
• developing and maintaining policies, procedures, and guidelines to ensure that the OAG respected the Access to Information Act and the Privacy Act
• promoting awareness of the Access to Information Act and the Privacy Act within the OAG to ensure that employees were aware of their responsibilities
• preparing annual reports to Parliament and other statutory reports, as well as other material that might be required by central agencies
• representing the OAG in dealings with the Treasury Board of Canada Secretariat, the information and privacy commissioners, and other government departments and agencies in matters pertaining to the Access to Information Act and the Privacy Act
• helping the OAG meet its commitments to ensure openness and transparency, through proactive and informal disclosure of information

Performance

Completion time for closed requests

For the first time since becoming subject to the Privacy Act, the OAG did not receive any requests for personal information during the reporting period.

Trends

The OAG responds to multiple requests throughout the year from individuals seeking informal feedback, input, or advice regarding whether they should submit a formal request for their personal information, either to the OAG or to another institution.

The OAG processed and completed a total of 4 formal requests for personal information during the 3 reporting periods prior to the reporting period for this report.

Training

The OAG requires that all employees complete mandatory ATIP training, offered by the Canada School of Public Service as an online, self-paced course.

All new OAG employees are required to complete the training within 3 months of the start date of their employment.

During the reporting period, 174 employees completed this training.

Impact of COVID-19 measures

The OAG required that all employees work from home as of 16 March 2020, granting access to the office only in exceptional circumstances. Because of this measure, the OAG is unable to conduct searches for physical records. However, the OAG considers the contents of notebooks or printed material that is also available digitally to be transitory. Therefore, the OAG is still able to conduct thorough searches for records in response to Privacy Act requests, and measures taken to restrict employee access to OAG offices have not affected the ability to respond to these requests.

The OAG regularly reminds employees of the importance of performing proper information management and requires that information with corporate value be saved in central data systems. These systems are accessible remotely.

Administration of the Privacy Act

Requests under the Privacy Act

Disposition of completed requests

The OAG received no formal Privacy Act requests during the reporting period and therefore completed no requests.

Exemptions invoked

The OAG did not invoke any exemptions during the reporting period.

Exclusions cited

The OAG did not cite any exclusions during the reporting period.

Completion time

The OAG did not receive or complete any requests during the reporting period.

Extension of time limits

The OAG did not invoke any extensions during the reporting period.

Method of access

The OAG was not required to give access to records during the reporting period, as no requests were received.

Costs

The costs directly associated with the administration of the Privacy Act for the reporting period are estimated to be $20,290 for salaries. Please see “Monitoring compliance” for further information.

Complaints and investigations

The OAG did not receive any complaints pursuant to the Privacy Act during this reporting period, and no investigations regarding the OAG were carried out.

Disclosure of personal information under section 8(2)

The OAG did not disclose any personal information pursuant to section 8(2) during the reporting period.

Requests for correction of personal information

No requests for correction of personal information were received during the reporting period.

Monitoring compliance

The OAG uses time-code (product-code) management software—essentially a digital timesheet—to track all audit and audit-service activities, including

• management of the ATIP team
• management of access to information cases (treatment of formal Access to Information Act requests and consultations)
• management of privacy cases (treatment of formal and informal Privacy Act requests)
• privacy impact assessments

Whenever employees or contractors of the OAG participate in any ATIP-related activity, they must track the time they spend on the activity by entering the number of hours or partial hours into the product-code management software. These records are monitored regularly for human resource and financial purposes. Any employee with access to the OAG network can use the OAG’s INTRAnet (internal Internet) to view this data.

Senior officials, up to and including the Auditor General, are advised about compliance with legislative, policy, and regulatory obligations, as requested or required.

As reflected in part 11.2 of the Appendix, the OAG dedicated 1.25 person-years to Privacy Act–related activities during the reporting period.

Breaches

No material privacy breaches occurred during the reporting period.

Completed privacy impact assessments

Security information and event management system

The OAG required security information and event management technology to replace its existing technology and meet the policy requirements established by the Government of Canada.

Security information and event management technology supports threat detection and security incident response through the collection and analysis of security events from a variety of event and data sources. It also supports compliance reporting and incident investigation through analysis of historical data from these sources.

None of the security information and event management logs collected or outputs (reports or alerts) are shared with any external suppliers or vendors. We deployed the solution on our premises, with no external hosting.

The only time that this type of information is shared with an external organization is in specific cases such as security breaches. In this case, some information may be shared with external parties to coordinate efforts or support an investigation. An approval must first be granted for such disclosures.

Human resources management system (ATOM)

My Government of Canada Human Resources (MyGCHR) was the Government of Canada’s system for the management of all human resources information in the federal public service. The system was a key component of the Government of Canada Human Resources Modernization Initiative.

In December 2014, Public Services and Procurement Canada’s Human Resources Branch implemented MyGCHR to replace its legacy human resources management system and related application suite. The deployment of the system was a complex endeavour, which involved the conversion and migration of large quantities of data from multiple existing human resources applications. The goal was to ultimately replace all human resources systems (including legacy systems) across the government with this 1 solution.

The project was put on hold in December 2017 to focus on the Phoenix issues, with the goal of restarting the project in 2021 or 2022. The OAG needed an immediate interim solution, as its legacy system (MIS 2000) was not compatible with Phoenix and other corporate applications.

As the expectation was that the OAG would eventually need to convert to an enterprise-wide solution, no funding or support for any purchase of systems was expected from the Treasury Board of Canada Secretariat. So, the only option was to develop our own solution in-house.

This system, ATOM, was designed to replace MIS in the handling of personnel information, including personal and related employment information. ATOM collects and maintains information from employees through either electronic or paper processes throughout the employment period. ATOM also contains information migrated from MIS.

Preliminary (informal) assessments

For all new or amended projects, the OAG has implemented a mandatory process that requires the completion of the Preliminary Privacy Checklist. This document ensures that personal information elements are considered before and during the completion of the project.

This process also identifies the required elements for a formal privacy impact assessment, which is initiated if the preliminary assessment identifies the need for one.

During the reporting period, the OAG completed 41 preliminary assessments.

Appendix—Statistical Report on the Privacy Act

Name of institution: Office of the Auditor General of Canada

Reporting period: 01/04/2020 to 31/03/2021

Section 1: Requests Under the Privacy Act

1.1 Number of requests

Requests Under the Privacy Act

	Number of Requests
Received during reporting period	0
Outstanding from previous reporting period	0
Total	0
Closed during reporting period	0
Carried over to next reporting period	0

Section 2: Requests Closed During the Reporting Period

2.1 Disposition and completion time

Disposition and completion time

Disposition of Requests	Completion Time
	1 to 15 Days	16 to 30 Days	31 to 60 Days	61 to 120 Days	121 to 180 Days	181 to 365 Days	More Than 365 Days	Total
All disclosed	0	0	0	0	0	0	0	0
Disclosed in part	0	0	0	0	0	0	0	0
All exempted	0	0	0	0	0	0	0	0
All excluded	0	0	0	0	0	0	0	0
No records exist	0	0	0	0	0	0	0	0
Request abandoned	0	0	0	0	0	0	0	0
Neither confirmed nor denied	0	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0	0

2.2 Exemptions

Exemptions

Section	Number of Requests
18(2)	0
19(1)(a)	0
19(1)(b)	0
19(1)(c)	0
19(1)(d)	0
19(1)(e)	0
19(1)(f)	0
20	0
21	0
22(1)(a)(i)	0
22(1)(a)(ii)	0
22(1)(a)(iii)	0
22(1)(b)	0
22(1)(c)	0
22(2)	0
22.1	0
22.2	0
22.3	0
22.4	0
23(a)	0
23(b)	0
24(a)	0
24(b)	0
25	0
26	0
27	0
27.1	0
28	0

2.3 Exclusions

Exclusions

Section	Number of Requests
69(1)(a)	0
69(1)(b)	0
69.1	0
70(1)	0
70(1)(a)	0
70(1)(b)	0
70(1)(c)	0
70(1)(d)	0
70(1)(e)	0
70(1)(f)	0
70.1	0

2.4 Format of information released

Format of information released

Paper	Electronic	Other
0	0	0

2.5 Complexity

2.5.1 Relevant pages processed and disclosed

Relevant pages processed and disclosed

Number of Pages Processed	Number of Pages Disclosed	Number of Requests
0	0	0

2.5.2 Relevant pages processed and disclosed by size of requests

Relevant pages processed and disclosed by size of requests

Disposition	Less Than 100 Pages Processed		101-500 Pages Processed		501-1000 Pages Processed		1001-5000 Pages Processed		More Than 5000 Pages Processed
	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed
All disclosed	0	0	0	0	0	0	0	0	0	0
Disclosed in part	0	0	0	0	0	0	0	0	0	0
All exempted	0	0	0	0	0	0	0	0	0	0
All excluded	0	0	0	0	0	0	0	0	0	0
Request abandoned	0	0	0	0	0	0	0	0	0	0
Neither confirmed nor denied	0	0	0	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0	0	0	0

2.5.3 Other complexities

Other complexities

Disposition	Consultation Required	Legal Advice Sought	Interwoven Information	Other	Total
All disclosed	0	0	0	0	0
Disclosed in part	0	0	0	0	0
All exempted	0	0	0	0	0
All excluded	0	0	0	0	0
Request abandoned	0	0	0	0	0
Neither confirmed nor denied	0	0	0	0	0
Total	0	0	0	0	0

2.6 Closed requests

2.6.1 Number of requests closed within legislated timelines

Number of requests closed within legislated timelines

	Requests closed within legislated timelines
Number of requests closed within legislated timelines	0
Percentage of requests closed within legislated timelines (%)	0

2.7 Deemed refusals

2.7.1 Reasons for not meeting legislated deadline

Reasons for not meeting legislated timelines

Number of Requests Closed Past the Legislated Timelines	Principal Reason
	Interference with Operations / Workload	External Consultation	Internal Consultation	Other
0	0	0	0	0

2.7.2 Requests closed beyond legislated timelines (including any extension taken)

Requests closed beyond legislated timelines (including any extension taken)

Number of Days Past Legislated Timelines	Number of Requests Past Legislated Timeline Where No Extension Was Taken	Number of Requests Past Legislated Timelines Where an Extension Was Taken	Total
1 to 15 days	0	0	0
16 to 30 days	0	0	0
31 to 60 days	0	0	0
61 to 120 days	0	0	0
121 to 180 days	0	0	0
181 to 365 days	0	0	0
More than 365 days	0	0	0
Total	0	0	0

2.8 Requests for translation

Requests for translation

Translation Requests	Accepted	Refused	Total
English to French	0	0	0
French to English	0	0	0
Total	0	0	0

Section 3: Disclosures Under Subsections 8(2) and 8(5)

Disclosures Under Subsections 8(2) and 8(5)

Paragraph 8(2)(e)	Paragraph 8(2)(m)	Subsection 8(5)	Total
0	0	0	0

Section 4: Requests for Correction of Personal Information and Notations

Requests for Correction of Personal Information and Notations

Disposition for Correction Requests Received	Number
Notations attached	0
Requests for correction accepted	0
Total	0

Section 5: Extensions

5.1 Reasons for extensions and disposition of requests

Reasons for extensions and disposition of requests

Number of requests where an extension was taken	15(a)(i) Interference with operations				15(a)(ii) Consultation			15(b) Translation purposes or conversion
	Further review required to determine exemptions	Large volume of pages	Large volume of requests	Documents are difficult to obtain	Cabinet Confidence Section (Section 70)	External	Internal
0	0	0	0	0	0	0	0	0

5.2 Length of extensions

Length of extensions

Length of Extensions	15(a)(i) Interference with operations				15(a)(ii) Consultation			15(b) Translation purposes or conversion
	Further review required to determine exemptions	Large volume of pages	Large volume of requests	Documents are difficult to obtain	Cabinet Confidence Section (Section 70)	External	Internal
1 to 15 days	0	0	0	0	0	0	0	0
16 to 30 days	0	0	0	0	0	0	0	0
31 days or greater								0
Total	0	0	0	0	0	0	0	0

Section 6: Consultations Received From Other Institutions and Organizations

6.1 Consultations received from other Government of Canada institutions and other organizations

Consultations received from other Government of Canada institutions and other organizations

Consultations	Other Government of Canada Institutions	Number of Pages to Review	Other Organizations	Number of Pages to Review
Received during the reporting period	0	0	0	0
Outstanding from the previous reporting period	0	0	0	0
Total	0	0	0	0
Closed during the reporting period	0	0	0	0
Carried over to the next reporting period	0	0	0	0

6.2 Recommendations and completion time for consultations received from other Government of Canada institutions

Recommendations and completion time for consultations received from other Government of Canada institutions

Recommendation	Number of Days Required to Complete Consultation Requests
	1 to 15 Days	16 to 30 Days	31 to 60 Days	61 to 120 Days	121 to 180 Days	181 to 365 Days	More Than 365 Days	Total
All disclosed	0	0	0	0	0	0	0	0
Disclosed in part	0	0	0	0	0	0	0	0
All exempted	0	0	0	0	0	0	0	0
All excluded	0	0	0	0	0	0	0	0
Consult other institution	0	0	0	0	0	0	0	0
Other	0	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0	0

6.3 Recommendations and completion time for consultations received from other organizations

Recommendations and completion time for consultations received from other organizations

Recommendation	Number of days required to complete consultation requests
	1 to 15 Days	16 to 30 Days	31 to 60 Days	61 to 120 Days	121 to 180 Days	181 to 365 Days	More Than 365 Days	Total
All disclosed	0	0	0	0	0	0	0	0
Disclosed in part	0	0	0	0	0	0	0	0
All exempted	0	0	0	0	0	0	0	0
All excluded	0	0	0	0	0	0	0	0
Consult other institution	0	0	0	0	0	0	0	0
Other	0	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0	0

Section 7: Completion Time of Consultations on Cabinet Confidences

7.1 Requests with Legal Services

Requests with Legal Services

Number of Days	Fewer Than 100 Pages Processed		101-500 Pages Processed		501-1000 Pages Processed		1001-5000 Pages Processed		More Than 5000 Pages Processed
	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed
1 to 15	0	0	0	0	0	0	0	0	0	0
16 to 30	0	0	0	0	0	0	0	0	0	0
31 to 60	0	0	0	0	0	0	0	0	0	0
61 to 120	0	0	0	0	0	0	0	0	0	0
121 to 180	0	0	0	0	0	0	0	0	0	0
181 to 365	0	0	0	0	0	0	0	0	0	0
More than 365	0	0	0	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0	0	0	0

7.2 Requests with Privy Council Office

Requests with Privy Council Office

Number of Days	Fewer Than 100 Pages Processed		101-500 Pages Processed		501-1000 Pages Processed		1001-5000 Pages Processed		More Than 5000 Pages Processed
	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed	Number of Requests	Pages Disclosed
1 to 15	0	0	0	0	0	0	0	0	0	0
16 to 30	0	0	0	0	0	0	0	0	0	0
31 to 60	0	0	0	0	0	0	0	0	0	0
61 to 120	0	0	0	0	0	0	0	0	0	0
121 to 180	0	0	0	0	0	0	0	0	0	0
181 to 365	0	0	0	0	0	0	0	0	0	0
More than 365	0	0	0	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0	0	0	0

Section 8: Complaints and Investigations Notices Received

Complaints and Investigations Notices Received

Section 31	Section 33	Section 35	Court action	Total
0	0	0	0	0

Section 9: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIB)

9.1 Privacy Impact Assessments

Privacy Impact Assessments (PIAs)

Number of PIA(s) completed	2

9.2 Personal Information Banks

Personal Information Banks

Personal Information Banks	Active	Created	Terminated	Modified
	4	0	0	0

Section 10: Material Privacy Breaches

Material Privacy Breaches

Number of material privacy breaches reported to Treasury Board of Canada SecretariatTBS	0
Number of material privacy breaches reported to Office of the Privacy Commissioner of CanadaOPC	0

Section 11: Resources related to the Privacy Act

11.1 Costs

Costs

Expenditures	Amount
Salaries	$20,290
Overtime	$0
Goods and Services Professional services contracts $0 Other $0	$0
Total	$20,290

11.2 Human Resources

Human Resources

Resources	Person Years Dedicated to Privacy Activities
Full-time employees	1.250
Part-time and casual employees	0.000
Regional staff	0.000
Consultants and agency personnel	0.000
Students	0.000
Total	1.250