Annual Report to Parliament on the Administration of the Privacy Act 2023-2024

Introduction

The Privacy Act (Act) provides individuals with a right of access to their personal information and protects the privacy of individuals with respect to personal information under the control of government institutions.

This Annual Report was prepared in accordance with section 72 of the Act, which stipulates that annual reports on privacy shall be tabled in Parliament.

This report will be submitted and tabled in Parliament through the Minister of Public Safety Canada according to the timeline set out in section 72.

About the Civilian Review and Complaints Commission for the Royal Canadian Mounted Police

The Civilian Review and Complaints Commission for the Royal Canadian Mounted Police (CRCC) operates pursuant to the Royal Canadian Mounted Police Act, R.S.C. 1985, c. R‑10. The CRCC provides civilian review of RCMP members' conduct in performing their policing duties so as to hold the RCMP accountable to the public.

One of the CRCC's main roles is to take public complaints about members of the RCMP. These complaints are then forwarded to the RCMP for initial investigation as mandated by the Royal Canadian Mounted Police Act; however, if the complainant is dissatisfied with the response that he or she receives from the RCMP, the CRCC will review the complaint with a view to determining the reasonableness of the RCMP's response. In appropriate cases, the CRCC will undertake its own investigation or hearing into a complaint. The Chairperson of the CRCC also has the power to file his or her own complaint if he or she feels that a matter is deserving of investigation.

Additionally, even in the absence of a public complaint, the CRCC is empowered to conduct a review of RCMP activities to evaluate compliance with legislation, regulations, ministerial directions, policy, procedures and/or guidelines.

ATIP Responsibilities

At the CRCC, the Access to Information and Privacy (ATIP) Unit consists of an ATIP Coordinator and a Junior ATIP Analyst . Both employees process requests from the public and consultations from other departments or agencies, and participate in forums for the ATIP community. The ATIP Coordinator also provides advice to CRCC employees and senior officials on ATIP-related matters, prepares annual ATIP reports, ensures the ongoing accuracy of the CRCC's Info Source, prepares completed Access to Information summaries for proactive publishing on the Open Government Portal, and monitors changes in ATIP policy, guidelines and directives. During the reporting period, the Junior ATIP Analyst was assigned the responsibility for monitoring compliance for proactive publishing at the CRCC, under Part 2 of the Access to Information Act.

When processing requests and consultations under the Access to Information and Privacy Acts, the ATIP Unit also benefits from some administrative assistance from personnel in the Information Management Unit of the CRCC and a student assistant.

The CRCC Chairperson, under delegated authority from the Minister of Public Safety, provides the final approval for all responses on ATIP requests and consultations.

During the reporting period, the CRCC was not party to any service agreements under section 73.1 of the Privacy Act.

Delegation Order

The Minister of Public Safety has delegated full authority under the Act to the CRCC Chairperson, the ATIP Coordinator, and the Senior Director of Corporate Services and Chief Financial Officer. The most recent delegation order was signed by the Minister of Public Safety on November 17, 2023 (see Annex A).

Privacy Requests Received

During the course of the reporting period, seventy-eight (78) new requests for personal information under the Act were received. Eleven (11) requests were carried over from the previous year. Of those eighty-nine (89), eighty (80) requests were processed during that period and nine (9) were carried forward into 2024-2025.

Thirty (30) of the requests for personal information that were processed during 2023-2024 were from individuals seeking their personal information from public complaints files held by the CRCC, in many cases, for more than one complaint file. Four (4) requests were from RCMP members who were subjects of complaints, forty-one (41) were from individuals who erroneously applied to the CRCC to obtain law enforcement information from the RCMP and five (5) were general requests from individuals searching for their personal information from the CRCC.

Performance

During the reporting period, sixty-five (65) of the eighty (80) requests processed (81.3%) were responded to within the established timelines.

The seventy-eight (78) Privacy requests received by the CRCC in 2023-2024 represent a sustained increase over the number of Privacy requests received in recent years:

2023-24    78
2022-23    77
2021-22    75
2020-21    46
2019-20    32
2018-19    27

The increase in number of requests received in recent years is likely attributable to the ATIP Online Request Service, which has allowed requesters to submit their requests online to the CRCC since late 2018, many of which it turned out were intended for other institutions (namely the RCMP).

During the 2023-2024 reporting period, the CRCC had eleven (11) active requests from the 2022-2023 reporting period. Of these requests, three (3) were closed within legislated timelines and eight (8) were closed beyond legislated timelines during the 2023-2024 reporting period.

Of the eighty (80) closed requests, fifty-nine (59) were completed within 1 to 30 days; ten (10) were completed within 31 to 60 days; seven (7) were completed within 61 to 120 days; two (2) were completed within 121 to 180 days; and two (2) were completed within 181 to 365 days.

The CRCC took extensions for fourteen (14) of the requests, where ten (10) were taken for external consultations, and four (4) were taken for a large volume of active requests and meeting the 30-day deadline would unreasonably interfere with the CRCC's operations.

Of the eighty (80) requests processed during the reporting period, ten (10) (12.5%) were released without redaction; twenty-four (24) (30%) were released in part with exemptions; and one (1) (1.3%) was abandoned. In the other forty-five (45) (56.3%) requests, no records were found to exist.

During the reporting period, the CRCC claimed exemptions pursuant to paragraph 19(1)(c) (information that was obtained in confidence from the government of a province or an institution thereof); section 21 (personal information the disclosure of which could reasonably be expected to be injurious to the conduct of international affairs), subparagraph 22(1)(a)(i) (information that was obtained or prepared by any government institution, or part of any government institution, that is an investigative body specified in the regulations in the course of lawful investigations pertaining to the detection, prevention or suppression of crime); paragraph 22(1)(b) (information the disclosure of which could be injurious to lawful investigations); section 25 (safety of individuals); section 26 (personal information about another individual); and section 27 (solicitor-client privilege) of the Privacy Act.

In total, fifteen (15) requests were not closed within the statutory timelines. The statutory timelines were not met for five (5) requests due to external consultation, three (3) requests due to interference with operations or workload, and seven (7) requests due to CRCC staff absences related to holidays or the Public Service Alliance of Canada general strike which occurred during the beginning of the reporting period.

Eleven (11) consultations were received from other Government of Canada institutions during the reporting period. These consultations all related to documents having to do with public complaints against RCMP members. All eleven (11) consultations were closed within 30 days, resulting in 287 pages processed.

See Annex B for the Statistical Report.

Training and Awareness

During the reporting period, all CRCC employees completed mandatory access to information and privacy training through the Canadian School of Public Service. In addition to this, guidance on privacy matters was provided on an ad hoc basis (e.g. in person, by email and through the CRCC's electronic newsletter).

The ATIP Coordinator also conducted a training session with the staff of the CRCC's Policy and Operational Support Unit during the reporting period.

Policies, Guidelines and Procedures

During the reporting period, the ATIP Unit drafted new policies or changes to policies for the following areas relating to the administration of the Act:

• Responding to requests for personal information corrections; and
• CRCC Privacy Breach Protocol. 

In response to a surge of personal information requests submitted to the CRCC and other institutions from a single individual using the ATIP Online Request, the Treasury Board of Canada Secretariat (TBS) issued guidance during the final quarter of the 2023-2024 reporting period on the preferred practices when responding to requests where the institution is unlikely to have control of the information requested. Previously, the CRCC performed a search for records and provided a No Records Exist response. However, the TBS guidance advised that such a response may inadvertently disclose personal information to which the requester has no right of access. Therefore, the CRCC discontinued this practice, and instead now advises requesters that the type of personal information requested is not part of our program responsibilities or information holdings, and the CRCC now reports these requests upon closing as Unable to Process. The impact to this 2023-2024 Annual Report is that the CRCC reported seventeen (17) fewer requests than the total number that would have been reported if the CRCC had not changed its procedure.

Initiatives and Projects to Improve Privacy

During the 2023-2024 reporting period, the ATIP Unit began consulting with the CRCC's operations to explore whether there are categories of records or complaint information that may be released to individuals informally, thus improving their access rights to their personal information.

Monitoring Compliance

The CRCC monitors the time to process Privacy requests through its case management software. The ATIP Coordinator keeps track of upcoming deadlines for requests and consultations. Reminders of approaching deadlines are provided to senior management at least quarterly. The ATIP Coordinator meets regularly with the CRCC Chairperson and General Counsel to discuss various issues pertaining to in-progress ATIP files.

In compliance with the Directive on Personal Information Requests and Correction of Personal Information, the CRCC uses discretion to limit inter-departmental consultations to requests only where there is the intention to disclose potentially sensitive policing information from external institutions. The CRCC does not consult external institutions before disclosing information that is routinely released to complainants during the public complaint process. This practice is monitored by advising the ATIP Coordinator, General Counsel, and the delegated head of ATIP within the initial 30-day period for each new request, as to whether or not an extension will be taken.

Privacy Impact Assessments

No new privacy impact assessments (PIA) were completed by the CRCC during the reporting period.

Privacy Breaches

The CRCC reported one (1) material privacy breach to the Treasury Board of Canada Secretariat (TBS) and the Office of the Privacy Commissioner during the reporting period.

The breach was a government-wide incident involving suspicious and unauthorized activity identified on third-party systems belonging to Sirva Worldwide systems (Brookfield Global Relocation Services [BGRS] and Sirva Canada), which occurred from August 17 to September 28, 2023. BGRS provides relocation services to the Government of Canada. The CRCC's records relating to relocation were examined and it was determined that a small number of past and present CRCC employees may be at risk due to the breach. In response, the CRCC delegated head of ATIP determined that it was necessary to report that a material breach at the CRCC had occurred as a result of this incident. The CRCC notified the affected individuals, or in one case, their next-of-kin, and provided information to TBS to enable it to provide credit monitoring services to the affected individuals. As of March 31, 2024, the breach investigation was still ongoing.

Disclosures Made Pursuant to Paragraph 8(2)(m) of the Privacy Act

The CRCC made no disclosures of personal information pursuant to paragraph 8(2)(m) of the Act in 2023-2024.

Complaints

During the 2023-2024 reporting period, the CRCC received three (3) new complaints.

One (1) alleged that the CRCC refused to release records and improperly applied exemptions. The Office of the Privacy Commissioner investigated and determined that the complaint was not well-founded.

In addition, the CRCC received two (2) complaints from the same individual that alleged that the CRCC took unreasonable extensions to the due dates of their requests. The Office of the Privacy Commissioner investigated one of these complaints and found that the CRCC was justified in its reasoning for taking the extension. However, the CRCC failed to respond within the extended legislated timeline, and therefore the complaint about the delay was founded.

The remaining extension complaint remains active as of March 31, 2024.

There were no audits or other investigations conducted during the reporting period.

Summary of Key Issues and Actions Taken on Complaints

During the 2023-2024 reporting period, the CRCC ATIP staff did not take any new actions in response to complaints.

Appendix A: Delegation Order

Privacy Act and Privacy Regulations

Civilian Review and Complaints Commission for the RCMP

The Minister of Public Safety Canada, pursuant to section 73 of the Privacy Act*, hereby designates the persons holding the positions set out below, or acting in those positions, to exercise the powers and perform the duties and functions of the Minister as the head of a government institution, that is, the Civilian Review and Complaints Commission for the RCMP, under the provisions of the Act and related regulations set out opposite each position. This designation replaces all previous delegation orders.

Dated, at the City of Ottawa,

this 17 day of November, 2023

Hon. Dominic LeBlanc, P.C., K.C., M.P.

*R.S.C. 1985, c. P-21

Appendix B: Statistical Report

Reporting period: 2022-04-01 to 2023-03-31

Supplemental Statistical Report on the Access to Information Act and Privacy Act

Reporting period: 2023-04-01 to 2024-03-31