Annual Report to Parliament on the Administration of the Privacy Act 2020-2021

Introduction

The Privacy Act (Act) provides individuals with a right of access to their personal information and protects the privacy of individuals with respect to personal information under the control of government institutions.

This Annual Report was prepared in accordance with section 72 of the Act, which stipulates that annual reports on privacy shall be tabled in Parliament.

About the Civilian Review and Complaints Commission for the Royal Canadian Mounted Police

The Civilian Review and Complaints Commission for the Royal Canadian Mounted Police (CRCC) operates pursuant to the Royal Canadian Mounted Police Act, R.S.C. 1985, c. R‑10. The CRCC provides civilian review of RCMP members' conduct in performing their policing duties so as to hold the RCMP accountable to the public.

One of the CRCC's main roles is to take public complaints about members of the RCMP. These complaints are then forwarded to the RCMP for initial investigation as mandated by the Royal Canadian Mounted Police Act; however, if the complainant is dissatisfied with the response that he or she receives from the RCMP, the CRCC will review the complaint with a view to determining the reasonableness of the RCMP's response. In appropriate cases, the CRCC will undertake its own investigation or hearing into a complaint. The Chairperson of the CRCC also has the power to file his or her own complaint if he or she feels that a matter is deserving of investigation.

Additionally, even in the absence of a public complaint, the CRCC is empowered to conduct a review of RCMP activities to evaluate compliance with legislation, regulations, ministerial directions, policy, procedures and/or guidelines.

ATIP Responsibilities

At the CRCC, the Access to Information and Privacy (ATIP) Unit consists solely of the ATIP Coordinator. The ATIP Coordinator processes all requests from the public and consultations from other departments or agencies. The ATIP Coordinator also provides

advice to CRCC employees and senior officials on ATIP-related matters, prepares annual ATIP reports, ensures the ongoing accuracy of Info Source, prepares completed Access to Information summaries for proactive disclosure on the CRCC's website, participates in forums for the ATIP community and monitors changes in ATIP policy, guidelines and directives.

When processing requests and consultations under the Access to Information and Privacy Acts, the ATIP Coordinator also benefits from some administrative assistance from personnel in the Information Management Unit of the CRCC.

The CRCC Chairperson, under delegated authority from the Minister of Public Safety, provides the final approval for all responses on ATIP requests and consultations.

During the reporting period, the CRCC was not party to any service agreements under section 73.1 of the Privacy Act.

Delegation Order

The Minister of Public Safety has delegated full authority under the Act to the CRCC Chairperson and Senior Director, Operations. The Minister has also delegated administrative duties and functions to the CRCC ATIP Coordinator. The most recent delegation order was signed by the Minister of Public Safety on July 4, 2016 (see Annex A).

Privacy Requests Received

During the course of the reporting period, forty-six (46) new requests for personal information under the Act were received. Seven (7) requests were carried over from the previous year. Of those fifty-three (53), forty-nine (49) requests were processed during that period and four (4) were carried forward into 2021-2022.

Fifteen (15) of the requests for personal information that were processed during 2020-2021 were from individuals seeking their personal information from public complaints files held by the CRCC. Two (2) were from members of the RCMP seeking their personal information from public complaint files in which they were the subject, held by the CRCC. Thirty-one (31) were from individuals who erroneously applied to the CRCC to obtain law enforcement information from the RCMP and one (1) was a general request searching for their personal information from the CRCC.

Performance

During the reporting period, forty-seven (47) of the forty-nine (49) requests processed (95.9%) were responded to within the established timelines.

The forty-six (46) Privacy requests received by the CRCC in 2020-2021 represent a dramatic increase over the number of Privacy requests received in recent years:

2020-21 46
2019-20 32
2018-19 27
2017-18 11
2016-17 9

Despite the increase in requests, the CRCC still responded to over 90% of requests within legislated timelines.

The increase in number of requests received is likely attributable to the ATIP Online Request Service, which has allowed requesters to submit their requests online to the CRCC since late 2018, many of which it turned out were intended for other institutions.

Of the forty-nine (49) requests processed during the reporting period, seven (7) (14.3%) were released without redaction, ten (10) (20.4%) were released in part with exemptions and two (2) were abandoned by the requestors; however, the CRCC partially released some pages for one (1) of these requests before the request was abandoned. The total number of pages processed was 2,770 pages. In the other thirty (30) requests, no records were found to exist.

During the reporting period, the CRCC claimed exemptions paragraph 22(1)(b) (Information the disclosure of which could be injurious to lawful investigations), section 22.3 (Public Servants Disclosure Protection Act), section 25 (Safety of individuals), section 26 (Personal information of a third party), and section 27 (Solicitor-client privilege) of the Privacy Act.

External consultation was required for four (4) requests.

The statutory deadlines were not met for two (2) requests due to external consultation.

Six (6) consultations were received from other Government of Canada institutions during the reporting period. These consultations all related to documents having to do with public complaints against RCMP members. All six (6) consultations were closed during the reporting period, resulting in 198 pages processed.

See Annex B for the Statistical Report.

On March 14, 2020, the CRCC implemented exceptional workplace measures to curb the spread of novel coronavirus (COVID-19) and protect federal employees and the public.

Since that date, the CRCC Access to Information and Privacy staff has been working from home most of the time, but completes tasks that cannot be performed remotely by attending the CRCC workplace as required. This work is supported by part-time on-site information management staff. However, unlike many federal institutions, these measures have not negatively impacted the CRCC's performance .

Training and Awareness

During the reporting period, no CRCC employees participated in formal privacy training. However, guidance on privacy matters was provided on an ad hoc basis (e.g. in person, by email and through the CRCC's electronic newsletter).

Policies, Guidelines, Procedures and Initiatives

The ATIP Unit has been actively involved in communicating evolving privacy requirements emerging in the context of the COVID-19 pandemic to protect the personal information of the CRCC's employees and members of the public that the CRCC serves. These communications include Treasury Board of Canada Secretariat policies and directives on privacy, as well as general advice on email encryption and personal information handling for employees working at home.

Furthermore, due to exceptional workplace measures implemented to curb the spread of novel coronavirus (COVID-19), the ATIP Office developed new secure online procedures for the review and approval process for completed requests.

Monitoring of Timeliness

The CRCC monitors the time to process Privacy requests through its case management software. The ATIP Coordinator keeps track of upcoming deadlines for requests and consultations. Reminders of approaching deadlines are provided to senior management at least quarterly. The ATIP Coordinator meets regularly with the CRCC Chairperson and General Counsel to discuss various issues pertaining to in-progress ATIP files.

Privacy Impact Assessments

The CRCC has one privacy impact assessment in progress. Once it is finalized, the CRCC will submit it to Treasury Board and the Privacy Commissioner.

Privacy Breaches

There were no material privacy breaches at the CRCC during the reporting period.

Disclosures Made Pursuant to Paragraph 8(2)(m) of the Privacy Act

The CRCC made one disclosure of personal information pursuant to paragraph 8(2)(m) of the Act in 2020-2021. A request was made by the sibling of a deceased person for information related to a police investigation into the circumstances of the sibling's death. Concurrent notice under subsection 8(5) was provided to the Office of the Privacy Commissioner, explaining the compassionate reasons for the disclosure.

Complaints

There were three (3) new complaints filed against the CRCC during the reporting period (i.e. two involved refusals to make corrections, and one related to an allegation that the CRCC shared personal information improperly with another federal institution).

Ten (10) complaints were filed against the CRCC during previous periods: two (2) complaints about the CRCC's refusal to correct personal information which the complainant alleged was false; six (6) complaints about the refusal to disclose information by improperly invoking exemptions; and two (2) complaints about refusing to disclose information by improperly invoking exemptions and by not conducting a proper search for records.

During the reporting period, the Office of the Privacy Commissioner (OPC) investigated all thirteen (13) of these new and previous complaints and issued findings on all but one.

The OIC concluded that all four (4) complaints involving the CRCC's refusal to correct personal information were unfounded.

The six (6) complaints that only alleged the improper application of exemptions were unfounded.

For the two (2) complaints concerning the improper application of exemptions as well as the improper search of records, the OPC concluded that the CRCC had properly applied exemptions, but did not conduct a thorough search for records that would not have been disclosable at the time of the response to the requestor. The OPC found these two complaints as conditionally resolved provided that the CRCC release the pertinent records to the requestor. The CRCC did release additional records to the requestor within 30 days of the OPC's finding.

Finally, the OIC investigated the complaint alleging the improper sharing of personal information with another federal institution, but no finding had been issued by March 31, 2021.

There were no audits or other investigations conducted during the reporting period.

Summary of Key Issues and Actions Taken on Complaints

CRCC ATIP staff is in the process of developing more rigorous procedures for retrieving records from Offices of Primary Interest after examining its practices during complaint investigations during the 2020-2021 reporting period.

Appendix A: Delegation Order

The Minister of Public Safety Canada, pursuant to section 73 of the Privacy Act*, hereby designates the persons holding the positions set out below, or acting in those positions, to exercise the powers and perform the duties and functions of the Minister as the head of a government institution, that is, the Civilian Review and Complaints Commission for the RCMP, under the section of the Act set out opposite each position.

Dated, at the City of Ottawa, 4th of July 2016.

Signed by the Honourable Ralph Goodale, P.C., M.P., Minister of Public Safety Canada

*R.S.C. 1985, c. P-21

Appendix B: Statistical Report

Reporting period: 2020-04-01 to 2021-03-31

Supplemental Statistical Report on the Access to Information Act and Privacy Act

Reporting period: 2020-04-01 to 2021-03-31

Section 1: Capacity to Receive Requests

Section 2: Capacity to Process Records