Annual Report to Parliament on the Administration of the Privacy Act 2022-2023

Introduction

The Privacy Act (Act) provides individuals with a right of access to their personal information and protects the privacy of individuals with respect to personal information under the control of government institutions.

This Annual Report was prepared in accordance with section 72 of the Act, which stipulates that annual reports on privacy shall be tabled in Parliament.

About the Civilian Review and Complaints Commission for the Royal Canadian Mounted Police

The Civilian Review and Complaints Commission for the Royal Canadian Mounted Police (CRCC) operates pursuant to the Royal Canadian Mounted Police Act, R.S.C. 1985, c. R‑10. The CRCC provides civilian review of RCMP members' conduct in performing their policing duties so as to hold the RCMP accountable to the public.

One of the CRCC's main roles is to take public complaints about members of the RCMP. These complaints are then forwarded to the RCMP for initial investigation as mandated by the Royal Canadian Mounted Police Act; however, if the complainant is dissatisfied with the response that he or she receives from the RCMP, the CRCC will review the complaint with a view to determining the reasonableness of the RCMP's response. In appropriate cases, the CRCC will undertake its own investigation or hearing into a complaint. The Chairperson of the CRCC also has the power to file his or her own complaint if he or she feels that a matter is deserving of investigation.

Additionally, even in the absence of a public complaint, the CRCC is empowered to conduct a review of RCMP activities to evaluate compliance with legislation, regulations, ministerial directions, policy, procedures and/or guidelines.

ATIP Responsibilities

At the CRCC, the Access to Information and Privacy (ATIP) Unit consisted solely of the ATIP Coordinator for most of the reporting period of 2022-2023. The ATIP Coordinator processes all requests from the public and consultations from other departments or agencies. The ATIP Coordinator also provides advice to CRCC employees and senior officials on ATIP-related matters, prepares annual ATIP reports, ensures the ongoing accuracy of the CRCC's Info Source, prepares completed Access to Information summaries for proactive disclosure on the CRCC's website, participates in forums for the ATIP community and monitors changes in ATIP policy, guidelines and directives. During the final quarter of the 2022-2023 reporting period, the CRCC added a Junior ATIP Analyst to the ATIP Unit. The Junior ATIP Analyst processes both formal and informal requests from the public and consultations from other departments or agencies.

When processing requests and consultations under the Access to Information and Privacy Acts, the ATIP Coordinator also benefits from some administrative assistance from personnel in the Information Management Unit of the CRCC and a student assistant.

The CRCC Chairperson, under delegated authority from the Minister of Public Safety, provides the final approval for all responses on ATIP requests and consultations.

During the reporting period, the CRCC was not party to any service agreements under section 73.1 of the Privacy Act.

Delegation Order

The Minister of Public Safety has delegated full authority under the Act to the CRCC Chairperson and Senior Director, Operations. The Minister has also delegated administrative duties and functions to the CRCC ATIP Coordinator. The most recent delegation order was signed by the Minister of Public Safety on July 4, 2016 (see Annex A).

Privacy Requests Received

During the course of the reporting period, seventy-seven (77) new requests for personal information under the Act were received. Twelve (12) requests were carried over from the previous year. Of those eighty-nine (89), seventy-eight (78) requests were processed during that period and eleven (11) were carried forward into 2023-2024.

Twenty-eight (28) of the requests for personal information that were processed during 2022-2023 were from individuals seeking their personal information from public complaints files held by the CRCC, in many cases, for more than one complaint file. Forty-eight (48) were from individuals who erroneously applied to the CRCC to obtain law enforcement information from the RCMP and two (2) were general requests searching for their personal information from the CRCC.

The total number of pages processed during the reporting period was 10,212, over twice as many pages as the 2021-2022 reporting period.

Performance

During the reporting period, sixty-five (65) of the seventy-eight (78) requests processed (83.3%) were responded to within the established timelines.

The seventy-seven (77) Privacy requests received by the CRCC in 2022-2023 represent a sustained increase over the number of Privacy requests received in recent years:

2022-23    77
2021-22    75
2020-21    46
2019-20    32
2018-19    27
2017-18    11

The increase in number of requests received in recent years is likely attributable to the ATIP Online Request Service, which has allowed requesters to submit their requests online to the CRCC since late 2018, many of which it turned out were intended for other institutions (namely the RCMP).

During the 2022-2023 reporting period, the CRCC had twelve (12) active requests from the 2021-2022 reporting period. Of these requests, ten (10) were closed within legislated timelines and two (2) were closed beyond legislated timelines during the 2022-2023 reporting period.

Of the seventy-eight (78) closed requests, fifty-six (56) were completed within 1 to 30 days; twelve (12) were completed within 31 to 60 days; six (6) were completed within 61 to 120 days; three (3) were completed within 121 to 180 days; and one (1) was completed within 181 to 365 days.

The CRCC took extensions for ten (10) of the requests, where nine (9) were taken for external consultations, and one (1) was taken for a large volume of active requests and meeting the 30-day deadline would unreasonably interfere with the CRCC's operations.

Of the seventy-eight (78) requests processed during the reporting period, seven (7) (8.9%) were released without redaction; nineteen (19) (24.4%) were released in part with exemptions; and three (3) (3.8%) were abandoned. In the other forty-nine (49) (62.8%) requests, no records were found to exist.

During the reporting period, the CRCC claimed exemptions pursuant to paragraph 19(1)(c) (information that was obtained in confidence from the government of a province or an institution thereof); subparagraph 22(1)(a)(i) (information that was obtained or prepared by any government institution, or part of any government institution, that is an investigative body specified in the regulations in the course of lawful investigations pertaining to the detection, prevention or suppression of crime); subparagraph 22(1)(a)(ii) (information that was obtained or prepared by any government institution, or part of any government institution, that is an investigative body specified in the regulations in the course of lawful investigations pertaining to the enforcement of any law of Canada or a province); paragraph 22(1)(b) (Information the disclosure of which could be injurious to lawful investigations); section 25 (Safety of individuals); section 26 (Personal information about another individual); and section 27 (Solicitor-client privilege) of the Privacy Act.

External consultation was required for twelve (12) requests.

The statutory deadlines were not met for seven (7) requests due to external consultation, five (5) requests due to interference with operations or workload, and one (1) request due to CRCC staff absences during the end of year holiday period.

Five (5) consultations were received from other Government of Canada institutions during the reporting period. These consultations all related to documents having to do with public complaints against RCMP members. All five (5) consultations were closed within 30 days, resulting in 50 pages processed.

See Annex B for the Statistical Report.

On March 14, 2020, the CRCC implemented exceptional workplace measures to curb the spread of COVID-19 and protect federal employees and the public.

However, during the 2022-2023 reporting period, the CRCC ATIP Coordinator worked on‑site, most days, at the CRCC workplace. This work is supported by part-time on-site information management staff.

Training and Awareness

During the reporting period, all CRCC employees completed mandatory access to information and privacy training through the Canadian School of Public Service. In addition to this, guidance on privacy matters was provided on an ad hoc basis (e.g. in person, by email and through the CRCC's electronic newsletter).

Policies, Guidelines, Procedures and Initiatives

The ATIP Unit was actively involved in communicating evolving privacy requirements emerging in the context of the COVID-19 pandemic to protect the personal information of the CRCC's employees and members of the public that the CRCC serves. These communications included Treasury Board of Canada Secretariat policies and directives on privacy, as well as general advice on email encryption and personal information handling for employees while teleworking.

Furthermore, due to exceptional workplace measures implemented to curb the spread of COVID-19, the ATIP Unit developed new secure online procedures for the review and approval process for completed requests. With the support of the Information Technology staff, the ATIP Unit has also implemented new procedures for offices of primary interest to provide large volumes of records to the ATIP Unit quickly and securely while teleworking. These new procedures have proved to be valuable for the evolving CRCC Hybrid Workforce, since the termination of the COVID-19 special measures during the second half of the 2022-2023 reporting period. 

Monitoring Compliance

The CRCC monitors the time to process Privacy requests through its case management software. The ATIP Coordinator keeps track of upcoming deadlines for requests and consultations. Reminders of approaching deadlines are provided to senior management at least quarterly. The ATIP Coordinator meets regularly with the CRCC Chairperson and General Counsel to discuss various issues pertaining to in-progress ATIP files.

In compliance with the Directive on Personal Information Requests and Correction of Personal Information, the CRCC uses discretion to limit inter-departmental consultations to requests only where there is the intention to disclose potentially sensitive information from external institutions.

Privacy Impact Assessments

No new privacy impact assessments (PIA) were completed by the CRCC during the reporting period. The amended personal information bank (PIB) submitted by the CRCC in the 2021-2022 reporting period was registered by Treasury Board of Canada Secretariat during the 2022-2023 reporting period.

Privacy Breaches

The CRCC reported one (1) material privacy breach to the Treasury Board of Canada Secretariat and the Office of the Privacy Commissioner during the reporting period.

Through human error, a report detailing the investigation of one complainant's public complaint about the RCMP was inadvertently included in the envelope of correspondence mailed to another unrelated complainant. The recipient recognized that the information was sent to them by mistake. The fact that the recipient notified the CRCC of the error suggests that they had no intention of improperly using this information.

CRCC staff who deal with personal information were reminded of the need for great caution when handling personal information to avoid inadvertent disclosure through human error. In future, staff will be sure to double check that all outbound envelopes contain only the proper documentation intended for that recipient.

Disclosures Made Pursuant to Paragraph 8(2)(m) of the Privacy Act

The CRCC made no disclosures of personal information pursuant to paragraph 8(2)(m) of the Act in 2022-2023.

Complaints

During the previous 2021-2022 reporting period, one (1) new complaint was filed against the CRCC alleging that the CRCC refused to release records. The Office of the Privacy Commissioner contacted the CRCC for information on that complaint and resolved the complaint through OPC Early Resolution rather than a formal investigation.

Similarly, in the course of the 2022-2023 reporting period, the CRCC received two (2) new complaints that alleged that the CRCC refused to release records and improperly applied exemptions. Towards the end of the reporting period, the Office of the Privacy Commissioner contacted the CRCC for information and resolved both of these complaint through OPC Early Resolution rather than through formal investigations.

There were no audits or other investigations conducted during the reporting period.

Summary of Key Issues and Actions Taken on Complaints

CRCC ATIP staff has adopted more rigorous procedures for retrieving records from Offices of Primary Interest after examining its practices during complaint investigations during the 2020-2021 reporting period. These procedures were reviewed and revised in 2022-2023 in light of the addition of a new staff member to the ATIP unit and the increase to CRCC personnel overall.

Appendix A: Delegation Order

The Minister of Public Safety Canada, pursuant to section 73 of the Privacy Act*, hereby designates the persons holding the positions set out below, or acting in those positions, to exercise the powers and perform the duties and functions of the Minister as the head of a government institution, that is, the Civilian Review and Complaints Commission for the RCMP, under the section of the Act set out opposite each position.

Dated, at the City of Ottawa, 4th of July 2016.

Signed by the Honourable Ralph Goodale, P.C., M.P., Minister of Public Safety Canada

*R.S.C. 1985, c. P-21

Appendix B: Statistical Report

Reporting period: 2022-04-01 to 2023-03-31

Supplemental Statistical Report on the Access to Information Act and Privacy Act

Reporting period: 2022-04-01 to 2023-03-31

Section 1: Capacity to Receive Requests under the Access to Information Act and the Privacy Act

Section 2: Capacity to Process Records under the Access to Information Act and Privacy Act

Section 3: Open Requests and Complaints Under the Access to Information Act

3.1 Enter the number of open requests that are outstanding from previous reporting periods.

3.2 Enter the number of open complaints with the Information Commissioner of Canada that are outstanding from previous reporting periods.

Section 4: Open Requests and Complaints Under the Privacy Act

4.1 Enter the number of open requests that are outstanding from previous reporting periods.

4.2 Enter the number of open complaints with the Privacy Commissioner of Canada that are outstanding from previous reporting periods.

Section 5: Social Insurance Number (SIN)

Section 6: Universal Access under the Privacy Act