Privacy Act Annual report for 2025-2026

Introduction

The Canada Water Agency (CWA) is pleased to present its annual report outlining its Privacy Act activities during the reporting period of April 1^st, 2025, to March 31^st, 2026.

The CWA did not have any wholly owned subsidiaries at any point during this timeframe.

This report is submitted in accordance with section 72 of the Privacy Act, which requires every head of a federal government institution to report to Parliament on the administration of the Act within their institution during the reporting period.

Purpose of the Privacy Act

Enacted in 1983, the Privacy Act gives Canadian citizens and people present in Canada the right to access information about themselves held by the federal government.

The Act imposes obligations on government institutions to govern the collection, use, protection, and disclosure of personal information.

Canada Water Agency’s Mandate

The Canada Water Agency’s mandate is to improve freshwater management in Canada by providing leadership, effective collaboration federally, and improved coordination and collaboration with provinces, territories, and Indigenous peoples to proactively address transboundary freshwater challenges and opportunities.

To deliver on this mandate, the CWA is:

1. Fostering creativity and whole-of-government approaches with federal departments and agencies;
2. Building partnerships, enhancing trust and participating in reconciliation with First Nations, Métis and Inuit partners;
3. Advancing meaningful and respectful collaboration with provinces and territories and binational, non-governmental and private sector partners; and,
4. Using science and data to achieve and report on measurable results.

For more information about the Agency, please visit our website.

Organizational Structure

The Canada Water Agency’s Access to Information and Privacy (ATIP) Unit is responsible for the administration and application of the Access to Information Act and Privacy Act. It sits within the Corporate Secretariat, which is part of the broader President’s Office. The Unit consists of two full-time employees – a PM-05 ATIP Lead Analyst and a PM-03 ATIP Analyst. Their activities are overseen by the Manager of the Corporate Secretariat, who directly reports to the President’s Chief of Staff.

Please note that the CWA was not party to any pre-existing service agreements under section 73.1 of the Privacy Act during the reporting period.

Delegation Order

The Delegation Order in Annex A of this report outlines the CWA officials with authority and accountability for decision-making related to the application of the Privacy Act.

On September 5^th, 2025, the Honourable Julie Dabrusin, Minister of Environment and Climate Change, approved the Delegation Order in effect during the reporting period.

Performance 2025-2026

The following section provides an overview of activities undertaken by the CWA during the reporting period.

• From April 1^st, 2025, to March 31^st, 2026, the CWA received one privacy request:
  • The request was not closed within the thirty-day legislated timeline, but rather within 61-120 days. This resulted in an overall on-time responsiveness rate of 0%.
  • The CWA took an extension on this request in accordance with Section 15(a)(i) of the Act. This section permits the head of a government institution to extend the time limit if the scale of the request would unreasonably interfere with the institution’s operations. 
  • Ultimately, the information requested was partially disclosed ("disclosed in part"). This disclosure occurred within the fiscal year, making the number of completed requests for the reporting period one (1).

At the end of the fiscal year, there were no active privacy requests within the CWA (i.e. no requests were carried over into the 2026-27 fiscal year). Similarly, there were no active privacy complaints against the CWA.

Finally, during the reporting period, the CWA received no requests for consultation from other institutions.

Training and Awareness

The CWA ATIP Unit offers employees training and awareness resources from the Canada School of Public Service on their responsibilities under the Privacy Act. Moreover, the ATIP Unit is available for employees to ask questions, raise concerns, and seek advice.

During the reporting period, the ATIP Unit offered an ATIP 101 presentation to CWA employees in both English and French. ATIP Analysts were also required to take additional in-depth training on the Act and best practices, which was captured in their Performance Management Agreements.

Policies, Guidelines, and Procedures

The ATIP Unit is currently finalizing Access to Information and Privacy policy frameworks and annexes to share with employees. This work is expected to continue into the next fiscal year. A comprehensive ATIP guide for CWA employees is in the final stages of development.

Initiatives and Projects to Improve Privacy

This reporting period, the Canada Water Agency acquired and onboarded the new ATIPXpress case management system. This will allow for increased efficiency in processing requests, as well as a more streamlined consultation process, leading to quicker turnaround times and fewer required extensions. The goal for the next reporting period is to improve response times and have more requests completed within the initial legislated timeline of 30 days, where possible.

Summary of Key Issues and Actions Taken on Complaints

Applicants have the right to file a complaint with the Privacy Commissioner of Canada related to the processing of a Privacy request.

During the reporting period, no complaints were received.

Material Privacy Breaches

A privacy breach is the improper or unauthorized access to, creation, collection, use, disclosure, retention or disposal of personal information. A privacy breach becomes “material” when it could reasonably be expected to create a real risk of significant harm to an individual (i.e. bodily harm; humiliation; damage to reputation or relationships; loss of employment, business or professional
opportunities; financial loss; identity theft; negative effects on a credit record; and damage to or loss of property).

During the reporting period, no material privacy breaches occurred.

Privacy Impact Assessments

A privacy impact assessment is a risk management process that helps institutions ensure that they meet legislative requirements and identify the impact(s) of their programs and activities on individuals’ privacy.

During the reporting period, no PIAs were completed.

Public Interest Disclosures

Paragraph 8 (2)(m) of the Privacy Act permits – at the discretion of the head of the institution – to disclose information that is considered to be in the public interest.

During the reporting period, no disclosures were made under paragraph 8 (2)(m) of the Privacy Act.

Monitoring Compliance

The Manager of the Corporate Secretariat oversees the CWA’s ATIP Unit and receives weekly reports on incoming requests, timelines, retrieval, challenges, and compliance related to privacy. This allows for regular performance and compliance management to ensure that the CWA’s requirements related to the Privacy Act are met in a timely and efficient manner.

Annex A: Delegation Order